Katherine Bishop v The Information Commissioner

1. This is an application for an order to progress a complaint made to the Information Commissioner (“the Commissioner”). The Commissioner’s case reference number is IC-331062-X1B2.

2. The parties opted for a paper determination of the application. The Tribunal is satisfied that it can properly determine the issues without a hearing in accordance with rule 2 and rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009 (as amended). Factual background

3. The initial Subject Access Request that led to this application was made to Wirral University Teaching Hospital NHS Foundation Trust (“the Trust”). The request and response

4. The Applicant made a Subject Access Request to the Trust in writing on 25 July 2024, which stated “I would like to request access to the security, CCTV and body-worn camera footage held by the Trust about me for 4 th April 2023”. Other documents indicate that the relevant date of the footage was, in fact, 04 April 2024.

5. On 31 July 2024, the Trust acknowledged the request and asked for additional information relating to the footage that was sought by the Applicant.

6. On 05 August 2024, the Applicant provided additional information about the footage that was sought, and what she was wearing to enable her to be identified in the footage.

7. On 04 September 2024, the Applicant sent an email to the Trust in which she stated that “it is now one month since this date, and therefore the subject access request should be complete”.

8. The Trust responded to the Applicant on 05 September 2024 to state that they were still looking into the request and that they would be back in contact with her shortly. The complaint to the Commissioner and response

9. On 05 September 2024, the Applicant lodged a complaint with the Commissioner, stating that she had not received a response from the Trust in relation to her request to obtain personal information from them.

10. The Commissioner responded to the Applicant in writing on 20 January 2025, using case reference number IC-331062-X1B2. The response stated as follows: “As a regulator our aim is to improve information rights practices within organisations. We do this by taking an overview of all concerns that are raised about organisations with a view to improving their compliance with the UK General Data Protection Regulation (UK GDPR) The law says we must investigate data protection complaints to an appropriate extent. We will put most of our effort into dealing with matters we think give us the best opportunity to make a significant difference to an organisation’s information rights practices. Depending on the circumstances, we will decide whether or not to take action against the organisation and what form our action will take. We do this by taking an overview of all concerns that are raised about that organisation with a view to improving their compliance with the data protection framework. Our decision will not affect your ability to enforce your rights through the courts. The ICO will keep a record of your complaint and the organisations actions. We use the information gathered from complaints to build a picture of an organisations data protection practices. No further action is being taken at this time however, your concern will be kept on file and this will help us over time to build a picture of Wirral University Teaching Hospital NHS Foundation Trust information rights practices”.

11. The Commissioner also emphasised that he was the regulator of UK data protection legislation, and not an ombudsman. If the Applicant was seeking personal redress or compensation for the way in which an organisation had dealt with her personal data, then the Commissioner indicated that she would need to pursue that independently through the courts, or with an industry’s own ombudsman or regulatory body.

12. The Applicant emailed the Commissioner on the same day, 20 January 2025, stating as follows: “I’m sorry, but, You cannot simply refuse to take action against GDPR breach. That is your role. Please provide justification for why you are refusing to take action against this? I have met all your requirements – I made a formal SAR to the Trust, I chased them repeatedly for a response and left ample time for them to answer. They have refused to release my personal data. This is something you are charged with taking action against”.

13. On 21 January 2025, the Commissioner wrote to the Applicant stating “I note that the organisation responded to you on 5 September saying they would respond to you, but you did not allow them time to respond before submitting your complaint to us. We suggest allowing an organisation one month to respond to complaints. The Commissioner also stated that “the outcome in this case is that we have logged your complaint, but will only keep a record of it at this stage”.

14. On 25 January 2025, the Applicant submitted a new complaint about the same issue, namely her concerns that the Trust had not provided copies of her personal data as requested.

15. On 25 January 2025, the Commissioner sent a further email to the Applicant, confirming that they had received her complaint. The Commissioner indicated that, due to a high volume of complaints, it was taking approximately 16 weeks to assign new complaints. The Commissioner outlined that one of their case officers would look into the complaint and would notify the Applicant of the outcome. Application to the First-tier Tribunal

16. The Applicant lodged her GRC3 form on 17 September 2025. She provided the chronology of her interactions with the Trust, highlighting that she had not received any response at all from the Commissioner following her new complaint that was submitted on 25 January 2025. She stated that there was a “clear breach of process not to update me or issue an outcome”.

