First-tier Tribunal Rules on Data Protection Complaints: When Can You Challenge the Information Commissioner?
📌 Em resumo
A person asked the First-tier Tribunal to force the Information Commissioner (IC) to take further action on their data protection complaint. However, the Tribunal decided it couldn't hear the case. It ruled that the IC had already given an 'outcome' to the complaint, and the Tribunal's role is only to check if the IC followed the correct process, not to decide if the IC's decision itself was right or wrong. The case was therefore 'struck out'.
⚖️ Tese Jurídica
The First-tier Tribunal's jurisdiction under section 166 of the Data Protection Act 2018 is limited to procedural failings by the Information Commissioner in responding to a complaint, and does not extend to challenging the substantive merits or outcome of the Commissioner's decision.
📖 O que diz a lei
This section allows individuals to complain to the First-tier Tribunal if they believe the Information Commissioner has not handled their data protection complaint properly. This case clarified that the Tribunal's power under this section is limited to reviewing *how* the Commissioner handled the complaint (procedural failings), not *whether* the Commissioner made the right decision on the merits of the complaint itself.
Ver o texto da lei
Orders to progress complaints to the Commissioner 166 1 This section applies where, after a data subject makes a complaint under section 165 ..., the Commissioner— a fails to take appropriate steps to respond to the complaint, b fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or c if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information durin…
This rule gives the Tribunal the power to stop an application if it decides it does not have the legal authority (jurisdiction) to hear that type of case. In this instance, the Tribunal used this rule because it concluded it did not have the power to review the substance of the Information Commissioner's decision.
This rule allows the Tribunal to stop an application if it believes the application has no real chance of succeeding. The Tribunal applied this rule because, given its limited jurisdiction, the data subject's request for the Commissioner to 'progress' a complaint that already had an outcome was deemed to have no prospect of success.
Explicação em linguagem simples — não substitui orientação de um advogado.
📖 Resumo técnico
The First-tier Tribunal struck out an application under DPA 2018 s.166(2) for an order to progress a data protection complaint, finding it lacked jurisdiction and had no reasonable prospect of success, as the Information Commissioner had already provided an 'outcome' to the complaint.
📜 Ementa Documento oficial
The First-tier Tribunal (General Regulatory Chamber) struck out an application by a data subject under section 166(2) of the Data Protection Act 2018, seeking an order for the Information Commissioner to progress their complaint against a data controller. Judge Harris found that the Tribunal lacked jurisdiction under Rule 8(2)(a) and that the application had no reasonable prospect of success under Rule 8(3)(c). The Tribunal's reasoning was that the Information Commissioner had already provided an 'outcome' to the complaint, as defined by relevant case law, and the Tribunal's powers under section 166 are limited to addressing procedural failings by the Commissioner, not challenging the substantive merits of their decision to take no further action. The data subject's application for costs against the Commissioner was also refused.
📚 Inteiro teor Documento oficial
Neutral citation number: [2026] UKFTT 00828 (GRC) Case Reference: FT/EA/2026/0013/GDPR First-tier Tribunal (General Regulatory Chamber) Information Rights Decided without a hearing Original decision issued 9 June 2026 Decision given on: 23 June 2026 Before JUDGE HARRIS Between [APPELLANT] Applicant and THE INFORMATION COMMISSIONER Respondent Decision:
1. The Application is struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with it and under Rule 8(3)(c) because there is no reasonable prospect of it succeeding.
2. The Applicant’s application for costs against the Respondent is refused.
3. As the proceedings are at an end, all existing case management directions are superseded by this decision and cease to have effect. REASONS 1. These proceedings concern an application (the “Application”) under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) for an order to progress the Applicant’s complaints against Indeed (“Indeed”) regarding his concerns about Indeed’s processing of data, in particular messaging data. The complaint was submitted to the Information Commissioner (“IC”) on 10 June 2025 and was dealt with under reference IC-399857-V4W4.
