Jerry Ugochukwu Okoye v The Information Commissioner

This application arises from a series of complaints made by the Applicant to the Information Commissioner between May and June 2025 concerning the Ministry of Justice’s handling of his personal data, including allegations relating to inaccurate criminal markers, data falsification, manipulated CCTV recordings, and substantial redactions within subject access disclosures. The Applicant asserts that the Commissioner failed to address what he characterises as “the real issues” in his complaints, namely, systemic inaccuracies, falsifications and procedural misconduct within MoJ data systems, and therefore failed to take appropriate steps under Article 57(1)(f) UK GDPR and sections 165–166 of the DPA 2018.

The Commissioner resists the application and invites the Tribunal to strike it out. In his Response, the Commissioner submits that the Tribunal has no jurisdiction because he has already taken the appropriate procedural steps by issuing outcomes for each complaint; that the application is, in substance, a disagreement with those outcomes; and that the Applicant’s case has no reasonable prospect of success because the remedies sought fall outside what can be ordered by this Tribunal under section 166.

The Applicant lodged his first complaint with the Commissioner (IC‑389798‑Q9W8) on 16 May 2025, relating to withheld or altered CCTV footage. The Commissioner allocated a case officer who issued an outcome on 24 July 2025, concluding that further work was required by the MoJ and directing the MoJ to revisit the matter. Following further correspondence, the Commissioner issued a revised outcome on 17 September 2025, notifying the MoJ that it had failed to comply with its obligations in respect of one of the SAR requests.

The Applicant’s second complaint (IC‑391459‑C2H7) was received on 3 June 2025 and concerned allegations of inaccurate, manipulated and incomplete data processed by the MoJ, together with concerns about the reissuance of heavily redacted SAR material. The Commissioner issued an initial outcome on 12 June 2025, identifying that internal complaint routes had not been exhausted. Following the Applicant’s additional submissions, including a chronology and supplementary evidence, a revised outcome was issued on 3 September 2025. A separate review was later conducted by a reviewing officer on 11 September 2025, following the Applicant’s request for internal review, who confirmed that the complaint had been handled appropriately and that the steps taken were reasonable.

Throughout this period, the Applicant sent extensive rebuttals, including a 64‑page forensic report and allegations of falsification of records, fraudulent offence markers, transgender misclassification, and systemic inaccuracies, asserting that none of these concerns had been substantively investigated. He contends that the Commissioner failed to address the “true issue”, namely the alleged systemic manipulation of his records and the consequential impact on his safety, legal position and mental health.

Section 165 of the Data Protection Act 2018 provides that a data subject may submit a complaint to the Commissioner if they consider that their personal data is being processed in violation of the UK GDPR. Section 166 is concerned solely with the Commissioner’s procedural obligations in handling such complaints. It allows a data subject to apply to the Tribunal for an order where the Commissioner has failed to take appropriate procedural steps, such as failing to respond to a complaint or failing to provide an outcome within the statutory time limits. However, the Tribunal’s jurisdiction is expressly limited to these procedural matters and does not extend to the substantive merits of the Commissioner’s view. The Tribunal has no authority to require the Commissioner to reach a different conclusion or to reconsider a matter that has already resulted in an outcome.

The leading authorities governing the Tribunal’s jurisdiction under section 166 are Killock & Veale, Delo, Mahmood and Smith. Each judgment emphasises a strict boundary between the Commissioner’s regulatory discretion and the Tribunal’s limited role.

In Killock & Veale v Information Commissioner [2021] UKUT 299 (AAC), the Upper Tribunal held that section 166 is strictly procedural and cannot be used to challenge or revisit the merits of an outcome. The Upper Tribunal explained that attempts to divert it from considering the enumerated procedural failings in section 166(1) towards assessment of the substantive merits “must be firmly resisted”. The Upper Tribunal described the Commissioner’s position as an “expert regulator”, uniquely placed to assess the regulatory context.

