Tag: Data Protection Act 2018

Simply Put: Compliance Orders Cannot Be Sought Under Simple Procedure

August 4th, 2026

Can an individual who alleges that a data controller has infringed the data protection legislation utilise a simple procedure claim to, in effect, seek an order under section 167 of the Data Protection Act 2018? That was one of several matters addressed by the Sheriff Appeal Court (Sheriff Principal Ross) in a recent appeal involving a father and the General Teaching Council for Scotland.

Background

The appellant (pseudonymised in the court’s opinion to protect the identity of his daughter) complained to the school that his daughter attended. Despite the school addressing the problem about which the appellant complained, it persisted. The appellant became concerned that records had been retrospectively falsified. The appellant reported the teachers to the respondent, the General Teaching Council for Scotland, who are responsible for regulating teachers in Scotland. The respondent began an investigation, but it ceased due to the passage of time and a lack of evidence. The appellant recovered from the school metadata from the school’s IT system and made a further referral to the respondent who deemed it to be frivolous.

The appellant thereafter submitted a request for information to the respondent under the Freedom of Information (Scotland) Act 2002. The respondent declined to comply with the request for information on the ground that it was vexatious. The appellant sought an internal review and then complained to the Scottish Information Commissioner who issued a decision in favour of the respondent.

The appellant then raised a simple procedure claim for the sum of £750. The claim centred on the response to the appellant’s FOI request. The Sheriff held that the data in question was not inaccurate for the purpose of Article 16 of the UK GDPR. The purpose was not to make factual findings about the appellant’s motive, rather it explained the respondent’s decision to refuse the appellant’s FOI request.

The use of Simple Procedure

Simple procedure was introduced to replace two separate processes in the Sheriff Court: small claims and summary cause. It hasn’t totally replaced them, but that is something that isn’t relevant for present purposes. The types of claims that can be raised under Simple Procedure are set out in Section 72(3) of the Courts Reform (Scotland) Act 2014.

The Sheriff who heard the claim considered that the claim was essentially an attempt to challenge the reasons given for refusing the appellant’s FOI request through data protection law. The Sheriff Appeal Court agreed. [14] A Sheriff has no jurisdiction, under simple procedure or otherwise, to interfere with a FOI decision as the legislation makes provision for how such decisions can be challenged. [6] Describing it as an action of payment of money created only a tenuous link with simple procedure. [14]

The appellant’s claim was based on sections 167, 168 and 180 of the Data Protection Act 2018 (not Article 82 of the UK GDPR). An application under section 167 of the Data Protection Act 2018 cannot be made under simple procedure. [19] Nor can simple procedure be used to seek an order under section 168 of the Data Protection Act 2018. [20] Section 170 of the Data Protection Act 2018 does not create a private law remedy for damages or compensation [18] and therefore simple procedure cannot be used. [21]

In essence, the appellant had no remedy for his claim under simple procedure, but even if he did the Sheriff did not err in finding that the personal data concerned was not inaccurate as it accurately recorded an opinion. [27] In essence, even if his claim had proceeded on the basis of Article 82, there would have been no infringement of the UK GDPR. The appeal was refused. [27]

Comment

Claims for damages are available under Article 82 of the UK GDPR or, for processing that falls within the ambit of the Data Protection Act 2018 rather than the UK GDPR, section 169 of the Data Protection Act 2018. If data subjects wish to exercise their right under section 167 of the Data Protection Act 2018 this cannot be done through a simple procedure claim. It is also not possible to effectively seek to challenge a response to a FOI request through a simple procedure claim, the Scottish Parliament has reserved that issue to the Scottish Information Commissioner and thereafter the Court of Session. If a simple procedure claim is going to be used to seek payment of damages, the claim needs to proceed on the basis that it is a claim for damages under Article 82 or section 169. However, if other orders are to be sought under the Data Protection Act 2018 instead of, or in addition to, a claim for damages, those cannot be obtained through a simple procedure claim.