2. On 9 January 2026, the IC’s case officer wrote to the Applicant. In that communication, the case officer advised that no further action would be taken, and that they would hold onto the information provided by the Applicant, in order to keep both a record of the complaint and to build a picture of Indeed’s data protection practices.
3. On the same date, the Applicant responded and complained that the response did not amount to an outcome and asked the case officer to recuse himself from further involvement in the consideration of his complaint.
4. On 12 January 2026, the IC wrote again to the Applicant. which again stated that no further action would be taken on the Applicant’s complaint.
5. On 16 January 2026, following the Applicant’s complaint, the IC’s reviewing officer conducted a review. The review upheld the previous decisions to take no further action and confirmed that the reviewing officer had reviewed all of the documentation provided and came to the view that Indeed were processing messaging data appropriately and had a lawful basis for such processing as outlined within their privacy policy. The Application 6. The Applicant applied to the Tribunal by way of form GRC3 dated 9 January 2026. He stated that the outcome he was seeking was as follows: “ an order that the IC to progress my complaint and/or reach an outcome pursuant to section 166 of DPA 2018”.
7. In his grounds for the Application, the Applicant stated: “The IC has failed to progress my complaint or reach an outcome pursuant to section 165 of DPA 2018; and the time to do so has expired.” The strike-out application 8. The IC applied by way of form GRC5 dated 27 January 2026 to strike out the Application on the basis that the Tribunal has no jurisdiction to consider it under Rule 8(2)(a) and/or that there is no reasonable prospect of it succeeding under Rule 8(3)(c) (the “strike-out application”).
9. The reasons which the IC gave for striking out the application were set out in its Response. In summary, these were as follows: a. Although at the time the Application was made by the Applicant, the Tribunal may have had jurisdiction to consider the application, the IC’s correspondence of 9, 12, and 16 January 2026 together comprise an outcome to the Applicant’s complaint for the purposes of section 165(4) of the DPA18 (see Lord v Information Commissioner [2025] UKFTT 1381 (GRC) at [29]). Accordingly, there are no further appropriate steps that can be ordered for the Commissioner to take in response to the complaint and the ability of the Tribunal to determine that an appropriate step has been omitted is therefore limited (see Smith v Information Commissioner [2025] UKUT 74 (AAC) at [60]). b. Further, an application under section 166 of the DPA18 permits a Tribunal to make an order against the IC only if he has failed in some procedural respect. In this case, it is the IC’s position that no procedural error has taken place. An outcome has been provided to the Applicant, when all of the relevant correspondence sent by the IC are considered together, which makes clear that the IC had concluded that Indeed (i) processed the messaging data correctly, (ii) explained the lawful basis for such processing, and (iii) explained the circumstances when they would be acting as either the processor or the controller. Accordingly, the IC having considered Indeed’s explanations, had come to the view that no further action was warranted on the complaint. This firmly falls within the definition of an outcome provided by the Court of Appeal as identified in Delo . c. the IC has provided a statutory compliant outcome in response to the Applicant’s complaint. The IC considered the material provided, made an assessment concerning the substance of the complaint, and concluded that Indeed’s processing was compliant with data protection legislation, and that no further action would be taken on the complaint, together with using that information gathered during the complaints process in order to not only build a picture concerning an organisation’s data protection practices, but to also inform future regulatory interventions. d. The IC has taken appropriate steps to investigate and respond to the Applicant’s complaint and has provided an outcome to him. Accordingly, it is respectfully submitted that the IC has complied with the procedural requirements set out in section 166(1) of the DPA18, and there is therefore no basis for the Tribunal to make an order under section 166(2) DPA18. e. it is unclear whether the Applicant still maintains the view that no outcome has been provided. However, as set out above, section 166 of the DPA18 does not provide a mechanism by which Applicants can challenge the substance of outcome to the complaint. The relief available from the Tribunal on an application under section 166 of the DPA18 only applies where it is satisfied that the IC has failed in some procedural respect to comply with the requirements of section 166(1) of the DPA18, limited solely to those orders that are set out in section 166(2) . There are no such procedural lapses by the IC on the facts of this case. f. If the Applicant wishes to seek an order of compliance against the data controller for any alleged breach of his data protection rights, the correct route for him to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.
