Keith Kennaugh v The Information Commissioner

These proceedings concern an application (the “Application”) under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) for an order to progress the Applicant’s complaint against West Yorkshire Combined Authority (“WYCA”) regarding the processing of his personal data. The complaint was submitted to the Information Commissioner (“IC”) on 19 June 2023 and was dealt with under reference IC-239469-C4K7.

Following submission of the Applicant’s complaint, on 14 August 2023, the IC’s case officer wrote to the Applicant and requested that he provided evidence of his complaint, in order for the IC to consider the matter further. In particular, the case officer asked for copies of correspondence with WYCA and any final response. The Applicant responded on the same day and provided some correspondence with the WYCA.

On 15 August 2023, the case officer advised the Applicant to raise a formal complaint with WYCA before bringing the matter to the IC.

The Applicant and the case officer exchanged emails between 15 and 22 August 2023, clarifying the complaint made to WYCA and confirming that a final response had not been issued.

A telephone call between the case officer and the Data Protection Officer (DPO) at WYCA to discuss the complaint took place on 23 August 2023. An update was sent to the Applicant about this.

Also, on 23 August 2023 the DPO sent copies of the WYCA’s response to the Applicant’s complaint to the case officer. The case officer subsequently obtained permission from the DPO to share this with the Applicant.

On 5 December 2023, WYCA’s response was shared with the Applicant. The Applicant responded on the same day and advised that he had requested a copy of the warrant authorising the interception of his emails and the Decision Notice made under the WYCA’s Unreasonable Behaviour Policy, and that these documents were not provided in WYCA’s response.

On the same day, the Applicant also made a Data Subject Access Request (“DSAR”) to the WYCA requesting a copy of a log of his emails received by the WYCA. WYCA provided a response to the Applicant on 19 December 2023 informing him that the requested information was not held by the WYCA.

On 21 December 2023, the Applicant contacted the IC’s case officer and advised that the WYCA had not provided him with a record of his correspondence, nor a copy of the Decision Notice previously requested.

On 9 January 2024, the case officer emailed the Applicant to inform him that she hadcontacted the WYCA to discuss his outstanding concerns. She informed theApplicant that she would be in touch with him with an update as soon as she had spokento the WYCA.

On 11 January 2024, the case officer obtained permission from the Applicant to forward an email thread to the DPO which detailed his outstanding concerns. The correspondence was sent to the DPO on 12 January 2024.

On 26 January 2024, the DPO responded to the issues raised in the Applicant’s email.

The Applicant exchanged emails with the case officer on 16 February 2024, who confirmed that they were still waiting on a response from the DPO.

On 22 February 2024 and 27 April 2024, the Applicant emailed WYCA, copying in the IC, and expressed further concerns regarding his complaint.

On 1 May 2024, the Applicant was informed that the complaint had been re-assigned to a different case officer and that an outcome would be provided upon review of the file.

The Applicant sent further emails to the case officer between 10 May 2024 and 7 June 2024 and reiterated his concerns about the WYCA’s response to his SAR.

On 20 June 2024, having reviewed the information provided by the Applicant and WYCA, the IC’s case officer wrote to the Applicant. The case officer was of the view that WYCA had considered the Applicant’s request and provided an appropriate response, and as such there was nothing further that WYCA could be expected to do in relation to his request. The case officer was also satisfied with WYCA’s response in relation to the Applicant’s other concern about WYCA’s processing of his personal data. Information on next steps and judicial remedies was provided to the Applicant.

The Applicant responded on 24 June 2024 and expressed his dissatisfaction with the outcome and requested further information from the case officer.

On 10 July 2024, the case officer sent the Applicant a final response. It was reiterated that the IC did not intend to take the matter further but that his request for information had been passed to the IC’s Information Access Team to respond separately. The Applicant was informed of his rights to request a case review, or bring a service complaint in the event he was dissatisfied with the outcome to his complaint, or the way in which his case was handled.

The Applicant wrote to the Tribunal on 16 August 2024 applying for an order under section 166 DPA 2018. In his grounds for the Application, the Applicant stated: 

The Application was not made in the prescribed form. I am aware that the Upper Tribunal (“UT”) is currently considering an appeal (reference UA-2025-000372-GIA) in relation to the use of forms in connection with earlier case management decisions in this Application. However, it appears to me that the outcome of the UT appeal is not determinative and, indeed, has no bearing on the substantive matters in issue in this Application, so I have proceeded to determine it without waiting for the appeal to the UT to be concluded.

The IC filed a response to the Application on 6 August 2025, opposing the Application. In, summary, it made the following points:

The Applicant filed a response to the Response on 18 August 2025. In this he explained that that the case is about the operation of WYCA’s Unreasonable Behaviour policy, under which correspondence from a complainant deemed ‘unreasonable’ is directed to a single point of contact within WYCA. He said that the principal purpose of the information request was to find the lawful authority for this and what he described as “the interception of these emails”.

In summary, the Applicant made the following points:

Section 165 DPA 2018 sets out the right of data subjects to complain to the IC about infringement of their rights under the data protection legislation. Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows:

The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.

Section 165 deals with the complainant’s right to make a complaint and states that:

In the case of Killock v Information Commissioner [2022] 1 WLR 2241, the Upper Tribunal at paragraph 74 stated - "…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."

Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 - "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...”.

Mostyn J’s decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141) – “For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.” (paragraph 80, Warby LJ).

The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo confirmed that the nature of section 166 is that of a limited procedural provision only. “The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33).

The case of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC), noted at paragraph 60 that “it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an appropriate step has been omitted is limited.” In considering this the Tribunal must, as set out in paragraph 85 of Killick “when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator.”

Paragraph 85 of Killick reads as follows: “However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.”

