Andrew White v The Information Commissioner

The Appellant complained to the Respondent on 12 July 2025 and then again on the 22 October 2025 concerning allegations of data protection breaches by the US-based consumer genetics and research company 23andMe Inc. The specific concern related to the transfer of the Appellant’s genetic data to TTAM Research Institute following 23andMe’s bankruptcy proceedings in the USA.

The Respondent replied to the Appellant’s complaint on 14 January 2026, with an outcome explaining that having considered the information available, no further action would be taken, but the Commissioner would keep a record of the complaint to inform future regulatory action.

The Appellant requested a review of that outcome and on 10 February 2026, the Respondent informed the Appellant that having conducted a review they were satisfied that the complaint had been dealt with appropriately and in line with the ICO’s case handling guidelines. The Respondent’s initial outcome therefore remained unchanged and in place. The Appellant was specifically told that that they could still take the case to court and/or they may be able to refer the case to the Parliamentary and Health Service Ombudsman (“PHSO”) if they felt that the Commissioner had not acted properly or fairly.

On the 22 February 2026 the Appellant lodged a Notice of Appeal with the Tribunal seeking an order determining that the Respondent “failed to take appropriate steps in response to the complaint” and “requiring the Commissioner to take further appropriate steps by issuing a supplementary, reasoned decision which: identifies the criteria applied in exercising discretion; and addresses issues raised by the applicant and identified in the grounds of application”.

The Appellant made an application to the PHSO and so the Respondent decided to conduct a further review re-opening and re-considering the complaint for a further time. Having concluded that work the Respondent informed the Appellant on 1 April 2026, that they were satisfied that 23andMe had complied with its data protection obligations, there had not been an infringement of the UK GDPR and no further action was needed.

On the 7 April 2026 the Respondent made an application that this appeal should be struck out under either rule 8(2)(a) and / or 8(3)(c) of the Tribunal Rules.

The Appellant replied to that application on the 8 April 2026 with 8 pages of response opposing the strike out application.

Section 166 of the DPA 2018 provides the Tribunal with a narrow power that is explicitly limited to the supervision of procedural matters rather than substantive ones. The Upper Tribunal in the judgment of Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC) stated at [74] that “[i]t is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals”

Section 166 does not provide any power for considering or reviewing the substance of any decision made by the Commissioner. Even where s.166 is engaged, the powers of the Tribunal are limited to procedural ones, such as requiring the Commissioner to take appropriate steps to provide the required notification. Even as regards what such ‘appropriate steps’ are the Commissioner benefits from a very wide discretion with caselaw confirming that this even “allows the Commissioner to decide, after investigating a complaint to a limited extent, that no further action should be taken” whether the complaint is spurious or not (see paragraphs 66 and 70 of R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022]EWHC 3046 (Admin)). It is established that neither s.165 nor s.166 of the DPA 2018 require the Commissioner “determine the merits of complaints” (See para 78, R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2023] EWCA Civ 1141).

Furthermore, there is a significant difference between cases where the Commissioner has provided an ‘outcome’ and ones where the ‘outcome’ is still pending. An outcome is a conclusive determination that marks the end of the Commissioner's handling of the relevant complaint. See para 60 of Smith v Information Commissioner [2025] UKUT 74 (AAC)) where it was stated “the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited”.

Where an outcome has been provided the scope of s.166 is necessarily much more limited. As noted in Killock at para 87 “s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate "steps to respond" and not with assessing the appropriateness of a response that has already been given (which would raise substantial Regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question”.

This position has since been reinforced by the case of Delo at the High Court in para 130 where it was ruled that “if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court”.

Once an outcome has been issued there is no power for the Tribunal to seek to order the Respondent to take some ‘appropriate step’ retrospectively especially where such a step could lead to a substantive change in outcome. The appropriate forum for challenging whether steps taken to investigate the complaint were appropriate or whether relevant evidence was considered or taken into account as regards cases where an outcome has been provided is Judicial Review in the High Court.

The Respondent argues that they have taken steps to comply with the procedural requirements set out in section 166(1) of the DPA18, and there is therefore no basis for the Tribunal to make an order under section of the 166(2) DPA18. The fact that the Appellant does not agree with the outcome provided they argue “does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint. The relief available from the Tribunal on an application under section 166 of the DPA18 only applies where it is satisfied that the Commissioner has failed in some procedural respect to comply with the requirements of section 166(1) of the DPA18, limited solely to those orders that are set out in section 166(2)”.

The Respondent goes on to set out that:

The Appellant’s response is lengthy and contradictory in parts. I considered the entirety of the reply and other documentation but have focused only on the most relevant parts for this decision in the following paragraphs.

