Eduardo Cortes v The Information Commissioner

Introduction

1. This case concerns an application for permission to appeal brought by the Applicant, Mr Cortes, a hospital consultant. The background concerns a complaint by Mr Cortes to the Information Commissioner about a hospital trust’s alleged (mis)handling of personal data. The legal issue concerns the scope and applicability of section 166 of the Data Protection Act 2018 , an issue on which there is case law authority from the Upper Tribunal, the High Court and now the Court of Appeal. I am refusing the application for permission to appeal for the reasons that follow. The oral permission hearing

2. I held a remote oral hearing of the application for permission to appeal on 27 November 2023. Mr Cortes attended in person (albeit remotely from Austria), ably represented by Professor Mark Engelman of Counsel. The Information Commissioner did not attend and was not represented but had not been directed to do so. I am indebted to Professor Engelman for his detailed submissions both in person and on paper. The background

3. The basic chronology is not in dispute and so need not be set out in any great detail here. Mr Cortes was concerned that personal data had been erased from the hospital data record system. On 17 August 2022 he submitted a complaint to the Commissioner expressing his concerns. His complaint was acknowledged on the same day. Mr Cortes sent the Commissioner chasing e-mails on 26 September and 2 November 2022, seeking an update on his complaint. On 4 November 2022 he received two e-mails from one of the Commissioner’s caseworkers.

4. The first e-mail stated that as his concerns did not relate to his own personal information, the Commissioner would review the matter but would not be providing any further response to Mr Cortes. He replied promptly by return, stating that on the contrary his personal data was involved. The caseworker’s second e-mail asserted that the case notes would be considered the personal data of the patient and not that of Mr Cortes.

5. On 18 November 2022 Mr Cortes applied to the First-tier Tribunal (FTT) under section 166 of the Data Protection Act (DPA) 2018. Following an application by the Commissioner dated 31 March 2023, the FTT (Judge Brian Kennedy KC) struck out Mr Cortes’ application as having no reasonable prospects of success. Applications for permission to appeal: the general principles

6. An appeal to the Upper Tribunal lies only on “any point of law arising from a decision” of the FTT (see section 11(1) of the Tribunals, Courts and Enforcement Act 2007 ). The Upper Tribunal will give permission to appeal only if there is a realistic prospect of an appeal succeeding, unless there is exceptionally some other good reason to do so: Lord Woolf MR in Smith v Cosworth Casting Processes Ltd [1997] 1 WLR 1538 .

7. The error of law must also be material, i.e. one that affected the outcome of the case in some relevant way. The Court of Appeal has set out a summary of the main errors of law in its decision in R (Iran) v Secretary of State for the Home Department [2005] EWCA Civ 982 at [9] (sometimes known as the Iran criteria). The main examples of where the FTT may go wrong in law include (in plain English): • the tribunal did not apply the correct law or wrongly interpreted the law; • the tribunal made a procedural error; • the tribunal had no or not enough evidence to support its decision; • the tribunal failed to find sufficient facts; • the tribunal did not give adequate reasons.

8. I also bear in mind that the principles governing appellate review in tribunals are common across the board. In the context of employment tribunal proceedings, they were helpfully expressed as follows by the Employment Appeal Tribunal (EAT, Elias J presiding) in ASLEF v Brady [2006] IRLR 576 at para [55] (so, for example, in the following extract substitute ‘Upper Tribunal’ for ‘EAT’ and ‘FTT’ for ‘Employment Tribunal’): “The EAT must respect the factual findings of the Employment Tribunal and should not strain to identify an error merely because it is unhappy with any factual conclusions; it should not ‘use a fine toothcomb’ to subject the reasons of the Employment Tribunal to unrealistically detailed scrutiny so as to find artificial defects; it is not necessary for the Tribunal to make findings on all matters of dispute before them nor to recount all the evidence, so that it cannot be assumed that the EAT sees all the evidence; and infelicities or even legal inaccuracies in particular sentences in the decision will not render the decision itself defective if the Tribunal has essentially properly directed itself on the relevant law.” The statutory framework

9. The domestic statutory framework on data protection must be understood against the backdrop of the UK GDPR. This provides that one of the Commissioner’s tasks is to “ handle complaints lodged by a data subject … and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period” (Article 57.1(f)). Article 77.1 then vests the data subject with the right to make a complaint to the Commissioner, who “shall inform the complainant on the progress and the outcome of the complaint” (Article 77.2). Article 78.2 further provides that “each data subject shall have the right to an effective judicial remedy where the Commissioner does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77”.

