Case Reference: FT/EA/2024/0440
Information Rights
Decided without a hearing
Decision given on: 20 Aug. 25
Before
JUDGE HARRIS
Between
FERDINAND COENRAAD BALFOORT
Applicant
and
INFORMATION COMMISSIONER
Respondent
Decision: The Application is struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with it and under Rule 8(3)(a) because there is no reasonable prospect of it succeeding.
REASONS
These proceedings concern an application under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) for an order to progress the Applicant’s complaint against handling of a data privacy complaint by Pack and Send UK (“PSUK”), which was submitted to the Respondent on 25 May 2024 (Reference IC-309952-D7C3).
On 3 September 2024, the Respondent wrote to the Applicant and informed him that his complaint had been raised with PSUK and the Respondent expected them to contact the Applicant within 28 days. On the same date PSUK provided further information to the Respondent about the complaint and explained that it considered it had complied with its data protection obligations. It provided further information to the Respondent on 24 September 2024.
On 1 October 2024, the Respondent confirmed to PSUK that he was satisfied with the handling of the complaint and no further action was required. He communicated this to the Applicant on the same day confirming that PSUK had made the Applicant aware of its processing activities in their in their privacy policy and that the sharing of the Applicant’s data to third parties was therefore in compliance with their data protection obligations. He advised the Applicant that that no further action would be taken in relation to the complaint.
Following further correspondence, the Applicant requested a case review from the Respondent on 6 October 2024. On 16 October 2024, the Respondent wrote to the Applicant issuing an outcome to the case review, upholding the case officer’s decision. He explained that the disclosure of the Applicant’s data to third parties was necessary in order for PSUK to complete their services and that he was satisfied that PSUK had responded to the Applicant’s complaint satisfactorily.
The Applicant applied to the Tribunal by way of form GRC1 dated 6 November 2024 (the “Application”) seeking the following outcome: “Allow the appeal and set aside the ICO decision, requiring a re opening of my case filed against PSUK to be investigated by a different independent ICO Case Office based on the evidence and information I have provided.”
The Respondent applied by way of form GRC5 dated 19 December 2024 (the “Strike-out application”) to strike out the Application on the basis that the Tribunal has no jurisdiction to consider it under Rule 8(2)(a) and/or that there is no reasonable prospect of it succeeding. Having considered the papers, Judge Heald struck out the Application on 8 July 2025.
The Applicant applied on 5 August 2025 for permission to appeal Judge Heald’s decision to the Upper Tribunal. By order dated 13 August 2025, Judge Heald refused permission to appeal. However, he set aside his order dated 8 July 2025 because it appeared that there had been a procedural irregularity as he had not seen and considered the Applicant’s responses dated 2 January 2025 and 2 June 2025 when making his decision. He directed that the Strike-out application should be considered afresh by a different Judge.
The Applicant’s case
The Applicant’s case set out in his Form GRC1 identifies the following alleged failings by the Respondent in relation to his complaint:
“The ICO…did not advise me about my rights to either request an Internal Review from the ICO or to appeal to the First Tier Tribunal, which I believe is a breach of ICO’s legal obligations.”
“On 3/10/2024 I filed further evidence and reiterated several key issues in my complaint which I believed aggravated the nature of the privacy breaches. The ICO did not respond to my follow up email.”
“without guidance from the ICO, I identified the next possible step in the process to be a request for an Internal Review.”
“ICO responded on 16/10/2024. The Internal Reviewer did not indicate I had the option and right to pursue the complaint via an Appeal to the First Tier Tribunal (FTT), which I believe the ICO must do in these cases. I thereafter requested clarification from ICO why they did not refer me to the FTT. ICO IR noted they did not believe my case would apply to FTT on 24/10/2024. I believe this was an incorrect determination. I do not believe the ICO has properly investigated my complaint on the facts.”
In his email dated 1 January 2025, the Applicant identified the following alleged failings by the Respondent:
“The Respondent did not provide updates or information about progress before the stipulated three-month period”
“Pack and Send were directed to provide a response directly to the Respondent. This never happened… No effort to resolve the issues was made by Pack and Send…Instead the Applicant had to follow up with the Respondent again on 27 September 2024 to enquire about the next steps in the absence of any response received from Pack and Send. The Applicant alleges this represents a breach of section 166(1)(a) of the DPA18, which evidenced that the Respondent “fails to take appropriate steps to respond to the complaint””.