10. The Applicant provided a Reply to the Response dated 26 January 2026, which deals with the strike-out application as well as the substantive response, so I am satisfied that the Applicant has had an opportunity to make representations on the proposed striking out under rule 8(4). The points made by the Applicant, in summary, were as follows: a. The central issue is not whether the IC articulated a view on the complaint, but whether the IC complied with its statutory duty under section 165 DPA 2018 at the time the decision under challenge was taken. The duties under section 165 must be complied with before a complaint is closed or disposed of. b. The premise that the IC’s statutory duty under section 165 can be retrospectively satisfied by correspondence post-dating the Application is not supported by the statutory scheme. c. The Applicant wishes the Tribunal to determine whether or not the IC complied with its procedural obligations under section 165 at the material time. Legal framework 11. Section 165 DPA 2018 sets out the right of data subjects to complain to the IC about infringement of their rights under the data protection legislation. Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows: “Orders to progress complaints (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner - a. fails to take appropriate steps to respond to the complaint, b. fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or c. if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner - d. to take appropriate steps to respond to the complaint, or e. to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.” 12. The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1) (a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166 . It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.
13. Section 165 deals with the complainant’s right to make a complaint and states that: “(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a)take appropriate steps to respond to the complaint, (b)inform the complainant of the outcome of the complaint, (c)inform the complainant of the rights under section 166 , and (d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a)investigating the subject matter of the complaint, to the extent appropriate, and (b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with foreign designated authority is necessary.” 14. In the case of Killock v Information Commissioner [2022] 1 WLR 2241 , the Upper Tribunal at paragraph 74 stated - " …It is plain from the statutory words that, on an application under section 166 , the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."
15. Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327 , paragraph 57 - " The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination... ”.
16. Mostyn J’s decision in Delo was upheld by the Court of Appeal ( [2023] EWCA Civ 1141 ) – “ For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint .” (paragraph 80, Warby LJ).
17. The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo confirmed that the nature of section 166 is that of a limited procedural provision only. “ The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33).
18. The case of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC) , noted at paragraph 60 that “ it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an appropriate step has been omitted is limited.” I n considering this the Tribunal must, as set out in paragraph 85 of Killick “when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator.” 19. Paragraph 85 of Killick reads as follows: “ However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.” Request for an oral hearing 20. I originally made this decision on 2 June 2026 (the “Decision”). The Applicant applied by way of form GRC7 dated 12 June 2026 to set aside the Decision. The application gave the following reasons: “ The decision was made without a hearing. The Applicant had previously requested an oral hearing…The decision does not address or determine the Applicant’s request for an oral hearing. On 8 June 2026, the Applicant made a GRC5 application seeking disclosure and information concerning [the Application]. The decision was issued on 9 June 2026 without determining that application. The Applicant also notes that case management directions dated 11 May 2026 remained in force at the time the decision was issued. The decision does not address the status of those directions.” 21. The Applicant, when completing his form GRC3, stated that he was content for the Application to be determined without a hearing. Subsequently, on 12 May 2026 he wrote to the Tribunal saying that he no longer wished the matter to be determined without a hearing and requested an oral hearing. However, this request for a case management direction was not made by form GRC5 in accordance with the Practice Direction on use of forms.
