Alistair O'Dwyer v The Information Commissioner

An individual (a ‘data subject’) has a right to make a complaint to the Commissioner if that individual considers that there is an infringement of the UK GDPR and/or Parts 3 or 4 of the DPA in connection with their personal data. Section 165 sets out the position as follows:

“(1)

Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.

(2)

A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.”.

So far as is relevant, section 165 then goes on to provide:

“(4)

If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a)

take appropriate steps to respond to the complaint,

(b)

inform the complainant of the outcome of the complaint,

(c)

inform the complainant of the rights under section 166, and

(d)

if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5)

The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a)

investigating the subject matter of the complaint, to the extent appropriate, and

(b)

informing the complainant about progress on the complaint...”.

In essence, therefore, section 165(4) requires the Commissioner to take appropriate steps, as well as the specified other actions, when he receives a relevant complaint from an individual. The appropriate steps which the Commissioner must take include (in summary) investigating the complaint and informing the individual about its progress.

Section 166 provides individuals with a right to make an application to the Tribunal for an order requiring the Commissioner to take appropriate steps to respond to a relevant complaint, or to inform the individual of the progress on (or outcome of) the complaint, if the Commissioner has failed to take certain procedural actions in relation to it. So far as is relevant, section 166 provides:

“(1)

This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—

(a)

fails to take appropriate steps to respond to the complaint,

(b)

fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c)

if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2)

The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a)

to take appropriate steps to respond to the complaint, or

(b)

to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3)

An order under subsection (2)(a) may require the Commissioner—

(a)

to take steps specified in the order;

(b)

to conclude an investigation, or take a specified step, within a period specified in the order.”.

I start by addressing the nature and effect of section 166. The Commissioner, in his response to the Application (and his associated strike out application), referred to various authorities from case law in that regard (in decisions of the Upper Tribunal, the High Court and the Court of Appeal). It is not necessary for me to refer to that case law again in this decision, but I accept the relevance to the Application of the various authorities which the Commissioner referred to.

I consider that it is appropriate, though, to briefly summarise the legal position based on those authorities. In essence (and so far as is relevant for current purposes) the following are the relevant legal principles.

An application under section 166:

In other words, an application under section 166 does not address the merits or substance of a complaint but rather is merely procedural in nature: it is concerned only with procedural actions which the Commissioner is required to take in respect of the complaint.

The test (in section 166(1)(a)) as to whether the Commissioner has failed “to take appropriate steps to respond to the complaint” is exactly as it says – namely “appropriate steps” and not an ‘appropriate outcome’ (or similar). Likewise, the Tribunal’s powers where the Commissioner has failed to take appropriate steps include making an order that the Commissioner must “take appropriate steps to respond to the complaint” (and not to ‘take appropriate steps to resolve the complaint’).

It is also well established that the Tribunal does not undertake an oversight role over the Commissioner’s exercise of his functions or internal processes. In considering an application under section 166, the Tribunal must bear in mind that the Commissioner is the expert regulator and so is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. Likewise, the Commissioner has a very broad discretion as to how he investigates complaints. However, whilst the Commissioner’s view carries weight, it is not decisive.

A key point regarding section 166 is that, as specified in section 166(1), it only applies in respect of a complaint made by a data subject under section 165 or under Article 77. Section 165 and Article 77 are concerned with rights given to data subjects to complain to the Commissioner if the data subject considers that, in connection with their personal data relating to him or her, there is an infringement of the UK GDPR or the DPA.

It is important to note, therefore, that the right for individuals to make an application to the Tribunal for an order under section 166(2) only applies if there has a relevant complaint to the Commissioner concerning an infringement of the UK GDPR or the DPA with regard to the complainant’s personal data.

The Commissioner applied for the Application to be struck out pursuant to Rule 8(3)(c) on the grounds that that the Application has no reasonable prospect of success. The Commissioner filed, as part of his response to the Application, a bundle of evidence as well as his submissions regarding the Application and his associated request for it to be struck out.