“No effort was made by Pack and Send to resolve the issues in the Applicant’s complaints in engaging with the Appellant. The Appellant was not informed of this correspondence between the Respondent and Pack and Send until 19 December 2024. These are evidently not appropriate steps to resolve a complaint, which would mean, inter alia, direct communication between the Appellant and Pack and Send, in line with the Respondent directions on 03 September 2024. The Appellant alleges this is a breach of Section 166 1 (a) of the DPA18.”
“Pack and Send had never identified their Privacy Policy to the Applicant in any of their responses to the complaints filed with them by the Applicant since December 2023. The Appellant alleges this is a breach of Section 166 1 (a) of the DPA18.”
“From the Respondents outline of facts it is evident that Pack and Send did not engage with the Applicant directly regarding the complaint. Pack and Send did not explain to the Applicant what happened. Pack and Send did not make any reasonable attempts to rectify the problems subject of the Applicant’s complaints commencing in 2023. Instead of addressing the Complaint Pack and Send engaged in repetitive breach of data privacy, as noted to the Respondent Case Officer on 02 November 2024 (Annex # 2). Pack and Send repeatedly engaged in the same data privacy breaches despite being advised by the Applicant on numerous occasions not to do so. The evidence does not appear to meet any definition of reasonableness as defined by the Respondent in its public communications as a factor to determine whether to investigate and improve information rights practice.”
the Respondent ought to have directed Pack and Send to follow the procedure stipulated and respond to the Applicant to have sufficient time to discuss and present evidence of breaches of the DPA18 to Pack and Send, to engage and resolve the Complaint… The Appellant notes that Pack and Send did not respond to the Appellant’s complaint at all, and instead engaged in communications with the Respondent instead. Without any communications or engagement it is difficult to establish how Pack and Send responded to the complaint satisfactorily, and this should have been evident to the Respondent during September 2024, when Pack and Send did not engage with the Appellant as directed by the Respondent. The Appellant alleges this is a breach of Section 166 1 (a) of the DPA 18 as it suggests a failure of the Respondent to respond to the complaint, aligned with Pack and Send’s failure to do so.”
“The intervention of the Respondent in communications with Pack and Send appears to have been contributory to the lack of resolution of the Complaint by the Applicant directly with Pack and Send. This suggests a procedural failure, in breach of the Respondent’s own instructions to resolve any outstanding matters to Pack and Send. The matter remains unsolved. The Appellant alleges this is a breach of Section 166 1 (a) of the DPA 18”
“Pack and Send refused to engage with the Applicant, after being directed to do so by the Respondent Case Officer on 03 September 2024. The Appellant alleges this is a breach of Section 166 1 (a) of the DPA 18.”
“any reasonable person presented with these facts would disagree that the matter was handled procedurally correctly by the Respondent, or that the procedural handling of the complaint by Pack and Send was satisfactory to any degree.”
“the Respondent did not provide “great Customer Service” as one would expect, in terms of referencing avenues for resolution, unless the Appellant repeatedly requested specific insights and directions. Great customer service would, by definition, require the Respondent to put itself in complainant shoes, and to strive to assist in resolving the Appellant’s complaints, as advertised in the Respondent’s direction to Pack and Send on 03 September 2024. The Appellant notes no significant evidence that the Respondent put itself in the Appellant’s shoes, including the repeated omission of any workable directions or guidance to resolve the Complaint.”
“The Respondent procedure has equally not led to any Complaint resolution to the Appellant, which the Appellant believes is the key goal for the Respondent organization under its stated objectives in the ICO 25. The Applicant submits that the evidence regarding the procedures applied by the Respondent in this submission do not show a great level of inclusiveness or empathy, nor procedural effectiveness by the Respondent.”
This appears to amount in summary to an allegation that the Respondent failed to take appropriate steps to ensure that PSUK resolved the Applicant’s complaint.