22. The relevant part of the Applicant’s email read as follows: “In particular, the Applicant is concerned that the present procedural record appears to contain inconsistencies and assumptions that are not readily apparent from the directions previously served on the parties. The Applicant has also sought clarification from the Tribunal regarding references to procedural obligations which do not appear in the earlier Case Management Directions served in this matter. The Applicant respectfully submits that the combined consideration of the strike out application and the costs application now raises issues of procedural fairness and procedural chronology which would be more appropriately addressed at an oral hearing. Further, rule 32(1) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 provides that the Tribunal must hold a hearing before disposing of proceedings unless each party consents to determination without a hearing and the Tribunal is satisfied that the issues can properly be determined on the papers. While rule 32(3) permits strike out matters to be disposed of without a hearing, the present proceedings also involve the Applicant’s Rule 10 costs application which is being considered together with the strike out application. The Applicant respectfully submits that, in light of the procedural developments that have arisen during the course of the proceedings, an oral hearing would assist in ensuring procedural fairness, clarifying the procedural history, and addressing any misunderstandings or inconsistencies in the procedural record prior to determination of the applications .” 23. It appears that there was a minor procedural irregularity in this case, in that the Legal Officer who carried out the first Legal Review of the case on 11 May 2026 made reference at direction 1 to the fact that no completed case management questionnaire had been completed by the Applicant. This arises from the fact that there is a different set of standard directions for applications under section 166 and the Legal Officer had wrongly assumed that the other set of standard directions (which does provide for a case management questionnaire) had been issued. This assumption was strengthened by the fact that the IC had submitted a CMQ in this case. This was an error, but there were no practical or procedural consequences which flowed from this so there was no prejudice to the Applicant as a result. I have dealt with this procedural irregularity by setting aside the erroneous direction.
24. The costs decision was not a decision which disposed of proceedings, so there was no requirement for this to be dealt with at an oral hearing. The application for costs was not made on form GRC5, and did not specify whether or not a hearing was requested for that application.
25. Rule 32(4) permits disposal of a strike out application without a hearing. However, in light of the wish expressed by the Applicant in his email dated 12 May 2026, I did consider at the time of making the Decision whether there was a need to hold an oral hearing in order to determine the strike out application and thus the Application. 26. . The reasons given by the Applicant in his email dated 12 May 2026 for wanting an oral hearing included that he was concerned about a direction given on 11 May 2026 which commented on him not having filed a case management questionnaire, when he contended that he had not been requested to do so. He considered that an oral hearing was required partly because he was now making a costs application and partly because of potential misunderstandings as to procedure which he felt needed to be corrected before any decision was made.
27. I considered that the reasons set out in the email dated 12 May 2026 did not demonstrate that an oral hearing was required to determine the strike out application justly and fairly, because the reasons given did not concern the strike out application at all or raise issues which were relevant to the merits of that application. I also considered that these reasons did not demonstrate that there was a substantial dispute of fact or need for oral evidence in order to determine the strike out application. I took into account the fact that the Applicant had filed a reply to the Respondent’s response which also dealt with the strike out application so had made representations, and the fact that the Applicant had filed some supplemental documents in support of his position, which I also considered. Accordingly, I concluded that it was fair and just to proceed to determine the strike out application on the papers, taking into account the overriding objective, particularly ensuring, so far as practicable, that the parties are able to participate fully in the proceedings.
28. However, although I had considered the need for an oral hearing, I accept that it was a procedural irregularity not to deal in the decision with the reasons why I considered it was fair and just to proceed without an oral hearing. I have therefore set aside the Decision under Rule 41 and re-made it with amended reasons to include this explanation. Discussion and conclusions - the strike out application 29. The first question is whether the IC provided an outcome to the Applicant’s complaint. The IC provided the Applicant with a response to his complaint on 9 January 2026, with a further response on 12 January 2026 and an additional response after review on 16 January 2026. I consider that the response dated 9 January 2026 was in fact an outcome to the complaint within the meaning set out in Delo , because it provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint.
