Shervin Sameni Fallah v The Information Commissioner

These proceedings concern an application (the “Second Application”) under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) for an order to progress the Applicant’s complaints against Bupa Global (UK) (“Bupa”) regarding a subject access request (“SAR”) dated 8 August 2025. The complaint was submitted to the Information Commissioner (“IC”) on 20 August 2025 and was dealt with under reference IC-416103-D1J4.

On 7 January 2026, the Applicant made an application to the Tribunal in relation to IC-416103-D1J4 which was given the Tribunal reference FT-EA-2026-0008-GDPR (“the First Application”).

On 13 January 2026, the IC’s case officer contacted the Applicant and asked him to provide a copy of the complaint he had made to Bupa and its response. On the same date, the Applicant responded clarifying the scope of his complaint and providing the case officer with some screenshots of email correspondence exchanged with Bupa.

On 14 January 2026 the case officer wrote to the Applicant noting that he had made a complaint to Bupa on 12 August 2025 and requesting copies of their response to it. The Applicant responded on the same day providing a copy of Bupa’s response.

Also on 14 January 2026, the case officer responded to the Applicant. She explained that, having considered the material provided by the Applicant, she was of the view that Bupa needed to do more to address his complaint. The case officer said she had written to Bupa asking them to contact the Applicant within 28 days.

On the same day the case officer wrote to Bupa noting that it appeared that it had failed to comply with the time limit for complying with the Applicant’s request, and requesting that it respond to the Applicant’s outstanding concerns within 28 days.

The Applicant then responded to the case officer thanking her for raising his concerns with Bupa and stating that he would revert to the IC if he remained dissatisfied with the explanation received from Bupa.

On 5 February 2026, Judge Barrett struck out the First Application under rule 8(3)(c) because there was no reasonable prospect of the First Application succeeding.

On 9 February 2026, the Applicant contacted the IC raising concerns with the response received from Bupa stating that there were deficiencies within the response.

On 10 February 2026, the IC’s case officer wrote to the Applicant outlining that they could raise the concerns with Bupa directly to allow them a chance to address them and highlighted: (i) that organisations are not obliged to provide detailed breakdowns on what they decide to disclose or withhold, (ii) that an Applicant may not always receive all of the information they expect and provided a link to the IC’s guidance on what to expect from an SAR and (iii) outlined the obligations of the IC under section 165 DPA18, stating that an outcome has previously been provided on 14 January 2026 and that a log had been taken of the way Bupa handled the Applicant’s data. They further reminded the Applicant that individuals should not expect the IC to take any further action beyond providing an assessment or to resolve matters to the individual’s satisfaction. The case officer reminded the Applicant of their right to take the case to court but recommended that the Applicant should seek legal advice before doing so.

On the same date, the Applicant requested a review of the handling of his complaint. This request was acknowledged and given a 30-day response time on 12 February 2026. The Applicant made three further sets of submissions in relation to the review on 12 and 13 February 2026.

The IC’s reviewing officer wrote to the Applicant on 26 February 2026 upholding the IC’s response dated 10 February 2026 and providing detailed reasons for doing so.

The Applicant made a service complaint on 26 February 2026. On 27 February 2026, the IC wrote to the Applicant in relation to his service complaint stating their view that both the original case officer and the reviewing officer handled the complaint appropriately and in accordance with the IC’s procedures. They informed the Applicant that he had exhausted the IC’s internal case and service review processes and informed him of his right to refer to the Parliamentary and Health Service Ombudsman (PHSO) and/or pursue his data protection concerns through the courts.

On 9 March 2026, the Applicant again emailed the IC to raise concerns.

On 10 March 2026, the IC wrote to the Applicant again, noting that he had received an outcome, a case review and a service complaint response, which together represented the full extent of the IC’s internal processes. He informed the Applicant that there was no further stage at which the issues raised could be reconsidered and that the IC would not be reopening the investigation or conducting a further review. The IC stated that it had considered the Applicant’s request to refer the matter for criminal investigation under section 170 DPA 2018, but that the threshold for doing so was not met.

