Jason James John Blake v The Information Commissioner

These proceedings concern an application (the "Application") under section 166(2) of the Data Protection Act 2018 ("DPA 2018"). On 28 October 2025 the Applicant complained to the Commissioner that his SAR had not been dealt with appropriately. The Applicant asserted that the Hertfordshire Constabulary/Bedfordshire Police (“the Police”) had not responded within the statutory timeframe. The Applicant alleged that when the Police did respond they confirmed that certain CCTV footage was no longer available but they did not confirm whether footage from the fingerprint room was available. The complaint has the reference number IC-442003-W4Z2.

On 20 February 2026 the Commissioner issued a letter to the Applicant setting out the outcome of his complaint (“the Outcome”). The Outcome was that having considered all the information provided and in line with the Commissioner’s Data Protection Framework the Commissioner had decided not to undertake a more detailed investigation. The Applicant was informed that his complaint would, however, be kept on record to support the Commissioner’s regulatory work. The Commissioner explained that the Applicant could ask for a review of the Outcome and/or that he had the right to take proceedings to court.

The Commissioner accepts that the Outcome did not explain the reasons why the Commissioner was taking no further action in respect of the Applicant’s complaint. However, the Commissioner has since provided the Applicant with reasons for his decision in correspondence dated 27 February 2026. This was in response to the Applicant’s request on 25 February 2026 for the Outcome to be reviewed. The Applicant referred to section 173(3) of the DPA 2018 and alleged that the Police had blocked, erased, or concealed records with the intention of preventing disclosure of information he was entitled to.

In his correspondence of 27 February 2026, the Commissioner confirmed that having carefully reviewed all the information provided by the Applicant, the Commissioner’s decision remained the same because the Police had already advised the Applicant that they do not hold the CCTV and body camera footage requested. The Commissioner acknowledged the Applicant’s concern that he did not receive a response to his SAR within the legislative timeframe, but it was not in the public interest to pursue this aspect of the Applicant’s complaint further. Further, the Commissioner explained that there is a high burden of proof in relation to the commission of an offence under section 173 of the DPA 2018 and the Commissioner did not consider that there was sufficient evidence to prove that the Police had deliberated deleted the Applicant’s personal data on this occasion. Finally, the Commissioner highlighted that the Applicant had a right to complain to the Parliamentary and Health Service Ombudsman (“PHSO”) if he believed that the Commissioner had not acted properly and fairly.

The Applicant sent a further email on 27 February 2026, asking the Commissioner to contact Bedfordshire Constabulary on his behalf to enquire about the availability of CCTV footage in the fingerprint room (notwithstanding that in correspondence dated 1 July 2025 the Police confirmed that certain of the data requested could not be disclosed due to an ongoing investigation). The Commissioner responded on 2 March 2026 to confirm that the Applicant had exhausted the ICO’s case review process, and the Commissioner would not be considering the issues raised again. The Applicant proceeded to make this application as he does not agree with the Outcome.

In his Notice of Application, the Applicant requests the Tribunal to make an order as follows:

“I wish, require and request, that you order ICO to investigate this matter and ask of Bedfordshire Constabulary if they still have the CCTV footage of my assault of the 10^th March 2025, whilst I was in there finger print room. This was included in my original DSAR of the 15th March 2025. If the Police have, I would like a copy. If the Police do not have, they need to give a reason as to why they do not have it and what remedy the Police will give me. If they cannot give it, then they need to confirm that the CCTVfootage of me in their finger print room has been saved and preserved for my future use.

I wish, require and request, that you order ICO to ask the Police, why they acted outside the DSAR time frame and what remedy they will give me.”

The Commissioner applied on form GRC5 dated 27 March 2026 to strike out the Application on the basis that the Tribunal has no jurisdiction to consider it under Rule 8(2)(a) and/or that there is no reasonable prospect of it succeeding under Rule 8(3)(c) of the Rules.

The grounds which the Commissioner gave for striking out the application were set out in the Response, particularly at paragraphs 32 to 35. In summary, these were as follows: 

The Applicant provided a Reply to the Response dated 7 April 2026, which deals with the strike-out application as well as the substantive response, and I am satisfied that the Applicant has had an opportunity to make representations on the proposed striking out under Rule 8(4). The main points made by the Applicant, in summary, were as follows:

Section 165 DPA 2018 sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows: 

The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal's powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. 

Section 165 deals with the complainant's right to make a complaint and states that: 

It has been confirmed that the Commissioner enjoys wide discretion in the handling of complaints brought by data subjects under the relevant provisions. In R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin) the High Court affirmed the very wide scope of the Commissioner’s discretion to handle complaints under section 165 DPA18 as he thinks best – finding that this extended so far as to entitle the Commissioner to take no further action on even a non-spurious complaint – and noted the importance of the Commissioner’s role as expert regulator in this field [65], [66], [70], and [85]. The High Court’s judgement in Delo was upheld by the Court of Appeal (R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2023] EWCA Civ 1141) which confirmed that the Commissioner has broad discretion in deciding the extent to which he investigates each complaint, and is entitled to reach and express a view on the complaint without necessarily determining whether there has been an infringement [80].

The Upper Tribunal has previously affirmed the strictly procedural focus of section 166 DPA 2018 in the judgment of Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC) in which the Upper Tribunal stated at [74] that “[i]t is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals”.