As this is an opinion of the Sheriff Appeal Court it is binding on all Sheriffs and Summary Sheriffs in Scotland.

^{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
Section 166: a continued disappointment for dissatisfied data subjects

January 6th, 2026

In my first blog post of 2026, I return to a subject that I have written about before: section 166 of the Data Protection Act 2018.

Those who frequently look at decisions of the First-tier Tribunal exercising its information rights jurisdiction will be well aware that in 2025 there were a substantial number of applications under section 166 of the Data Protection Act 2018 struck out by the tribunal (and that this is a continuing trend from previous years). The end of 2025 was no exception with a number of such decisions being published over the Christmas and New Year period.

There continues to be a wide-spread misunderstanding by data subjects as to what section 166 provides. Data subjects have a right, under Article 77 of the UK GDPR and/or section 165 of the Data Protection Act 2018, to complain to the Information Commissioner about how a controller has dealt with a request to exercise their rights (most commonly their right of subject access but it could be other rights such as rectification or erasure). In response to such a complaint the Commissioner has an obligation to investigate the complaint “to the extent appropriate” and to inform the data subject about the progress of the complaint, including whether any further investigation is necessary. If the Commissioner does not provide an update or outcome within three months (or at intervals of three months after each update if no outcome has been reached), the First-tier Tribunal has the power, under section 166(2) of the Data Protection Act 2018 to make an order which requires the commissioner to either take appropriate steps to respond to the complaint or to inform, within a period specified in the order, the data subject of the progress of the complaint or of the outcome of the complaint.

Section 166 does not provide a substantive right of appeal against the outcome of such a complaint. It is a procedural jurisdiction only and is concerned with ensuring that data subjects get a final response to their complaint and are kept up to date with the progress of any investigation that the Commissioner deems to be appropriate. The Court of Appeal (England and Wales) determined in R (Delo) v Information Commissioner that the Commissioner is provided with a broad discretion to decide the level of intensity of any investigation and what action, if any, to take in response to such a complaint (including a decision to take no further action in response to a complaint). The terms of section 166 of the Data Protection Act 2018 therefore do not confer a jurisdiction on the First-tier Tribunal to review the decision of the Commissioner similar to that which is conferred on it by section 57 of the Freedom of Information Act 2000.

It is well known in data protection circles that the Commissioner rarely, if ever, takes any formal enforcement action in response to an individual complaint. Indeed, his office rarely, if ever, carries out an investigation of sufficient intensity to, for example, require a data controller to disclose material withheld in response to a subject access request. The Commissioner does have the tools and power to do so; but does not use his resources in that way. It is open to people to agree or disagree with the Commissioner’s approach, and I shall refrain from commenting on that debate in this post.

During the passage of the Data (Use and Access) Act 2025 attempts were made, notably by Liberal Democrat Peer Lord Clement-Jones, to introduce provisions which would have conferred upon the First-tier Tribunal a substantive jurisdiction in relation to data subject complaints. In essence, Lord Clement-Jones’ proposals would have had the effect of transferring the compliance order and compensation jurisdictions from the courts to the First-tier Tribunal. The proposals were not adopted by Parliament.

Data subjects almost never have legal advice or representation when they make applications under section 166 of the Data Protection Act 2018 to the First-tier Tribunal. It is very easy to see how an unrepresented data subject could read section 166 as conferring such a right (especially if they are familiar with the First-tier Tribunal’s role in relation to decisions of the Commissioner made under section 50 of the Freedom of Information Act 2000) and would proceed without knowledge of the existence of key decisions such as Delo and Killock v Information Commissioner.

So, what options are open to a dissatisfied data subject following a complaint to the Information Commissioner (soon to be replaced by the Information Commission)? Well, specifically in relation to the Commissioner’s decision there is the option of judicially reviewing it in the High Court, the High Court in Northern Ireland or the Court of Session depending on where the data subject is located. That is likely to be an unattractive option because judicial review is also concerned with process and procedure rather than a review of the substantive decision; a successful judicial review would most probably only result in the Commissioner’s decision being reduced/quashed and him having to make a new decision exercising his broad discretion. In short, a judicial review is very unlikely to result in a data subject, for example, receiving personal data withheld in response to a subject access request.

