Case Reference: FT/EA/2024/0403/GDPR
Information Rights
Decided without a hearing
Before
TRIBUNAL JUDGE KIAI
Between
BRIDGET HIGGINS
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The proceedings are struck out under Rule 8(3)(c) of The Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009 because there is no reasonable prospect of the Applicant’s case, or part of it, succeeding.
REASONS
Introduction
These proceedings involve an application to the Tribunal under section 166(2) of the Data Protection Act 2018 (“DPA”), by way of a Notice of Application dated 28 October 2024.
In his response to the application, the Commissioner submits that the application has no reasonable prospects of succeeding and/or the Tribunal has no jurisdiction, accordingly the appeal should be struck out. The Appellant opposes the strike out.
The Commissioner says that the remedies sought by the Appellant are not outcomes that the Tribunal can grant under section 166 DPA because an order can only be made in relation to procedural failings.
Legal Background
Under Rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers it does not have jurisdiction in relation to the proceedings or that part of them; and does not exercise its power under rule 5(3)(k)(i) (transfer to another court or tribunal) in relation to the proceedings or that part of them.
Under Rule 8(3)(c) of the Rules, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers there is no reasonable prospect of the applicant’s case, or part of it, succeeding.
Section 165 DPA sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under section 166 DPA a data subject can make an application to this Tribunal for an order as follows:
166 Orders to progress complaints
This section applies where, after a data subject makes a complaint under section165 or Article 77 of the UK GDPR, the Commissioner -
fails to take appropriate steps to respond to the complaint,
fails to provide the complainant with information about progress on thecomplaint, or of the outcome of the complaint, before the end of the periodof 3 months beginning when the Commissioner received the complaint, or
if the Commissioner's consideration of the complaint is not concluded duringthat period, fails to provide the complainant with such information during asubsequent period of 3 months.
The Tribunal may, on an application by the data subject, make an order requiringthe Commissioner -
to take appropriate steps to respond to the complaint, or
to inform the complainant of progress on the complaint, or of the outcomeof the complaint, within a period specified in the order.
The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1) (a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. Some key decisions are:
Scranage v Information Commissioner[2020] UKUT 196 (AAC), paragraph 6
- "In my experience – both in the present appeal and in many other cases – thereis a widespread misunderstanding about the reach of section 166. Contrary tomany data subjects’ expectations, it does not provide a right of appeal againstthe substantive outcome of the Information Commissioner’s investigation on itsmerits. Thus, section 166(1), which sets out the circumstances in which anapplication can be made to the Tribunal is procedural rather than substantive inits focus." (emphasis in original).
Killock v Information Commissioner [2022] 1 WLR 2241, Upper Tribunal at paragraph 74 - "…It is plain from the statutory words that, on an application undersection 166, the Tribunal will not be concerned and has no power to deal with themerits of the complaint or its outcome. We reach this conclusion on the plain andordinary meaning of the statutory language but it is supported by the ExplanatoryNotes to the Act which regard the section 166 remedy as reflecting the provisionsof article 78(2) which are procedural. Any attempt by a party to divert a tribunalfrom the procedural failings listed in section 166 towards a decision on the meritsof the complaint must be firmly resisted by tribunals."
Background
The underlying factual matrix to this case is succinctly set out at [25] to [31] of the Commissioner’s response dated 20th December 2024:
‘25. On 1 April 2024, the Applicant submitted her complaint to the Commissioner together with some supporting evidence regarding the Home Office and the Security Service (‘MI5’) [Annex 1]. The complaint concerned data about the Applicant held by the Home Office and MI5. The documents attached to the complaint are not included in Annex 1 due to their volume.
On 16 April 2024, the Applicant wrote to the Commissioner to advise that she had raised a complaint with MI5 and asked for a response to the complaint by 23 April 2024
On 23 April 2024, the Applicant wrote to the Commissioner providing a copy of the complaint response from MI5.
The complaint against MI5 was allocated case reference IC-319211-M9C9 and
assigned to an ICO case officer. The complaint against the Home Office was separated and allocated case reference number IC-298683-W9Q7. The Commissioner understands this complaint is not subject to this Application.
Following further updates from the Applicant, on 6 August 2024, the case officer wrote to the Applicant asking for a copy of the Applicant’s subject access request to MI5 and a copy of their response. On 22 August 2024, the case officer wrote to the Applicant and confirmed that she was satisfied with MI5’s response and that they had complied with their data protection obligations [Annex 2].
Following further correspondence on 26 September 2024, the Applicant wrote was understood to ask the Commissioner for a case review.
On 21 October 2024, the reviewing officer issued a reviewed outcome upholding the case officer’s outcome in relation to MI5. [Annex 3]’.
Conclusions
I find that the Commissioner has provided an outcome to the complaint by way of a letter dated 22nd August 2024 and 21st October 2024. Contrary to the expectations of many Appellants, section 166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits. The Tribunal is bound to take into consideration and give weight to the views of the Commissioner, as described by the Chamber President in Barbara Rogers v ICO EA/2021/0348:
’14…In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively: Killock & Ors v Information Commissioner [2021] UKUT 299. The obligation of the Commissioner is to take appropriate steps to respond to the complaint’.
The Appellant’s response to the strike out is lengthy and is not therefore set out here, it ends with the words ‘Mi5, Neil Jones, the Home Office and Police, IPT have not resolved this issue, I would like the ICO to insist whoever can, that they investigate and give answers’. It is clear that the Appellant is challenging the substantive outcome of the complaint to the Commissioner. The Tribunal does not have the power under section 166 to consider the merits or substantive outcome of a complaint.
Section 166 is limited to procedural issues. The Commissioner took steps to investigate and respond to the complaint. It provided an outcome to the complaint and a reviewed outcome. For these reasons, I find that the Commissioner has not failed to comply with the procedural requirements set out in section 166(1) of the DPA. I therefore find that there is no reasonable prospect of the case or any part of it, succeeding. The proceedings are therefore struck out.
For completeness, I add here that there are further rights of action against the data controller or data processor contained at sections 167 to 169. These may only be pursued in the High Court or the County Court. The Tribunal’s powers are limited by statute, and I have no power to consider matters outside it’s jurisdiction.
Signed Date:
Gilda Kiai 12th September 2025