The Applicant applied to the Tribunal by way of form GRC3 dated x. He stated that the outcome he was seeking was as follows:

“An order under Section 166(2)(a) DPA 2018 requiring the Commissioner to take appropriate steps to respond to the complaint, specifically: (a) to initiate correspondence with BISL requiring explanation of the discrepancy between its DSAR response and documents obtained through the UAE SAR; (b) to assess whether BISL's exemption claims for withholding internal communications were lawful; (c) to assess whether the attendance of a Bupa representative at the Applicant's psychiatric clinic without consent constituted unlawful processing of special category data; and (d) to provide a reasoned outcome engaging with the evidence submitted.”

In his grounds and supplemental grounds for the Second Application, the Applicant made the following points, in summary:

The IC applied by way of form GRC5 dated 17 April 2026 to strike out the Second Application on the basis that the Tribunal has no jurisdiction to consider it under Rule 8(2)(a) and/or that there is no reasonable prospect of it succeeding under Rule 8(3)(c) and/or as an abuse of process (the “strike-out application”).

The reasons which the IC gave for striking out the application were set out in its Response. In summary, these were as follows: 

The Applicant provided a Reply to the Response dated 20 April 2026, which deals with the strike-out application as well as the substantive response, so I am satisfied that the Applicant has had an opportunity to make representations on the proposed striking out under rule 8(4). The points made by the Applicant, in summary, were as follows:

Section 165 DPA 2018 sets out the right of data subjects to complain to the IC about infringement of their rights under the data protection legislation. Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows: 

“Orders to progress complaints

(1)

This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner -

a.

fails to take appropriate steps to respond to the complaint,

b.

fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

c.

if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2)

The Tribunal may, on an application by the data subject, make an order requiring the Commissioner -

d.

to take appropriate steps to respond to the complaint, or

e.

to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.”

The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. 

Section 165 deals with the complainant’s right to make a complaint and states that: 

“(4)

If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a)take appropriate steps to respond to the complaint,

(b)inform the complainant of the outcome of the complaint,

(c)inform the complainant of the rights under section 166, and

(d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5)

The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a)investigating the subject matter of the complaint, to the extent appropriate, and

(b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with  foreign designated authority is necessary.”

In the case of Killock v Information Commissioner [2022] 1 WLR 2241, the Upper Tribunal at paragraph 74 stated - "…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."

Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 - "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...”. 

Mostyn J’s decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141) – “For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.” (paragraph 80, Warby LJ). 

The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo confirmed that the nature of section 166 is that of a limited procedural provision only. “The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33). 

The case of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC), noted at paragraph 60 that “it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an appropriate step has been omitted is limited.” In considering this the Tribunal must, as set out in paragraph 85 of Killick “when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator.”

Paragraph 85 of Killick reads as follows: “However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.”

The Applicant has asked that the question of strike-out be determined at an oral hearing if the Tribunal is minded to strike out any aspect of the Second Application. The Tribunal may, under rule 32(3), in any event dispose of proceedings without a hearing under rule 8 (striking out a party's case). Taking into account the overriding objective, and in particular, ensuring, so far as practicable, that the parties are able to participate fully in the proceedings, I note that the Applicant is not legally represented, but has provided full written submissions both in support of the Second Application and the strike-out application. Given that he has argued his case at length in these submissions, I do not consider that an oral hearing would be likely to elicit any further arguments which would assist the Tribunal and conclude that there is no material unfairness to the Applicant in the Tribunal determining the strike-out application without a hearing.

I note the Applicant’s clear statement in their Reply that the Second Application is not intended to reopen the First Application but is concerned only with matters arising after the First Application had been struck out by the Tribunal on 5 February 2026. I have therefore decided to consider first the threshold questions of whether the Tribunal has jurisdiction and/or can grant the remedies sought in relation to these specific matters under section 166. This is because if the Tribunal in any event does not have jurisdiction or cannot make the orders asked for then the question of whether seeking for it to do so is an abuse of process does not arise.

