Kennaugh v Information Commissioner: section 166 DPA 2018 cannot be used to challenge the merits of a complaint outcome

In Keith Kennaugh v The Information Commissioner [2026] UKFTT 648 (GRC), the First-tier Tribunal (General Regulatory Chamber) has dismissed a section 166 Data Protection Act 2018 application, confirming once again that the provision is a narrow procedural remedy and cannot be deployed to challenge the substantive outcome of a complaint already concluded by the Information Commissioner (IC).

The case arose from a complaint made to the IC in June 2023 concerning West Yorkshire Combined Authority (WYCA). The applicant, Mr Kennaugh, objected to WYCA's "Unreasonable Behaviour" policy, under which correspondence from individuals deemed unreasonable is routed to a single point of contact, effectively preventing direct communication with the mayor, deputy mayor, or other staff. Mr Kennaugh sought a copy of the decision deeming him unreasonable, together with any supporting evidence and records of processing his personal data. WYCA responded that no such records were held.

Following sustained engagement between the IC's case officers and WYCA's Data Protection Officer — including telephone calls, forwarded correspondence and multiple updates to Mr Kennaugh — the IC issued an outcome on 20 June 2024 concluding that WYCA had provided an appropriate response and that no further action was warranted. A confirmatory response followed on 10 July 2024. Mr Kennaugh applied to the Tribunal in August 2024 under section 166(2), contending that the IC had not taken appropriate steps and had failed to engage meaningfully with his complaint.

Judge Harris found that the responses of 20 June and 10 July 2024, taken together, plainly constituted an outcome to the complaint. The IC had investigated, liaised with WYCA and reached a considered conclusion. That the applicant disagreed with the outcome did not render it unlawful.

The judgement rehearses the now well-established line of authority governing section 166 applications. Drawing on Killock v Information Commissioner [2022] 1 WLR 2241, R (Delo) v Information Commissioner [2023] EWCA Civ 1141 and Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC), the Tribunal reiterated that section 166 confers only a procedural jurisdiction. The Tribunal may order the IC to take steps to progress a complaint or to provide information about its progress or outcome — nothing more. It has no power to direct the IC to investigate in a particular way, to take enforcement action, or to determine whether a breach of UK GDPR has occurred. Challenges to the adequacy of the IC's reasoning or the merits of its conclusions belong in the High Court by way of judicial review.

The applicant's suggestion that the IC had accepted WYCA's account uncritically and been influenced by an adverse view formed in earlier, unrelated proceedings was characterised by the Tribunal as a rationality or bias challenge — precisely the kind of argument appropriate for judicial review rather than a section 166 application. The Tribunal also noted that compliance orders against a data controller should be pursued through civil proceedings under section 167 in the County Court or High Court.

One procedural observation merits attention. The Tribunal noted that where an investigation has been concluded, there is no ongoing matter to progress and therefore no section 166 remedy available at all. Signposting an applicant to a procedural route that is not open to them would itself be inappropriate.

The judgement is a clear reminder that dissatisfaction with how the IC has exercised its broad regulatory discretion — or with the outcome it has reached — is not, of itself, a ground for a section 166 order. Where a complaint has received an outcome, the proper avenue is judicial review.