Gyorgy Locsi v The Information Commissioner

This appeal concerns a complaint initially submitted to the Information Commissioner on 5 March 2025 relating to the data‑collection practices of Admiral, an insurance provider. The Applicant asserts that Admiral’s system design makes it impossible for him to input accurate personal data, allegedly resulting in an infringement of Article 5(1)(d) UK GDPR. He applied to this Tribunal under section 166(2) of the Data Protection Act 2018, contending that the Commissioner has failed to address the accuracy issue relating to his personal data.

The Commissioner resists the application and invites the Tribunal to strike it out. In his Response he submits that the application is out of time, that the Tribunal has no jurisdiction because the Commissioner has already taken the appropriate procedural steps, and that the Applicant’s case has no reasonable prospect of success.

The Applicant’s original complaint was received by the Commissioner on 5 March 2025. The Commissioner allocated the matter to a case officer who issued an outcome on 3 September 2025, concluding that the insurer’s collection of data such as occupation, marital status and mileage was consistent with standard industry practice and reasonably used for risk assessment. The Commissioner’s evidence records that the Applicant was invited to provide information on any unresolved elements, such as whether his subject access or rectification requests had been properly addressed.

The Applicant requested an internal review, and on 14 October 2025 a different case officer upheld the original outcome. In that communication, the reviewing officer confirmed that the complaint had been handled appropriately and that the Commissioner was satisfied with the explanation provided by the insurer.

On 29 January 2026, following post‑review correspondence, the reviewing officer provided further clarification. In that email, the Commissioner expressly addressed the question of accuracy, stating that whilst some occupational categories may require an element of judgment, categorisation itself does not render data inherently inaccurate, that no evidence had been provided that Admiral was processing inaccurate personal data about the Applicant, and that the real concern appeared to be disagreement with the insurer’s reliance on generalised rating criteria.

The Applicant contends that none of these communications addressed the “real issue”, which he characterises as the systemic inability to enter accurate personal data into the insurer’s platform. He argues that the Commissioner therefore failed to handle his complaint in accordance with Article 57(1)(f) GDPR and that the failure is ongoing.

Section 165 of the Data Protection Act 2018 provides that a data subject may submit a complaint to the Commissioner if they consider that their personal data is being processed in violation of the UK GDPR. Section 166 is concerned solely with the Commissioner’s procedural obligations in handling such complaints. It allows a data subject to apply to the Tribunal for an order where the Commissioner has failed to take appropriate procedural steps, such as failing to respond to a complaint or failing to provide an outcome within the statutory time limits. However, the Tribunal’s jurisdiction is expressly limited to these procedural matters and does not extend to the substantive merits of the Commissioner’s view. The Tribunal has no authority to require the Commissioner to reach a different conclusion or to reconsider a matter that has already resulted in an outcome.

The leading authorities governing the Tribunal’s jurisdiction under section 166 are Killock & Veale, Delo, Mahmood and Smith. Each judgment emphasises a strict boundary between the Commissioner’s regulatory discretion and the Tribunal’s limited role.

In Killock & Veale v Information Commissioner [2021] UKUT 299 (AAC), the Upper Tribunal held that section 166 is strictly procedural and cannot be used to challenge or revisit the merits of an outcome. The Upper Tribunal explained that attempts to divert it from considering the enumerated procedural failings in section 166(1) towards assessment of the substantive merits “must be firmly resisted”. The Upper Tribunal described the Commissioner’s position as an “expert regulator”, uniquely placed to assess the regulatory context.

The judgment of the High Court in R (Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin), upheld by the Court of Appeal in [2023] EWCA Civ 1141, provides the most authoritative articulation of the Commissioner’s discretion. It was held that the Commissioner has a “very wide scope” in deciding how to investigate complaints, including the power to take no further action even on a non‑spurious complaint. The Commissioner is entitled to express a view that conduct is “likely” to be compliant without making a definitive merits determination. In the Court of Appeal, Warby LJ emphasised that an “outcome” for the purposes of the statutory scheme includes any decision that concludes the Commissioner’s handling of a complaint, even where it does not resolve the underlying merits. The courts held that there is nothing in sections 165 or 166 requiring the Commissioner to determine the substantive merits of complaints.