The other option doesn’t involve the Commissioner at all and can be taken without even complaining to the Commissioner: to seek a compliance order against the controller under section 167 of the Data Protection Act 2018. Compliance orders can be sought in the Sheriff Court or Court of Session (in Scotland) or the County Court or High Court (in England and Wales or Northern Ireland). The courts can, in response to an application under section 167 perform what might be termed “a full merits review” of the controller’s handling of the request. The courts can specifically order, for example, the disclosure of incorrectly withheld information (in response to a subject access request) or the rectification or the erasure of personal data where that has been incorrectly refused. The Data (Use and Access) Act 2025 has fixed a lacuna that has existed since 2018 making it clear that the courts can require controllers to make available such information as is available to the controller for inspection by the court without it being disclosed to the data subject until after a final determination in favour of the data subject.

Whether either of these solutions are realistic given their costs and, where it is technically possible to get, the availability of solicitors willing to provide legal aid services for such applications is an entirely separate matter on which I shall offer no commentary in this post. Section 167 applications appear comparatively rare; whether that is down to their cost (and the potential for an adverse award of expenses/costs if unsuccessful), a lack of knowledge on the part of data subjects or a combination thereof is not clear.

I suspect that 2026 will continue to see a flow of struck out section 166 applications as data subjects dissatisfied (rightly or wrongly) with the decision of the controller in relation to their request and the outcome of their complaint to the Commissioner continue to seek to challenge those decisions.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
The Data (Use and Access) Act 2025: Implementation Begins

July 28th, 2025

After much procedural back and forth between the House of Commons and the House of Lords, the Data (Use and Access) Act 2025 (“DUAA”) was enacted by Parliament back in June. The vast majority of the DUAA requires to be commenced by way of Regulations made by the Government and so its implementation will happen in tranches. On 21 July 2025, The Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025 were made bringing into force, with effect from 20 August 2025, a number of important provisions of the Act pertaining to data protection. The provisions of the 2025 Act which are coming into force are set out in Regulation 2. There are provisions coming into force on 20 August 2025 which I think deserve particular mention.

Court’s Powers in subject access and data portability cases

The newly inserted section 180A of the Data Protection Act 2018, inserted by section 104 of the DUAA, will be in force from 20 August 2025. This provision relates to proceedings brought in the courts concerning subject access requests under Article 15 of the UK GDPR, section 45 of the Data Protection Act 2018 or section 94 of the Data Protection Act 2018 as well as data portability rights under Article 20 of the UK GDPR . This was a provision that I was surprised was not commenced right away, but it is in the first tranche of provisions to be commenced by way of Regulations.

Section 180A of the 2018 Act will, from 20 August 2025, give courts the power to require a controller to make available to the court, for inspection by it, information which is available to the controller where there is a dispute about whether the data subject is entitled to that information under those data subject rights. It also provides, expressly, that until the substantive question of whether the data subject is entitled to the information has been determined in favour of the data subject, the information made available to the court under this section is not to be disclosed to the data subject or their representatives (including by way of recovery of documents). The court cannot require the controller to carry out a search that is more extensive than the reasonable and proportionate search which the controller would ordinarily be required to carry out.

This provision is important because courts could very well be required to consider whether personal data has been properly withheld and, in the vast majority of situations, they cannot (certainly at first instance) really be expected to do so without seeing the withheld information. Supplying the withheld information to the data subject would defeat the object of the proceedings and so, it cannot really be lodged with the court (at least in Scotland) in the normal way.