The judgment of the High Court in R (Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin), upheld by the Court of Appeal in [2023] EWCA Civ 1141, provides the most authoritative articulation of the Commissioner’s discretion. It was held that the Commissioner has a “very wide scope” in deciding how to investigate complaints, including the power to take no further action even on a non‑spurious complaint. The Commissioner is entitled to express a view that conduct is “likely” to be compliant without making a definitive merits determination. In the Court of Appeal, Warby LJ emphasised that an “outcome” for the purposes of the statutory scheme includes any decision that concludes the Commissioner’s handling of a complaint, even where it does not resolve the underlying merits. The courts held that there is nothing in sections 165 or 166 requiring the Commissioner to determine the substantive merits of complaints.

The decision in Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) further clarified that once an outcome has been issued, any order compelling the Commissioner to perform additional investigative steps would improperly “unpick or unwind” that outcome, which the Tribunal has no power to do.

Finally, in Smith v Information Commissioner [2025] UKUT 74 (AAC), the Upper Tribunal observed that the scope for finding that an “appropriate step” has been omitted after an outcome has been provided is “limited”, because section 166 cannot be used as a mechanism to obtain, “by the back door”, relief available only through judicial review or a claim against the controller.

When these authorities are read together, the legal position is clear. The Tribunal may not question the correctness, sufficiency or quality of the Commissioner’s reasoning. It may intervene only where a procedural failure remains outstanding. Once an outcome has been issued on the subject matter of the complaint, the Tribunal’s jurisdiction is effectively spent.

The Applicant contends that the Commissioner has not addressed what he regards as the “real issues” in his complaints, asserting that crucial matters, such as the alleged falsification of MoJ records, manipulation of CCTV evidence, and the reissue of SAR pages without explanation, were never substantively engaged with. He therefore argues that the Commissioner’s duty remains unfulfilled and that his application seeks only a prospective order requiring the Commissioner to take steps that have not yet been taken.

This submission cannot be accepted. The Commissioner’s outcomes of 24 July 2025, 17 September 2025, 12 June 2025, and 3 September 2025, together with the internal review of 11 September 2025, constitute responses to the subject matter of the complaints. Whether those responses were accurate, comprehensive or compelling is not relevant to the Tribunal’s jurisdiction. The question is not whether the Commissioner correctly analysed the evidence, but whether he took the procedural steps envisaged by section 166(1). The Tribunal in Killock made clear that it cannot examine the adequacy or quality of an investigation. The courts in Delo confirmed that the Commissioner is not obliged to investigate to any particular depth or to reach a substantive determination on the merits. Mahmood prohibits any order requiring a retrospective reinvestigation. Smith confirms that section 166 cannot be used to obtain relief that is structurally unavailable.

In this case, the Commissioner plainly took procedural steps: he opened case files, sought evidence, issued outcomes, communicated with the MoJ, requested further reviews and provided explanations for his decisions. The Applicant’s disagreement is not with the absence of a response but with its content. That is a merits challenge, and section 166 is not available for such a challenge. The proper remedies, if any are available, lie either in judicial review of the Commissioner’s decision‑making or in proceedings under section 167 against the controller.

Accordingly, there is no outstanding failure for the Tribunal to remedy. The Commissioner has taken the procedural steps required, and the Tribunal therefore has no jurisdiction under section 166.

Even if jurisdiction existed, which it does not, the application would have no reasonable prospect of success. The relief sought would require the Tribunal to compel the Commissioner to provide a fresh, substantive response to the Applicant’s allegations regarding MoJ data practices. Any such order would require the Commissioner to reopen and reconsider the complaint, contrary to the binding authorities of Delo, Killock, Mahmood and Smith. Because the Tribunal cannot order a remedy of the type sought, the application must be struck out under rule 8(3)(c).

The Commissioner has taken appropriate procedural steps, has investigated the complaints to the extent he considered appropriate and has issued outcomes. The Applicant’s challenge is, in substance, a disagreement with the Commissioner’s reasoning rather than a demonstration of procedural failure. Section 166 provides no jurisdiction for the Tribunal to entertain such a challenge. The application is also devoid of reasonable prospects of success, since the relief sought is prohibited by binding authority. For these reasons, the Tribunal strikes out the proceedings under rule 8(2)(a) and rule 8(3)(c).