Appeal Number: EA/2025/0210/GDPR
Information Rights
Heard on: 24 February & 5 June 2026.
Before Judge Brian Kennedy KC with
Specialist Members; Dr. Phebe Mann and Emma Yates.
Between:
Wendy Williams
Appellant
and
The Information Commissioner
Respondent
Decision: The appeal is Dismissed.
Headnote:
The jurisdiction under section 166 of the Data Protection Act 2018 is confined to procedural oversight. The Tribunal is required to determine, on an objective basis, whether the Commissioner has taken appropriate steps in response to a complaint; it is not empowered to re-examine the merits, sufficiency, or outcome of the Commissioner’s investigation: see Killock v Information Commissioner [2021] UKUT 299 (AAC).
Once an outcome has been issued, the scope for intervention is narrowly circumscribed. The Tribunal may exceptionally “wind back the clock” only where a complaint, or a distinct and identifiable limb of it, has not been addressed at all: see Veale v Information Commissioner [2021] UKUT 248 (AAC). It will not do so merely because further investigatory steps could have been taken or because the complainant disputes the conclusions reached.
Attempts to characterise dissatisfaction with the investigation as a failure to take appropriate steps must be scrutinised closely. Where, in substance, the complaint is that the Commissioner should have investigated more extensively or reached a different conclusion, such arguments are likely to constitute an impermissible attempt to obtain a merits-based remedy “by the back door”, which lies outside the Tribunal’s jurisdiction: see Killock v Information Commissioner [2021] UKUT 299 (AAC).
In assessing appropriateness, the Tribunal must give due weight to the Commissioner’s regulatory judgment as the expert supervisory authority, including decisions as to the scope and intensity of investigation. Rule 2 operates as a further limiting principle, requiring that any order be proportionate and consistent with the Tribunal’s confined procedural role. Each case must be decided on its merits.
REASONS FOR THIS DECISION
Background:
This is an application under section 166 of the Data Protection Act 2018 (“the 2018 Act”). The Appellant contends that the Information Commissioner (“the Commissioner”) failed to take appropriate steps in response to her complaint concerning the handling of her personal data by Aneurin Bevan University Health Board (“ABUHB”).
The central factual issue concerns the alleged absence, non-recording, or removal of an audit trail entry relating to an asserted access to the Appellant’s records on 28 November 2023.
The Commissioner investigated the complaint and issued an outcome on 2 May 2025 determining that no further action was required.
Following an adjournment and two sets of case management directions, the Commissioner has provided detailed and comprehensive submissions addressing both the legal framework and the specific concerns identified by the Tribunal.
Chronology:
The material chronology is not disputed:
Complaints to the Commissioner: September 2024 to January 2025.
(b) Commissioner’s enquiries and correspondence: March to April 2025.
(c) Response from ABUHB: 23 April 2025.
(d) Outcome issued: 2 May 2025.
(e) Appeal lodged: 27 May 2025.
(f) Further submissions following Tribunal directions: March 2026.
Issues:
The issues for determination are:
Whether the Commissioner failed to take “appropriate steps” within section 166(1) of the 2018 Act.
(b) Whether the Appellant’s challenge is properly characterised as procedural or constitutes, in substance, a challenge to the merits of the Commissioner’s decision.
(c) Whether this is an exceptional case justifying the Tribunal “winding back the clock” following the issuance of an outcome.
(d) The role of proportionality and the overriding objective in determining whether any further steps should be required.
Summary of the Parties’ Submissions:
The Appellant submits that a discrete and serious limb of her complaint, namely the alleged deletion or concealment of audit trail data, was not properly investigated and required specific enquiries, including audit logs and technical system evidence.
The Commissioner submits that:
Section 166 provides a procedural remedy only and does not permit the Tribunal to revisit the substance or correctness of a decision.
(b) The complaint, including the issue of alleged deletion, was considered in substance, notwithstanding the Appellant’s varied terminology.
(c) The extent of investigation undertaken was a matter of regulatory judgment within the Commissioner’s broad discretion.
(d) Any complaint about the sufficiency of investigation amounts in reality to a public law challenge rather than a section 166 issue.
Legal Framework:
Section 166 confers a limited and strictly procedural jurisdiction. It is directed to failures in complaint handling, not to reviewing the substance of regulatory decisions.
The statutory scheme effected by sections 165–166 establishes a deliberate separation between procedure and substance.
The Tribunal’s function is confined to ensuring that the Commissioner has taken appropriate procedural steps; it is not to determine whether those steps were sufficient to justify the outcome.
The authorities emphasise that the Tribunal must firmly resist any attempt to divert a section 166 application into a merits-based adjudication.
That separation reflects a broader structural allocation of functions:
procedural oversight lies with this Tribunal;
(b) substantive challenge lies either in judicial review or in alternative proceedings against the data controller.
The Tribunal has no jurisdiction to determine the merits or correctness of the Commissioner’s decision.
The Commissioner enjoys a broad discretion as to whether, and to what extent, to investigate complaints.
The Tribunal must apply an objective test to appropriateness but must give weight to the Commissioner’s expertise and regulatory judgment.
