Sandra Bruno v The Information Commissioner

The Appellant complained to the Respondent on 26 July 2025 concerning allegations of a data protection breach by Lindt & Sprüngli (UK) Ltd as regards the refusal of a subject access request.

On the 21 October 2025 the Commission provided a progress update to the Appellant.

On 17 December 2025 the Respondent provided the Appellant with an outcome to their complaint. This explained that based on the information provided to the Respondent they were satisfied with the explanation provided by Lindt & Sprüngli (UK) Ltd as to why the request was considered to be manifestly unfounded, consequently no further action would be taken.

The Appellant requested a review of that outcome on 18 December 2025.

On the 16 January 2026 the Respondent informed the Appellant that having conducted a review they were upholding the original outcome.

On the 1 February 2026 the Appellant lodged a Notice of Appeal with the Tribunal seeking an order requiring the Respondent “to reconsider my complaint concerning the refusla of my subject access request... and conduct a fresh investigation to an appropriate extent in accordance with section 165 of the DPA 2018 applying the correct statutory test under Article 12(5) UK GDPR and in particular to assess whether the controller discharged the burden of demonstrating that the request was manifestly unfounded at the time of refusal...”.

On the 2 April 2026 the Respondent made an application that this appeal should be struck out under either rule 8(2)(a) and / or 8(3)(c) of the Tribunal Rules.

The Appellant replied to that application on the 6 April 2026 with 5 pages of response opposing the strike out application.

Section 166 of the DPA 2018 provides the Tribunal with a narrow power that is explicitly limited to the supervision of procedural matters rather than substantive ones. The Upper Tribunal in the judgment of Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC) stated at [74] that “[i]t is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals”

Section 166 does not provide any power for considering or reviewing the substance of any decision made by the Commissioner. Even where s.166 is engaged, the powers of the Tribunal are limited to procedural ones, such as requiring the Commissioner to take appropriate steps to provide the required notification. Even as regards what such ‘appropriate steps’ are the Commissioner benefits from a very wide discretion with caselaw confirming that this even “allows the Commissioner to decide, after investigating a complaint to a limited extent, that no further action should be taken” whether the complaint is spurious or not (see paragraphs 66 and 70 of R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022]EWHC 3046 (Admin)). It is established that neither s.165 nor s.166 of the DPA 2018 require the Commissioner “determine the merits of complaints” (See para 78, R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2023] EWCA Civ 1141).

Furthermore, there is a significant difference between cases where the Commissioner has provided an ‘outcome’ and ones where the ‘outcome’ is still pending. An outcome is a conclusive determination that marks the end of the Commissioner's handling of the relevant complaint. See para 60 of Smith v Information Commissioner [2025] UKUT 74 (AAC)) where it was stated “the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited”.

Where an outcome has been provided the scope of s.166 is necessarily much more limited. As noted in Killock at para 87 “s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate "steps to respond" and not with assessing the appropriateness of a response that has already been given (which would raise substantial Regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question”.

This position has since been reinforced by the case of Delo at the High Court in para 130 where it was ruled that “if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court”.

Once an outcome has been issued there is no power for the Tribunal to seek to order the Respondent to take some ‘appropriate step’ retrospectively especially where such a step could lead to a substantive change in outcome. The appropriate forum for challenging whether steps taken to investigate the complaint were appropriate or whether relevant evidence was considered or taken into account as regards cases where an outcome has been provided is Judicial Review in the High Court.

The Respondent, in summary, argues that they have taken appropriate steps to investigate and respond to the Appellant’s complaint, providing them with an outcome and a review. It is submitted that the Respondent has taken steps to comply with the procedural requirements set out in section 166(1) of the DPA18, and there is therefore no basis for the Tribunal to make an order under section 166(2) of the DPA18.

The fact that the Appellant does not agree with the outcome provided they argue “does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint. The relief available from the Tribunal on an application under section 166 of the DPA18 only applies where it is satisfied that the Commissioner has failed in some procedural respect to comply with the requirements of section 166(1) of the DPA18, limited solely to those orders that are set out in section 166(2)”.

The Respondent goes on to set out that:

The Appellant’s response opposes the strike out application. I considered the entirety of the reply and other documentation but have focused only on the most relevant parts for this decision in the following paragraphs.

The Appellant argues that the Respondent mischaracterises the grounds of the appeal and that it is not a challenge to the substantive outcome but rather “concerns the legal adequacy of the Commissioner’s investigative process” (para 3 of the reply).

In paragraph 10 the Appellant argues that “the Commissioner failed to take appropriate steps because he misdirected himself as to the legal framework governing the complaint, and therefore did not assess the complaint properly”.

In paragraphs 14 and 15 the Appellant states that the outcome of the Respondent is not being challenged itself, but rather the appeal concerns “how the complaint was handled, not what conclusion was reached”.

The Appellant makes a number of allegations of procedural impropriety or failure by the Respondent as regards the handling of the Complaint, including as regards the approach taken to absence of evidence and the substantiation of assertions of the controller, as well as misdirections as to the applicable legal framework.

The Appellant in paragraph 59 seeks an order under s.166(2) to require the Respondent to take a number of specific “appropriate steps” including a re- assessment of the key substantive issue in the complaint of whether the subject access request was lawfully considered to be manifestly unfounded.

In the conclusion of the reply the Appellant states in paragraph 61 that “The application identifies a clear and arguable procedural defect in the handling of the complaint”.

Under s.166(2) there are just two potential orders that the Tribunal can make.

Under subsection (b) this can be an order requiring the Respondent to inform the Appellant of the progress on the complaint or the outcome of the complaint. It is common ground amongst the parties that the Appellant has been provided with an outcome, and therefore this potential order is not applicable in this context.

Under subsection (a) this can be an order requiring the Respondent to “take appropriate steps to respond to the complaint” and this necessarily infers that the complaint has yet to be responded to because further appropriate steps are necessary.

It is noteworthy that the Appellant does not unequivocally seek either of the outcomes provided for by s.166(2). The reply uses the phrasing of “appropriate steps” but the Appellant on the contents of their own reply is not seeking to progress an outcome to a complaint. Rather, the Appellant repeatedly asserts that the purpose of this appeal is to challenge the Respondent’s handling of the complaint in terms of legal adequacy of the investigation, the legal standards the Respondent applied in assessing the complaint, and various alleged procedural defects or failures in the conduct of the Respondent as regards the substantive issues of the complaint. None of the identified ‘appropriate steps’ sought by the Appellant are ones that seek to progress a response to the complaint, instead they seek to revisit and alter the approach taken by the Respondent in the hope that will in turn change the ultimate outcome.

What the Appellant seeks is to assess or review the actions and decisions of the Respondent in producing the outcome that it did. The Appellant has sought to dress up these arguments in a way that does not explicitly offend the established law and precedent regarding s.166, however these are very thinly veiled arguments that are to my mind exactly the sort of ‘sleight of hand’ that is referred to in the Delo case.

Where the Appellant believes that the Respondent has acted in some way that is procedurally flawed or improper, this might be because they acted unlawfully or because they acted irrationally, then the proper jurisdiction for such a challenge is the High Court in Judicial Review not the Tribunal.

In light of the above I find that the Tribunal does not have jurisdiction for the releif sought by the Appeal and that there is no reasonable prospect of the Applicant being able to successfully argue that the Tribunal should make an order pursuant to the power found in s.166(2) DPA 2018. It is therefore ordered that this case is struck out under both Rule 8(2)(a) and Rule 8(3)(c).