Wayne Leighton v The Information Commissioner

Background

2. The applicant made an information request on 8 September 2025 to the Information Commissioner (the Commissioner). His request for information related to a previous complaint to the Commissioner (the first complaint) with reference IC-260448-C2N2. He sought information provided to the Commissioner by British Transport Police. The appellant’s request was acknowledged on 9 September 2025 and was allocated the reference IC-424816-H4Y9.

3. On 16 September 2025, a case officer responded to the request. The applicant was informed that it had been treated as a subject access request. The case officer explained that the requested information had been withheld under section 132 of the Data Protection Act 2018 (the DPA). That is because the information had been provided to the Commissioner for the purposes of carrying out his regulatory functions and he did not have lawful authority to disclose it. The Commissioner noted that it is an offence to disclose information in breach of section 132 .

4. The applicant requested an internal review on 17 September 2025.

5. On 25 September 2025 the case officer responded and explained that as the request was handled as a subject access request, there was no right to an internal review, but that the applicant could made a complaint to the Commissioner’s Office as the regulator. It does not appear that the applicant in fact made a complaint following the case officer’s email of 25 September 2025. Instead, the applicant submitted a GRC1 notice of appeal dated 5 October 2025. He contended that the Commissioner had misused section 132 of the DPA and that he is in fact entitled to the information under the DPA. The remedies he sought were ‘disclosure and penalties’. He states in his GRC1 that the decision he is challenging is the Commissioner’s correspondence dated 16 September 2025, i.e. the response to his subject access request.

6. Directions were issued to the parties on 11 November 2025. The applicant was put on notice that given his information request was treated as a subject access request which was refused under section 132 of the DPA, it was unclear as to the basis on which the application sought to appeal to the tribunal.

7. The directions referred the applicant to section 165 of the DPA which sets out the right of an individual to complain to the Commissioner about infringement of their rights under data protection legislation; and to section 166 which sets out the conditions that must be satisfied for the tribunal to make an order and the nature of the orders the tribunal can make.

8. The applicant was directed to make written submissions setting out the basis on which he says the tribunal has jurisdiction to hear his appeal. The Commissioner was directed to respond, and the applicant was given the opportunity to reply.

9. On 11 November 2025 the applicant emailed the tribunal stating that he had lodged an appeal and not an application under section 166 of the DPA. He made more detailed submissions on 19 November 2025. Having sought and obtained an extension of time to respond, the respondent made an application to strike the proceedings out on 14 January 2026. There is no record before me of any further reply from the applicant. The law

10. A detailed summary of the relevant law is set out in the Commissioner’s response and is not repeated in full here. A summary of the relevant law and principles is as follows: (i) Section 132(1) of the DPA provides that the Commissioner must not disclose information which has been obtained by or provided to the Commissioner in the course of or for the purposes of discharging the Commissioner’s functions, unless the disclosure is made with lawful authority. Section 132(2) sets out the limited circumstances in which disclosure will be with lawful authority and section 132(3) provides that it is an offence to knowingly or recklessly disclose information in contravention of subsection (1). (ii) Section 165 of the DPA provides for a an individual to complain to the Commissioner if they consider that there is an infringement of the UK GDPR and or Parts 3 or 4 of the DPA. (iii) Section 165(4) sets out the steps the Commissioner must take if he receives a complaint under subsection (2). They include investigating the complaint; informing the complainant about progress of the complaint and informing them of the outcome of the complaint. (iv) Section 166 of the DPA provides for an individual to make an application to the First-tier Tribunal for an order requiring the Commissioner to take appropriate steps. Subsection (1) sets out the circumstances in which the tribunal may make an order; and subsection (2) sets out the orders the tribunal may make. (v) An application under section 166 is not concerned with the merits of the relevant complaint and does not provide a right of challenge to the substantive outcome of the Commissioner’s investigation into the complaint. (vi) The phrase ‘appropriate steps to respond to the complaint’ required by section 166(1) means simply that. The Commissioner is not required to reach an appropriate outcome or to resolve the complaint, merely to respond to it. (vii) The Commissioner has broad discretion as to how he investigates complaints and is the expert regulator. The tribunal does not have an oversight role over the Commissioner’s exercise of his functions or his internal processes. The Commissioner’s view carries weight but is not necessarily determinative. (viii) It is for the tribunal to decide, applying an objective test, if an ‘appropriate step’ has been omitted, but in practice that is unlikely to be the case where an outcome has been issued. That is because section 166 is procedural and cannot be used effectively as a back door route to obtaining a remedy that should be pursued by making a claim against the data controller or by judicial review of the Commissioner. The Commissioner’s application for strike out

