Application to Challenge ICO Decision Struck Out by First-tier Tribunal

NCN: [2026] UKFTT 00947 (GRC) Case No. FT/EA/2026/0186/GDPR In the First-tier Tribunal (General Regulatory Chamber) Information Rights Before: Judge Worth Appellant: [APPELLANT] (formerly trading as AP Dairies Ltd) Respondent(s): Information Commissioner Case Management Directions (The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009) It is ordered:- 1. The time for lodging this application is retrospectively extended to the date it was received, namely 13 May 2026.

2. The time for the Appellant to reply to any strike out application is, pursuant to rule 5(3)(a) of the of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 can be found online at https://www.gov.uk/courts-tribunals/first-tier-tribunal-general-regulatory-chamber (now referred to at the “GRC Rules”) reduced to coincide with the date on which his reply was filed and served.

3. The application is STRUCK OUT, pursuant to rule 8(3)(c) of the GRC Rules. REASONS 1. This Tribunal is concerned with an application for a Section 166 Order to Progress made about ICO reference number IC-461234-P0Y4.

2. The underlying issue is about Aviva Insurance and its handling of data. I note that any actions taken by Aviva Insurance in respect of events in December 2022 only came about because someone permitted an uninsured driver to use a vehicle. Had that not happened, there would have been no accident, no claim and no complaints about Aviva Insurance.

3. On 07 October 2025 In the GRC3 Form it is stated that the complaint was made on 07 March 2025, that appears to be a typo by the person completing the GRC3 form ; this date is taken from the ICO’s Response at paragraph 27 ; it is noted that the records (Annex 1 to the Response) records the complaint as lodged at 00:07 on 07 October 2025 [NAME] filed with the ICO a complaint about data handling at Aviva Insurance and the Financial Conduct Authority (FCA) that complaint included mention of the following legal entities: a. AP Dairies Ltd (a company) b. [NAME] (an individual) c. [NAME] (an individual) It also mentions a [NAME] as the owner of the email address used.

4. On 24 March 2026, the ICO declined to investigate; the copy of that communication provided as Annex 2 does not appear to have a reference number. On 26 March 2026 the ICO sent another communication (with the reference of IC-416234-P0Y4) to [NAME]: they still declined to make further investigations. Further responses (again with the reference number and declining to investigate) were provided to [NAME] on 02 April 2026 and 07 May 2026. 5. [NAME] (acting on behalf of [APPELLANT], the Appellant) lodged a GRC3 with the Tribunal by email sent on 12 May 2026.

6. As a matter of fact, the GRC3 Application was lodged out of time; time having expired on 05 May 2026 as that was the date 6 months plus 28 days from the date of the complaint (07 October 2025).

7. Standard directions were issued on 14 May 2026 and the ICO provided a response to the application which also sought strike out under rule 8(2)(a) and/or rule 8(3)(c). Those directions gave the ICO until 11 June 2026 to respond and make any application to the application and the Appellant a further 14 days to reply to the response and/or any application.

8. The ICO’s response was, on 11 June 2026 sent to the Tribunal and [NAME] along with a GRC5 application for strike out. [NAME] sent a reply to the response and strike out application on 12 June 2026 (copied to the ICO).

9. Both parties have consented to consideration without a hearing, the Applicant in their GRC3, the ICO in their CMQ.

10. I consider it appropriate to deal with this strike out application without a hearing; I also consider it appropriate to take [NAME]’s reply as all he wishes to say on behalf of the Applicant and, accordingly, formally shorten the date for reply.

11. I find that [NAME] is seeking a substantive review of the decision, it is the only conclusion I can reasonably draw. [NAME] was told that the ICO (partly due to lack of clarity about who owned the policy of insurance) was declining to investigate. I can see that a document has been provided to the Tribunal I know not whether it was previously sent to the ICO which appears to show that there may have been an individual who held a policy with Aviva, but I note that it records: This may be the same person as is named as Applicant in this Application, but the first names are spelled differently.

12. It seems, from correspondence with the Financial Ombudsman Service, that the complaint to them was made by a corporate entity (they refer to “an employee of A, who was driving one of its vehicles at the time”, emphasis added). There remains a lack of clarity as to whose data was held by Aviva: an individual’s or a company’s.

13. I consider that, collectively (and for some, individually) the 4 letters detailed above sent to [NAME] fully explain why the ICO declined to investigate any complaint about the handling of [APPELLANT]’s personal data by Aviva Insurance.

14. Whilst I can see that [NAME] is very aggrieved by Aviva Insurance’s actions; he has received an outcome from the ICO and that is what [APPELLANT] is entitled to under section 166 of the Data Protection Act 2018 . Signed: Judge Worth Date: 19 June 2026