John Evans v Information Commissioner

This is an application made by Mr Evans under s.166(2) of the Data Protection Act 2018 (the “DPA 2018”) for an order requiring the Commissioner to take appropriate steps to respond to a complaint made by Mr Evans in respect of the processing of his personal data by a data controller (the “Complaint”). In this case, the data controller about whom Mr Evans complained to the Commissioner was the Financial Conduct Authority (the “FCA”).

The application was considered at an oral hearing which took place by CVP link on 18 August 2025. Mr Evans, the applicant, attended in person. The Commissioner was represented by Samuel Willis of Counsel. Both Mr Evans and the Commissioner filed skeleton arguments before the hearing. The Tribunal was satisfied that all parties had an ample opportunity to advance their case at the hearing and that it was appropriate to conduct the hearing by CVP link. The Tribunal was grateful for the careful, concise and helpful way in which both Mr Evans and Mr Willis advanced their respective arguments at the hearing.

This application arises out of the Commissioner’s handling of the Complaint. The Complaint was made by Mr Evans to the Commissioner on 26 October 2023. The Complaint concerned Mr Evans’ assertion that the FCA had inadequately responded to a subject access request he had made of the FCA for his personal data. In his application, Mr Evans says the relief which he seeks is for “the Tribunal to find that the ICO incorrectly dismissed my request for an investigation into the FCA’s refusal (by silence) to supply requested personal documents, and to advise the ICO to treat my request properly.”

By 12 December 2023, the Commissioner had not allocated the Complaint to a Case Officer. However, a Case Officer at the Information Commissioner’s Office (the “ICO”) was subsequently appointed by the Commissioner. On 26 January 2024, the Case Officer responded to Mr Evans in relation to the Complaint (the “Response”). In the Response, the Commissioner explained that it deals with complaints such as that from Mr Evans:

“under s.165 of the [DPA 2018] which requires us to take steps to respond to complaints including investigations to the extent that we feel is appropriate. It also requires us to inform the complainant of the outcome of their complaint.” The Commissioner informed Mr Evans that “at this stage we do not appear to hold clear evidence of an infringement of the legislation that we oversee in your case….As we do not appear to hold any clear evidence of an infringement we have closed this case.”

Mr Evans was not content with the Response; on 28 January 2024, he complained to the Commissioner about the Response. In so doing, he invited the Commissioner to reconsider its position and “submit a substitution”. On 28 February 2024, Mr Evans made a further “formal complaint” in respect of the Response. At paragraph 6 of this formal complaint, Mr Evans stated “On 26 January 2014 [sic], the ICO dismissed my complaint against the FCA”. Initially, Mr Evans complained that the Commissioner had dealt with the Complaint under data protection legislation rather than under the Freedom of Information Act 2000 (“FOIA”).

The ICO responded to Mr Evans’ complaint about the Response on 8 March 2024. In this letter, amongst other things, the ICO informed Mr Evans that it:

“cannot involve ourselves in disputes between data controllers and data subjects when there is a disagreement regarding what personal information is held and/or provided by an organisation. Ultimately as a regulator, we have to take what a controller says in good faith, our investigations under s.165 of the [DPA 2018] are not to prove matters beyond reasonable doubt, instead to provide an outcome based on the balance of probabilities. As such a SAR may not be the most appropriate route for obtaining the information or documents you seek. In light of this, you may wish to consider independent legal advice with a view to obtaining a Court Order to access the documents you require…

…A case review is the final stage of the ICO’s case handling process which means that we won’t consider this complaint further. However, I recognise that you may continue to disagree with our view. It may be helpful to explain that you are entitled to take your own cases to court under data protection legislation, irrespective of our decision.”

The ICO’s letter advised Mr Evans that he could complain, if he so wished, to the Parliamentary and Health Service Ombudsman. It made no reference to any rights under s.166 of the DPA 2018.

