Giuseppe Brida v The Information Commissioner

The Commissioner applies to strike out the application on the basis that, since lodging the application, the Applicant has received an outcome to their complaint.

The Commissioner accepts that there was a delay in initially communicating with the Applicant in relation to their complaint. However, the Commissioner states that the Applicant was given an outcome on the complaint in correspondence of 13 January 2026, as further explained in a case review of 22 January 2026. Taken together, the Commissioner submits that both constitute an outcome for the purposes of section 165(4) of the 2018 Act. In consequence, the Commissioner maintains that the Tribunal no longer has jurisdiction to consider the application on the grounds proposed by the Applicant under Rule 8(2)(a), and/or there are no reasonable prospects of success under Rule 8(3)(c) of the 2009 Rules.

The Applicant opposes the strike-out application. The response includes comments on the separate active Upper Tribunal proceedings in which the Applicant is involved. Those comments are not summarised here as it is not only inappropriate to do so, but of no direct relevance to this application which must be decided on its own facts.

The Applicant says that the present proceedings concern the partial refusal of his SAR by the Legal Ombudsman, which purported to rely upon the legal privilege arising from a tripartite professional relationship. In summary, the Applicant submits that the Commissioner’s case for striking out his application proceeds as though the only question is whether any outcome was provided. On the Commissioner’s own account, the outcome was to record the complaint without substantive engagement. This the Applicant, submits, is precisely the category identified as potentially appropriate for a section 166 order in Smith v Information Commissioner [2025] UKUT 74 (AAC) at [61].

The Applicant submits that the Commissioner’s case is inconsistent with the legal framework he purports to apply and Osifeso v Information Commissioner [2022] UKUT 146 (AAC), which requires more than passive acknowledgement of an outcome. The Tribunal must assess whether the Respondent has taken the steps the statute requires; it is not confined to acknowledging the existence of an outcome.

The Applicant considers the appropriate steps in the circumstances were for the Commissioner to proceed on the basis of his own prior regulatory decision that privilege had been waived and could not be relied upon by any data controller, including the Legal Ombudsman. This, the Applicant contends, falls squarely within the scope of the Tribunal’s powers. The Commissioner’s failure to do so meant the investigation was not carried out to the extent appropriate. The Applicant considers that the Commissioner impermissibly got the law wrong and the complaint was left without a legally correct assessment of the very question on which it turned.

It is asserted that the Commissioner had in the Court of Appeal in R (Delo) v Information Commissioner[2023] EWCA Civ 1141advanced a “sophisticated argument” of a kind with the Applicant’s case here – that section 166 is wider in scope that previously recognised. Specifically, the provision of an outcome does not extinguish the Tribunal’s jurisdiction under section 166. The Applicant considers that the Commissioner cannot now advance a narrower argument before the Tribunal inconsistent with his position in the Court of Appeal.

The point is made by the Applicant that the argument that section 166 may have broader scope than presently recognised was acknowledged by the Court of Appeal in Delo at [48-49] as unresolved and the Court expressly reserved judgment on the full ambit of section 166.

The Applicant submits that if Killock and Delo were found to be per incuriam, Smith (which rests in part of Killock) “could not survive as authority insofar as it endorses the jurisdictional divide”.

It is further submitted that:

“the entire jurisdictional framework on which the Commissioner’s strikeout depends is arguably per incuriam. Boddington v British Transport Police[1998] UKHL 13 (“Boddington”) establishes, as a matter of binding House of Lords authority, that a party may raise the invalidity of an administrative act as a collateral challenge in the proceedings in which it is directly in issue, without being confined to judicial review as the exclusive forum, unless Parliament has expressly or by necessary implication so required, which is not the case for the DPA 2018. This principle applies with particular force against public bodies: Parliament is presumed not to have intended an administrative body to be the final arbiter on questions of law, and any error of law in the exercise of a statutory function renders its decision a nullity: Anisminic Ltd v Foreign Compensation Commission [1969] 2 AC 147 at 171 (Lord Reid); Re Racal Communications Ltd[1980] UKHL 5 (Lord Diplock); R v IRC ex p Preston[1985] 1 AC 835 at 862 (Lord Templeman). Neither Killock, nor either court in Delo, nor Smith considered Boddington. A decision given in ignorance of a binding authority that would have produced a different result is per incuriam and doesnot bind: Morelle Ltd v Wakeling[1955] 2 QB 379.”