The Commissioner argued that the Application has no reasonable prospect of success, on the basis that an outcome to the Complaint has been provided by the Commissioner and consequently there is no reasonable prospect of persuading the Tribunal to make an order under section 166(2).

Case law has established the principles to be followed by the Tribunal when considering whether to strike out a case as having no reasonable prospect of success. In essence, the Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the case succeeding at a full hearing.

After receipt of the Commissioner’s response to the Application and his associated strike out application, the Tribunal issued a Case Management Order dated 13 October 2025, requiring the Applicant to provide his submissions in respect of the strike out application. The Case Management Order stated that it was not fair or just to consider the strike out application without having heard from the Applicant in response to it.

Pursuant to the Case Management Order, the Applicant subsequently provided his submissions in respect of the strike out application.

The Applicant wrongly interpreted the Case Management Order as “recognition that the Section 166 application raises substantive procedural adequacy questions warranting full examination”. He also incorrectly considered that the Case Management Order “directly contradicts the Respondent's position that the appeal has "no reasonable prospects of success”” and that the Tribunal had accordingly determined that the Application merited a full hearing.

The Case Management Order was, in fact, merely seeking the Applicant’s submissions on the Commissioner’s application to strike out the Application. This was a matter of procedural fairness and reflects Rule 8(4).

The Applicant made various allegations regarding the merits of the Commissioner’s handling of the Complaint, including with regard to certain matters which he alleged had not been adequately investigated.

As I have noted, section 166 is concerned with providing a remedy for any procedural failings on the part of the Commissioner after a complaint is made to him (not the merits of the complaint or its outcome). The Tribunal may only make an order under section 166(2) only if the Commissioner has failed in some procedural respect.

The evidence shows that certain steps were taken by the Commissioner, including correspondence with the Applicant regarding the Complaint, and that an outcome to the Complaint was provided by the Commissioner. In respect of the Complaint, the Commissioner concluded that Revolut Limited needed to take certain action and that he had contacted Revolut accordingly.

Given the above, I therefore find that the Commissioner has taken appropriate steps to respond to the Complaint. I also find that the Commissioner updated the Applicant regarding the outcome of the Complaint.

It is important to reiterate that, for the purposes of section 166, the merits or substance of the Complaint are not relevant - but rather only the procedural actions which the Commissioner is required to take in respect of it.

In his correspondence with the Commissioner in connection with the Complaint, the Applicant stated: “I strongly believe that this is not just about my individual case anymore, but represents systematic consumer data protection violations instead, with broader implications for regulatory accountability and consumer protection mechanisms”. He also stated in his submissions regarding the strike out application, that this was about “a request for the Commissioner to exercise statutory information-gathering powers to investigate my complaint, not a demand for personal data access”.

The Applicant submitted, in essence, that the Complaint which was the subject of the Application related to the Commissioner's power to compel evidence for regulatory investigation under section 149, rather than regarding his personal data.

As I have noted, the right for individuals to make an application to the Tribunal for an order under section 166(2) only applies if there has been a relevant complaint regarding the complainant’s personal data. On that basis, I consider that the Tribunal may not even have jurisdiction to consider the Application and it could be open to the Tribunal to strike it out pursuant to Rule 8(2)(a).

However, I have taken into account that aspects of the Complaint do relate to the Applicant’s rights regarding his personal data and that the Applicant has alleged that the Commissioner should have taken steps to investigate it.

As I have outlined, the Tribunal’s powers (had the Application been successful) would only extend to making an order for the Commissioner to either take appropriate steps to respond to the Complaint, or to inform the Applicant of progress on (or the outcome of) the Complaint.

Given my findings above that the Commissioner has taken appropriate steps to respond to, and has updated the Applicant regarding the outcome of, the Complaint, I find that there is no basis for the Tribunal to make an order under section 166(2). Accordingly I find that there is no reasonable prospect of the Applicant’s case succeeding.

For the reasons I have given, the proceedings are struck out under Rule 8(3)(c) on the basis that there is no reasonable prospect of the Applicant’s case succeeding.