Case Reference: FT/EA/2026/0209/GDPR
Information Rights
Decided without a hearing
Before
JUDGE STEPHEN ROPER
Between
KERRY HINDMARCH
Applicant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The application is struck out
REASONS
Preliminary matters
In this decision, I use the following terms to denote the meanings shown:
Applicant: | Kerry Hindmarch. |
Application: | The Applicant’s application dated 26 May 2026 (via Form GRC3) for an order by the Tribunal under section 166(2) in respect of the Complaint. |
Commissioner: | The Information Commissioner (the Respondent). |
Complaint: | The Applicant’s complaint to the Commissioner, dated 30 May 2025, concerning the refusal by Vincent Solicitors Limited of the Applicant’s subject access request. |
DPA: | |
Tribunal Rules: | The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. |
UK GDPR: | The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018. |
Unless the context otherwise requires (or as otherwise expressly stated), references in this decision:
to a section are references to the applicable section of the DPA; and
to a Rule are references to the applicable rule of the Tribunal Rules.
Nothing I say in this decision should be treated as the Tribunal’s view regarding the merits of the Commissioner’s decision (outcome) in respect of the Complaint. That is not a matter which is within the powers of the Tribunal to determine, for the reasons I refer to below.
Summary of this decision
This decision relates to the Applicant’s application for an order by the Tribunal under section 166(2).
The Commissioner made an application to strike out the Application.
Pursuant to Rule 8(3)(c), the Tribunal may strike out proceedings if it considers that there is no reasonable prospect of a case succeeding. However, in accordance with Rule 8(4), the Applicant is to be afforded the opportunity to make submissions in relation to any proposed strike out. As noted below, the Applicant has provided such submissions.
Having considered the relevant evidence and submissions of the parties, I conclude that the Application should be struck out as having no reasonable prospect of success. I set out my reasons below.
The Application
The basis of the Application was the Applicant’s view that, in essence, the Commissioner’s statement (in his outcome to the Complaint) that no factors had been identified to suggest significant harm which would warrant intervention from the Commissioner was inaccurate. The Applicant asserted that his was an unjust and ‘suspect’ response from the Commissioner.
Following the Commissioner’s strike out application, the Applicant provided their submissions in respect of it, which I have taken into account. In summary, though, it was clear that the Applicant was unhappy with the merits or substance of the outcome to the Complaint. Regarding the Commissioner’s submissions in support of his strike out application, the Applicant stated (in essence) that:
there was much emphasis by the Commissioner on procedural focus, but the matters which were the subject of the Complaint were not procedural in nature but rather concerned “biases and other significant factors”; and
the Application was not concerned with procedural issues, but rather the reasons behind the data controller’s refusal of the Applicant’s subject access request.
The Tribunal’s powers and role
The relevant powers of the Tribunal are set out in section 166(2) (as supplemented by section 166(3)). In summary, the Tribunal is empoweredto make an order requiring the Commissioner either:
to take appropriate steps to respond to an applicable complaint; or
to inform the complainant of the progress on that complaint, or of the outcome of that complaint, within a period which the Tribunal may specify.
However, an application under section 166 permits the Tribunal to make any such order only if the Commissioner has failed in some procedural respect, as specified in section 166(1) which is referred to below.
The relevant statutory framework
The right to complain to the Commissioner
An individual (a ‘data subject’) has a right to make a complaint to the Commissioner if that individual considers that there is an infringement of the UK GDPR and/or Parts 3 or 4 of the DPA in connection with their personal data. Section 165 sets out the position as follows:
“(1) Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.
(2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.”.
So far as is relevant, section 165 then goes on to provide:
“(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—
(a) take appropriate steps to respond to the complaint,
(b) inform the complainant of the outcome of the complaint,
(c) inform the complainant of the rights under section 166, and
(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
(a) investigating the subject matter of the complaint, to the extent appropriate, and
(b) informing the complainant about progress on the complaint...”.
In essence, therefore, section 165(4) requires the Commissioner to take appropriate steps, as well as the specified other actions, when he receives a relevant complaint from an individual. The appropriate steps which the Commissioner must take include (in summary) investigating the complaint and informing the individual about its progress.
The right to apply to the Tribunal
Section 166 provides individuals with a right to make an application to the Tribunal for an order requiring the Commissioner to take appropriate steps to respond to a relevant complaint, or to inform the individual of the progress on (or outcome of) the complaint, if the Commissioner has failed to take certain procedural actions in relation to it. So far as is relevant, section 166 provides:
“(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period specified in the order.”.
Discussion and findings
The nature and effect of section 166
I start by addressing the nature and effect of section 166. The Commissioner, in his response to the Application (and his associated strike-out application), referred to various authorities from case law in that regard (in decisions of the Upper Tribunal, the High Court and the Court of Appeal). It is not necessary for me to refer to that case law again in this decision, but I accept the relevance to the Application of the various authorities which the Commissioner referred to.
I consider that it is appropriate, though, to briefly summarise the legal position based on those authorities. In essence (and so far as is relevant for current purposes) the following are the relevant legal principles.
