Challenging an ICO Decision: When the Tribunal Can (and Can't) Help with Your Data Protection Complaint

NCN: [2026] UKFTT00950 (GRC) Case No. FT/EA/2026/0155-GDPR In the First-tier Tribunal (General Regulatory Chamber) Information Rights Before: Judge Mornington Appellant: [APPELLANT] Respondent: Information Commissioner Determined on the papers Decision given on: 25 June 2026 Decision:

1. The Appeal is struck out. REASONS 2. This is an application made by [APPELLANT] on 21 April 2026 under s.166(2) of the Data Protection Act 2018 (the “DPA 2018”) for an order requiring the Information Commissioner (“IC”) to take appropriate steps to respond to a complaint made by [APPELLANT] in respect of his complaint to the Commissioner in relation to the conduct of ADD Accountancy Ltd (“ADD”) and to “force the offending party to cease breaching the Data Protection Act” .

3. On 20 May 2026 the Information Commissioner responded to the Notice of Appeal and proposed a strike out of the Application on the grounds that the Tribunal does not have jurisdiction to consider the application and/or that the application in its current form has no prospects of success.

4. The Information Commissioner states that a case officer has finalised the Commissioner’s investigation into the Appellant’s complaint against ADD and that an outcome was provided to the Appellant on 24 March 2026 in which the Commissioner had decided not to take a more detailed investigation. The Commissioner explained the reasons for the outcome were that this appeared to be an isolated incident with no meaningful ongoing impact and that no factors such as wider impact or alignment with ICO strategic priorities had been identified that would support a more detailed investigation.

5. The Commissioner submits that there is no order that the Tribunal can make under s.166 DPA 2018 because, as a matter of law, this remedy is procedural and cannot be used to change the substantive outcome of a complaint. The Commissioner submits that it has taken steps to investigate and respond to the complaint and provided an outcome to the Applicant’s complaint on 24 March 2026. It has therefore taken steps to comply with the procedural requirements set out in section 166(1) of the DPA 2018.

6. The Commissioner opposes the application in its entirety and seeks to have it struck out pursuant to rules 8(2)(a) and/or (3)(c) of the Rules on the basis that the Tribunal lacks jurisdiction to make the orders sought and/or because the application does not have a reasonable prospect of success.

7. The Appellant submitted on 22 May 2025 and on 9 June 2026 that his appeal ought not to be struck out on the basis that his appeal raises a substantive and arguable complaint that the Commissioner failed to comply with the statutory duty to take “appropriate steps” to investigate under the Data Protection Act 2018 . He contends that there was clear evidence of an ongoing infringement of the UK GDPR affecting not only himself but more than 200 individuals, including material provided before the Commissioner’s decision which was not addressed. In particular, he maintains that the Commissioner failed to pursue obvious lines of enquiry, such as contacting a third party capable of providing corroborative evidence and thereby committed a procedural failure going directly to the adequacy of the investigation.

8. Against that background, the Appellant submits that the Tribunal has jurisdiction to consider whether the Commissioner discharged his investigative obligations and that the appeal cannot be said to have no reasonable prospect of success. Accordingly, he contends that neither limb of the strike - out application is made out and that the case should proceed to determination on its merits. Legal Framework 9. Under Rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers it does not have jurisdiction in relation to the proceedings or that part of them; and does not exercise its power under rule 5(3)(k)(i) (transfer to another court or tribunal) in relation to the proceedings or that part of them.

10. Under Rule 8(3)(c) of the Rules, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers there is no reasonable prospect of the Applicant’s case, or part of it, succeeding.

11. Section 165 DPA sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under section 166 DPA a data subject can make an application to this Tribunal for an order as follows: 166 Orders to progress complaints (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner - (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner - (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

12. The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1) (a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.

13. Judge Scherbel-Ball sets out a detailed and diligent review of the relevant case law in the Tribunal’s decision in John Evans v Information Commissioner [2025] UKFTT 1057 (GRC) (“Evans”) and I repeat the same in paragraphs 14 to 26 below.

14. The scope of the Tribunal’s jurisdiction under s.166 of the DPA 2018 have been subject to judicial scrutiny in a number of appellate cases in recent years. These decisions include (i) R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2024] 1 WLR 263 (CA) (“Delo CA”) (ii) Killock & Veale & Others v Information Commissioner [2022] 1 WLR 2241 (“Killock”), (iii) Smith v Information Commissioner [2025] UKUT 74 (AAC) (“Smith”). Delo CA and Killock were also considered by a decision of the FTT in Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) (“Mahmood”) albeit that decision is not binding on this Tribunal and predates the Upper Tribunal’s decision in Smith.

15. We consider that the following core principles can be derived from these authorities when the Tribunal is considering its jurisdiction and discretion as to whether to make an order under s.166(2) of the DPA 2018:

16. First, s.166 is a “forward-looking provision” concerned with remedying ongoing procedural defects that stand in the way of a timely resolution of a complaint by a data subject to the Commissioner. It is not the role of the Tribunal when considering an application under s.166 to assess or challenge the merits of an outcome which has already been given by the Commissioner. That is a matter for the supervisory function of the High Court on an application for judicial review. Accordingly, the focus of the Tribunal is on procedural omissions – Killock at [74], [75] and [87], Smith at [136].