Mr Evans remained dissatisfied with the ICO’s position. Following further correspondence and a complaint about the review Mr Evans had received, the ICO sent a further letter to Mr Evans dated 31 January 2025 (the “Clarification Letter”). The Commissioner describes this as a “Clarification Letter…the purpose of [which] was to assist the Applicant’s understanding of the [ICO’s] regulatory role in investigating complaints.” The Clarification Letter, stated, amongst other things:

“When you submit a complaint to The Information Commissioner’s Office (ICO) you are asked to provide supporting documents to evidence your data protection complaint. The ICO has very limited resources and we can only use those resources effectively if concerns are presented in a manner which is clear and concise, and where we are provided only with the appropriate evidence which is actually relevant to the appropriate elements of the legislation concerned. Unfortunately, you provided the ICO with a large volume of documents/correspondence which meant we were unable to determine the evidence we require to support your complaint. We did note that the FCA responded to your SAR and provided the following information in relation to any redactions applied: ‘You will notice that some redactions have been applied. There are two reasons for this. Firstly, we have removed the personal data of third parties which have no connection with your personal data. Secondly, we have removed information that is not ‘personal’ data at all and therefore falls outside the UK GDPR.’”

…

“At no point, through the assessment process, have you clarified the main data protection concerns beyond you being unhappy with the way in your SAR was handled by the FCA. Using the information available to us on this case, we were able to determine that the FCA responded to your SAR and provided information in regard to any redactions made. This is inline with our guidance and in accordance with UK GDPR legislation.

We therefore cannot determine any infringement has occurred by the FCA on this occasion. This is what we implied when we advised you ‘At this stage we do not appear to hold clear evidence of an infringement of the legislation that we oversee in your case.’

If you believe the FCA has deliberately withheld your personal data, you will need to provide clear evidence to support this claim. This might include specific instances where you believe data was omitted or inconsistencies in the information provided. I hope this provides you with some clarification on how we have assessed your complaint and arrived at our decision outcome letter.”

By letter dated 2 February 2025, Mr Evans rejected the points made by the ICO in the Clarifying Letter stating, amongst other things “I cannot accept that your further clarification is any more than a restatement of previously made comments justifying your decision not to investigate the circumstances.”

Mr Evans issued the instant application under s.166 of the DPA 2018 on 17 August 2024. The grounds of the application were stated in the following terms by Mr Evans:

“I submitted a request on 26 October 2023 to the [ICO] to investigate a breach of the legislation by the [FCA]…. The ICO rejected my request by their e-mail dated 26 January 2024…

Their decision not to investigate my complaint was based upon the following statement in the above referenced e-mail:

At this stage we do not appear to hold clear evidence of an infringement of the legislation that we oversee in your case.

The rejection was ostensibly confirmed by the ICO Team Manager in her e-mail of 10 April 2024… I say ostensibly because, rather surprisingly, her e-mail is totally devoted to pointing out that I was wrong to make my request under [FOIA] and that the ICO was correct in declaring it, and treating it as, a complaint under the [DPA 2018]. She did not confirm her caseworker's findings that there was no evidence of an infringement of the legislation but, since she declared the correspondence closed, we must assume that she was confirming the caseworker's findings.

On the matter of which Act my complaint should have been considered under, I refer the Tribunal to the following extract from the ICO's website, drawn to my attention by the Parliamentary and Health Service Ombudsman (PHSO):

A request does not have to include the phrases “subject access request,” “right of access,” or “section 45(1) of the DPA 2018”. It just needs to be clear that the person is asking for their own personal information. Indeed, a request may be a valid SAR even if it refers to other legislation, such as [FOIA] or the Freedom of Information (Scotland) Act 2002.

Consequently, I am relaxed about the fact that the complaint was considered and decided on the basis of Section 165, and other relevant Sections, of the DPA

.

This appeal is built upon the ICO Lead Case Officer’s statement that there was “no clear evidence of an infringement of the legislation”. I reject this statement, and I submit that there was ample such evidence. I shall now confirm what that evidence was.

1.

In my initial Subject Access Request (SAR) of 12 September 2023 (Attachment D) I specified under paragraphs A and B the types of document I was seeking.

2.

I repeated this request in my e-mail to the FCA dated 26 October 2023 (Attachment E), adding that a subsequent (late) response by the FCA included an e-mail to them from their Complaints Commissioner seeking clarity on some issues. I pointed out that the FCA had not sent me their response to the Complaint Commissioner’s request, and asked specifically for a copy.

None was forthcoming.

I submit that non-supply of the requested data, together with the absence of a reason for such non-supply is a breach of the legislation.”

The Commissioner opposes the making of any order under s.166(2) of the DPA 2018. He filed his response to the application dated 10 February 2025. In short summary, the Commissioner contended in his response to the application that he had complied with the procedural requirements of the UK GDPR and the DPA 2018. The Commissioner submitted that the FTT did not have jurisdiction to consider the application and/or that it has no real prospect of success and therefore should be struck out under either r.8(2)(a) and/or r.8(3)(c) of the Tribunal’s rules. The Commissioner filed an application seeking the strike out of the application.