Legal framework

Section 165 of the 2018 Act sets out the right of data subjects to complain to the Commissioner if they consider there is an infringement of the Act in connection with their personal data, as below:

165 Complaints by data subjects … (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act. … (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a) take appropriate steps to respond to the complaint, … (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a) investigating the subject matter of the complaint, to the extent appropriate, and (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with a foreign designated authority is necessary.

A data subject can apply to this Tribunal under section 166 for an order as follows:

There are some key decisions addressing the scope of section 166, as set out below.

In Killock and Veale v Information Commissioner [2021] UKUT 299 (ACC) the Commissioner had considered a complaint and undertaken some investigation but then decided to take the complaint itself no further. The Upper Tribunal treated the discontinuance as the outcome of the complaint and beyond further challenge under section 166. It ruled that section 166 “is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given…” [87].

The Commissioner’s discretion to deal with complaints under section 166 was also considered by the High Court in R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin). The Court found at paragraph 128:-

Both decisions in Delo and Killock were cited by the Upper Tribunal in Cortes v Information Commissioner UA-2023-001298-GDPA, where it was reinforced (at paragraph 33) that once a complaint has been progressed to an outcome, there is no longer any scope for a section 166 order to bite, as follows:

“The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question” (Killock and Veale, paragraph 87). As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” [33]

More recently in Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC) the Upper Tribunal noted that:

“…the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited. This is the effect of all the authorities, it seems to me. They all hold that, on an application under section 166, it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.” [60]

The Upper Tribunal in Smith went on to say:

“61.

However, the authorities do not preclude an order being made for an appropriate step to be taken even where an outcome has already been provided. One ready example where that is likely to be appropriate is (it seems to me) where the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complaint as a result of oversight or other mistake. In other words, a case where effectively a single complaint is dealt with in part as the Commissioner dealt with the complaint in the Killock and Veale case itself, while the other part is treated like the complaint in the EW v IC case that was considered by the Upper Tribunal at the same time.”

In considering whether any further ‘appropriate steps’ need to be taken by the Commissioner, the Tribunal must give weight to the views of the Commissioner as an expert regulator. This requirement is identified in paragraph 85 of Killock which reads as follows:

“However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.” [85]

Consideration and Conclusions

The application to the Tribunal was brought under section 166(2) of the 2018 Act. Such application must be made to the Tribunal within 28 days of the expiry of 6 months from the date the Commissioner received the complaint (Rule 22(6)(f) of the 2009 Rules). The complaint was made to the Commissioner on 19 July 2025, and a copy of the Applicant’s complaint (with attachment) was provided to the Commissioner on 2 September 2025. The application to this Tribunal dated 23 December 2025 was therefore made within time.

Before addressing the main issue of whether or not the application should be struck out, it is appropriate to identify matters that fall outside the scope of this determination.

Whatever line of argument the Commissioner may have taken in previous litigation is not the Tribunal’s concern. The Tribunal applies the law as it currently stands. Much of the Applicant’s case rests on the current legal authorities being wrong and that the scope of section 166 is broader than presently recognised. This Tribunal is bound to follow decisions of the upper courts. That is the approach I take.

The Applicant also criticises the Commissioner for not drawing the Tribunal’s attention to the judgment in Smith, particularly as the Applicant is a “vulnerable litigant in person”. The role of the Tribunal is to consider the strike-out application before it and not to address a party’s complaints about how an opponent has chosen to make their case. The Appellant was clearly aware of the Smith judgment because he advanced detailed legal argument on it and other legal authorities. He was not prejudiced in these proceedings by the Commissioner omitting reference to the judgment in Smith. I am satisfied that the Applicant has been given fair and proportionate opportunity to make his case.

I turn to the main issue under consideration.

The Tribunal can only make an order under section 166(2) of the 2018 Act if one of the three conditions at section 166(1)(a), (b), or (c) is met. Thus, the Tribunal can only require the Commissioner to take appropriate steps for procedural failings. This was emphasised by the Upper Tribunal in Osifeso where it was reiterated that first and foremost, section 166 is concerned with providing a remedy for procedural failings on the part of the Commissioner.

In considering whether appropriate steps have been taken, this Tribunal must consider the actions of the Commissioner by reference to its section 165 obligations and the relevant legal authorities. In this case, the Commissioner wrote to the Applicant on 13 January 2026 in the following terms (utilising the same partial bold font):

“What we do

Part of our role is to consider complaints from individuals who believe that there has been an infringement of the data protection law. The Data Protection Act 2018 (DPA) requires us to investigate a complaint to the extent we feel is appropriate and to inform you of the outcome.