10. So far as is relevant, section 165 of the DPA 2018 provides as follows: Complaints by data subjects

165. –(1) Articles 57(1)(f) and (2) and 77 of the GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the GDPR. (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act . … (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a) take appropriate steps to respond to the complaint, (b) inform the complainant of the outcome of the complaint, (c) inform the complainant of the rights under section 166 , and (d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a) investigating the subject matter of the complaint, to the extent appropriate, and (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with another supervisory authority or foreign designated authority is necessary.

11. Section 166 then provides the judicial remedy mandated by Article 78.2 thus: Orders to progress complaints

166. –(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order. (3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order. (4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

12. The proper scope of section 166 lies at the heart of the present application. Section 166 has not been ‘on the statute book’ for very long but has already generated a body of case law. There are two leading cases. The first is the decision of the Upper Tribunal in Killock and Veale v Information Commissioner; EW v IC and Coghlan (on behalf of C) v IC (“Killock and Veale”) [2021] UKUT 299 (AAC) ; [2022] AACR 4. The second is the decision of Mostyn J in the High Court in R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin) , a judgment recently upheld by the Court of Appeal at [2023] EWCA Civ 1141 (“ R (on the application of Delo”). As will become evident, I am not satisfied there is any significant difference of opinion between these authorities on the proper scope of section 166 . The Upper Tribunal’s decision in Killock and Veale

13. I start with the Upper Tribunal decision, if only because it was first in point of time. Although Killock and Veale concerned what were in effect three joined cases, for present purposes it is helpful to focus on just two of them, being Killock and Veale itself and EW v IC .

14. In Killock and Veale itself, the Commissioner had considered a complaint and undertaken some investigation, but then decided to take the complaint itself no further (although a related but separate investigation continued). The Upper Tribunal treated this discontinuance as the outcome of the complaint and beyond further challenge under section 166 (see in particular paragraph 105).

15. In EW v IC , by contrast, the Commissioner, relying on a misapplication of his own policy, had declined to engage at all with the data subject’s complaint. There had simply been no investigation. The Upper Tribunal ordered the Commissioner to take further appropriate steps to investigate and to respond to the complaint (see paragraph 118).

16. Thus, a key passage in the Upper Tribunal’s decision in Killock and Veale involves an emphasis on the procedural nature of section 166 , which accordingly does not confer a right to challenge the outcome of a complaint to the Commissioner: “ Analysis and discussion

74. The remedy in s.166 is limited to the mischiefs identified in s.166(1) . We agree with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a “remedy for inaction” which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166 , the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals.

75. We do not accept that the limits of s.166 mean that the rights of data subjects are not protected to the extent required by the GDPR or by the CFR. Infringement of rights under data protection legislation is remediable in the courts (ss.167-169 DPA). In addition, if a data subject decides to complain to the Commissioner, s.166 provides procedural protections in order to ensure that the complaint receives appropriate, timely and transparent consideration. The Tribunal as a judicial body has expertise in procedural matters. It is therefore apt for a Tribunal to provide a remedy against procedural failings in complaints handling.

76. The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioner’s regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints.

77. This does not leave data subjects unprotected. If the Commissioner goes outside her statutory powers or makes any other error of law, the High Court will correct her on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals. It does not require us to strain the language of s.166 to rectify any lack of protection or to correct any defect in Parliament’s enactment of the UK’s obligations to protect an individual’s data.”

17. I interpose here that Mostyn J in R (on the application of Delo) (at [130]) “fully” agreed with the opening paragraph 74 in the above passage.

