Katherine Carrington v The Information Commissioner

Introduction

1. This is an application made by Ms Carrington under s.166(2) of the Data Protection Act 2018 (the “DPA 2018”) for an order requiring the Information Commissioner (“IC”) to take appropriate steps to respond to a complaint made by Ms Carrington in respect of her right to erasure and a report made by the ‘Stronger Families Team’ within Wiltshire Council.

2. The application was considered at an oral hearing which took place by CVP link on 1 December 2025. Ms Carrington, the Applicant, attended in person. The IC was represented by Jack Jennett of Counsel. The IC filed a skeleton argument before the hearing. The Tribunal was satisfied that all parties had an ample opportunity to advance their case at the hearing and that it was appropriate to conduct the hearing by CVP link. Background

3. The factual background to this case is succinctly set out at [25] to [26] of the IC’s response dated 8 October 2025:

25. On 30 October 2024, the Applicant submitted a complaint to the Commissioner about the concerns she had following Wiltshire Council’s (“the Council”) response to her right of erasure request on 30 April 2024 [Annex 1].

26. On 19 February 2025, the assigned case officer wrote to the Applicant with the Commissioner’s Outcome letter [Annex 2]. Having considered all the information available in relation to the complaint, the Commissioner advised that he could only provide a view on the Data Protection Act and not any other matters that the Applicant mentioned in his complaint. The case officer confirmed that he was of the view that the Council appears to have given proper consideration to the Applicant’s request for rectification and had applied the Data Protection Act appropriately.

4. The Applicant seeks an order under section 166(2) of the Data Protection Act 2018 (DPA 2018) requiring the Information Commissioner (the Commissioner) to take appropriate steps to investigate her complaint concerning Wiltshire County Council.

5. In her original GRC3 Form, the Applicant stated that she sought remedy in the Tribunal ordering the removal of inaccurate information held within a report made by the ‘Stronger Families Team’ within Wiltshire Council.

6. However, during submissions, the Applicant amended the remedy sought to an order requiring the IC to take appropriate steps to investigate her complaint against Wiltshire Council.

7. In his response to the application, the IC invites the Tribunal to strike out the Applicant’s application on the basis that the Tribunal does not have jurisdiction to consider the application and/or that the application has no reasonable prospects of succeeding and accordingly, should be struck out.

8. The Applicant opposes the strike out and seeks an order from the Tribunal directing the Commissioner to undertake a full and appropriate investigation into her complaint. Legal Framework

9. Under Rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers it does not have jurisdiction in relation to the proceedings or that part of them; and does not exercise its power under rule 5(3)(k)(i) (transfer to another court or tribunal) in relation to the proceedings or that part of them.

10. Under Rule 8(3)(c) of the Rules, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers there is no reasonable prospect of the Applicant’s case, or part of it, succeeding.

11. Section 165 DPA sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under section 166 DPA a data subject can make an application to this Tribunal for an order as follows: 166 Orders to progress complaints (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner - (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner - (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

12. The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1) (a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.

13. Judge Scherbel-Ball sets out a detailed and diligent review of the relevant case law in the Tribunal’s decision in John Evans v Information Commissioner [2025] UKFTT 1057 (GRC) (“Evans”) and I repeat the same in paragraphs 14 to 26 below.

14. The scope of the Tribunal’s jurisdiction under s.166 of the DPA 2018 have been subject to judicial scrutiny in a number of appellate cases in recent years. These decisions include (i) R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2024] 1 WLR 263 (CA) (“ Delo CA ”) (ii) Killock & Veale & Others v Information Commissioner [2022] 1 WLR 2241 (“ Killock ”), (iii) Smith v Information Commissioner [2025] UKUT 74 (AAC) (“ Smith ”). Delo CA and Killock were also considered by a decision of the FTT in Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) (“ Mahmood ”) albeit that decision is not binding on this Tribunal and predates the Upper Tribunal’s decision in Smith.

15. We consider that the following core principles can be derived from these authorities when the Tribunal is considering its jurisdiction and discretion as to whether to make an order under s.166(2) of the DPA 2018:

16. First, s.166 is a “forward-looking provision” concerned with remedying ongoing procedural defects that stand in the way of a timely resolution of a complaint by a data subject to the Commissioner. It is not the role of the Tribunal when considering an application under s.166 to assess or challenge the merits of an outcome which has already been given by the Commissioner. That is a matter for the supervisory function of the High Court on an application for judicial review. Accordingly, the focus of the Tribunal is on procedural omissions – Killock at [74], [75] and [87], Smith at [136].

17. Second, the scheme of the legislation does not require the Commissioner to determine every complaint on its merits. Rather, the Commissioner’s principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of “outcome” - Delo CA at [62] – [64] and [80].

18. Third, the “outcome” must be the end point of the Commissioner’s handling of a complaint. A conclusive determination or ruling on the merits will be an “outcome” but the term is intended to have broad scope. Therefore an “outcome” will also include (i) a decision not to investigate further and to cease handling a specific complaint while informing and assisting wider investigation, (ii) a conclusion by the Commissioner that a data controller had “likely” complied with its obligations under the relevant data protection legislation without reaching any final conclusion and taking no further action - Delo CA at [64] and [80], Smith at [47].

19. Fourth, the outcome will have been reached after the Commissioner has investigated the complaint “to the extent appropriate” in the circumstances of the case. The legislation provides the Commissioner with a broad discrection to decide the intensity of any investigation according to the circumstances of the case - Delo CA at [66] and [80].

