Case Reference: FT/EA/2025/0104/GDPR
Information Rights
Heard: on the papers in Chambers
Before
TRIBUNAL JUDGE HAZEL OLIVER
Between
ADEEL AHMAD
Applicant
and
INFORMATION COMMISSIONER
Respondent
Decision:
The proceedings are struck out under Rule 8(3)(c) because there is no reasonable prospect of the Applicant's case, or part of it, succeeding.
REASONS
These proceedings involve an application to the Tribunal under section 166(2) of the Data Protection Act 2018 (“DPA”). The Applicant asks for an order in relation to a complaint to the Information Commissioner (the “Commissioner”).
Under Rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers there is no reasonable prospect of the applicant's case, or part of it, succeeding.
In his response to the application, the Commissioner submits that the Tribunal has no jurisdiction to consider the application and/or it has no reasonable prospect of succeeding and accordingly should be struck out. The Commissioner has made a strike out application on this basis. The Applicant opposes the strike out.
The Commissioner says that the remedies sought by the Applicant are not outcomes that the Tribunal can grant under section 166 DPA because an order can only be made in relation to procedural failings.
The law
Section 165 DPA sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under section 166 DPA a data subject can make an application to this Tribunal for an order as follows:
Orders to progress complaints
This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner -
fails to take appropriate steps to respond to the complaint,
fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
The Tribunal may, on an application by the data subject, make an order requiring the Commissioner -
to take appropriate steps to respond to the complaint, or
to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. Some key decisions are:
Killock and Veale v Information Commissioner [2022] 1 WLR 2241, Upper Tribunal at paragraph 74 - "…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."
And at paragraphs 76 to 77 – “The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioners regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints…This does not leave data subjects unprotected. If the Commissioner goes outside her statutory powers or makes any other error of law, the High Court will correct her on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals.”
Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 - "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...”.
Mostyn J’s decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141) – “For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.” (paragraph 80, Warby LJ).
The recent decision of the Upper Tribunal in Smith v information Commissioner [2025] UKUT 75. This holds that it is not correct to say that just because the Commissioner has provided an “outcome” to the complaint, there is no scope at all for making an application to this Tribunal. However, “…the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited. This is the effect of all the authorities, it seems to me. They all hold that, on an application under section 166, it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.” (paragraph 60). Judge Stout goes on to confirm that the authorities do not preclude an order being made for an appropriate step even when an outcome has been provided, and “One ready example where that is likely to be appropriate is (it seems to me) where the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complaint as a result of oversight or other mistake.” (paragraph 61).
Under section 165(5) DPA, taking “appropriate steps” in response to a complaint includes “investigating the subject matter of the complaint, to the extent appropriate”, and “informing the complainant about progress on the complaint”. The Tribunal is required to give weight to the views of the Commissioner as expert regulator, and this is directly relevant to the Tribunal’s assessment of whether the Commissioner has failed to take an appropriate step. In Killock & Veale, the Upper Tribunal said, “the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations” (paragraph 85), and “…where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may, in turn, depend on the degree of regulatory judgment involved) and cannot simply substitute its own view.” (paragraph 86).
Factual background
On 15 November 2024 the Applicant made a complaint to the Commissioner about Telefonica O2 Holdings Ltd (“O2”) and their response to a data subject access request (“SAR”). He complained about missing information and was concerned that O2 may be withholding information. The Applicant says that he was a victim of eSIM fraud.
The Applicant’s complaint was assigned to a case officer. The case officer spoke to a detective about the complaint. The case officer also spoke to the Data Protection Officer at O2, who said that the Applicant had been provided with all requested data apart from IP addresses. The Appellant contacted the case officer a number of times by email during this period and also spoke to her by telephone. On 25 February the case officer sent an email to the Applicant after a telephone call with him, confirming that one-time password messages and IP addresses have short retention periods and are no longer available, and so O2 were unable to fulfil the SAR in relation to those items.
The Applicant sent further emails expressing his concerns about deletion of the requested information. On 26 February 2025 the case officer sent an email to the Applicant saying there was nothing further she could do at this juncture. The Applicant was inferring that O2 deliberately deleted data after he submitted the SAR. The case officer explained that, “As this is a criminal offence, the burden of proof is beyond all reasonable doubt. There is insufficient evidence of this offence.” In an email the following day the case officer explained, “Our role as a regulator is to assess complaints in order to provide an outcome. In addition, you have no formal right to request that we take specific action in any particular case and the Commissioner does not act on behalf of individuals to resolve matters to their satisfaction.”
The Applicant asked for a review. The reviewing officer wrote to the Applicant on 4 March 2025. She said that she was satisfied that the case officer had dealt with the complaint appropriately and in line with case handling guidelines. She also said that the case officer had explained the reasons for her view by telephone and email. In relation to information being deliberately deleted, the reviewing officer explained that there is a high burden of proof before they can say that an organisation has deliberately deleted or altered information to prevent its disclosure. The reviewing officer concluded, “Section 165 of the Data Protection Act 2018 states that the ICO must investigate a complaint about the handling of an individual’s personal data to an appropriate extent and inform the individual of the outcome. I believe Amy has exceeded this boundary and has investigated your concerns to a considerable extent; above and beyond the expectations set out in our casework policies and procedures.”