Consideration will need to be given as to how these procedures will work in practice to avoid issues arising under Article 6 of the European Convention on Human Rights. If the court is going to be determining issues in relation to material that only it and one other party has seen an issue of fairness arises. There may well, in the future, be an Act of Sederunt setting out a procedure to be followed in the Scottish courts, but whether one will come and whether it will be in place in time for the 20 August 2025 remains to be seen. Controllers who find themselves on the receiving end of a section 167 application which challenges the application of exemptions in the context of a subject access request (and those representing them) will likely need to turn their minds early to whether an order under section 180A will be necessary and, especially in the early days if there is no Act of Sederunt, have suggestions as to how the process can be conducted in a manner that is Article 6 compliant and which does not restrict the principles of open justice any more than is strictly necessary.

Duties of the Information Commissioner in carrying out his functions

Sections 120A, 120B, 120C and 120D of the Data Protection Act 2018 will also be coming into force on 20 August 2025. Section 120A is worth particular mention because it provides that the Commissioner’s principal objective when carrying out his functions under the data protection legislation is to (a) secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and (b) to promote public trust and confidence in the processing of personal data. However, this is somewhat tempered by section 120B where the interests of data subjects, other than children, are completely absent.

Sections 120A, 120B, 120C and 120D, at the time of writing, do not appear on the version of the Data Protection Act 2018 published on legislation.gov.uk and so reference will, for the time being, need to be had to section 91 of the DUAA for the wording of the sections. Hopefully, the version of the Data Protection Act 2018 on legislation.gov.uk will be updated to include these provisions before 20 August. Whether these provisions will have any material impact upon the way in which the Information Commissioner regulates and enforces under the UK GDPR and Data Protection Act 2018 remains to be seen, but I suspect that they will not.

Establishment of the Information Commission

The Information Commission will also formally be established as a body corporate on 20 August 2025. It will not, however, replace the office of the Information Commissioner on that date. The provisions of the DUAA which are coming into force with respect to the Commission are those which establish it, not the assumption of the Commissioner’s powers.

With the Commission being formally established, it will allow the necessary preparatory work to be undertaken to enable the Commission to get into a position whereby it can assume the powers, duties and responsibilities of the Information Commissioner. It will allow, for example, the appointment of non-executive members of the Commission by the Secretary of State under Paragraph 3(2)(b) of Schedule 12A to the Data Protection Act 2018. John Edwards doesn’t need to be appointed separately as Chair of the Commission because he will automatically, by operation of law, be the first Chair of the Commission as the person holding office as Information Commissioner on 19 August 2025 (unless something dramatic happens in the next 3 weeks or so).

Amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003

Some, but not all, of the DUAA amendments in relation to Privacy and Electronic Communications (EC) Directive Regulations 2003 (PECR) are coming into force on 20 August 2025. Regulation 5A(2) will be amended to require notification to the Information Commissioner of personal data breaches under PECR to be made without undue delay “and, where feasible, not later than 72 hours after having become aware of it.” Currently only the “undue delay” requirement appears in Regulation 5A.

^{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
The Data (Use and Access) Bill: Third time’s a charm?

November 12th, 2024
Data Protection reform has been a consistent theme of government policy over the past couple of years. The previous government had two attempts at reforming the law relating to data protection in the form of the Data Protection and Digital Information Bill and then the (cleverly titled) Data Protection and Digital Information (No 2) Bill. The first attempt was abandoned, and the second attempt did not make it through parliament before the general election held earlier this year. The new government is now having its own attempt having introduced into the House of Lords the Data (Use and Access) Bill on 23 October 2024.

For those who were familiar with the proposals in the bills introduced by the previous government, there is a lot in the Data (Use and Access) Bill that is familiar; however, the government is not going ahead with some of the proposals from the previous government and has introduced some of its own proposals for good measure.

Abolition of the Information Commissioner

Potentially the biggest reform within the bill (and one which has carried over from the previous government’s bills) is to replace the Information Commissioner with a body corporate to be known as the Information Commission. Currently, everything in relation to data protection (and everything else that the ICO does) rests in the hands of one person: the Information Commissioner (currently John Edwards).