17. Second, the scheme of the legislation does not require the Commissioner to determine every complaint on its merits. Rather, the Commissioner’s principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of “outcome” - Delo CA at [62] – [64] and [80].

18. Third, the “outcome” must be the end point of the Commissioner’s handling of a complaint. A conclusive determination or ruling on the merits will be an “outcome” but the term is intended to have broad scope. Therefore an “outcome” will also include (i) a decision not to investigate further and to cease handling a specific complaint while informing and assisting wider investigation, (ii) a conclusion by the Commissioner that a data controller had “likely” complied with its obligations under the relevant data protection legislation without reaching any final conclusion and taking no further action - Delo CA at [64] and [80], Smith at [47].

19. Fourth, the outcome will have been reached after the Commissioner has investigated the complaint “to the extent appropriate” in the circumstances of the case. The legislation provides the Commissioner with a broad discrection to decide the intensity of any investigation according to the circumstances of the case - Delo CA at [66] and [80].

20. Fifth, the Commissioner also has secondary obligation to inform the complainant of the progress of the investigation and of the complaint – Delo CA at [63].

21. Sixth, where a complainant has received an outcome, there may still be circumstances where it is appropriate for the complainant to ask the Tribunal to “wind back the clock” and order an appropriate step being taken in response to a complaint under s.166(2) (a). However, these circumstances will be limited. In particular, the Tribunal will “firmly resist” attempts either to use such a mechanism to achieve a different complaint outcome or attempts to “dress up” a substantive merits challenge as procedural failings for the purposes of s.166 – Killock at [87], Smith at [60] and [136].

22. Seventh, the question of what amounts to “appropriate steps” is not determined by the IC and the IC’s view is not decisive in this regard. The question of appropriateness is for the Tribunal to decide itself. Accordingly, the Tribunal must decide for itself, applying an objective test what is “appropriate” by way of investigation and not merely review the Commissioner’s decision as the High Court would on an application for judicial review. The Tribunal should therefore expressly direct itself to consider whether, applying an objective test, it was appropriate for the Commissioner to take further steps to respond to a complaint – Killock at [74], [84] and [116], Smith at [84] – [85].

23. Eighth, when considering the appropriateness of the steps taken by the Commissioner, the Tribunal will nevertheless take into account and give weight to the views of the Commissioner as the expert regulator. A decision of the Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal. However, in so doing, the Tribunal must not tamely accept the Commissioner’s position in such a way to derogate from the judicial duty to scrutinise a case - Killock at [85] – [86].

24. Ninth, examples of where there may be a justified reason for the Tribunal to make an order to “wind back the clock” under s.166(2) include (i) where the Commissioner has failed to take appropriate steps to investigate a complaint at all because it has failed to apply its own Service Standards – Killock at [117] or (ii) where the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complaint as a result of oversight or other mistake – Smith at [61].

25. Tenth, the Tribunal always retains a discretion whether to make an order under s.166(2) . It is not obliged to do so even if there has been a procedural failing by the Commissioner – Killock at [117].

26. Eleventh, any order made under s.166(2) should not be reduced to a formalistic remedy. The Tribunal has the power to make an order requiring the Commissioner to take appropriate steps to respond to a complaint, which can include investigating the subject matter of the complaint to the extent necessary – Killock at [83]. The steps which a Tribunal can prescribe, where appropriate, include directing the Commissioner to make contact with the data controller to understand its position and considering in light of any such responses whether the data controller’s actions were lawful – Killock at [118].

27. In Scranage v Information Commissioner [2020] UKUT 196 (AAC) , paragraph 6 the Upper Tribunal noted that “there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal is procedural rather than substantive in its focus." (emphasis in original). Conclusions 28. The Tribunal finds that the Commissioner has provided a response and outcome to the complaint on 24 March 2026.

29. Contrary to the expectations of many Applicants, section 166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits. The Tribunal is bound to take into consideration and give weight to the views of the Commissioner, as described by the Chamber President in Barbara Rogers v ICO EA/2021/0348: ’14…In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively: Killock & Ors v Information Commissioner [2021] UKUT 299 . The obligation of the Commissioner is to take appropriate steps to respond to the complaint’.

30. Part of the Applicant’s original application sought a remedy which this Tribunal does not have the power to grant, namely, to force the offending party to cease breaching the Data Protection Act and the other part of the remedy sought was to order the IC to take appropriate steps to respond to the complaint.

31. It is clear to the Tribunal that the Applicant is not satisfied witht he outcome of the IC and is looking for the IC to take further steps to arrive at a different decision, thereby challenging the substantive outcome of the complaint to the IC. The Tribunal does not have the power under section 166 to consider the merits or substantive outcome of a complaint.

32. Section 166 is limited to procedural issues and specifically allows the Tribunal to make an order requiring the Commissioner (a) to take appropriate steps to respond to the complaint. The IC took steps to consider, investigate and respond to the complaints. It decided that a further, more detailed investigation was not appropriate, and the Tribunal gives weight to the IC’s decision as expert regulator.

33. The Tribunal only has the power to order the IC to take steps to respond. In this case, the IC has responded.

34. For these reasons, the Tribunal finds that the IC has not failed to comply with the procedural requirements set out in section 166(1) of the DPA. The Tribunal therefore finds that there is no reasonable prospect of the appeal or any part of it succeeding. The proceedings are therefore struck out. Signed: Judge Mornington Date: 19 June 2026