30. Even if I am wrong on this, I am satisfied that when taken together with the responses dated 12 and 16 January 2026, these responses have provided an outcome to the Applicant’s complaint, provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint. This is sufficient in my view to demonstrate that the IC has complied with the requirements of section 165(4). The fact that the Applicant does not agree with the outcome does not render it wrong in law.
31. The Applicant argues in his Reply that the duties under section 165 must be complied with before a complaint is closed or disposed of and cannot retrospectively be satisfied after that point. There is no time limit in the wording of section 165 and the Applicant has not pointed to any case law which supports his position. The only time limit in section 166 appears in section 166(1) which sets out the pre-conditions for an order under section 166 , one or more of which must be met. To imply into this statutory provision a strict time limit for complying with section 165, beyond which no further action is possible, does not appear to me to be consistent with the ongoing nature of the duty under section 165, which is to progress the handling of a complaint. If there was a cut-off date for compliance beyond which the IC could not take further steps, this would mean there was little practical point to an order to progress handling a complaint, because no further action could be taken. If the Applicant wishes to challenge the fact that the IC did not comply with its responsibilities by a certain time, that would be a matter for judicial review, not a section 166 application. This is because it is backward looking and concerned with the manner in which the IC exercised its duty including its timeliness, whereas a section 166 application is forward looking and concerned with ensuring the complaint is properly handled. I note also and agree with the argument of the IC in the costs application that a failure to give adequate reasons in an initial decision may be cured by the availability of a review: see e.g. Information Commissioner v Secretary of State for Health and Social Care & Anor [2025] UKUT 177 (AAC) at paragraph 49.
32. It appears to me therefore that there are no further appropriate steps which the IC ought reasonably to take to progress the complaint. In making this decision I have given significant weight to the view of the IC as the expert regulator that there are no further appropriate steps he should have taken.
33. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision. In an application under section 166 , the Tribunal has no power to direct the IC to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the UK GDPR. I also agree with the IC’s position that it is not a court or ombudsman and that orders for compliance need to be sought through civil action.
34. Because I consider that there was an outcome determining the complaint and that there were no further appropriate steps which should be taken, I find the complaint has already been determined and therefore the Tribunal has no jurisdiction over it. I am also satisfied that there is no reasonable prospect of the case, or any part of it, succeeding because, against the background of my finding that the complaint had been determined by the issue of an outcome, the remedy sought by the Applicant is not something which is within the Tribunal’s power to grant.
35. The proceedings are therefore struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with them and under Rule 8(3)(c) because there is no reasonable prospect of them succeeding. The costs application 36. The Applicant applied on 26 January 2026 for an order for costs pursuant to rule 10(1)(b) and 10(1)(c).
37. The Applicant, in summary, made the following points: a. The decision which is the subject of these proceedings is the IC’s decision to close the complaint on 9 January 2026 because at that point he says that the complaint had not been progressed through investigation and no outcome had been communicated to the Applicant. b. The IC’s later correspondence cannot retrospectively legitimise or cure the unlawfulness of the earlier closure decision. c. The decision of 9 January 2026 was therefore not a decision contemplated by the statutory scheme and was unreasonable for the purposes of rule 10(1)(c). d. The IC acted unreasonably in choosing to defend the proceedings in relation to a procedurally defective decision, including making the strike-out application, and did not acknowledge: • The only reasoned “outcome” relied upon post-dated the closure of the complaint; and • Section 165 had not been complied with at the time the decision under challenge was taken. e. The decision to defend the proceedings on that basis caused the Applicant, a litigant in person, to incur unnecessary time and expense in pursuing a procedurally well-founded application.