20. Fifth, the Commissioner also has secondary obligation to inform the complainant of the progress of the investigation and of the complaint – Delo CA at [63].

21. Sixth, where a complainant has received an outcome, there may still be circumstances where it is appropriate for the complainant to ask the Tribunal to “wind back the clock” and order an appropriate step being taken in response to a complaint under s.166(2) (a). However, these circumstances will be limited. In particular, the Tribunal will “firmly resist” attempts either to use such a mechanism to achieve a different complaint outcome or attempts to “dress up” a substantive merits challenge as procedural failings for the purposes of s.166 – Killock at [87], Smith at [60] and [136].

22. Seventh, the question of what amounts to “appropriate steps” is not determined by the IC and the IC’s view is not decisive in this regard. The question of appropriateness is for the Tribunal to decide itself. Accordingly, the Tribunal must decide for itself, applying an objective test what is “appropriate” by way of investigation and not merely review the Commissioner’s decision as the High Court would on an application for judicial review. The Tribunal should therefore expressly direct itself to consider whether, applying an objective test, it was appropriate for the Commissioner to take further steps to respond to a complaint – Killock at [74], [84] and [116], Smith at [84] – [85].

23. Eighth, when considering the appropriateness of the steps taken by the Commissioner, the Tribunal will nevertheless take into account and give weight to the views of the Commissioner as the expert regulator. A decision of the Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal. However, in so doing, the Tribunal must not tamely accept the Commissioner’s position in such a way to derogate from the judicial duty to scrutinise a case - Killock at [85] – [86].

24. Ninth, examples of where there may be a justified reason for the Tribunal to make an order to “wind back the clock” under s.166(2) include (i) where the Commissioner has failed to take appropriate steps to investigate a complaint at all because it has failed to apply its own Service Standards – Killock at [117] or (ii) where the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complaint as a result of oversight or other mistake – Smith at [61].

25. Tenth, the Tribunal always retains a discretion whether to make an order under s.166(2) . It is not obliged to do so even if there has been a procedural failing by the Commissioner – Killock at [117].

26. Eleventh, any order made under s.166(2) should not be reduced to a formalistic remedy. The Tribunal has the power to make an order requiring the Commissioner to take appropriate steps to respond to a complaint, which can include investigating the subject matter of the complaint to the extent necessary – Killock at [83]. The steps which a Tribunal can prescribe, where appropriate, include directing the Commissioner to make contact with the data controller to understand its position and considering in light of any such responses whether the data controller’s actions were lawful – Killock at [118].

27. In Scranage v Information Commissioner [2020] UKUT 196 (AAC), paragraph 6 the Upper Tribunal noted that “there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal is procedural rather than substantive in its focus." (emphasis in original). Submissions

28. The Applicant considers that the IC has not followed its own procedures, did not investigate thoroughly and produced only a ‘desktop’ report. She considers that the IC ought to have done more in contacting the Applicant to confirm and/or consider the veracity of the information held within the report.

29. The Applicant submits that she is not challenging the substantive outcome of the IC’s investigation and will accept any outcome provided by the IC as long as, in her view, a thorough investigation is carried out as she does not accept that this has happened so far.

30. The IC considers that the outcome sought by the Applicant i.e. that she wishes “to have the inaccurate information removed from the report made by the Stronger Families Team support workers from Wiltshire Council” is not within the jurisdiction of this Tribunal and is better suited to an application for a Compliance Order against Wiltshire Council in the County Court.

31. The IC considered that it has responded properly and provided a statutory compliant outcome on 19 February 2025 and that there is limited scope, per the authorities detailed above, for the Tribunal to interfere with that outcome since s166 is procedural in nature. Conclusions

32. The Tribunal finds that the Commissioner has provided a response and outcome to the complaint on 19 February 2025.

33. Contrary to the expectations of many Applicants, section 166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits. The Tribunal is bound to take into consideration and give weight to the views of the Commissioner, as described by the Chamber President in Barbara Rogers v ICO EA/2021/0348: ’14…In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively: Killock & Ors v Information Commissioner [2021] UKUT 299 . The obligation of the Commissioner is to take appropriate steps to respond to the complaint’.

34. The Applicant’s original application sought a remedy which this Tribunal does not have the power to grant, namely, the removal of her name from the Council’s report. In submissions, the Applicant amended her application and now requests that the Tribunal order the Commissioner to undertake steps which amount to a substantive investigation in response to the complaint. Despite the Applicant’s assurances that she is not challenging the outcome already provided by the IC, it is clear that the Applicant is looking for the IC to take further steps to arrive at a different decision, thereby challenging the substantive outcome of the complaint to the IC. The Tribunal does not have the power under section 166 to consider the merits or substantive outcome of a complaint.

35. Section 166 is limited to procedural issues and specifically allows the Tribunal to make an order requiring the Commissioner (a) to take appropriate steps to respond to the complaint. The IC took steps to investigate and respond to the complaints. It provided outcomes to the complaint. The Tribunal only has the power to order the IC to take steps to respond. In this case, the IC has responded.

36. In investigating the Applicant’s complaint, the IC considered the Applicant’s detailed complaint, the original request to Wiltshire Council and the Council’s response which set out their rationale. The Tribunal finds that in the circumstances, the steps taken by the IC were objectively appropriate.

37. For these reasons, we find that the IC has not failed to comply with the procedural requirements set out in section 166(1) of the DPA. The Tribunal therefore finds that there is no reasonable prospect of the appeal or any part of it succeeding. The proceedings are therefore struck out. Signed: Judge Peri Mornington Date: 17 December 2025