Mr Evans filed a reply dated 20 February 2025 in which he opposed the strike out application. In summary, in his reply, Mr Evans contended that:

The DPA 2018 does not provide the Commissioner with “carte blanche” to do whatever he wishes with a complaint. He has a duty to “deal with” all complaints” referred to him “to the extent appropriate”. Mr Evans relied on paragraph 63 of Delo CA which he asserts stated:

Unlike in Delo CA, there was no evidence that the Commissioner had reviewed any correspondence, or undertaken any form of investigation. The Commissioner had not provided any witness evidence to support his position about an investigation. The Commissioner had not advised Mr Evans that the FCA had likely complied with its obligations. In Delo CA, Mr Evans contended that there had “obviously been a reasonable amount of investigation” by the Commissioner prior to issuing the outcome letter in that case.

A complete absence of investigation was only appropriate where a complaint was frivolous or vexatious.

The “error” committed by the Commissioner was of a procedural nature and was therefore within the scope of the Tribunal’s jurisdiction.

By order dated 3 June 2025, Judge Heald refused the Commissioner’s strike-out application. The Judge found that the Commissioner had not shown that Mr Evans’ case had no reasonable prospect of success. The issue of whether the Commissioner’s actions in considering the Complaint objectively amounted to “appropriate steps” was one which should be considered at a hearing.

If a data subject has a complaint about the handling of their personal data by a data controller under the UK GDPR or DPA 2018 (as applicable depending on the appropriate data processing regime), they have two options, which are not mutually exclusive. One option for a data subject is to apply to court for an appropriate remedy (see Article 78 of the UK GDPR and ss.167 and 168 of the DPA 2018). Alternatively, a data subject has the right to make a complaint to the relevant supervisory authority, which in the United Kingdom is the Commissioner. This judgment and the issues which it addresses concern the latter of these two options.

The right to make a complaint to the Commissioner about an alleged infringement of the UK GDPR is set out in Article 77(1) of the UK GDPR. Article 77(2) of the UK GDPR provides that the Commissioner shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the UK GDPR. The judicial remedies which must be available under Article 78 of the UK GDPR are (i) an effective judicial remedy against a legally binding decision of the Commissioner concerning them and (ii) the right of a data subject to an effective judicial remedy where “the Commissioner does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.”

Article 77 of the UK GDPR must be read in conjunction with Article 57(1) of the UK GDPR. This latter provision sets out “tasks” of the Commissioner under the UK GDPR. Article 57(1)(f) provides that one of these tasks is to “handle complaints lodged by a data subject….and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with a foreign designated authority is necessary.”

These provisions of the UK GDPR must be read alongside the relevant provisions of the DPA 2018. Specifically, s.165(1) of the DPA 2018 identifies that Articles 57 and 77 of the UK GDPR “confer rights on data subject to complain to the Commissioner if the data subject considers that, in connection with the personal data relating to him or her, there is an infringement of the UK GDPR.”

S.165(2)-(5) of the DPA 2018 concern complaints about the processing of personal data under legislative frameworks other than the UK GDPR. Specifically these subsections concern complaints to the Commissioner about processing under Parts 3 and 4 of the DPA 2018 (law enforcement processing and intelligence services processing respectively). Accordingly, they are not relevant for the purposes of this application.

S.166 of the DPA 2018 is headed “Orders to progress complaints”. S.166(1) provides that the section “applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner – (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.”

If one of these three gateway conditions is established, then s.166(2) of the DPA 2018 provides that the Tribunal, may, on an application by the data subject, make an order requiring the Commissioner (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress, or of the outcome of the complaint, within a period specified in the order. S.166(3) provides that an order under s.166(2)(a) may require the Commissioner to (a) take steps specified in the order, and/or (b) to conclude an investigation, or take a specified step within a period specified in the order.

Recital 141 of the UK GDPR provides that an investigation “following a complaint should be carried out, subject to judicial review, to the extent that it is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period.”