38. The IC made submissions in response on 17 February 2026 maintaining that neither his decision of 9 January 2026 nor his conduct in defending that decision were unreasonable. In summary, the IC made the following points: a. The IC’s decision of 9 January 2026 was well within the scope of his statutory discretion and not unreasonable. It properly notified the Applicant of the outcome of his complaint, as required by section 165(4) (b) of the Data Protection Act 2018 and it was clear from that letter that the IC did not accept the substance of the Applicant’s complaint. To the extent that the reasons for the IC’s decision were unclear, moreover, they were supplemented in any event by those given in the review letter of 16 January 2026. The IC’s decision, therefore, involved no error of law. In the alternative, any error of law was not material. b. Section 165 only requires the IC to give an outcome; there is no requirement to provide a summary of investigative steps taken, provide findings on the alleged infringement or communicate a reasoned outcome. There is a plainly reasonable explanation for the IC’s conduct and the Applicant can be left in no doubt as to the reasons why the IC has decided to take no further c. It is well-established that a failure to give adequate reasons in an initial decision may be cured by the availability of a review: see e.g. Information Commissioner v Secretary of State for Health and Social Care & Anor [2025] UKUT 177 (AAC) at paragraph 49. If, therefore, the IC’s letter of 9 January 2026 involved any error of law (which is denied) it was cured by the reasons given in the review letter of 16 January 2026. d. The IC’s defence of his decision of 9 January 2026 was not unreasonable in any respect. The IC having provided the Applicant with an outcome to his complaint, it was reasonable for the IC to apply to strike out the Application as the Tribunal has no jurisdiction to consider either the lawfulness or the merits of that outcome. e. The matters of which the Applicant complains are all public law matters that could form the basis of a claim for judicial review of the IC’s decision. f. The Applicant has failed to comply with Rule 10(3)(b) and has not filed a schedule of the costs claimed with the application. This is a further reason why the Tribunal should not exercise its discretion to make a costs order. Legal framework – costs 39. Relevant provision relating to the issue of costs in the First-tier Tribunal is to be found in primary legislation, namely section 29 of the Tribunals, Courts and Enforcement Act 2007, which provides: “(1) The costs of and incidental to— (a) all proceedings in the First-tier Tribunal… shall be in the discretion of the Tribunal in which the proceedings take place. (2) The relevant Tribunal shall have full power to determine by whom and to what extent the costs are to be paid. (3) Subsections (1) and (2) have effect subject to Tribunal Procedure Rules. (4) In any proceedings mentioned in subsection (1), the relevant Tribunal may— (a) disallow, or (b) (as the case may be) order the legal or other representative concerned to meet, the whole of any wasted costs or such part of them as may be determined in accordance with Tribunal Procedure Rules. (5) In subsection (4) “wasted costs” means any costs incurred by a party— (a) as a result of any improper, unreasonable or negligent act or omission on the part of any legal or other representative or any employee of such a representative, or (b) which, in the light of any such act or omission occurring after they were incurred, the relevant Tribunal considers it is unreasonable to expect that party to pay. (6) In this section “legal or other representative”, in relation to a party to proceedings, means any person exercising a right of audience or right to conduct the proceedings on his behalf. (7) In the application of this section in relation to Scotland, any reference in this section to costs is to be read as a reference to expenses.” 40. The relevant provisions of the First-tier Tribunal (General Regulatory Chamber) Rules 2009 (“2009 Rules”) read as follows: “10(1) …the Tribunal may make an order in respect of costs… (b) if the Tribunal considers that a party has acted unreasonably in bringing, defending or conducting proceedings; (c) where ... the Information Commissioner is the respondent and a decision, direction or order of the Commission or the Commissioner is the subject of the proceedings, if the Tribunal considers that the decision, direction or order was unreasonable .” 41. Whenever the First-tier Tribunal exercises any power conferred by the 2009 Rules, or interprets those Rules, it is required by rule 2(3) to seek to give effect to the overriding objective: “2. Overriding objective and party’s obligation to cooperate with the Tribunal (1) The overriding objective of these Rules is to enable the Tribunal to deal with cases fairly and justly. (2) Dealing with a case fairly and justly includes - a. dealing with the case in ways which are proportionate to the importance of the case, the complexity of the issues, the anticipated costs and the resources of the parties; b. avoiding unnecessary formality and seeking flexibility in the proceedings; c. ensuring, so far as practicable, that the parties are able to participate fully in the proceedings; d. using any special expertise of the Tribunal effectively; and e. avoiding delay, so far as compatible with the proper consideration of the issues. (3) The Tribunal must seek to give effect to the overriding objective when it – f. exercises any power under these Rules; or g. interprets any rule or practice direction.