17. In relation to the outcome sought, the Applicant stated that “I would like the Tribunal to order the ICO to take appropriate steps to respond to my complaint, by way of investigating the breach of GDPR by Wirral NHS Trust”. Response to the application on behalf of the Commissioner

18. The Commissioner filed his response on 29 October 2025. The Commissioner applied for the Tribunal to strike out the application on the basis that it was submitted out of time. If the application was not struck out on that basis, then the Commissioner also applied for it to be struck out pursuant to rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009 (“the Rules”) and / or rule 8(3)(c) of the Rules on the grounds that the Tribunal had no jurisdiction to consider the application and / or that the application had no reasonable prospect of success.

19. The Commissioner made the following submissions: a. Section 166 is a procedural remedy only, and cannot be used to interrogate the substance of the outcome; b. That the Commissioner has a very broad discretion as to how he investigates complaints and there is no constraint upon that discretion; c. Once an outcome has been provided, the ability to find that an appropriate step had been omitted is limited; d. Section 166 cannot be used as a back door remedy, where the data subject should pursue either a direct action against the controller or alternatively via judicial review proceedings where there is a public law complaint against the Commissioner’s decision.

20. The Commissioner submitted that the Tribunal has no jurisdiction to determine the application as the Commissioner had previously sent an outcome to the Applicant on 20 January 2025. In addition, the Commissioner asserted that there was no reasonable prospect of persuading the Tribunal to make any form of order pursuant to section 166(2) of the Data Protection Act 2018 (“the DPA”) as the Commissioner had already provided an outcome to the complaint on 20 January 2025.

21. The Commissioner’s Response further stated that: a. The grounds in support of the application indicated that the Applicant did not agree with the outcome of her complaint. However, section 166 of the DPA does not provide a mechanism by which an Applicant can challenge the substantive outcome of a complaint; b. The Commissioner had taken steps to investigate and respond to the complaint and had provided an outcome to the Applicant’s complaint on 20 January 2025. As such, there was no basis for the Tribunal to make an order under section 166(2) of the DPA.

22. In conclusion, the Commissioner stated that “In all the circumstances, it is submitted that the Application should be struck-out as having been filed out of time, alternatively the Tribunal has no jurisdiction to consider the Applicant’s application and / or it has no prospect of success, and that the Tribunal is invited to either strike out the application under either rule 8(2)(a) / and or 8(3)(c) of the Tribunal Rules”.

23. The Commissioner stated that, notwithstanding their application for a strike out, the ICO’s Public Advice Data Protection Complaints Services team would look at the new complaint by the end of that week and would acknowledge this to the Applicant. The Applicant’s Reply to the Commissioner’s Response

24. The Applicant filed her Reply to the Commissioner’s Response on 05 November 2025.

25. In relation to the application being made out of time, the Applicant stated that she suffered from a disability which had impacted the rate at which she could undertake administrative processes. She provided medical evidence in support of her request to extend the time limit for submission of her application.

26. The Applicant opposed the application for a strike out and made the following submissions: a. That the Commissioner failed to take ‘appropriate steps’ by failing to conduct any investigation at all into the breach of UK GDPR prior to issuing its outcome of 20 January 2025; b. That the Commissioner had failed to conduct any investigation following the Applicant highlighting to the Commissioner that he was in breach of his legal obligations, on the false premise that the Trust had not had sufficient time to respond to the Subject Access Request; c. That the Commissioner failed to take ‘appropriate steps’ by failing to conduct any investigation and / or by failing to inform the Applicant about progress in relation to her complaint dated 25 January 2025; d. That no outcome had ever been issued by the Commissioner in response to the complaint dated 25 January 2025; e. That the Commissioner himself had already admitted to the Applicant that there had been a failure to respond to the complaint dated 25 January 2025.