11. It is the Commissioner’s position that because the applicant’s information request was treated as a subject access request, there was no right for him to seek an internal review, and that the applicant’s appropriate course of action was to complain to the Commissioner as the regulator.

12. The Commissioner’s position is that he acknowledged the applicant’s complaint; took appropriate steps to investigate the complaint; and provided the applicant with an outcome to the complaint on 16 September 2025. The Commissioner submits that he complied with the procedural requirements set out in section 166(1) of the DPA and accordingly there is no basis on which the tribunal can make an order under section 166(2).

13. The Commissioner notes that the applicant is clearly dissatisfied with the outcome of his complaint but relies on the established case law that section 166 does not provide a mechanism by which an individual can challenge the substantive outcome of a complaint. The Commissioner concluded by noting that should the applicant wish to seek an order of compliance against the controller for breach of his data rights, the correct route for him to do so is by way of separate civil proceedings in the County Court or the High Court under section 167 of the DPA. The appellant’s submissions

14. In his submissions dated 19 November 2025, the appellant contends that the Commissioner has failed to investigate the subject matter of his complaint. He contends that ‘responding to the complainant’ is not the same as investigating the subject matter of the complaint. He submits that the appropriate steps for the Commissioner to have taken would have been to issue an enforcement notice under section 149 of the DPA or to seek further information by issuing an information notice under section 142. The applicant relies on sections 2 and 115(2) of the DPA and submits that the Commissioner has failed to discharge his duties under those provisions.

15. The applicant seeks to make a distinction between ‘responding to the complainant’ and ‘responding to the complaint’, which he asserts are not the same thing. Consideration

16. The underlying matter to which this application relates is the applicant’s request for information made to the Commissioner. His request was treated as a subject access request because he sought complaint to the Commissioner about how he handled his subject access request. His request for information was refused on the basis that the information was obtained by or provided to the Commissioner in the exercise of his functions, i.e. investigating the first complaint and that he did not have lawful authority to disclose the information. The applicant was dissatisfied with that response and so requested an internal review.

17. The Commissioner’s email dated 25 September 2025 makes it clear that the applicant did not have a right of review, and that if he was dissatisfied with the response to his subject access request, he could make a complaint to the Commissioner. There is no indication that the Commissioner agreed to treat the applicant’s request for an internal review as a complaint, and I find that he did not do so. There is no evidence before me of any further correspondence from the applicant to the Commissioner after the email dated 25 September 2025. I therefore reject the Commissioner’s submissions that he took appropriate steps to respond to the applicant’s complaint. This is because based on the information and evidence before me, I find that the applicant did not in fact make a complaint to the Commissioner. Instead, he lodged a notice of appeal with this tribunal seeking to challenge the Commissioner’s decision dated 16 September 2025.

18. Section 165 provides for the right for an individual to make a complaint and what the Commissioner must do once a complaint has been made. Given that I have found that the applicant did not make a complaint, the Commissioner was not required to take any steps pursuant to section 165(4) of the DPA. Given that the Commissioner was not required to take any steps, the applicant cannot demonstrate that any of the conditions in section 166(1) is satisfied. Section 166 does not provide a mechanism for the applicant to challenge the outcome of his subject access request. Accordingly, there is no order the tribunal can make.

19. The tribunal does not have jurisdiction to consider this application, and the appeal is struck out pursuant to rule 8(2)(a) of the Procedure Rules. Signed J K Swaney Date: 6 March 2026 Judge J K Swaney Judge of the First-tier Tribunal