42. In Ridehalgh v Horsefield [1994] Ch 205 , a leading authority on the issue of ‘ wasted costs ’ the Court held, at [232], that the word “ unreasonable ” was such as aptly to describe – “… conduct which is vexatious, designed to harass the other side rather than advance the resolution of the case and it makes no difference that the conduct is the product of excessive zeal and not improper motive. But conduct cannot be described as unreasonable simply because it leads in the event to an unsuccessful result or because other more cautious legal representatives would have acted differently. The acid test is whether the conduct permits of a reasonable explanation. If so, the course adopted may be regarded as optimistic and as reflecting on a practitioner’s judgment but it is not unreasonable. ” 43. The Upper Tribunal has also given guidance on the issue of costs, in Willow Court v Alexander [2016] UKUT 290 (LC) stating, at [24]: 44. “ An assessment of whether behaviour is unreasonable requires a value judgment on which views might differ but the standard of behaviour expected of parties in tribunal proceedings ought not to be set at an unrealistic level. We see no reason to depart from the guidance given in Ridehalgh at 232E, despite the slightly different context. “ Unreasonable ” conduct includes conduct which is vexatious, and designed to harass the other side rather than advance the resolution of the case. It is not enough that the conduct leads in the event to an unsuccessful outcome. The test may be expressed in different ways. Would a reasonable person in the position of the party have conducted themselves in the manner complained of? Or Sir Thomas Bingham ’ s “ acid test ” : is there a reasonable explanation for the conduct complained of?” Discussion and conclusion - costs 45. I can identify nothing vexatious in the IC’s conduct in this Application, nor is there any evidence that the IC engaged in conduct designed to harass the Applicant or that there was an improper motive from the IC any time. There is nothing improper in the steps which the IC took in the Application. Looking at the circumstances as a whole, in my conclusion the IC did not act unreasonably – in the sense identified in Ridehalgh , Willow Court etc - in defending or conducting the proceedings.
46. As to whether the IC’s decision to take no further action in the Applicant’s complaint was reasonable, paragraph 80 of the Court of Appeal’s decision in Delo (see above) states that where the IC has received and considered a complaint, he has a broad discretion as to whether to conduct a further investigation and if so to what extent. That paragraph continues “ having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood this is so and to take no further action.” In all the circumstances of this case, I consider that the IC’s decision to take no further action in relation to the Applicant’s complaint was well within the range of reasonable responses to the complaint which were open to the IC under his discretion. I therefore conclude that the IC’s decision on 9 January 2026 to take no further action was not unreasonable. Any challenge to the lawfulness or rationality of such a decision is a matter for judicial review, not this Tribunal.
47. For these reasons, I refuse the Applicant’s application for costs against the Council. Signed: Judge Harris Date: 22 June 2026
📊 Como os tribunais decidem casos parecidos
Entre 12 decisões semelhantes neste acervo:
- First-tier Tribunal (General Regulatory Chamber) Challenging an ICO Decision: When the Tribunal Can (and Can't) Help with Yo…
- First-tier Tribunal (General Regulatory Chamber) When the Information Commissioner has already responded: Tribunal's powers …
- First-tier Tribunal (General Regulatory Chamber) First-tier Tribunal Explains Limits on Challenging Information Commissioner…
- First-tier Tribunal (General Regulatory Chamber) Understanding Tribunal Powers: Why You Can't Appeal the Substance of an ICO…
- First-tier Tribunal (General Regulatory Chamber) Data Protection Appeal Struck Out: Understanding Tribunal Jurisdiction
- First-tier Tribunal (General Regulatory Chamber) When can a data protection complaint to the ICO be struck out by the Tribun…
- First-tier Tribunal (General Regulatory Chamber) Application to Challenge ICO Decision Struck Out by First-tier Tribunal
- First-tier Tribunal (General Regulatory Chamber) Appeal Struck Out: Why Following Tribunal Directions is Crucial for Your Ca…
- First-tier Tribunal (General Regulatory Chamber) Appeal Struck Out: Why Following Tribunal Directions is Crucial for Your Ca…
- First-tier Tribunal (General Regulatory Chamber) Driving Instructor Qualification Appeal Struck Out by Tribunal Over Expired…
Panorama deste acervo — não é previsão do resultado do seu caso.