Both, (i) the scope of the Commissioner’s obligations under Articles 57 and 77 of the UK GDPR and (ii) the scope of the Tribunal’s jurisdiction under s.166 of the DPA 2018 have been subject to judicial scrutiny in a number of appellate cases in recent years. These decisions include (i) Delo CA, (ii) Killock & Veale & Others v Information Commissioner [2022] 1 WLR 2241 (“Killock”), (iii) Smith v Information Commissioner [2025] UKUT 74 (AAC) (“Smith”). Delo CA and Killock were also considered by a decision of the FTT in Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) (“Mahmood”) albeit that decision is not binding on this Tribunal and predates the Upper Tribunal’s decision in Smith. We have considered the decision in Mahmood although we do not think it adds anything to the other binding authorities, in particular as a result of the subsequent decision of the Upper Tribunal in Smith.

We consider that the following core principles can be derived from these authorities when the Tribunal is considering its jurisdiction and discretion as to whether to make an order under s.166(2) of the DPA 2018:

We have read and taken into account a joint hearing bundle of 237 pages. During the hearing, it became apparent that the parties had a slightly different bundle which included a very few additional pages. Neither party suggested that anything turned on this minor discrepancy or that anything of significance had been omitted from the Tribunal’s bundle. The Tribunal was able to locate all the documents which the parties drew to its attention in the skeleton arguments and during the course of the hearing.

In his skeleton argument for the hearing, Mr Evans described his case as an “appeal…against a refusal by the Commissioner to investigate and decide upon [his] complaint…”. In fact, this application under s.166 of the DPA 2018 is not an appeal. Mr Evans is not an appellant but an applicant for a discretionary order under the DPA 2018. We address this distinction further below, to the extent it is relevant to the decision we have to make.

At the hearing itself, Mr Evans’ submissions largely followed the shape and content of the points he had raised in his Reply, as outlined at paragraph 12 above.

In particular, Mr Evans sought to emphasise that he was not challenging any “outcome” of the Commissioner in respect of the Complaint. Rather, his case was that there was no evidence of any investigation and therefore there could not be, and was not, any “outcome” in respect of the Complaint.

In support of his argument about the absence of evidence, Mr Evans drew the Tribunal’s attention to paragraph 104 of Smith, in which Upper Tribunal Judge Stout stated:

“…in general, in section 166 cases, given their limited scope, all that will be necessary for the fair disposal of the application is for the Commissioner to put before the Tribunal the documentary trail demonstrating the steps taken in dealing with any complaint (as the Commissioner did in this case by disclosing the 7 February 2023 email among others) or, if that does not tell the story, a short witness statement from the officer who dealt with the complaint may be appropriate. Since the Tribunal is not concerned with the merits of the complaint, what is required by way of disclosure or witness statement will in most cases be neither extensive or elaborate, and there is certainly no requirement for the Commissioner to put in evidence justifying or explaining the merits of the decision he took on the complaint.”

Mr Evans also emphasised the authorities which show that it is for the Tribunal, not the Commissioner, to determine on an objective basis the appropriateness of the steps taken, and whether a particular investigative step is reasonable. He contends that objectively judged, the Commissioner did not take the appropriate steps required of him. There was no evidence of any thought being applied to the Complaint or explanation for why the Commissioner had told him that it had concluded that it did not “hold clear evidence of an infringement of the legislation that we oversee in your case”. The ICO had not sought to contact Mr Evans when considering the complaint to obtain clarity on anything which the Commissioner considered unclear.

In support of his case, Mr Evans also relies on the terms of the Clarification Letter, including in particular its assertions that (i) Mr Evans had not “clarified the main data protection concerns beyond you being unhappy with the way in which your SAR was handled by the FCA” and its assertion that he had provided the Commissioner with “a large volume of documents/correspondence which meant we were unable to determine the evidence we require to support your complaint”. Mr Evans submits both of these assertions are without foundation and demonstrate the lack of investigation undertaken by the Commissioner. Without that investigation, he repeated, there could be no outcome.

Mr Evans also contended that the Commissioner had failed in his handling of the Complaint to (i) inform him of his rights under s.166 of the DPA 2018 as he was required to do pursuant to s.165(4)(c) of the DPA 2018 and (ii) inform him about progress on the Complaint as required by s.165(4)(a) of the DPA 2018, read in conjunction with s.165(5)(b) of the DPA 2018.

The essence of the Commissioner’s case can be briefly summarised. His case is largely based on what he says must follow as a result of a proper understanding of the relevant authorities. Specifically, the Commissioner contends that:

We have applied the legislative framework and legal principles set out above to the facts of this case. Having done so, we have decided to dismiss the application. In summary this is because we largely accept the Commissioner’s submissions as summarised at paragraph 32 above. In reaching our conclusion, we have expressly concluded that, objectively judged, the Commissioner did take “appropriate steps” to handle the Complaint, including investigating to the extent appropriate.

