Leila Kozma v Information Commissioner

This is an application for an order that the IC progress a complaint with reference number IC-383615-W5P0.

Both parties are content for the application to be determined without a hearing. I am satisfied that I can properly determine the issues without a hearing within rule 32(1)(b) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).

A data subject has a right to make a complaint to the Commissioner if they consider that, in connection with the processing of personal data relating to them, there is an infringement of the UK GDPR and/or Parts 3 or 4 of the DPA: see Article 77 UK GDPR, and Section 165(1) & (2) DPA.

Under Section 166 DPA, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.

Section 166 DPA as relevant states:

The powers of this Tribunal in determining an application under Section 166 are limited to those set out in Section 166(2) and (3). The Tribunal has no power to consider the merits of a complaint or the outcome. It has no power to sanction the IC for providing a late outcome, even one provided only after the application is made to this Tribunal.

Killock & Veale v Information Commissioner [2021] UKUT 299 (AAC) is authority for the fact that Section 166 is a forward-looking provision intended to remedy ongoing procedural defects that stand in the way of a timely resolution of a complaint.

In the Court of Appeal in Delo v Information Commissioner [2023] EWCA Civ 1141, LJ Warby confirmed the Tribunal’s powers are to require the Commissioner to take a specified step, conclude an investigation or take a specified step within a specified period [at paragraph 23].

As the Upper Tribunal confirmed in Smith v ICO [2025] UKUT 74 (AAC) [at paragraph 60]:

“the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.”

The Upper Tribunal goes on in paragraph 61 to confirm that an order could be made where an outcome has been provided for example when the outcome deals only with part of the complaint.

The nature of an “outcome” was discussed in Delo [at paragraph 64]:

“An “outcome” must be the end point of the Commissioner’s “handling” of a complaint.”

At paragraph 80, the Court of Appeal confirmed that:

“the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.”

In her application dated 4 July 2025, Ms Kozma explained that she sought information from the CPS about files relating to various orders made at Highbury Magistrates’ Court. She disagrees with an IC decision made on 12 June 2025 that the CPS was permitted to delete those files. She asked for a Tribunal order that the IC takes appropriate steps to respond to her complaint.

The Response dated 6 October 2025 says that the IC provided an outcome to Ms Kozma’s complaint on 12 June 2025 but that it agreed to carry out a case review on 6 October 2025. As at the date of the Response, the outcome of the case review was still outstanding but expected within 30 days.

The Response avers that the IC had taken appropriate steps to investigate and respond to Ms Kozma’s complaint and provided an outcome, so there is no basis for an order under Section 166.

I considered a bundle of 115 pages.

I make these findings on the balance of probabilities.

On 6 May 2025, Ms Kozma complained to the IC about a SAR made to the Crown Prosecution Service (CPS) on 3 March 2025. She said that the CPS had told her that they had “purged” their files, which she said was against their guidelines.

On 12 June 2025, the ICO case officer wrote to Ms Kozma about her complaint suggesting that there was no evidence that there was an infringement of her information rights. The email concludes that the ICO will keep a record of the complaint for monitoring purposes. It is clear from the body of the email that the ICO does not intend to take any further action.

After this, on 16 June 2025, the ICO case officer wrote to the CPS, explaining that Ms Kozma asserted that her information was destroyed before the retention period advised on their website.

On 17 June 2025, Ms Kozma raised a formal complaint about the way her case was handled.

On 19 June 2025, the CPS responded to confirm that Magistrates’ Court cases have a minimum retention period of one year, but that period may be extended in circumstances including a sentence exceeding 12 months.

On 29 September 2025, the ICO case officer wrote to Ms Kozma with this information.

On 2 October 2025, Ms Kozma wrote to the ICO case officer to explain that the sentence was for more than 12 months, so the CPS deleted their files before the scheduled deletion date. She complained that the ICO did not explain why they could not exercise their powers and enforce the CPS’s guidelines.

On 6 October 2025, the ICO case officer wrote to Ms Kozma to say that she had passed the complaint to a reviewing officer for a case review and that they would respond within 30 days.

On 31 October 2025, the ICO reviewing officer wrote to Ms Kozma to request more information.

On 9 November 2025, Ms Kozma provided further information to the ICO reviewing officer. The ICO reviewing officer acknowledged that information on 11 November, said that she would contact the CPS again, and that she hoped to provide a further update by 30 November.

On 18 November 2025, the ICO case officer asked the CPS to confirm whether or not the data was deleted prematurely or in line with retention/disposal schedules. The CPS replied on 21 November 2025 and confirmed that the case file was destroyed in error – it should have been retained for at least an additional year after a restraining order expires on 11 November 2028.

On 24 November 2025, the ICO reviewing officer wrote to Ms Kozma. The email contains a section headed “outcome”. That outcome was that the CPS did not comply with their data protection obligations because case information was deleted prematurely. Ms Kozma was advised that she would need to pursue personal redress or compensation through the courts or an industry ombudsman or regulatory body and that this is not a process that the ICO can assist her with. The email further confirms that concerns Ms Kozma had expressed about how the police had handled her data would have to be the subject of a separate complaint because the police and CPS are separate data controllers. The email concludes by saying that advice had been provided to the CPS to ensure this type of incident did not happen again and that the ICO would keep a record of the complaint for monitoring purposes. It is clear from the email that the ICO will not be taking any further action.

The email of 12 June 2025 was an outcome to Ms Kozma’s complaint because it communicated the ICO’s view on whether or not Ms Kozma’s information rights had been infringed and what the ICO would do. The fact that very little if any investigation was carried out is immaterial: it was undoubtedly an outcome because it was (at that stage) the “end point” of the ICO’s handling of the complaint.

The ICO then agreed to carry out a case review on 6 October 2025. At this point, there was no longer an “end point” to the handling of the complaint: Ms Kozma was advised that she should expect a response within 30 days.

That response was eventually provided on 24 November 2025, after seeking further information both from Ms Kozma and the CPS. This email was undoubtedly an outcome: it contains a section headed “outcome” that gives a (different) view on whether or not Ms Kozma’s information rights were infringed, signposts Ms Kozma to alternative routes to seek redress and advises that the ICO could not assist her with those routes. It further explains that Ms Kozma would need to raise a new complaint about how the police handled her data, because they are a separate data controller to the CPS. The letter concludes by saying what the ICO will do about the complaint, namely to provide advice to the CPS and keep a copy of the complaint for monitoring purposes. It is undoubtedly and definitively an “end point” to the handling of the complaint.

There is therefore nothing for this Tribunal to do: Ms Kozma has received her outcome so there are no ongoing procedural defects to remedy. The application is therefore dismissed.