Doug Paulley v Information Commissioner

1. This case concerns the handling of a complaint made on 24 July 2025 to the Respondent in relation to a third party’s refusal of a rectification request that the Applicant had previously made. The Applicant lodged a Notice of Appeal dated 14 January 2026 with the Tribunal seeking an order under s. 166 of the Data Protection Act 1998 to require the Respondent to take “appropriate steps to investigate the complaint” including (but not limited to) a number of specific actions regarding the examination of particular issues flagged by Applicant.

2. The Respondent applied on the 26 January 2026 for the case to be struck out on the basis that the Tribunal has no jurisdiction to consider the Applicant’s application (under Rule 8(2)(a)) and/or that the Applicant’s application has no prospect of success under Rule 8(3)(c) of the relevant Tribunal Rules.

3. The Applicant made written submissions in response to the strike out application on the 27 January 2026. In summary these submissions argue that the Tribunal does have jurisdiction under s.166 in this case, that the challenge concerns a procedural failure not a challenge to a substantive outcome, and the Respondent has unlawfully fettered their discretion.

4. Section 166 of the DPA 2018 provides the Tribunal with a narrow power that is explicitly limited to the supervision of procedural matters rather than substantive ones. The Upper Tribunal in the judgment of Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC) stated at [74] that “[i]t is plain from the statutory words that, on an application under s.166 , the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals”

5. Section 166 does not provide any power for considering or reviewing the substance of any decision made by the Commissioner. Even where s.166 is engaged, the powers of the Tribunal are limited to procedural ones, such as requiring the Commissioner to take appropriate steps to provide the required notification. Even as regards what such ‘appropriate steps’ are the Commissioner benefits from a very wide discretion with caselaw confirming that this even “allows the Commissioner to decide, after investigating a complaint to a limited extent, that no further action should be taken” whether the complaint is spurious or not (see paragraphs 66 and 70 of R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin) ). It is established that neither s.165 nor s.166 of the DPA 2018 require the Commissioner “determine the merits of complaints” (See para 60 of Smith v Information Commissioner ). [2025] UKUT 74 (AAC)

6. Furthermore, there is a significant difference between cases where the Commissioner has provided an ‘outcome’ and ones where the ‘outcome’ is still pending. An outcome is a conclusive determination that marks the end of the Commissioner's handling of the relevant complaint (See para 60 of Smith v Information Commissioner ). [2025] UKUT 74 (AAC)

7. Where an outcome has been provided the scope of s.166 is necessarily much more limited. As noted in Killock at para 87 “ s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate "steps to respond" and not with assessing the appropriateness of a response that has already been given (which would raise substantial Regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question”.

8. This position has since been reinforced by the case of Delo at the High Court in para 130 where it was ruled that “if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court”.

9. Once an outcome has been issued there is no power for the Tribunal to seek to order the Respondent to take some ‘appropriate step’ retrospectively especially where such a step could lead to a substantive change in outcome. The appropriate forum for challenging whether steps taken to investigate the complaint were appropriate or whether relevant evidence was considered or taken into account as regards cases where an outcome has been provided is Judicial Review in the High Court.

10. The Respondent provided a substantive outcome to the Applicant’s complaint on the 14 January 2026. In that communication the Respondent set out its role and the investigation of the complaint it had carried out. It explained the legal position regarding accuracy in relation to subjective opinions and noted that no further regulatory action would be taken other than the retention of a record of the complaint.

11. Consequently, though the Applicant may not like the outcome, there can be no question that the complaint has not been responded to. Contrary to the Applicant’s assertion the Respondent’s issuing of an outcome makes their actions “unreviewable”, they are very much reviewable before the High Court. The Applicant also sought to argue that their challenge was to an “absence of investigation” however from the documents before me such an assertion is completely untenable. Whilst the Respondent may not have conducted the investigation the way the Applicant wanted or would have done, there are no grounds to argue that no investigation took place nor that no investigation of the appropriate level took place given the wide discretion given to the Respondent.

12. At the core of the dispute is a fundamental misunderstanding by the Applicant of how both the duty to maintain accurate data and the right of rectification work as a matter of law in relation to opinion information. The Applicant does not agree with the inevitable outcome that legal position produces in the context of their own particular circumstances and so has sought to craft procedural failings arguments as a sleight of hand to seek to change the ultimate outcome decision by the Respondent.

13. If the Applicant contests the legality and or reasonableness of the Respondent’s actions as regards the now completed process of this complaint, then the correct forum is the High Court.

14. If the Applicant wishes to seek to enforce a rectification claim against the third-party controller this must be done by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA 2018.

15. In light of the above there is no reasonable prospect of the Applicant being able to successfully argue that the Tribunal should make an order pursuant to the power found in s.166(2) DPA 2018. Because the procedure for dealing with the complaint is complete and the substantive content and outcome of the Respondent’s investigation is out of scope. It is therefore ordered that this case is struck out under Rule 8(3)(c). Signed: Judge T Barrett Date: 2 February 2026