18. The Upper Tribunal then ruled that “the Commissioner’s multifactorial decisions as to the outcome of complaints in the context of the specialist regulatory area of data protection” meant that judicial review was an effective remedy in relation to the substance of complaints (at paragraph 82). The Upper Tribunal further held as follows (the passage in paragraph 87 has been highlighted for reasons that will become apparent): “83. We agree however with Ms Lester’s submission that a s.166 order should not be reduced to a formalistic remedy and that the various elements of s.166(2) have real content in the sense of ensuring the progress of complaints. Parliament has empowered the Tribunal to make an order requiring the Commissioner to take appropriate steps to respond to a complaint ( s.166(2) (a)). Any such steps will be specified in the order ( s.166(3) (a)). Appropriate steps include “investigating the subject matter of the complaint, to the extent appropriate” (s.165(5)(a)).

84. There is nothing in the statutory language to suggest that the question of what amounts to an appropriate step is determined by the opinion of Commissioner. As Mr Black submitted, the language of s.165 and s.166 is objective in that it does not suggest that an investigative step in response to a complaint is appropriate because the Commissioner thinks that it is appropriate: her view will not be decisive. Nor has Parliament stated that the Tribunal should apply the principles of judicial review which would have limited the Tribunal to considering whether the Commissioner’s approach to appropriateness was reasonable and correct in law. In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself.

85. However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts ) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.

86. We do not mean to suggest that the Tribunal must regard all matters before it as matters of regulatory judgment: the Tribunal may be in as good a position as the Commissioner to decide (to take Mr Milford’s example) whether a complainant should receive a response to a complaint in Braille. Nor need the Tribunal in all cases tamely accept the Commissioner’s judgment which would derogate from the judicial duty to scrutinise a party’s case. However, where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may in turn depend on the degree of regulatory judgment involved) and cannot simply substitute its own view.

87. Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2) (a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.

88. The same reasoning applies to orders under s.166(2) (b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome.”

19. The italicised passage in paragraph 87 in the extract above was questioned by Mostyn J in R (on the application of Delo) (at [130]-[131]), as discussed below. This is the only point on which there is any real difference of approach between the authorities. The High Court’s decision in R (on the application of Delo)

20. In terms of the Commissioner’s function of the handling of complaints made by data subjects, Mostyn J observed in R (on the application of Delo) as follows (at [57]) : “The treatment of such complaints by the Commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy.”

21. So far as DPA 2018 section 165 is concerned, Mostyn J concluded as follows (at [85]): “… the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation, and, if so, to what extent. [Counsel for the Commissioner] correctly submits, further, that this discretion properly recognises that the Commissioner is an expert Regulator who is best placed to determine on which cases he should focus.”

22. This approach, of course, is entirely consistent with that of the Upper Tribunal in Killock and Veale .

23. As regards DPA 2018 section 166 , Mostyn J held as follows: “128. Section 166(2) thus provides the "effective judicial remedy" for dilatoriness referred to in Article 78.2. Sections 166(2) and (3) allow the Tribunal to order the Commissioner to take steps specified in the order to respond to the complaint. In my judgment, this would not extend to telling the Commissioner that he had to reach a conclusive determination on a complaint where the Commissioner had rendered an outcome of no further action without reaching a conclusive determination. This is because s.166 by its terms applies only where the claim is pending and has not reached the outcome stage. It applies only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision.”

24. Again, this is essentially on all fours with the decision in Killock and Veale . Indeed, as already noted above, at [130] Mostyn J indicated his full agreement with paragraph 74 of Killock and Veale . However, Mostyn J then identified what “seems to be some back-tracking” in paragraph 87 of Killock and Veale (in the italicised passage highlighted in paragraph 18 above). He added: “131. For my part, if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court. ...”

25. In argument before Mostyn J it was submitted that it was arguable that the claimant’s challenge was not that the Commissioner's substantive decision was wrong on its merits but rather that the Commissioner had failed to adequately determine the complaint (i.e. failed to take appropriate steps to respond to the complaint). That, it was submitted, was a procedural failing of the sort where the appropriate forum for redress is the Tribunal by way of an application pursuant to section 166(2) . It was suggested that the claimant could have asked the Tribunal to take steps such as approaching the data controller for further information and reaching a concluded view on whether it had complied with its data protection obligations. Professor Engelman’s submissions in the present proceedings had echoes of this sort of approach.