. The IC provided the Applicant with a response to his complaint on 14 January 2026, with further responses on 26 February 2026, 27 February 2026 (in relation to the service complaint) and after review on 10 March 2026. I consider that the response dated 14 January 2026 was in fact an outcome to the complaint, because provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint. The Applicant accepts that an outcome to his complaint was provided on 14 January 2026 so this aspect is not in dispute. This is sufficient in my view to demonstrate that the IC has complied with the requirements of section 165(4). The fact that the Applicant does not agree with the outcome does not render it wrong in law.

The next question is whether appropriate steps were taken to respond to the Applicant’s complaint after the First Application was determined, as this is the Applicant’s stated scope for the Second Application set out in his Reply.

The first issue raised by the Applicant is procedural failure in relation to the IC’s handling of a formal review request. The chronology set out by the Applicant at section C of his Reply, indicates that he submitted new material evidence to the IC on 9 February 2026 including evidence of a discrepancy between Bupa’s response to his UK SAR and documents obtained through a parallel subject access process in the UAE and evidence of attendance by a representative of the controller at a clinic treating the Applicant without the Applicant’s consent. I find as a matter of fact that the “new” review request was the Applicant’s email to the IC dated 10 February 2026. In summary, this request says that:

In my view, this request is in fact challenging (i) the adequacy of the response to the SAR by Bupa and (ii) the IC’s approach to considering this, rather than arguing that there were appropriate steps which the IC needed to have taken to reach an outcome in the Applicant’s complaint. In my view these are both substantive challenges and thus matters for judicial review, as the Applicant acknowledges in his email dated 10 February 2026. An application under section 166 cannot be used as a cost-free alternative to judicial review proceedings.

The second issue raised by the Applicant is that the IC has omitted appropriate steps in respect of new material evidence. He failed to investigate the subject matter to the extent appropriate. He argues that the appropriate level of investigation cannot be exhausted by a review that expressly declines to engage with the new evidence. The new evidence, set out at paragraph 6 of the grounds of application, consists of an internal email and 274 files obtained through an SAR in the UAE together with what the Applicant says is evidence of processing by Bupa of special category health data without a lawful basis.

Based on the decisions of the Upper Tribunal and Court of Appeal set out in Delo (see paragraphs 25 and 26 above) I consider that the IC is correct to state that the extent of any investigation is in his broad discretion. The jurisdictions of England and Wales and the UAE are entirely separate, so what is disclosable under one jurisdiction does not automatically mean it is disclosable under the other. Challenges to the way in which the IC has dealt with this and the extent of its investigation are, again, substantive challenges for judicial review, not for this Tribunal.

The third issue raised by the Applicant is in relation to his request to the IC that it commence criminal investigation into Bupa under section 170 DPA 2018. This was dealt with explicitly in the review dated 12 March 2026, where the IC stated that it had considered the request and concluded that the information provided by the Applicant did not indicate that a criminal offence may have been committed. What the Applicant now appears to be trying to do in his Reply is to “appeal” this conclusion through the Second Application. This is not a proper use of the procedural mechanism for an order to progress an investigation under section 166.

It appears to me therefore that there are no further appropriate steps which the IC ought reasonably to take to progress the complaint.  In making this decision I have given significant weight to the view of the IC as the expert regulator that there are no further appropriate steps he should have taken.  

The remedy sought by the Applicant is also, in effect, challenging the substantive outcome of the complaint to the IC. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint, which includes the decision reached as well as the way in which it was reached. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision.   In an application under section 166, the Tribunal has no power to direct the IC to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the UK GDPR. I also agree with the IC’s position that orders for compliance need to be sought through civil action. Accordingly, I find that the Tribunal does not have the power to grant the remedies sought. 

Because I consider that there was an outcome determining the complaint and that there were no further appropriate steps which should be taken, I find the complaint has already been determined and therefore the Tribunal has no jurisdiction over it.  I am also satisfied that there is no reasonable prospect of the case, or any part of it, succeeding because the outcome sought by the Applicant is not something which is within the Tribunal’s power to grant.

Having determined that the Tribunal does not have jurisdiction or the power to grant the remedies sought, there is no need to consider additionally whether the Second Application is an abuse of process in order to strike it out, as sufficient grounds already exist.

The proceedings are therefore struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with them and under Rule 8(3)(c) because there is no reasonable prospect of them succeeding.