The model of a single office holder as the regulator has persisted since the introduction of the Data Protection Registrar in the Data Protection Act 1984. Over the years the Data Protection Registrar has evolved into the Information Commissioner as data protection regulation has evolved and the role gained new responsibilities in other areas (such as freedom of information). The previous government considered, and the present government would seem to agree, that the model was no longer appropriate for a regulator of the size of the Information Commissioner’s Office and with the range of functions that the Commissioner has.

Some of the more controversial elements of the previous government’s proposal for the establishment of a new body have not been carried over by the present government. In particular, the proposal to require the regulator to follow a statement of strategic priorities prepared by the Secretary of State has not been carried forward. This was an element of previous proposals that caused concern about the regulator’s independence from the government. However, the Secretary of State will still be responsible for appointing non-executive members of the commission (who, in turn, will be responsible for appointing the executive members of the commission). The Chair of the Commission will be appointed by The King on the recommendation of the Secretary of State. Given the role of the Secretary of State in the appointment of members of the commission, some concerns may remain about the independence of the new commission from the government. The Scottish Information Commissioner, for example, is appointed by The King after nomination by the Scottish Parliament and that method of appointment has been suggested by some in the past as a method of appointment for the UK Information Commissioner (without any success). There may be, as this bill navigates its parliamentary journey, suggestions that that there ought to be more involvement by parliament in the appointment process for members of the new commission.

Legitimate Interests

The proposal to create a list of “recognised legitimate interests” is being carried over into the current government’s bill; however, the list of “recognised legitimate interests’ is not identical to the list in the previous government’s proposals. In particular “democratic engagement” does not feature, as it would have done under the previous government’s proposals. The list of recognised legitimate interests will be subject to amendment by regulations made by the Secretary of State.

Rights of data subjects

The bill contains some minor changes to the rights of data subjects. It will codify the principle that data controllers have an obligation to carry out reasonable and proportionate searches for personal data in response to subject access requests. This implied obligation currently flows from a decision of the Court of Appeal in England and Wales in respect of cases under the (now repealed) Data Protection Act 1998. Decisions of the Court of Appeal are not binding on Scottish courts, even in relation to UK-wide legislation (and there are examples in other fields of the Scottish courts disagreeing with the English and Welsh courts in relation to UK-wide legislation resulting in the Supreme Court having to step in and sort it out), and so placing it on a statutory footing will provide certainty for controllers and data subjects elsewhere in the UK.

Another change of note is a new right of complaint to the controller by the data subject. Currently there is nothing to stop data subjects making a complaint to a controller about a response that they receive to, for example, a subject access request, but there is no legal obligation on the controller to deal with the complaint. Under the proposals in the Data (Use and Access) Bill, controllers would be required to deal with such complaints. This right is in addition to the right to complain to the Information Commissioner and the right to raise court proceedings seeking a compliance order; however, the Bill does not propose making a complaint to the controller a pre-requisite to doing either of those things.

The time for dealing with, for example a subject access request, will explicitly be stopped where further information is required by the controller. Current ICO guidance is that the days between requesting clarification and that clarification being provided do not count towards the time for responding to the request, but it is now proposed to make this the law.

Financial Penalties

The maximum penalty that the Information Commissioner can impose for contraventions of the Privacy and Electronic Communications (EC Directive) Regulations 2003 will be aligned with the maximum financial penalties under the UK GDPR (increasing it from £500,000 to the greater of £17,500,000 or 4% of global turnover). This is not a new proposal, having been carried over from the previous government’s proposals.

International Transfers

The bill will amend chapter 5 of the UK GDPR, which covers transfers of personal data to other countries and to international organisations. The Secretary of State will still be able to make adequacy decisions by way of regulations; however, a new Article 45A will be inserted into the UK GDPR which will provide that the Secretary of State may only make such regulations where they consider that “the data protection test” is met in relation to the transfers covered by the regulations. The test will be met where the protection provided in relation to the processing of personal data “is not materially lower than the standard of protection provided for data subjects” by the UK GDPR and Parts 2, 5, 6 and 7 of the Data Protection Act 2018. This will likely give the government much more flexibility when it comes to making adequacy regulations.