The decision in Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) further clarified that once an outcome has been issued, any order compelling the Commissioner to perform additional investigative steps would improperly “unpick or unwind” that outcome, which the Tribunal has no power to do.

Finally, in Smith v Information Commissioner [2025] UKUT 74 (AAC), the Upper Tribunal observed that the scope for finding that an “appropriate step” has been omitted after an outcome has been provided is “limited”, because section 166 cannot be used as a mechanism to obtain, “by the back door”, relief available only through judicial review or a claim against the controller.

When these authorities are read together, the legal position is clear. The Tribunal may not question the correctness, sufficiency or quality of the Commissioner’s reasoning. It may intervene only where a procedural failure remains outstanding. Once an outcome has been issued on the subject matter of the complaint, the Tribunal’s jurisdiction is effectively spent.

The Applicant submits that Delo is distinguishable because, he argues, the Commissioner has not addressed the “real” accuracy complaint. He says that the Commissioner responded only to a different question concerning industry‑standard occupational categories and did not address his claim that the insurer’s system design makes accurate data entry impossible. He therefore maintains that the Commissioner’s duty remains unfulfilled and that his application seeks only a prospective, not retrospective, order.

This submission cannot be accepted. The reviewing officer’s email of 29 January 2026 expressly considered the accuracy issue. The Commissioner stated that whilst categorisation involves an element of judgment, that does not make the resulting data inherently inaccurate; that the Applicant had provided no evidence that Admiral processed inaccurate personal data about him; and that the issue raised appeared to relate to the appropriateness of the insurer’s rating methodology rather than a breach of the Accuracy Principle.

That constitutes a response outcome to the Applicant’s accuracy complaint. Whether the response was right or wrong, or whether it adequately grappled with the matter, is not relevant to jurisdiction to this Tribunal under section 166. The Upper Tribunal in Killock made clear that the statutory framework does not permit scrutiny of the adequacy or appropriateness of the Commissioner’s investigation where an outcome has been provided. The High Court and Court of Appeal in Delo reinforced that the Commissioner does not have to determine the substantive merits of the alleged infringement or conduct a particular degree of investigation. The Tribunal must not order the Commissioner to revisit the matter, as doing so would amount to the impermissible “unwinding” of the outcome condemned in Mahmood.

The Applicant’s position is, in essence, that the Commissioner’s reasoning was incomplete, misconceived or failed to engage with the true issue. That is a merits challenge. Section 166 is not available for such challenges. The proper remedy, if any, lies either in judicial review or in proceedings against the controller under section 167.

It follows that the Commissioner has already taken the procedural steps envisaged by section 166(1). There is, therefore, no outstanding failure for the Tribunal to remedy and the Tribunal has no jurisdiction to consider the application.

Even if the Tribunal had jurisdiction, which it does not, the application would fail under rule 8(3)(c). The relief sought by the Applicant asks the Tribunal to order the Commissioner to provide a “substantive response” to his Article 5(1)(d) complaint and to address evidence concerning systemic industry practices. That relief would necessarily require the Commissioner to reopen and reconsider the merits of his decision. Such an order would run plainly contrary to Delo, Killock, Mahmood and Smith, each of which makes clear that the Tribunal cannot require retrospective reinvestigation. Since the order sought is one that the Tribunal is legally prohibited from making, the application has no reasonable prospect of success.

The Commissioner has taken appropriate procedural steps, has investigated the complaint to the extent he considered appropriate, and has issued an outcome. The Applicant’s challenge is, in substance, a disagreement with the Commissioner’s reasoning rather than a demonstration of procedural failure. Section 166 provides no jurisdiction for the Tribunal to entertain such a challenge. The application is also devoid of reasonable prospects of success, as the relief sought is prohibited by binding authority. For these reasons, the Tribunal strikes out the proceedings under rule 8(2)(a) and rule 8(3)(c).