Case No. FT/EA/2025/0271 | |
NCN: [2025] UKFTT 01196 (GRC) | |
 | In the First-tier Tribunal (General Regulatory Chamber) Information Rights |
Before: Judge Taft
Appellant: Mark Williams
Respondent: Information Commissioner
Determined on the papers
Decision given on 14 October 2025
Decision: The application is struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because it does not have any reasonable prospects of success.
REASONS
Mr Williams asks the Tribunal to
Instruct the ICO to conduct a full audit of his health records held by the Aneurin Bevan Health Board (ABHB) and release it to him;
Instruct the ICO to investigate the ABHB for inappropriate access to his health records; and
Instruct the ICO to investigate the ABHB for withholding/blocking or deleting information from the “watch list” and neglecting to provide that information to him.
A data subject has a right to make a complaint to the Commissioner if they consider that, in connection with the processing of personal data relating to them, there is an infringement of the [UK] General Data Protection Regulations [GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3 or 4 of the DPA18: see Article 77 [UK]GDPR, and section 165 (1) & (2) DPA2018.
Under section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.
Section 166 DPA18 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—
fails to take appropriate steps to respond to the complaint,
fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
to take appropriate steps to respond to the complaint, or
to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
An order under subsection (2)(a) may require the Commissioner—
to take steps specified in the order;
to conclude an investigation, or take a specified step, within a period specified in the order.
The powers of this Tribunal in determining an application under s.166 are limited to those set out in s.166(2). The jurisdiction to make an Order is limited to circumstances in which there has been a failure of the type set out in s.166(1) (a), (b) and (c). The Tribunal has no power to deal with the merits of the complaint to the Commissioner.
The Tribunal may consider whether a step is appropriate; the Information Commissioner’s view on this will not be determinative but should be taken into account by this Tribunal and accorded due weight given that the Commissioner is an expert regulator in the best position to decide what investigations should be undertaken into any particular issue and how that should be done. This Tribunal will not interfere with an exercise of regulatory judgement without good reason.
As the Upper Tribunal confirmed in Smith v ICO [2025] UKUT 74 (AAC) [at paragraph 60], “the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.”
Mr Williams made a complaint to the ICO on 20 August 2024. After seeking information from the ABHB, the ICO provided an outcome on 25 March 2025. Mr Williams then sought a case review, for which an outcome was provided on 1 July 2025. Mr Williams does not agree with the outcomes with which he has been provided, but this Tribunal has no power to consider an appeal against the Information Commissioner’s substantive findings.
The “appropriate steps” Mr Williams seeks are not procedural but substantive. The Tribunal does not have the power to order the ICO to make a different substantive decision.
For that reason, the application has no reasonable prospects of success.
Signed: Judge Taft
Date: 3 October 2025