Daniel Morris v The Information Commissioner

An individual (a ‘data subject’) has a right to make a complaint to the Commissioner if that individual considers that there is an infringement of the UK GDPR and/or Parts 3 or 4 of the DPA in connection with their personal data. Section 165 sets out the position as follows:

“(1)

Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.

(2)

A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.”.

So far as is relevant, section 165 then goes on to provide:

“(4)

If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a)

take appropriate steps to respond to the complaint,

(b)

inform the complainant of the outcome of the complaint,

(c)

inform the complainant of the rights under section 166, and

(d)

if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5)

The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a)

investigating the subject matter of the complaint, to the extent appropriate, and

(b)

informing the complainant about progress on the complaint...”.

In essence, therefore, section 165(4) requires the Commissioner to take appropriate steps, as well as the specified other actions, when he receives a relevant complaint from an individual. The appropriate steps which the Commissioner must take include (in summary) investigating the complaint and informing the individual about its progress.

Section 166 provides individuals with a right to make an application to the Tribunal for an order requiring the Commissioner to take appropriate steps to respond to a relevant complaint, or to inform the individual of the progress on (or outcome of) the complaint, if the Commissioner has failed to take certain procedural actions in relation to it. So far as is relevant, section 166 provides:

“(1)

This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—

(a)

fails to take appropriate steps to respond to the complaint,

(b)

fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c)

if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2)

The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a)

to take appropriate steps to respond to the complaint, or

(b)

to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3)

An order under subsection (2)(a) may require the Commissioner—

(a)

to take steps specified in the order;

(b)

to conclude an investigation, or take a specified step, within a period specified in the order.”.

I start by addressing the nature and effect of section 166. The Commissioner, in his response to the Application (and his associated strike-out application), referred to various authorities from case law in that regard (in decisions of the Upper Tribunal, the High Court and the Court of Appeal). It is not necessary for me to refer to that case law again in this decision, but I accept the relevance to the Application of the various authorities which the Commissioner referred to.

I consider that it is appropriate, though, to briefly summarise the legal position based on those authorities. In essence (and so far as is relevant for current purposes) the following are the relevant legal principles.

An application under section 166:

In other words, an application under section 166 does not address the merits or substance of a complaint but rather is merely procedural in nature: it is concerned only with procedural actions which the Commissioner is required to take in respect of the complaint.

The test (in section 166(1)(a)) as to whether the Commissioner has failed “to take appropriate steps to respond to the complaint” is exactly as it says – namely “appropriate steps” and not an ‘appropriate outcome’ (or similar). Likewise, the Tribunal’s powers where the Commissioner has failed to take appropriate steps include making an order that the Commissioner must “take appropriate steps to respond to the complaint” (and not to ‘take appropriate steps to resolve the complaint’).

It is also well established that the Tribunal does not undertake an oversight role over the Commissioner’s exercise of his functions or internal processes. In considering an application under section 166, the Tribunal must bear in mind that the Commissioner is the expert regulator and so is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. Likewise, the Commissioner has a very broad discretion as to how he investigates complaints. However, whilst the Commissioner’s view carries weight, it is not decisive.

The Applicant provided submissions to the Tribunal in respect of the strike out application (and in reply to the Comm’s response). Amongst other things, he challenged that the Commissioner was an ‘expert regulator’ – however, that is simply a reflection of the position established by case law, which the Tribunal needs to take into account (as I have mentioned).

The Commissioner applied for the Application to be struck out pursuant to Rule 8(3)(c) on the grounds that the Application has no reasonable prospect of success.

Form GCR5 submitted by the Commissioner referred also to a potential strike out of the Application on the grounds that the Tribunal has no jurisdiction to consider the Application. However, the Commissioner’s supporting grounds did not address that, and did not refer to Rule 8(2)(a), and I therefore find that the Commissioner was not seeking to strike out the Application on the basis of the Tribunal not having jurisdiction.

The Commissioner argued that the Application has no reasonable prospect of success, on the basis that an outcome to the Complaint has been provided by the Commissioner and consequently there is no reasonable prospect of persuading the Tribunal to make an order under section 166(2).

Case law has established the principles to be followed by the Tribunal when considering whether to strike out a case as having no reasonable prospect of success. In essence, the Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the case succeeding at a full hearing.

As I have noted, section 166 is concerned with providing a remedy for any procedural failings on the part of the Commissioner after a complaint is made to him (not the merits of the complaint or its outcome). The Tribunal may only make an order under section 166(2) only if the Commissioner has failed in some procedural respect.

The procedural failings in question are those set out in section 166(1), which (in summary and paraphrasing) are as follows:

At the time of the Application, it appears (from the evidence available to me) that there was no response from the Commissioner to the Complaint. However, the Commissioner did deal with the Complaint after the date of the Application. The evidence shows that certain steps were taken by the Commissioner and that an outcome to the Complaint was provided by the Commissioner, as referred to in the next paragraph.

The Commissioner concluded that there was a failing on the part of the Information Commissioner’s Office regarding the Applicant’s subject access request. The Commissioner advised the Applicant (by way of a letter dated 1 August 2025) that he had contacted the Information Commissioner’s Office advising it to take certain specified steps.

Given the above, I therefore find that the Commissioner has taken appropriate steps to respond to the Complaint and provided the Applicant with an outcome to the Complaint (albeit he did not do so within three months of receiving the Complaint).

It is important to reiterate that, for the purposes of section 166, the merits or substance of the Complaint are not relevant - but rather only the procedural actions which the Commissioner is required to take in respect of it.

As I have outlined, the Tribunal’s powers (had the Application been successful) would only extend to making an order for the Commissioner to either take appropriate steps to respond to the Complaint, or to inform the Applicant of progress on (or the outcome of) the Complaint.

The Commissioner has therefore now done all that the Tribunal could have ordered him to do regarding the Complaint. Consequently I find that there is no basis for the Tribunal to make an order under section 166(2) and accordingly that there is no reasonable prospect of the Applicant’s case succeeding.

For the reasons I have given, the proceedings are struck out under Rule 8(3)(c) on the basis that there is no reasonable prospect of the Applicant’s case succeeding.