The Upper Tribunal also said in Smith at paragraph 136 “It is clear from Killock and Veale and Delo that challenges to the legal merits of the outcome of a complaint (and challenges to the adequacy of the Commissioner’s reasons for his decision are also challenges to the legal merits) should be taken to the High Court on judicial review. They should not be ‘dressed up’ as procedural errors and brought as section 166 applications to the First-tier Tribunal… the appellant’s complaints are in reality challenges to the merits of the Commissioner’s outcome decision and, as such, they belonged in the High Court and not in the First-tier Tribunal.”

The hearing was held remotely by cloud video platform (CVP).  The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.

The Tribunal considered a hearing bundle (157 pages) and an authorities bundle (153 pages). It also had the benefit of s skeleton argument from Mr Willis for the IC.

It became apparent at the beginning of the hearing that the initial email from Mr Kennaugh dated 16 August 2024 had not been sent to the IC. Upon my forwarding this to the parties present in the hearing chat box, the IC had an opportunity to consider this and make submissions as to whether or not the hearing should proceed. The IC commented on the procedural fairness of not having seen what is, in effect, the Applicant’s grounds before the hearing. Mr Kennaugh commented that he did not consider the issue of whether or not he had been informed of his rights was sufficiently significant to warrant adjourning and delaying the hearing further. Having heard from both parties, I considered that the only matter raised in that email which was not also raised in the Reply was the issue of whether IC had informed Mr Kennaugh of his rights under section 165. Accordingly, taking into account the overriding objective and, in particular, avoiding unnecessary formality and seeking flexibility in the proceedings and ensuring, so far as practicable, that the parties are able to participate fully in the proceedings, it appeared to me appropriate to proceed with the hearing rather than adjourning it as the parties had had an opportunity to understand the main thrust of each other's cases before the hearing.

We heard oral evidence from Mr Kennaugh, who also made submissions in the hearing. In summary, he made the following points:

The IC, in summary, made the following submissions in its skeleton argument and at the hearing:

The key issue in dispute is whether the IC took appropriate steps in responding to the Applicant’s complaint.

Other issues are whether an outcome to the Applicant complaint was issued and whether the Tribunal has the jurisdiction to grant the outcomes which the Applicant seeks.

The Applicant also complains that the IC did not inform him of his right to refer the matter to the Tribunal under section 165(4)(c). The Applicant commented that this possibly had prejudiced him given the tight timescale for applying for judicial review, but that it was not a big enough issue to warrant adjourning the hearing to deal with it. As the IC had not had notice of this point before the hearing, it did not make submissions on this other than to say that procedurally ordering the IC to take this step at this stage would not achieve anything.

This Application is in relation to the Applicant’s complaint reference IC-239469-C4K7. The Applicant may have made other complaints to the IC about WYCA, and I find that he did provide a number of comments and clarifications in the course of the IC dealing with this complaint, but this is the complaint before the Tribunal in the context of this Application.

The first question is whether the IC has provided an outcome to the Applicant’s complaint. The IC provided the Applicant with a response to his complaint on 20 June 2024 with a further response on 10 July 2024.  I consider that the response dated 20 June 2024 was in fact an outcome to the complaint, because it provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint.  

Even if I am wrong on this, I am satisfied that when taken together with the response dated 10 July 2024  these responses have provided an outcome to the Applicant’s complaint, provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint. This is sufficient in my view to demonstrate that the IC has complied with the requirements of section 165(4). The fact that the Applicant does not agree with the outcome does not render it wrong in law.   

I have considered the steps taken by the IC to investigate and liaise with WYCA set out in the chronology of facts in the Response and also the criticisms of this approach set out in the Applicant’s Reply. As a matter of fact I find it was not correct that there was no evidence that the IC had not engaged with WYCA. The Tribunal, as explained in the Court of Appeal decision in Delo referred to at paragraph 30 above, has a broad discretion to investigate to the extent it sees fit and I find that the engagement it had with WYCA falls well within this discretion.

The Applicant’s primary concern in relation to appropriate steps appears to be that he did not consider it was appropriate for the IC to decide not to take the matter further once it had received a response from WYCA. At this point, the IC had determined that WYCA had provided an appropriate response, and as such there was nothing further that WYCA could be expected to do in relation to the Applicant's request.

I have taken into account the relevant passages of Cortes and Smith referred to above. The scope of the Tribunal’s power under section 166(2) is to make an order specifying appropriate steps which the IC should take, not assessing the appropriateness of a response already given. Whilst the Tribunal can specify such steps after an outcome has been, for the reasons set out in Smith, in all the circumstances of this case I consider it is not appropriate to do so. Challenges to the adequacy of a response or outcome are ones which should be dealt with by judicial review.

It appears to me therefore that there are no further appropriate steps which the IC ought reasonably to take to progress the complaint.  In making this decision I have given significant weight to the view of the IC as the expert regulator that there are no further appropriate steps he should have taken.

The outcome sought by the Applicant is also, in effect, challenging the substantive outcome of the complaint to the IC and the adequacy of WYCA’s response. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision.   In an application under section 166, the Tribunal has no power to direct the IC to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the UK GDPR. I also agree with the IC’s position that orders for compliance need to be sought through civil action.

Although this was not an issue dealt with at the hearing, I observe that orders under section 166(2) are procedural remedies which require the IC to take positive steps to progress an investigation. Those rights only arise where an investigation is ongoing. Where an investigation has been concluded, there is no ongoing investigation to progress, so it would be inappropriate to signpost a complainant to a course of action not open to them.

Because I consider that there was an outcome determining the complaint and that there were no further appropriate steps which should be taken by the IC in handling the complaint, I dismiss the Application.