26. However, Mostyn J was having nothing to do with such a proposition: “133. In my judgment this is precisely the sort of sleight of hand with which I disagree. The Commissioner's argument seeks to clothe a merits-based outcome decision with garments of procedural failings. The substantive relief sought by the Claimant was disclosure of the documents. The Commissioner's argument is that the Tribunal could have made a mandatory procedural order specifying as a responsive step the disclosure of those very documents. The Court of Appeal’s decision in R (on the application of Delo)

27. Mr Delo’s appeal against Mostyn J’s judgment has subsequently been dismissed by the Court of Appeal. Giving the leading judgment, Warby LJ observed as follows about Article 57.1(f): “60. For present purposes the most striking point about the language of that provision is that it does not contain any words that are redolent of decisions on the merits of a complaint. Article 57 does not adopt any of the familiar ways of designating a decision-making function. We are not told that the Commissioner must (for instance) adjudicate, decide, determine, rule upon, or resolve a complaint, or that complaints must be "upheld" or not upheld by the Commissioner. Rather, we are told that the Commissioner must "handle" a complaint. He must "investigate the subject-matter of the complaint" but even then only "to the extent appropriate". He must "inform" the complainant of the "progress" of the complaint and its investigation and its "outcome".

61. The same points can be made about Articles 77 and 78. Article 77(2) does not state that the data subject who exercises the Article 77(1) right to lodge a complaint is entitled to have the Commissioner adjudicate, or decide, or determine or resolve that complaint. It states that the Commissioner "shall inform" the complainant "on the progress and the outcome" of the complaint. No remedy is identified other than an "outcome". Article 78 does confer a right to an "effective judicial remedy" but it does not say there must be such a remedy where the Commissioner fails to determine the merits of a complaint. The conduct for which Article 78 requires an effective judicial remedy is failure to "handle" the complaint or to "inform" the data subject of its "progress" or "outcome".

62. These are all distinctive and unusual words to use in a context of this kind. As Mr Delo submits, a regulatory scheme usually provides for decisions to be made by the regulator. A dispute resolution mechanism calls for a definitive conclusion of the dispute. But in my view these are points against the interpretation advocated by Mr Delo rather than in favour of it. If this were domestic UK legislation intended to impose on the Commissioner a duty to reach and pronounce a decision on the merits of all complaints lodged by data subjects, in the same way that a court or tribunal would be bound to do if seized of a disputed allegation of infringement, then one would expect to see language of the kind I have mentioned at [60] above. From the perspective of an English lawyer, the absence of any such language and the use of the quite different terminology which I have highlighted are both remarkable features of Articles 57, 77 and 78. Making all due allowance for differences between the legislative methods of the UK and the EU, these are indications – and in my opinion strong ones – that the legislative intent was not to require the Commissioner to determine every complaint on its merits.

63. In my view, contrary to Mr Delo's submissions, the ordinary and natural interpretation of the language used in these provisions is that the Commissioner's principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of "outcome", having first investigated the subject matter "to the extent appropriate" in the circumstances of the case. There are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint.

64. An "outcome" must be the end point of the Commissioner's "handling" of a complaint. A conclusive determination or ruling on the merits that brings an end to the complaint is certainly an "outcome" but that word is intended to have broader connotations. In Killock, the Upper Tribunal decided, in my view correctly, that it embraced a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation. In the present case, Mostyn J held that the word "outcome" is an apt description of the Commissioner's decision to conclude his consideration of Mr Delo's complaint by informing him of the Commissioner's view that the conduct complained of was "likely" to be compliant with the UK GDPR (or, put another way, that the complaint of infringement was "likely" to be ill-founded). Again, I would agree with that.”

28. Warby LJ concluded this part of his judgment as follows: “80. For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.”

29. The Court of Appeal thus approved of the approach of both Mostyn J at first instance in the High Court and the Upper Tribunal in Killock and Veale . The grounds of appeal in this case