The Strike-out application
The reasons given for the Strike-out application in the Respondent’s Response were as follows:
“The Tribunal does not have jurisdiction to determine the present application, as the Commissioner has already provided an outcome on the Applicant’s complaint when he sent a decision to the Applicant on 1 October 2024 followed by a review outcome on 16 October 2024.” (Response, paragraph 22)
“Given that the application shows no discernible grounds that would warrant the Tribunal exercising its powers under section 166(2) of the DPA18, the Commissioner having provided an outcome on 1 October 2024 and reviewed outcome on 16 October 2024, then there is no reasonable prospect of persuading the Tribunal to make any order pursuant to section 166(2) of the DPA18, as there are no longer any procedural issues that remain outstanding for the resolution of the complaint” (Response, paragraph 22)
“the remedies sought by the Applicant are not outcomes that the Tribunal can grant in an application under section 166 DPA18 against the Commissioner. An Application under section 166 DPA18 only permits a Tribunal to make an order against the Commissioner only if he has failed in some procedural respect…the Commissioner has taken steps to investigate and respond to this complaint and has provided an outcome to the Applicant’s complaint on 1 October 2024 and a reviewed outcome on 16 October 2024” (Response paragraph 37)
“It is clear from the grounds in support of the application that the Applicant does not agree with the outcome of his complaint, however, as the Tribunal has already established, section 166 DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint. The relief available from the Tribunal on an application under section 166 DPA18 only applies where it is satisfied that the Commissioner has failed in some procedural respect to comply with the requirements of section 166(1) DPA18, limited solely to those orders that are set out in section 166(2). Accordingly, it is respectfully submitted that the Commissioner has taken steps to comply with the procedural requirements set out in section 166(1) of the DPA18, and there is accordingly no basis for the Tribunal to make an order under section 166(2) DPA18.” (Response paragraph 38)
“If the Applicant wishes to seek an order of compliance against the controller for breach of his data rights, the correct route for him to do so is by way of separate civil proceedings in the County Court or High Court. “(Response paragraph 39).
The Applicant responded to the Strike-out application by email dated 2 June 2025. In this he cross-referred to his email dated 2 January 2025 and reproduced it. He concluded that the Tribunal has jurisdiction to make an order under section 166(2) against the Respondent for the following reasons:
“A breach of stipulated legal as well as stated procedural response times in processing the Appellants complaint under Section 166 1 (b) of the DPA18.
An absence of any reasonable and transparent communications with the Applicant during the process, before and after the investigation commenced, breaching the Respondent’s publicly stated rules and objectives on procedural transparency and inclusiveness.
Evidenced breach of the Respondent’s own procedural instructions to Pack and Send to “resolve any outstanding matters”. The outstanding matters have remained unsolved and other evidence indicating a breach of Section 166 1 (a) of the DPA18.
Any measure of justice in resolving the Appellants complaints through the failure of the Respondent’s stated procedures and strategic goals (ICO25). Without the Respondent’s claimed support to investigate similar complaints, it is hardly likely that any complaints are successfully resolved, based on the statistics noted.
A broader procedural ineffectiveness that is indicative of the Respondent’s failure to achieve justice for a growing number of Complainants, as evidenced by a 0.12% rate of actions resulting from investigations and an inability to meet strategic goals and key performance indicators established by the Respondent in its strategic plans.
I have hereby identified that the First Tier Tribunal has jurisdiction to review and adjudicate on this particular case due to the evidenced breaches of procedures by the Respondent, who appear to be, based on the public statistics, inclined to not investigate 99.88% of all complaints filed in 2023/2024. This suggests that the ICO, as the Respondent, is entirely unfit for purpose and ineffective, to the greatest extent.
As the penalties listed above also identify, the “Prospect of Success” test would take a relatively reasonable effort to apply through a reasoned and dedicated focus on the complaint and the evidence I have presented as the Appellant, resulting in a determination to either fine, reprimand, enforce or prosecute, where the latter penalty would likely take additional effort. At this stage, the circular reasoning applied that a case should not be investigated because it is unlikely to succeed does not appear to have any merits. Instead, the Respondent’s application of their test appears to have resulted in the stark imbalance between cases that are successfully investigated and those that are similarly dismissed to the Appellant case. This significant lack of action in regard to official complaints submitted to the Respondent’s offices raises equally significant questions about the protection of privacy and data pertaining to private individuals. This implies that UK service providers may in effect act with impunity, not only across the hundreds of outlets and operations managed by the original Respondent subject to the ICO non investigation, but also for any and all similar service providers which chose to conduct their operations in similarly dismissive and unscrupulous manners.