⚖️ O que costuma pesar em casos assim
✅ Costuma ser acolhido
- A public body was able to show a strong public interest in keeping certain government communications private.
❌ Costuma ser rejeitado
- The appeal tried to challenge the final decision of the Information Commissioner, rather than just how they handled the complaint process.
- The appeal asked the Tribunal to make an order that went beyond its power to only direct procedural steps.
- The person bringing the case repeatedly failed to follow the Tribunal's instructions.
- The case was submitted after the deadline, and no extension was agreed upon.
- The case had no reasonable chance of winning because the law clearly limited the Tribunal's power.
Padrões observados nos casos semelhantes deste acervo — cada processo é único.
❓ Perguntas frequentes
What did this decision decide?
The First-tier Tribunal decided to 'strike out' an application that asked it to order the Information Commissioner (IC) to take further steps on a data protection complaint. This means the application was stopped and not heard on its full merits.
Who was involved?
The case involved a data subject (the person who made the complaint) and the Information Commissioner (the UK's independent authority for upholding information rights).
How did the court decide, and why?
The Tribunal decided to strike out the application because it found it did not have the legal power (jurisdiction) to deal with it, and that the application had no reasonable chance of succeeding. This was because the IC had already provided an 'outcome' to the complaint, and the Tribunal's role is limited to checking if the IC followed the correct procedures, not to review the substance of their decision.
Which laws or rules were applied?
The key laws and rules applied were sections 165 and 166 of the Data Protection Act 2018, which deal with making complaints to the IC and applying to the Tribunal. Also, Rule 8 of the Tribunal Procedure Rules for the General Regulatory Chamber, which allows cases to be struck out.
What was the argument that mattered most?
The most important argument was whether the Information Commissioner had provided a proper 'outcome' to the data subject's complaint. If an outcome had been provided, the Tribunal's powers under section 166 DPA 2018 are very limited and only apply if the IC failed in a procedural way, not if the data subject disagreed with the IC's decision.
Was the decision for or against the person who brought the case?
The decision was against the data subject who brought the case, as their application was struck out.
What does this mean for someone in a similar situation?
If you've complained to the Information Commissioner about a data protection issue and they've given you a clear decision or 'outcome', the First-tier Tribunal generally cannot review whether that outcome was correct. Its role is mainly to ensure the IC followed the right steps in handling your complaint, not to re-evaluate the merits of your original complaint.
What evidence or documents mattered?
The Tribunal considered the correspondence between the data subject and the Information Commissioner, particularly the letters from the IC that were deemed to constitute an 'outcome' to the complaint. Previous court decisions on the scope of section 166 DPA 2018 were also important.
Can a decision like this be appealed?
Generally, decisions from the First-tier Tribunal can be appealed to the Upper Tribunal, but usually only if there's a point of law that needs to be clarified or if the Tribunal made a legal error. Permission to appeal is required.
Is it worth getting a solicitor for a case like this?
It is always advisable to seek advice from a qualified solicitor for your specific case, especially when dealing with complex areas of law like data protection and tribunal procedures, to understand your rights and the best way forward.