27. In relation to the question of jurisdiction, the Applicant submitted that the application – namely an application to consider procedural failures by the Commissioner to progress the Applicant’s complaint – did fall within the jurisdiction of the Tribunal. Further, the Commissioner had already admitted to procedural failings in relation to the Applicant’s complaint and therefore it could not be said that the application had no reasonable prospect of success. Subsequent communications

28. On 30 October 2025, the Commissioner wrote to the Applicant, under case reference IC-331062-X1B2, apologising for the delay in responding further to the data protection complaint about the Trust. The Applicant was asked to confirm whether she had received any further correspondence from the Trust since 05 September 2024 and was informed that, once a response was received to that query, the Commissioner would then contact the Trust in relation to the matter.

29. The Applicant emailed the Commissioner in response on the same date. She stated that the Commissioner had continuously erred in rejecting her complaint and again provided copies of the communications that she had had with the Trust. She confirmed that she had not received any further correspondence from the Trust since September 2024.

30. On 31 October 2025, the Commissioner sent a further email to the Applicant, using reference number IC-331062-X1B2, in which it was stated that the Commissioner had intended to progress the complaint following the further correspondence from the Applicant on 25 January 2025 but that, due to an administrative oversight, that had not taken place. The Commissioner indicated that they had contacted the Trust to ask for further information about the Applicant’s complaint and their information rights practices.

31. On 26 November 2025, an updated outcome was provided to the Applicant in writing by the Commissioner. The Commissioner stated that, in their view, the Trust had infringed their data protection obligations by failing to provide a response and a copy of the Applicant’s personal data to the SAR of 25 July 2024 within the legislative framework of one month. The Commissioner indicated that the Trust had confirmed that they had now responded to the SAR, providing a redacted copy of the footage that had been requested. As the Trust had now fully responded to the SAR, the Commissioner was not requiring them to take any further action in relation to the specific data protection complaint. However, the Trust had been asked to review their data protection policies, procedures and staff training for handling SARs to ensure that staff could recognise, refer and respond to SARs fully within the legislative timeframe in the future.

32. On 26 November 2025, the Applicant emailed the Commissioner and the Trust. She stated that she had received the body-worn camera footage, but that CCTV footage also existed which had not been released and in respect of which no exemption had been given.

33. On 26 November 2025, the Commissioner contacted the Applicant and informed her that her follow-up queries and requests relating to the SAR had been passed on to the Trust and that they (the Trust) had been asked to respond directly to the Applicant.

34. On 13 January 2026, the Applicant sent an email to the Commissioner in which she stated that the Trust had ignored her request for the CCTV footage which had been part of her Subject Access Request, and stated that action by the Commissioner was required.

35. On 21 January 2026, the Commissioner wrote to the Applicant in response to her email of 13 January 2026. The Commissioner stated that it had considered her concerns and provided an outcome to the complaint on 26 November 2025. They had also followed up with the Trust following the Applicant’s further query to the Trust on the same date. The Commissioner stated that, whilst they had logged that the Applicant remained concerned about the case, the Commissioner did not deem it to be an appropriate or proportionate use of their resources to take any further action in relation to the matters raised.

36. On 23 January 2026, the Applicant sent an email to the Commissioner and to the Trust. She stated that, in addition to the CCTV footage which had not been supplied, there was additional body-worn camera footage which had also not been supplied. The Applicant requested that the information that she had requested in her Subject Access Request be provided to her, or that she be informed of any exemption that was being relied upon for refusing her request. She stated that, if she did not receive a response within fourteen days, she would commence legal proceedings against both the Trust and the Commissioner.

37. On 28 January 2026, the Commissioner wrote to the Applicant, reiterating that they had closed the case as the Trust had previously confirmed to them that they had provided the Applicant with a copy of the personal data held within the footage to which she was entitled. The Commissioner reiterated that he did not deem it to be an appropriate or proportionate use of his resources to take any further action in relation to the matters raised by the Applicant.