The starting point for our reasoning is to emphasise the essentially procedural and “forward-looking” nature of the jurisdiction under s.166 of the DPA 2018. This permits the Tribunal, where appropriate, to make an order to progress complaints in circumstances where there has been a procedural error on the part of the Commissioner. That requires consideration on the part of the Tribunal of the appropriateness of the steps taken by the Commissioner to progress a complaint, including in particular whether there has been an “outcome” to a complaint. In so doing, this is not an appeal against the Commissioner’s outcome. It is a procedural application to progress a complaint. Insofar as Mr Evans has framed the application as an appeal, this is a misunderstanding of the legislative framework.

In this regard, we reject Mr Evans’ attempts to suggest that there has not been an outcome in respect of the Complaint. That is not sustainable on the facts. The Response (as defined at paragraph 4 above) was plainly the outcome of the Complaint. It stated in terms, “at this stage we do not appear to hold clear evidence of an infringement of the legislation that we oversee in your case….As we do not appear to hold any clear evidence of an infringement we have closed this case.”. This conclusion falls well within the scope of a potential outcome as set out in the authorities summarised at paragraph 23.3 above. It is the Commissioner expressing a regulatory judgment in respect of the Complaint.

This conclusion is reinforced by the language which Mr Evans has used to describe the Response e.g. at paragraph 5 of his skeleton argument, Mr Evans himself described the Response as a “rejection of the [C]omplaint”. That would be a fair description of the Response and indeed is plainly an outcome which was available to the Commissioner. The authorities make clear that it is not this Tribunal’s role to interfere with his outcome as a matter of substance. Our view is further reinforced by a proper analysis of Mr Evans’ subsequent correspondence with the Commissioner following the Response, including multiple complaints he made about the Response.

In light of our conclusion that there was an outcome to the Complaint, the authorities make it clear that there is limited scope for “winding back the clock” to challenge the adequacy of the “appropriate steps” taken by the Commissioner. We do not accept that there was a wholesale failure on the part of the Commissioner to consider the Complaint or that he failed to deal with a part of the Complaint as advanced. While the circumstances set out in the authorities are not intended to be exhaustive, they do indicate that this will likely be because there has been a wholesale or material procedural failing. We do not consider that applies on the circumstances of this case.

In this regard, the real thrust of Mr Evans’ submissions focused on what he contended was the lack of an investigation, or adequate investigation, of the Complaint. He used this submission as the springboard for his assertion that there had been no outcome in respect of the Complaint. We have explained above why we reject the submission that there was no outcome in respect of the Complaint. We also reject the submission that there was no investigation or adequate investigation.

As a matter of law, we do not accept that every complaint must involve an investigation by the Commissioner, if by investigation what is meant is external engagement with a complainant and a data controller and the acquisition of relevant information from third parties such as the relevant data controller. That would be to overstate the meaning of “investigation” and to ignore the critical qualifying phrase in Article 57(1)(f) of the UK GDPR, that investigation is only required “to the extent appropriate”. In some, perhaps many cases, investigation may only require a desktop consideration of a complaint. Indeed, it may be immediately obvious on consideration of a complaint that any detailed or further investigation is not necessary from the terms of the complaint itself. For example, the complete absence of a response or any engagement from a data controller to the exercise of a data subject’s rights. In other cases, more detailed investigation and engagement with the complainant and the relevant data controller may be justified. However, Delo CA, as summarised at paragraph 23.4 above, is clear and binding authority to the effect that the Commissioner has a wide discretion as to the intensity of the investigation required for each complaint. There is no requirement, as Mr Evans contended should have happened in his case, that the Commissioner should seek clarification from a complainant or engage in further correspondence about the adequacy of the framing of the complaint.

We acknowledge that the Commissioner has not submitted any extraneous evidence in the form of a witness statement or correspondence with third parties, as to the nature of the investigation which the ICO undertook. In Smith at [104], the Upper Tribunal suggested that “in general”a brief documentary trail or short witness statement may be appropriate “in demonstrating the steps taken in dealing with any complaint”. However, we do not consider that the Upper Tribunal in Smith was setting out an immutable position that such evidence would always be necessary. Indeed, that would be to ignore the express caveats given at paragraph 104 of Smith. In any event, Mr Evans’ submission as to the lack of evidence relates to the nature of the investigation carried out by the ICO. Paragraph 104 of Smith concerns evidence “demonstrating the steps taken in dealing with any complaint”. That is not the same as requiring detailed evidence to demonstrate the extent of any investigation into the complaint.