In the reply the Appellant asserts in various places that they do not seek to ‘challenge the substantive correctness of the respondent’s decision, nor contend that any particular investigative step was legally required’ but then also questions whether “the Respondent in fact took appropriate steps in handling the complaint’ implying that any steps taken were incorrect and others should have been preferred.

Whilst stating that the Appeal does not seek to challenge whether the Respondents outcome conclusion was correct or not, it nonetheless attempts to unpick that conclusion by challenging whether the Respondent took “appropriate steps” in coming to the conclusion of the outcome provided. In paragraph 27 of the reply the Appellant in particular asserts that the material provided by the respondent is insufficient because a number of matters of procedural detail were not disclosed in addition to an outcome being provided. The Appellant seeks to argue that the strike out is inappropriate not because no outcome was provided nor because no outcome was provided whilst at the same time appropriate steps were not taken, but uniquely that an outcome was provided but appropriate steps were not taken in providing it.

The Appellant in paragraph 32 of their reply complains that the outcome and material supplied does not disclose how the ICO framework was applied. In paragraph 32A they go on to complain that it has not been disclosed how the structured criteria relating to complaint handling were applied in this case.

The Appellant also makes reference to issues regarding vulnerability relating to disability but in paragraph 34 of the reply definitively states that this point is not advanced “as a free standing merits challenge but as further context” only. Though they then go on later to raise issues relating to Equality Act compliance and “lawful exercise of public function” both of which are clearly outside of the jurisdiction of this Tribunal. The Appellant asserts in para 37 that such points are only “relied on in the narrower procedural sense that ... disability related needs were a relevant consideration requiring proper consideration as part of lawful and intelligible handling of the complaint”.

On the issue as regards the Respondent’s reliance on the First Tier decision of Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) as regards the limits of what the Tribunal can consider once an outcome has been issued. The Appellant seeks to distinguish that non-binding authority and sets out that they do “not ask the Tribunal to order the Commissioner to take retrospective investigative steps that would produce a different outcome. It asks the Tribunal to be satisfied that the statutory process was properly carried out before the outcome is reached” in paragraph 50 of the reply. Further in paragraph 55 of the reply the Appellant complains that there was no evidence to “demonstrate that the statutory task had already been properly performed” and in paragraph 56 raises the question “whether the Respondent had, at the material time, already taken and disclosed an intelligible application of the statutory standard”.

Under s.166(2) there are just 2 potential orders that the Tribunal can make.

Under subsection (b) this can be an order requiring the Respondent to inform the Appellant of the progress on the complaint or the outcome of the complaint. It is common ground amongst the parties that the Appellant has been provided with an outcome, and therefore this potential order is not applicable in this context.

Under subsection (a) this can be an order requiring the Respondent to “take appropriate steps to respond to the complaint” and this necessarily infers that the complaint has yet to be responded to because further appropriate steps are necessary.

In the conclusion of the Reply the Appellant states that the appeal is “confined to the procedural sufficiency of the material provided” notably the Appellant does not seek either of the outcomes provided for by s.166(2). Rather, they explicitly state that they are seeking “further particulars of [the respondent’s] handling of the complaint as are sufficient to identify the criteria applied, the inquiries undertaken or treated as sufficient, and why no further enquiry was considered necessary” (Paragraph 58 of the reply).

In other words the relief sought is disclosure of information about the appropriate steps already taken to a complaint already responded to. The Appellant on the contents of their own reply is not seeking any particular substantive steps that would progress an outcome to a complaint.

What the Appellant seeks is actually disclosure of evidence relating to the actions and process of the Respondent. The approach throughout the reply is explicit in that the Appellant does not seek to procedurally progress a complaint but rather seeks to assess or review the actions and decisions of the Respondent in producing the outcome that it did. The Appellant has sought to dress up these arguments in a way that does not explicitly offend the established law and precedent regarding s.166, however these are very thinly veiled arguments that are to my mind exactly the sort of ‘sleight of hand’ that is referred to in the Delo case. The Appellant believes that the Respondent has acted in some way that is procedurally improper, this might be because they acted unlawfully (such as the equality and public function issues raised) or because they acted irrationally (such as by failing to apply the proper framework or guidance criteria), in any event this is properly the jurisdiction of the High Court in Judicial Review not the Tribunal.

In light of the above there is no reasonable prospect of the Applicant being able to successfully argue that the Tribunal should make an order pursuant to the power found in s.166(2) DPA 2018. It is therefore ordered that this case is struck out under Rule 8(3)(c).