Once an outcome has been issued, the scope for intervention is limited. Section 166 must not be used to obtain, “by the back door”, a remedy which lies in judicial review or proceedings against the data controller.
Although “winding back the clock” is not excluded in principle, the Tribunal must ensure that section 166 is not misused to secure a different outcome.
These principles define a clear jurisdictional boundary which the Tribunal must rigorously maintain.
Discussion and Analysis:
Proper Characterisation of the Complaint
The Tribunal accepts that the Appellant advanced her concerns using a variety of formulations, including deletion, concealment, manipulation, or omission, but each reflects the same underlying factual contention.
The Commissioner addressed that contention by seeking the position of the data controller, who confirmed that no access occurred.
In the Tribunal’s judgment, that constituted consideration of the substance of the complaint, albeit not in the manner or to the extent preferred by the Appellant.
Procedure and Substance
This case turns on a fundamental distinction. Section 166 is concerned with procedural failures: omissions, failure to respond, or failure to progress a complaint.
It is not concerned with whether the Commissioner ought to have undertaken further, different, or more extensive enquiries once an investigation has been conducted and an outcome issued.
To hold otherwise would dissolve the statutory boundary between procedural oversight and substantive review.
The “Back Door” Principle
On careful deliberation the Tribunal unanimously considers this to be a case in which that boundary must be firmly enforced.
The authorities make clear that section 166 must not be used to obtain a merits-based reconsideration by recasting dissatisfaction with an outcome as a procedural complaint.
The Appellant’s case, properly analysed, is that the Commissioner ought to have conducted a more extensive or technically probing investigation.
That contention, however framed, is a challenge to the adequacy and conclusions of the investigation and is therefore, in substance, a challenge to the merits.
Such a challenge lies outside the Tribunal’s jurisdiction under section 166.
Assertions that the Commissioner ought to have sought additional material, explored alternative factual possibilities, or reached a different evaluative conclusion will ordinarily amount to a merits challenge in procedural guise.
On careful analysis the Tribunal unanimously adopts a substance-over-form approach: the label applied by the Appellant is not determinative; the Tribunal must identify the true character of the complaint.
Limited Scope for Post-Outcome Intervention
The Tribunal have acknowledged and accept that there are exceptional cases where a complaint has not been addressed in whole or in part and where a further step may properly be required notwithstanding an outcome.
However, that jurisdiction is narrow and must be cautiously exercised.
It arises only where a complaint has not been addressed at all, or where a discrete limb has been wholly overlooked.
On careful analysis that is not the position here. The allegation relied upon by the Appellant was identified, understood, and addressed, albeit not resolved in her favour.
The Commissioner’s Regulatory Judgment
The Commissioner is entrusted by Parliament with expert regulatory judgment, including decisions as to investigative priorities, scope, and proportionality.
The Tribunal must respect that institutional competence.
It is not sufficient to demonstrate that additional steps might have been taken; there must be clear justification for concluding that appropriate steps were not taken.
On careful analysis no such justification has been established.
Mere disagreement with the Commissioner’s evaluative approach cannot suffice.
Proportionality and the Overriding Objective
Further and in any event, Rule 2 of the 2009 No. 1976 The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 requires the Tribunal to deal with cases fairly and justly, including proportionately to the importance and complexity of the case.
The steps proposed by the Appellant would entail a detailed and technically intensive investigation extending beyond the procedural function of section 166.
Requiring such steps would risk transforming the Tribunal into a substitute decision-maker on the merits.
That would be disproportionate and contrary to the statutory scheme.
Section 166 is not an appeal jurisdiction and must not be treated as such.
The question is not whether further investigative steps could have been taken, but whether the absence of such steps constitutes a procedural failure.
Where an outcome has been issued, the Tribunal’s role is confined to identifying clear procedural omissions, not re-evaluating investigative adequacy.
Allegations that the Commissioner should have undertaken additional enquiries will ordinarily engage the Commissioner’s regulatory judgment and thus fall outside section 166.
The “back door” prohibition is of central importance and must be rigorously applied.
The “winding back the clock” jurisdiction is exceptional and should not be invoked unless a complaint, or a distinct limb of it, has been left unaddressed.
Proportionality under Rule 2 is an essential control mechanism and militates against imposing disproportionate or merits-oriented investigative steps.
Conclusion:
The Tribunal finds:
The Commissioner took appropriate steps within the meaning of section 166.
(b) The Appellant’s case constitutes a challenge to the merits of the decision.
(c) Section 166 cannot be used as a “back door” route to such a challenge.
(d) There are no exceptional circumstances justifying further intervention and the impugned decision is proportionate in all the circumstances.
This decision should not be taken as minimising the seriousness of allegations of data manipulation. Rather, it affirms that such allegations must be pursued through the correct legal route. Section 166 provides a procedural safeguard; it is not a substitute for substantive challenge.
For the above reasons, the appeal is dismissed.
Right of Appeal:
A party seeking permission to appeal must apply within 28 days of the date this decision is sent to them, identifying the alleged error of law.
Brian Kennedy KC 8 June 2026.