Interview Notices

The proposal to confer a power on the Information Commissioner to compel a person to attend an interview (including where the Commissioner suspects that a criminal offence has been committed) has been carried over into the Data (Use and Access) Bill. It is a power that is unlikely to be used often but adds to the tools available to the Commissioner should his office face any difficulties during investigations.

Significant proposals that are absent from the Data (Use and Access) Bill

The above proposals are just some of those contained within the Data (Use and Access) Bill; however, there are some significant proposals from the previous government that have not been carried over. These include:
- Replacing the Data Protection Impact Assessment with an ‘Assessment of high-risk processing’,
- Limiting the requirement to maintain a Record of Processing Activity to only high-risk processing; and
- The replacement of data protection officers with “senior responsible individuals”.
There is much more to this bill, both in terms of data protection reform and other data use and access matters, and it will now continue its passage through Parliament (its second reading in the House of Lords is on 19 November 2024). It is, of course, probable that there will be amendments to the bill during its passage; however, given that many of the significant proposals have already been the subject of substantial parliamentary consideration, it may well be that there are no significant amendments to it. We are at the early stages of a parliament in which the government has a sizeable majority, so it can be expected that this Bill will complete its parliamentary journey and become law (in whatever final form it takes).

Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.
When no complaint is found

October 3rd, 2022

Section 166 of the Data Protection Act 2018 has produced a reasonable amount of litigation arising out of what appear to be repeated fundamental misunderstandings by data subjects as to what section 166 provides them with. The Upper Tribunal has authoritatively, on more than one occasion, sated that the right afforded by section 166 of the 2018 Act is limited and does not provide a route for an unhappy data subject to appeal the outcome of their complaint to the Information Commissioner.

A recent FTT decision on section 166 took a slightly different approach, striking out the appeal on the grounds that the applicant had not even made a complaint to the Commissioner and so the Commissioner’s obligation to provide information as to the progress of the complaint was not even engaged.

On 25 May 2021, the applicant copied the Information Commissioner’s Office into an E-mail that had been sent to various other organisations. In that E-mail, the applicant raised a number of issues, none of which seem to have engaged the data protection legislation. There was, attached to the E-mail, an annotated copy of an E-mail that she had received days earlier from the Home Office.

On 8 June 2021, a case officer at the ICO wrote to the applicant to inform her that none of the issues she had raised fell within the jurisdiction of the Commissioner and advised her to complete one of the ICO’s complaint forms if she wished to raise a complaint under the data protection legislation.

The Commissioner argued that as no valid complaint had been made to his office there was no complaint to progress and therefore the application under section 166 of the Data Protection Act 2018 had no reasonable prospect of success.

Judge O’Connor agreed with the Commissioner and concluded that there was no reasonable prospect that the applicant could establish the contrary. Therefore, the application was dismissed. Judge O’Connor did go on to state that even if he was wrong on this, the Commissioner’s letter dated 8 June 2021 was a response and so the Tribunal would have had no jurisdiction under section 166 of the Act in any event.

This case is rather different to the usual section 166 cases that have been seen until now. It suggests that the Information Commissioner is taking a robust approach to what is and what is not a complaint. It has been the case for many years that the ICO would not typically respond to E-mails where they have simply been copied in. The Tribunal appears to be willing, at least in this case, to conclude that no complaint in terms of Article 77 of the UK GDPR or section 165 of the Data Protection Act 2018 has been made to the Commissioner where that is appropriate, and strike out section 166 applications which follow on the back of correspondence not amounting to a proper complaint.

Tag: Data Protection Act 2018

Simply Put: Compliance Orders Cannot Be Sought Under Simple Procedure

Section 166: a continued disappointment for dissatisfied data subjects

The Data (Use and Access) Act 2025: Implementation Begins

The Data (Use and Access) Bill: Third time’s a charm?

When no complaint is found