The Tribunal does not have the power to alter the conclusion reached by the Commissioner on a complaint. Neither does the Tribunal have an oversight role over the Commissioner’s exercise of his functions or internal processes. Indeed, the Upper Tribunal in Killock & Veale recognised the Commissioner’s position as an “expert regulator” and stated at [76] that “[s]he is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome”. Should a data subject wish to take issue with the substance of the Commissioner’s findings, the Upper Tribunal held at [77] that there existed adequate protection afforded to data subjects, stating that “[i]f the Commissioner goes outside [his] statutory powers or makes any other error of law, the High Court will correct [him] on ordinary public law principles in judicial review proceedings”.

The analysis of the Upper Tribunal at [74] and [77] of Killock has been confirmed by the High Court in Delo [130], [131]. In addition, Mostyn J has warned against “any attempt[s] by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect.” Thus, collateral attacks to decisions with a view to achieving a different outcome are not permissible when the Tribunal comes to consider applications under section 166 DPA 2018.

In addition, the Court of Appeal in Delo held that “an ‘outcome’ must be the end point of the Commissioner’s ‘handling’ of a complaint. A conclusive determination or ruling on the merits that brings an end to the complaint is certainly an ‘outcome’ but that word is intended to have broader connotations” [64].

Warby LJ further held that “[i]n Killock, the Upper Tribunal decided, in [his] view correctly, that it embraced a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation.” [64] He also agreed with Mostyn J that ‘the word “outcome” [was] an apt description of the Commissioner’s decision to conclude his consideration of Mr Delo’s complaint by informing him of the Commissioner’s view that the conduct complained of was “likely” to be compliant with the UK GDPR (or, put another way, that the complaint of infringement was “likely” to be ill-founded)’ [64]. The Court confirmed that ‘there is nothing in the language of s.165, or for that matter s.166, to suggest that Parliament read the GDPR as requiring the Commissioner to determine the merits of complaints’ [78].

In relation to the investigating to the extent appropriate in the circumstances reference to taking “appropriate steps” in section 166(1)(a) and (2)(a) DPA 2018 includes “investigating the subject matter of the complaint to the extent appropriate” and “informing the complainant about progress on the complaints” – sections 166(4) and 165(5) DPA 2018. The requirement to investigate “to the extent appropriate” must be seen in the context of the Commissioner’s role as a regulator.

The concept of “appropriate steps” was addressed in the judgment of Killock & Veale in which the Upper Tribunal provided guidance on the point at [85], specifically stating that when considering the appropriateness of steps carried out by the Commissioner in relation to a complaint “the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator.” The Upper Tribunal further stated that It went further to say that “[…] where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere […] and cannot simply substitute its own view.” The Upper Tribunal also provided clarity at [87] as to the “forward-looking” nature of section 166 DPA 2018, noting that it is “[…] concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate ‘steps to respond’ and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court).”

The Upper Tribunal made it clear that any order made as to an investigation is likely to trespass upon the matters that the Administrative Court is to consider as well as being an impermissible unravelling or unpicking of the substantive decision and refer to Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) at [53]:

“However, any consideration by the tribunal, after an outcome has been issued, of whether steps taken to investigate the complaint were appropriate or whether relevant evidence was considered or taken into account is likely to step on the toes of the High Court. If the tribunal were to order the Commissioner to take those steps after an outcome has been issued, this would be likely to unpick or unwind that outcome. The tribunal has no power to order the Commissioner to retrospectively take a step that it deems appropriate, where taking such a step might lead to a different substantive outcome to the complaint.”

The Court of Appeal in Delo concluded that the language used in the provisions makes it clear that “the Commissioner’s principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of ‘outcome’, having first investigated the subject matter ‘to the extent appropriate’ in the circumstances of the case” [63]. Furthermore, the Court held that Recital 141 makes it “clear that the Commissioner has a broad discretion to decide the intensity of any investigation, according to the facts of the matter: “the investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case” [66]. Thus, “the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent” [80].

The Upper Tribunal has confirmed, in the case of Smith v Information Commissioner [2025] UKUT 74 (AAC) at [60], that “the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.”

I find that the Commissioner provided an outcome to the Applicant's complaint. The Commissioner provided the Applicant with a response to his complaint on 20 February 2026 with further a response on 27 February 2026 following review. I consider that the responses dated 20 February 2026 and 27 February 2026 when taken together were in fact an outcome to the complaint, because they provided an answer to all outstanding issues and demonstrated that the Commissioner had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant's complaint.

This is sufficient in my view to demonstrate that the Commissioner has complied with the requirements of section 165(4). The fact that the Applicant does not agree with the outcome does not render it wrong in law. 

It appears to me, therefore, that there are no further appropriate steps which the Commissioner ought reasonably to take to progress the complaint.   In making this decision I have given significant weight to the view of the Commissioner as the expert regulator that there are no further appropriate steps he should have taken.  

The outcome sought by the Applicant expressly seeks to overturn the Commissioner's decision and require the Commissioner to reopen the investigation. The outcome sought by the Applicant is, in effect, challenging the substantive outcome of the complaint to the Commissioner. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision.   In an application under section 166, the Tribunal has no power to direct the Commissioner to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the UK GDPR. Its powers are limited to ordering the Commissioner to progress its handling of the Applicant's complaint.

I agree also with the Commissioner's position that it is not a court or ombudsman and that orders for compliance need to be sought through civil action. Accordingly, I find that the Tribunal does not have the power to grant the outcomes sought. 

Because I consider that there was an outcome determining the complaint and that there were no further appropriate steps which should be taken, I find the complaint has already been determined and therefore the Tribunal has no jurisdiction over it.  I am also satisfied that there is no reasonable prospect of the case, or any part of it, succeeding because the outcome sought by the Applicant is not something which is within the Tribunal's power to grant.

The proceedings are therefore struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with them and under Rule 8(3)(c) because there is no reasonable prospect of them succeeding.