The Applicant’s desired outcome from the application as set out in his form GRC1 is,
“Here’s what I want out of this appeal:
My case reopened by the ICO, no ifs or buts.
O2’s deletion logs handed over, showing when, why, and how my data was wiped or lost.
Section 173(3) applied right, judging O2’s actions, not my ability to finger some random employee.
A proper check on that 12-month retention rule, with answers about why my data’s missing if it should’ve been kept.
A straight, evidence-backed story from O2 on their data practices—no dodging, just facts.
That’s it. I’m after a fair go—evidence I’m entitled to and answers that hold O2 accountable. The ICO needs to deliver this so my rights aren’t just words on paper.”
The Applicant also completed a form GRC3. This sets out the order he wants the tribunal to make as follows,
“I am requesting that the First-tier Tribunal (General Regulatory Chamber) issue the following order under Section 166 of the Data Protection Act 2018 (DPA 2018):
Direct the Information Commissioner’s Office (ICO) to reopen the investigation into my complaint against O2 (ICO Case Reference: IC-344770-H2X5). The ICO closed the case prematurely on 26 February 2025, without adequately addressing the issues raised or ensuring that O2 complied with my Subject Access Request (SAR).
Order the ICO to require O2 to provide the following data, which was either withheld or incompletely disclosed in response to my SAR:
Deletion logs for OTP (one-time password) records and any other data that O2 claims was deleted during the period of my SAR.”
The Commissioner made an application for strike-out on 30 July 2025. On 4 August 2025, Registrar Bamawo invited the Applicant to respond by 18 August. The Applicant provided a response on 8 August 2025, which I have read and considered.
Conclusions
The Applicant’s response argues that he is complaining about procedural breaches. I have considered his arguments:
Delays - The Commissioner breached section 166(1)(b) DPA by failing to provide progress updates for over three months. Although this may fall within the category of a procedural breach, it is not an ongoing situation and so an order from the Tribunal to progress the complaint is not required or appropriate.
Inadequate Investigation – The Commissioner failed to act under section 165(5) DPA, ignoring key evidence. The Appellant has provided three Annexes of evidence which he says show that metadata was available, that there was evidence that should have been secured by the Commissioner’s fraud team, and that falsified device dates and denials were not scrutinised by the Commissioner. I do not agree that these are procedural matters. They relate to the merits of the Commissioner’s investigation, and are exactly the kind of issue that the authorities caution the Tribunal against considering. As stated by the Court of Appeal in Delo, the Commissioner has a “broad discretion” as to whether to conduct further investigation, and to what extent. The only way the Tribunal could consider these matters would be by scrutinising the evidence and the extent of the Commissioner’s investigation in detail – which is exactly what the authorities say the Tribunal cannot do under section 166 DPA.
The Commissioner’s failure to investigate is an improper exercise of discretion, and the investigation was not thorough. The Applicant says this is due to a failure to investigate critical evidence. Again, I do not agree that this is a procedural matter, it relates to the merits of the complaint outcome.
The fact there has been an outcome does not preclude the Tribunal from making an order. This is correct according to Smith. However, this authority also makes it clear that the scope for finding an appropriate step has been omitted after an outcome has been provided is “limited” – because section 166 should not be used to obtain a remedy by the “back door”, and because of the Commissioner’s wide discretion. Investigation to the “extent appropriate” is subject to the Commissioner’s position as expert regulator.
Extensive documents and evidence. The Applicant has provided extensive evidence and refers to having more available. Again, consideration of these detailed matters of evidence would involve the Tribunal in the merits of the complaint and outcome.
Tribunal orders for new evidence are permitted. The Applicant refers to paragraph 74 of Killock & Veale and says this allows Tribunal orders for new or overlooked evidence showing procedural failures. I have considered this paragraph, and do not agree. This paragraph is quoted above, and says that the Tribunal has no power to deal with the merits of a complaint or its outcome. It is not suggested anywhere in the decision that a procedural remedy can include requiring the Commissioner to reopen a finalised complaint in order to consider new evidence.
I find that the Applicant is challenging the substantive outcome of the complaint to the Commissioner. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to procedural issues.
This is clear from the information in the forms GRC1 and GRC3 from the Applicant, as quoted above. He is asking the Tribunal to require the Commissioner to reopen the investigation, after an outcome has been provided. The Applicant is clearly dissatisfied with the extent of the Commissioner’s investigation, and the outcome that has been provided to him. He has provided a considerable amount of evidence to the Tribunal as to why he says the Commissioner’s investigation was not sufficient. However, this falls squarely within the prohibition on the Tribunal considering the merits of a complaint, as is made very clear in the authorities set out above.
This is not a situation where the Commissioner has failed to deal with part of a complaint due to oversight or mistake. The Applicant’s complaint was about the response to his SAR, and the Commissioner also considered and responded to the Applicant’s concern that data had been deleted. The Commissioner has a wide discretion as to what to investigate and the outcome of a complaint. I do not consider that the Applicant has any reasonable prospect of showing that an appropriate step has been omitted by the Commissioner in these factual circumstances.
I therefore find that there is no reasonable prospect of the case, or any part of it, succeeding. The proceedings are struck out.
Signed: Judge Hazel Oliver
Date: 22 September 2025