38. The Tribunal has been provided with a further GRC3 application submitted by the Applicant, dated 04 February 2026. The Applicant states that “In the Trust’s response to my complaint about events on 4 th April 2023, they make 5 separate references to the CCTV about me which they have reviewed. They have therefore clearly withheld personal data which they hold about me, having confirmed they have the data and yet directly ignored the instructions of the ICO to release it, and to communicate with me. The ICO are obliged to act in such an instance of DPA 18 breach”. The Applicant also states that she wants the Tribunal “to make an order requiring the Commissioner to take appropriate steps to respond to my complaint, by way of issuing an enforcement notice to the Trust”. The Tribunal takes the view that this is a new application by the Applicant, which the Trust has not had the opportunity to respond to, and it therefore falls outside of the scope of this case. Case management directions

39. Case management directions were issued by Tribunal Judge Harris on 03 December 2025. Tribunal Judge Harris refused the Commissioner’s application for a strike out of the Applicant’s case, stating that it would be premature to strike out the case on the basis that an outcome had been provided or that the application had no real prospect of success when it appeared from the Commissioner’s email to the Applicant on 30 October 2025 that the investigation into the complaint was ongoing.

40. Tribunal Judge Harris gave permission for the Applicant to submit her application out of time and made directions for the progression of the case. Legal Framework

41. A data subject has a right to make a complaint to the Commissioner if they consider that the processing of personal data relating to them infringes the UK General Data Protection Regulation (“the UKGDPR”) and / or Parts 3 and 4 of the DPA.

42. Section 165 of the DPA reads as follows: 165 Complaints by data subjects (1) Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject’s right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR. (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act . (3) …… (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must – (a) take appropriate steps to respond to the complaint, (b) inform the complainant of the outcome of the complaint, (c) inform the complainant of the rights under section 166 , and (d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes – (a) investigating the subject matter of the complaint, to the extent appropriate, and (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with a foreign designated authority is necessary. (6) ….. (7) …..

43. Section 166 of the DPA reads as follows: 166 Orders to progress complaints (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner – (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on application by the data subject, make an order requiring the Commissioner – (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order. (3) An order under subsection (2)(a) may require the Commissioner – (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order. (4) …..

44. In Scranage v Information Commissioner at paragraph 6, the Upper Tribunal stated: [2020] UKUT 196 (AAC) “... there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1) , which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus……The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three month period in which the Commissioner is still considering the complaint.”

45. In Leighton v the Information Commissioner (No.2) [2020] UKUT 23 (AAC) , Upper Tribunal Judge Wikeley said (at paragraph 31): “ Section 166 is directed towards providing a tribunal-based remedy where the Commissioner fails to address a section 165 complaint in a procedurally proper fashion. Thus, the mischiefs identified by section 166(1) are all procedural failings. “Appropriate steps” means just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant”.

46. Section 166 of the DPA is therefore a procedural remedy only. An application pursuant to section 166 of the DPA is not concerned with the merits of the underlying complaint, and nor is it intended to provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint. It follows that the Tribunal only has jurisdiction to consider a procedural failure by the Commissioner to progress an individual’s complaint concerning an infringement of their rights pursuant to data protection legislation.

47. The Commissioner has a broad discretion to decide whether to investigate a complaint at all and, if so, to what extent. In R (on the application of Ben Peter Delo) and the Information Commissioner [2022] EWHC 3046 (Admin) at paragraph 80, the Warby LJ held: “…I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint”.

48. The Tribunal does not have the power to alter a conclusion reached by the Commissioner in relation to a complaint. Further, the Tribunal does not have an oversight role over the Commissioner’s exercise of his functions or internal processes. It has been recognised by the Upper Tribunal that the Commissioner is in the best position to consider the merits of a complaint and to reach a conclusion on its outcome (see James Killock & Michael Veale & others v the Information Commissioner [2021] UKUT 299 (AAC) ).