30. The grounds of appeal are somewhat diffuse but may be fairly summarised as follows. It is contended that the FTT erred in law because it failed to address its mind to the basis of the Applicant’s complaint to the Commissioner, namely that his personal data was involved and not just that of the patient. It is further argued that the FTT erred in law by applying the wrong legal test to the limits of the Commissioner’s jurisdiction. It is in addition contended that had R (on the application of Delo) been properly applied, the FTT Judge would have concluded that: “5.1. It was not the information of the complainee/Applicant that had been “handled” by the ICO but that of a third-party; 5.2. The ICO could not make recommendations to the Trust because it had not concerned itself with the personal data of the complainee/Applicant; 5.3. The ICO could not ask the Trust to explain how they handled the complainee’s/Applicant’s personal data because the ICO had wrongly excluded it from the ICO’s consideration of the subject matter of the complainee’s/Applicant’s complaint instead focusing upon the Wrong Data Subject; 5.4. The ICO could therefore not take regulatory action as it concerned the complainee’s/Applicant’s person data; 5.5. The ICO Case Officer could not weigh up the facts as they related to the complainee’s/Applicant’s personal data but only that of the Wrong Data Subject a third-party to these proceedings; 5.6. The ICO could not ask the Trust or the complainee/Applicant for further information because the Case Worker had not considered the complainee’s/Applicant’s personal data but that of the Wrong Data Subject; 5.7. Tell the complainee/Applicant of the outcome of the ICO’s considerations. In fact, the ICO expressly refused to do so by its email of 30 August 2022. It refused to consider the complainee’s/Applicant’s personal data electing to only consider that of the Wrong Data Subject; 5.8. The ICO could not take steps to cured [sic] the erasure of the complainee’s/Applicant’s personal data from the Trust database data because the ICO had excluded that personal data from its consideration; 5.9. The ‘outcomes’ contemplated by the ICO website questions could not be triggered because the ICO had excluded consideration of the complainee’s/Applicant’s personal data and therefore in consequence his complaint.” Analysis

31. I am satisfied that I am bound by both Killock and Veale and R (on the application of Delo) . The thrust of the case law and its direction of travel is very clear and cannot be derailed by the fact there is a pending reference to the CJEU in AB v Land Hesse ( Case C-64/22 ). The domestic decisions demonstrate beyond any doubt that the nature of section 166 is that of a limited procedural provision. Professor Engelman argues, however, that section 166 in effect enables Mr Cortes to challenge whether the Commissioner has investigated the subject matter of the complaint to the extent appropriate and thus as a potential failure to take appropriate steps to respond to the complaint (see DPA 2018 s.166(1) (a), (2)(a) and (4)). But this is just another example of the “sleight of hand” identified by Mostyn J in R (on the application of Delo) ; it is an attempt to clothe a merits-based outcome decision with the garments of procedural failings. If the FTT were to order the Commissioner under section 166 to take further alternative steps, in the absence of quite exceptional circumstances such as those in EW v IC , then the outcome of the complaint would necessarily be subject to an impermissible collateral challenge – a challenge that the case law confirms beyond any doubt could only be launched by way of a judicial review.

32. In sum, Article 77.2 provides for an effective judicial remedy where “the Commissioner does not handle a complaint”. Mostyn J ruled that ‘handling’ a complaint includes not acting on a complaint as well as rejecting it (at [68]). Further, Mostyn J acknowledged the very wide scope of the Commissioner’s discretion to handle complaints under section 166 as he thinks best. Indeed, it extended as far as permitting the Commissioner to take no further action on even a non-spurious complaint, a finding echoed by the Court of Appeal. However, in this instance the Commissioner plainly handled Mr Cortes’ complaint, albeit he handled it in a manner and to an end which left Mr Cortes dissatisfied. But the purpose of section 166 is also evident from its heading – it provides for “Orders to progress complaints”, not for “Orders to re-open or re-investigate complaints”.

33. The short answer to Mr Cortes’ case is that his complaint had been progressed to an outcome, and so there was no longer any scope for a section 166 order to bite. As Mostyn J held, section 166 “by its terms applies only where the claim is pending and has not reached the outcome stage” (at [128]; presumably in that passage the word ‘claim’ must be a typo for ‘complaint’). In the same vein, the Upper Tribunal ruled in Killock and Veale that “ s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question” ( Killock and Veale , paragraph 87). As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo) . It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review. Conclusion

34. In conclusion, and despite the attractive arguments and sterling efforts of Professor Engelman, the proposed appeal has no realistic prospects of success on a point of law. I therefore must refuse the application for permission to appeal. Nicholas Wikeley Judge of the Upper Tribunal Signed on the original on 1 December 2023