Kevin McDonnell v The Information Commissioner

This application arises from a series of complaints made by the Applicant to the Information Commissioner between September 2025 and February 2026, relating to eight separate organisations: Otford Medical Practice, Octopus Energy, HSBC, Department for Work and Pensions (DWP), Nationwide, Fidelity Pensions, Sevenoaks Council and Kent Police. The Applicant asserts that none of these organisations has properly responded to his DSARs, that criminal offences have been committed in respect of concealment or destruction of information, and that the Commissioner has not addressed what he regards as “the real issues” raised in his complaints.

The Commissioner resists the application and invites the Tribunal to strike it out. In the Commissioner’s Response, detailed outcomes or updates are identified for each of the eight complaints, and the Commissioner submits that section 166 is a strictly procedural jurisdiction which does not permit the Tribunal to revisit or overturn the substantive merits of any outcome already issued.

The Applicant’s complaints were submitted between 22 September 2025 and 11 October 2025 and allocated eight separate ICO reference numbers. For each complaint, the Commissioner either issued a full outcome, or requested further information from the Applicant and confirmed that an outcome or update would follow within the statutory period.

The chronology is set out in detail in the Commissioner’s Response and in summary is as follows:

The Applicant’s own correspondence demonstrates that he has repeatedly been sent requests or outcomes by the ICO, though he disputes their accuracy or sufficiency. He also contends that the Commissioner has not contacted certain controllers or has failed to address alleged concealment of data, including by Kent Police.

Section 165 of the Data Protection Act 2018 provides that a data subject may submit a complaint to the Commissioner if they consider that their personal data is being processed in violation of the UK GDPR. Section 166 is concerned solely with the Commissioner’s procedural obligations in handling such complaints. It allows a data subject to apply to the Tribunal for an order where the Commissioner has failed to take appropriate procedural steps, such as failing to respond to a complaint or failing to provide an outcome within the statutory time limits. However, the Tribunal’s jurisdiction is expressly limited to these procedural matters and does not extend to the substantive merits of the Commissioner’s view. The Tribunal has no authority to require the Commissioner to reach a different conclusion or to reconsider a matter that has already resulted in an outcome.

The leading authorities governing the Tribunal’s jurisdiction under section 166 are Killock & Veale, Delo, Mahmood and Smith. Each judgment emphasises a strict boundary between the Commissioner’s regulatory discretion and the Tribunal’s limited role.

In Killock & Veale v Information Commissioner [2021] UKUT 299 (AAC), the Upper Tribunal held that section 166 is strictly procedural and cannot be used to challenge or revisit the merits of an outcome. The Upper Tribunal explained that attempts to divert it from considering the enumerated procedural failings in section 166(1) towards assessment of the substantive merits “must be firmly resisted”. The Upper Tribunal described the Commissioner’s position as an “expert regulator”, uniquely placed to assess the regulatory context.

The judgment of the High Court in R (Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin), upheld by the Court of Appeal in [2023] EWCA Civ 1141, provides the most authoritative articulation of the Commissioner’s discretion. It was held that the Commissioner has a “very wide scope” in deciding how to investigate complaints, including the power to take no further action even on a non‑spurious complaint. The Commissioner is entitled to express a view that conduct is “likely” to be compliant without making a definitive merits determination. In the Court of Appeal, Warby LJ emphasised that an “outcome” for the purposes of the statutory scheme includes any decision that concludes the Commissioner’s handling of a complaint, even where it does not resolve the underlying merits. The courts held that there is nothing in sections 165 or 166 requiring the Commissioner to determine the substantive merits of complaints.

The decision in Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) further clarified that once an outcome has been issued, any order compelling the Commissioner to perform additional investigative steps would improperly “unpick or unwind” that outcome, which the Tribunal has no power to do.

Finally, in Smith v Information Commissioner [2025] UKUT 74 (AAC), the Upper Tribunal observed that the scope for finding that an “appropriate step” has been omitted after an outcome has been provided is “limited”, because section 166 cannot be used as a mechanism to obtain, “by the back door”, relief available only through judicial review or a claim against the controller.

When these authorities are read together, the legal position is clear. The Tribunal may not question the correctness, sufficiency or quality of the Commissioner’s reasoning. It may intervene only where a procedural failure remains outstanding. Once an outcome has been issued on the subject matter of the complaint, the Tribunal’s jurisdiction is effectively spent.

The Applicant argues that the Commissioner has still not addressed what he considers to be the the real issues in his complaints. He contends that the ICO’s outcomes are incomplete or inaccurate, that essential correspondence or evidence was overlooked, and that no meaningful engagement took place in respect of alleged criminality or concealment of information.

That submission cannot be accepted. The Commissioner’s chronology shows clearly that outcomes or progress updates including requests for further information with a view to providing an outcome or further update within 3 months have been issued for each of the eight complaints. The 3 month period following the Commissioner’s requests for further information in several of the complaints is still ongoing.

The fact that the Applicant disagrees with the outcomes already provided is not relevant to the Tribunal’s jurisdiction.

As the authorities make clear, the Tribunal may not examine whether the Commissioner’s investigation was correct, comprehensive, or convincing. It is not the Tribunal’s function to assess whether the controller breached data protection law, whether criminal offences occurred, or whether the Commissioner should have investigated more deeply.

The Applicant’s challenge is, in substance, a challenge to the merits of the Commissioner’s reasoning and the sufficiency of the Commissioner’s investigative steps. Those matters lie wholly outside the scope of section 166.

I do not consider that there is any outstanding procedural failure. The Commissioner has taken appropriate steps to respond, provided progress information, requested further information and issued outcomes where appropriate. Any remaining steps depend on the Applicant providing the further information requested and allowing the Commissioner the reasonable period of a further 3 months to investigate further.

Accordingly, the Tribunal has no jurisdiction under section 166.

The Commissioner has taken the procedural steps required by section 166(1) and some investigations are ongoing. The Applicant’s real complaint is with the content of the Commissioner’s outcomes, but the Tribunal has no jurisdiction to assess or amend those outcomes.

The application is therefore struck out under rule 8(2)(a) on the basis that the Tribunal has no jurisdiction, and in the alternative under rule 8(3)(c) because the application has no reasonable prospect of success.