Chantal Bryden v The Information Commissioner

The application under section 166 of the Data Protection Act 2018 is STRUCK OUT.

In this decision, ‘the Application’ is a reference to the application made to the tribunal by Chantal Bryden under section 166 of the Data Protection Act 2018 (DPA) and ‘the Applicant’ is a reference to Ms Bryden.

The Commissioner applies by way of a GRC5 submitted with his response for the Application to be struck out under rule 8(3)(a) (no jurisdiction) or rule 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

The Commissioner submits that that is clear that the Applicant does not agree with the outcome of her complaint, however he submits that section 166 DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint. The Commissioner submits that he has taken steps to investigate and response to the complaint and has provided an outcome. It is submitted that the Commissioner has taken steps to comply with the procedural requirements set out in section 166 and there is no basis for the tribunal to make an order under section 166(2) DPA.

The Applicant was given the opportunity to respond to this application by case management directions dated 13 June 2025, which provided that the Applicant had 14 days to make representations in response to any application made by the Commissioner. Those 14 days expired on 22 July 2025. The Applicant has not made any representations.

The grounds of the Application are, in essence, that the Commissioner was wrong to conclude that the data controller (a credit management company) had provided the Applicant with all the information in response to her subject access request.

On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner[2021] UKUT 299 (AAC) (Killock & Veale). That is the sole focus of this Application.

Further, once an outcome to a complaint has been provided, the circumstances in which the tribunal has the power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint is very limited. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock & Vealeand R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2023] EWCA Civ 1141 and Smith v Information Commissioner[2025] UKUT 74].

The Applicant complained to the Commissioner on 2 April 2024. The Commissioner communicated the outcome of the complaint to the Applicant on 3 June 2024. This outcome was upheld on 17 July 2024. The tribunal does not have any remit to consider whether or not that outcome was substantively correct.

There is in this Application no challenge to the ‘appropriate steps’ taken by the Commissioner, and certainly none which would not involve reopening that outcome. I conclude therefore that this case does not fall within the narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint) after the complainant has been informed of the outcome of their complaint.

For those reasons, I do not consider that there is any reasonable prospect of the tribunal making any order under section 166(2).

I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.

I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.

As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

For the above reasons the Application is struck out.