49. In the case of Delo at paragraph 64, Warby LJ stated: “An “outcome” must be the end point of the Commissioner’s “handling” of a complaint. A conclusive determination or ruling on the merits that brings an end to the complaint is certainly an “outcome” but that word is intended to have broader connotations. In Killock, the Upper Tribunal decided, in my view correctly, that it embraced a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation”. The role of the Tribunal

50. The Tribunal’s remit is governed by section 166 of the DPA. This requires the Tribunal to consider whether there has been a procedural failure by the Commissioner to progress the Appellant’s complaint concerning an infringement of their rights under data protection legislation. Evidence

51. We read and took account of an open bundle containing 98 pages including indexes. Discussions and conclusions

52. The Commissioner’s position was that his communication to the Applicant, dated 20 January 2025, was “an outcome” within the meaning of section 166 of the DPA and that, by providing such an outcome, the Commissioner had complied with his statutory duty. The stated outcome was that a record would be kept of the complaint and that, whilst no further action would be taken, the concern raised by the Appellant would be kept on file to assist in building up a picture of the practices of the Trust in relation to information rights. The response on 20 January 2025 was provided under reference IC-331062-X1B2.

53. It is clear from the above authorities that, where the Commissioner has dealt with a complaint by arriving at and informing the Applicant of some form of “outcome”, having first investigated the subject matter to the extent appropriate in the circumstances, that neither of the remedies in section 166(2) and (3) of the DPA can apply because those remedies are directed to steps or actions that have already been taken – even where the outcome is to take no further action, or where an outcome was provided late.

54. However, in this case, we are not satisfied that the Commissioner’s response of 20 January 2025 amounted to “an outcome” for the purposes of the legislation. After the Applicant submitted a further complaint on 25 January 2025 relating to the same issue, the Commissioner contacted her by letter and indicated that the complaint would be actioned as soon as possible, albeit that the waiting time for the allocation of new complaints was in the region of 16 weeks. There is no reference number on the email from the Commissioner to the Applicant.

55. The Commissioner then sent a letter to the Applicant, dated 28 October 2025, giving the reference number that related to the original complaint, namely IC-331062-X1B2. In that correspondence, the Commissioner apologised for the delay “in responding further to your data protection complaint about the Trust”. The Commissioner outlined the concern raised by the Applicant, namely about how the Trust handled her Subject Access Request of 25 July 2024, and asked for clarification as to whether the Trust had responded further to the Applicant.

56. On 31 October 2025, the Commissioner sent a further letter to the Applicant, in which he stated “We had intended to progress your complaint further following your further correspondence of 25 January 2025. However, due to an administrative oversight on our part this did not happen”. The Commissioner indicated that they had contacted the Trust to ask for further information about the Applicant’s complaint and their information rights practices. Again, the reference number of the initial complaint, namely IC-331062-X1B2, was given by the Commissioner.

57. On 26 November 2025, an updated outcome was provided to the Applicant in writing by the Commissioner in which he concluded that the Trust had infringed their data protection obligations by failing to provide a response and a copy of the Applicant’s personal data to the SAR of 25 July 2024 within the legislative framework of one month. The reference on the updated outcome was IC-331062-X1B2, as before.

58. We therefore conclude that “an outcome” was not provided by the Commissioner until 26 November 2025. We take the view that the complaint remained under investigation / open from the date of the initial complaint on 05 September 2024 until its resolution on 26 November 2025. We reach this for the following reasons: a. The reference number that was used by the Commissioner on all key correspondence, including the updated outcome on 26 November 2025, corresponded to the reference number for the initial complaint; b. The letter from the Commissioner on 28 October 2025 referred to the delay in providing a ‘further’ response to the complaint raised by the Applicant against the Trust; c. The letter from the Commissioner on 31 October 2025 clearly indicates that there had been a failing to progress the complaint following the Applicant’s correspondence on 25 January 2025. We take the view that the wording of the letter supports the contention that the Commissioner was treating the complaint as one continuous complaint, rather than separate or new complaints.

59. We therefore conclude that the Commissioner failed to provide the Applicant with information about the progress of her complaint, or of the outcome of the complaint, before the end of the period of three months beginning when the Commissioner received the complaint (namely 05 September 2025) in breach of section 166(1) (b) of the DPA.

60. However, we are satisfied that the Commissioner has now taken appropriate steps to respond to the complaint, and has informed the Applicant of the outcome of the complaint.

61. As such, no further steps are required to be taken by the Commissioner. Conclusion

62. The Tribunal takes no action on the application as the Applicant received a final outcome to her complaint on 26 November 2025.