We do not always act against an organisation based on one complaint, rather we monitor their overall performance against their role and responsibilities as a data controller under the DPA. You can read more about possible outcomes of complaints to the ICO on our website.

Our view of your complaint

We have considered your complaint and the information provided, the ICO will keep a record of your complaint and the organisation’s actions. We use the information gathered from complaints to build a picture of an organisation’s actions.

We may use the information you have provided to take further regulatory action in the future but no further action is being taken at this time. When we do take action against an organisation, it is published on the action we’ve taken page of our website.

Next steps

If you wish to pursue your complaint further or you are seeking personal redress/compensation for the way an organisation has dealt with your personal information, you will need to pursue this independently through the courts or with an industry’s own ombudsman or regulatory body.

If an organisation does not comply with their data protection obligations, you have the right to apply to a court for an order that the organisation takes further steps to comply.”

That response was upheld upon internal case review on 22 January 2026. The Commissioner concluded that:

“We are satisfied that the Office for Legal Complaints (Legal Ombudsman) has handled your complaint appropriately and has provided suitable responses to your additional concerns about the exemptions applied in response to your Subject Access Request (SAR). We are also satisfied that the exemptions applied were appropriate and used in accordance with legislative guidelines.”

The first response from the Commissioner of 13 January 2026 is written in generic terms. The response said that the complaint had been considered but it cannot be gauged whether the subject matter of the complaint had been investigated to the extent appropriate, as provided in section 165(5)(a). The second response of 22 January 2026 is brief, but it provides more detail. It confirms that the Commissioner is satisfied with the responses given by the Legal Ombudsman and that the exemptions applied were appropriate and accorded with the legislative guidelines. Steps have thus been taken to consider the complaint, and the Commissioner has reached a view that he is satisfied there is no need of further action.

The Appellant may be discontent with the investigation to reach those conclusions, but the approach to be taken to complaints by the Commissioner was addressed by Mostyn J in R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin), when he stated as follows:

“The treatment of such complaints by the Commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under Article 79. And then he decides whether he shall, or shall not, reach a conclusive determination.” [57]

Mostyn J’s decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141), with Warby LJ, commenting as follows:

“For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so, the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.” [80]

I remind myself that I am not assessing the appropriateness of a response that has already been given. I am assessing whether the Commissioner has taken appropriate steps to respond to the complaint.

Since lodging the appeal, the Appellant has been informed of the outcome. That alone is not necessarily the end of the matter. Following the Upper Tribunal’s decision in Smith, the issue of an outcome decision by the Commissioner to the complaint is not necessarily fatal to an application under section 166(2). There are particular (if unlikely) instances where this Tribunal may have jurisdiction under section 166 despite an ‘outcome’. The question remains whether an ‘appropriate step’ has been omitted by the Commissioner.

Through the second case review letter, the Commissioner has confirmed his view that the refusals were appropriate and lawful, which was the outcome sought in the application before the Tribunal. The conclusion has been communicated to the Applicant. The Applicant is not satisfied with the answer, but taking no further action was plainly an option available to the Commissioner. Having considered both responses in the context of the application, I am not satisfied that there were further appropriate steps that the Commissioner should reasonably have taken to progress the complaint.

It strikes me that the essence of the Applicant’s case revolves around his belief that the scope of section 166 should be interpreted more widely than it currently is. I consider that it was a matter of judgement for the Commissioner to decide what investigations were to be undertaken and how they were conducted.

Nothing before me demonstrates an oversight that should reasonably be addressed, a mistake or other procedural failure by the Commissioner. The application does not reveal a failure to take appropriate steps to investigate the complaint to the extent appropriate, as required by sections 165(4)(a) and 165(5). It seems to me that the Applicant’s grievance with the Commissioner concerns matters of substance not process.

In arriving at this view, I have attributed weight to the Commissioner being the expert regulator who is in the best position to know what steps, if any, are appropriate in investigating a complaint, but I do not take the Commissioner’s view as decisive. The Commissioner has exercised a regulatory judgment to take no further action. I have found no good reason to interfere with that judgement.

In all the circumstances, I have concluded that the application should be struck under Rule 8(3)(c) of the 2009 Rules as I consider that there is no realistic prospect of it succeeding.