Regardless of these distinctions, we do consider that there is an adequate documentary trail as to the steps which the Commissioner took in handling the Complaint. In this regard, we reject Mr Evans’ submission that there is no evidence of any investigation before the Tribunal. In this case, there is evidence before the Tribunal of an investigation by the ICO and the handling of the Complaint. This is found in the contents of the Response itself and the Clarification Letter. In this regard:

Taking all these points together, we find that objectively judged, the Commissioner did take appropriate steps to handle the Complaint, having taken into account and considered the Commissioner’s particular role as a specialist regulator and the wide margin which he is afforded as to the intensity of any investigation applied to a particular complaint.

Moreover, in light of the conclusions we have set out above, we also accept the Commissioner’s contention that in reality this application is a merits complaint about the outcome dressed up as a complaint about the adequacy of procedural steps. The authorities make clear the Tribunal should be astute to avoid such an approach. This is demonstrated by (i) the content of Mr Evans’ complaints to the Commissioner following the Response and (ii) the grounds of his application to the Tribunal which state, in terms “this appeal is built upon the ICO Lead Case Officer’s statement that there was “no clear evidence of an infringement of the legislation.” I reject this statement, and I submit that there was ample such evidence…I submit that non-supply of the requested data, together with the absence of a reason for such non-supply is a breach of the legislation.” The recalibration of Mr Evans’ grounds for an order under s.166(2) DPA 2018 in the Reply to focus on the alleged lack of investigation does not alter the substance of the application. It is precisely the type of approach which the authorities make clear is impermissible.

Put another way, we do not consider that there is any meaningful procedural benefit which could be derived from an order requiring the Commissioner to investigate (or further investigate) Mr Evans’ the Complaint. The Commissioner has investigated the Complaint, and Mr Evans’ subsequent complaints about the Complaint, and it has rejected them. An order for further steps will not progress it further. It would be entirely circular. Accordingly, while we are satisfied that there is no basis for the exercise of our discretion to make an order under s.166(2) DPA 2018, we would have declined to exercise that discretion for the reasons we have given.

Finally, we address Mr Evans’ contentions that the Commissioner failed to inform him of the progress of the Complaint and failed to inform him of his rights under s.166 of the DPA 2018. While Mr Evans advanced these points under s.165(4) and (5) of the DPA 2018 which concern data processing under data protection legislation other than under the UK GDPR, we do not consider that anything turns on this as the same secondary rights exist Article 77(2) of the UK GDPR.

We reject Mr Evans’ submission that the Commissioner failed to inform him of the progress of the Complaint. We make two points in this regard:

In relation to Mr Evans’ contention that he was not informed of his rights to a judicial remedy to progress his complaint under s.166 of the DPA 2018, we accept that on the evidence before us, the ICO did not inform Mr Evans of his rights to a judicial remedy under Article 78, as required by Article 77. The hearing bundle does not appear to contain the “standard holding reply” which Mr Evans acknowledges he received from the ICO when he filed the Complaint (see his letters to the ICO of 14 November 2023 and 7 December 2023). The Tribunal does not know therefore whether the potential judicial remedy was indicated in this correspondence. Accordingly, on the evidence before us, we find that the Commissioner did fail to inform Mr Evans of his right to a judicial remedy under Article 78(2) of the UK GDPR

However, assuming that this did amount to a failure by the Commissioner to “take appropriate steps” to respond to the Complaint for the purpose of s.166(1) of the DPA 2018, which is itself debatable, we would decline to exercise our discretion to make any such order if the jurisdiction was engaged to allow us to do so. This is because any order would be entirely academic and redundant in these circumstances where (i) such a remedy only arose where the Commissioner had not handled a complaint or informed Mr Evans of the progress or outcome of his complaint within 3 months of the date of the Complaint, which it did for the reasons we have set out above and (ii) Mr Evans has in any event attempted to exercise those rights through the making of the present application. It is not the role of the Tribunal to make orders which serve no purpose. An order under s.166(2) DPA is supposed to be substantive, not formulaic.

For these reasons, we dismiss the application for an order against the Commissioner under s.166(2) of the DPA 2018. Our decision is unanimous.