An application under section 166:
is not concerned with the merits of the relevant complaint; and
does not provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint.
In other words, an application under section 166 does not address the merits or substance of a complaint but rather is merely procedural in nature: it is concerned only with procedural actions which the Commissioner is required to take in respect of the complaint.
The test (in section 166(1)(a)) as to whether the Commissioner has failed “to take appropriate steps to respond to the complaint” is exactly as it says – namely “appropriate steps” and not an ‘appropriate outcome’ (or similar). Likewise, the Tribunal’s powers where the Commissioner has failed to take appropriate steps include making an order that the Commissioner must “take appropriate steps to respond to the complaint” (and not to ‘take appropriate steps to resolve the complaint’).
Where the Commissioner has provided an outcome to a complaint, there may still be some scope for the First-tier Tribunal to make an order under section 166(2). However, in practice, once an outcome has been provided then the First-tier Tribunal will have limited scope to find that an “appropriate step” has been omitted.
It is also well established that the Tribunal does not undertake an oversight role over the Commissioner’s exercise of his functions or internal processes. In considering an application under section 166, the Tribunal must bear in mind that the Commissioner is the expert regulator and so is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. Likewise, the Commissioner has a very broad discretion as to how he investigates complaints. However, whilst the Commissioner’s view carries weight, it is not decisive.
The Commissioner’s strike-out application
The Commissioner applied for the Application to be struck out pursuant to Rule 8(2)(a) or Rule 8(3)(c) on the grounds that either the Tribunal has no jurisdiction to consider the Application or that the Application has no reasonable prospect of success.
As the Application was made pursuant to section 166, seeking an order from the Tribunal pursuant to section 166(2), it follows that I must reject the Commissioner’s argument (in respect of the first ground) that the Tribunal has no jurisdiction to determine the matters before it.
In respect of the second ground, the Commissioner argued that the Application has no reasonable prospect of success, on the basis that an outcome to the Complaint has been provided by the Commissioner and consequently there is no reasonable prospect of persuading the Tribunal to make an order under section 166(2).
Case law has established the principles to be followed by the Tribunal when considering whether to strike out a case as having no reasonable prospect of success. In essence, the Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the case succeeding at a full hearing.
Whether there was a procedural failing by the Commissioner
As I have noted, section 166 is concerned with providing a remedy for any procedural failings on the part of the Commissioner after a complaint is made to him (not the merits of the complaint or its outcome). The Tribunal may only make an order under section 166(2) only if the Commissioner has failed in some procedural respect.
The procedural failings in question are those set out in section 166(1), which (in summary and paraphrasing) are as follows:
not taking appropriate steps to respond to the complaint;
not updating the complainant about progress on, or of the outcome of, the complaint within three months of the Commissioner receiving the complaint;
not updating the complainant during a subsequent period of three months if the Commissioner has not concluded matters within the first three months.
The evidence shows that certain steps were taken by the Commissioner, including correspondence with the Applicant regarding the Complaint, and that an outcome to the Complaint was provided by the Commissioner.
An outcome to the Complaint was provided by the Commissioner by way of letter dated 18 May 2026. The Commissioner stated that it may have been frustrating for the Applicant to not receive a response from the data controller to their subject access request, but concluded that there were no identified factors to suggest significant harm, wider impact, or broader data protection concerns that would warrant intervention from the Commissioner in respect of the Complaint.
After further correspondence with the Applicant, the Commissioner also provided written confirmation dated 15 June 2026 (following an internal review) that, in summary, the outcome previously provided was appropriate.
Given the above, I therefore find that the Commissioner has taken appropriate steps to respond to the Complaint.
It is important to reiterate that, for the purposes of section 166, the merits or substance of the Complaint are not relevant - but rather only the procedural actions which the Commissioner is required to take in respect of them.
Whether there is a reasonable prospect of the Applicant’s case succeeding
As I have outlined, the Tribunal’s powers (had the Application been successful) would only extend to making an order for the Commissioner to either take appropriate steps to respond to the Complaint, or to inform the Applicant of progress on (or the outcome of) the Complaint.
The Commissioner has therefore now done all that the Tribunal could have ordered him to do regarding the Complaint. Consequently I find that there is no basis for the Tribunal to make an order under section 166(2) and accordingly that there is no reasonable prospect of the Applicant’s case succeeding.
Other points
I recognise that the matters which are the subject of the Complaint are important to the Applicant and that the Applicant is unhappy with the Commissioner’s conclusions regarding the Complaint. However:
if the Applicant wishes to challenge the merits or the substance of the Commissioner’s decision (outcome) in respect of the Complaint, that is not a matter for the Tribunal under section 166 but rather a matter for a judicial review claim in the Administrative Court;
if the Applicant wishes to take action against the data controller in question relating to their personal data rights, again that is not a matter for the Tribunal under section 166 but there are options for the Applicant to pursue civil proceedings under section 167 and section 169.
Final conclusions
For the reasons I have given, the proceedings are struck out under Rule 8(3)(c) on the basis that there is no reasonable prospect of the Applicant’s case succeeding.
Signed: Stephen Roper Date: 8 July 2026
Judge of the First-tier Tribunal