The Appellant therefore requests that the Respondent’s objections be set aside and to be directed to re investigate the original ICO case based on the evidence the Appellant has submitted initially and thereafter in sequence to address and respond to the ICO Case Officer’s requests and clarifications. The Appellant also requests that the Respondent be directed to do so in an impartial and effective manner, in compliance with the rules that stipulate the conduct, timeliness and impartiality of the Respondent’s operations to avoid making a mockery of a public institution that has been established to investigate breaches of privacy for the purpose of establishing an effective public safeguard against the type of egregious behaviours the Appellant has identified.”
Legal framework
Section 165 DPA 2018 sets out the right of data subjects to complain to the Information Commissioner (here the Respondent) about infringement of their rights under the data protection legislation. Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows:
“Orders to progress complaints
This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner -
a. fails to take appropriate steps to respond to the complaint,
b. fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
c. if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner -
a. to take appropriate steps to respond to the complaint, or
b. to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.”
The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.
The case of Killock v Information Commissioner [2022] 1 WLR 2241, Upper Tribunal at paragraph 74 stated - "…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."
Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 - "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...”.
Mostyn J’s decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141) – “For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.” (paragraph 80, Warby LJ).
The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo in confirming that the nature of section 166 is that of a limited procedural provision only. “The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33).
The case of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC), noted at paragraph 60 that “it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an appropriate step has been omitted is limited.” In considering this the Tribunal must, as set out in paragraph 85 of Killick “when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator.”
Paragraph 85 of Killick reads as follows: “However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.”
Discussion and conclusions
The Respondent provided the Applicant with a response to his complaint 1 October 2024 followed by a review outcome on 16 October 2024. I am satisfied that when taken together these responses both provided an outcome to the complaint and demonstrated that the Respondent had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint. It appears to me therefore that there were no further appropriate steps which the Respondent ought reasonably to have taken to progress the complaint. In making this decision I have given significant weight to the view of the Respondent as the expert regulator that there were no further appropriate steps hehe should have taken. It does not appear to me that the Respondent could reasonably have been expected to take responsibility for PSUK’s failure to respond as instructed or as the Applicant would wish.
In light of paragraph 57 of Delo, which I mention above, it appears to me that it is a matter for the Respondent to determine what investigation is appropriate, particularly noting “He decides the scale of an investigation of a complaint to the extent that he thinks appropriate.”. The Tribunal’s power to order progression of a complaint under section 166 is limited to ordering the Respondent to take appropriate steps to respond to a complaint, or to inform the complainant of progress or an outcome within a specified period. The Tribunal has no power, as sought by the Applicant to require “a re opening of my case filed against PSUK to be investigated by a different independent ICO Case Office based on the evidence and information I have provided.” The Tribunal does not have the power to dictate how the Respondent should investigate any matter.
Nor does the Tribunal have power to address the points raised by the Applicant in his email dated 2 June 2025 as to the wider effectiveness or fitness for purpose of the Respondent. These may be matters which the Applicant chooses to pursue in the civil and/or Administrative courts.
The Applicant’s other points, particularly his assertion that the Respondent has breached DPA 2018 because the complaint to PSUK remains unresolved, are, in effect, challenging the substantive outcome of the complaint to the Respondent. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision.
I therefore find an outcome was provided to the Applicant’s complaint which means that the Tribunal has no jurisdiction to reopen the complaint or to order that it be reinvestigated or investigated in a particular way. I am also satisfied that there is no reasonable prospect of the case, or any part of it, succeeding because the outcome sought by the Applicant is not something which is within the Tribunal’s power to grant.
The proceedings are therefore struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with them and under Rule 8(3)(a) because there is no reasonable prospect of them succeeding.
Signed: Judge Harris Date: 18 August 2025