Case Reference: FT/EA/2026/0089/GDPR
Information Rights
Decided without a hearing
Before
JUDGE HEALD
Between
ZOFIJA TOPALOVA
Applicant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The Application is struck out by rule 8(2)(a) and rule 8(3)(c) The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.
REASONS
This Application is brought by section 166(2) Data Protection Act 2018 ("DPA18"). The Respondent has applied for it to be struck out. This decision has been made without a hearing as provided for by rule 32(3) The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 ("2009 Rules").
Background in summary
The Applicant takes issue with the way in which Thanet District Council ("the Council") dealt with a request made to them and the sharing of data with Orbit Housing Association. The Applicant made a complaint about this to the Respondent ("the IC") which was allocated case reference IC-440553-L7Y3. On 3 February 2026 the IC sent the Applicant, what was said by the IC to be, the outcome of the complaint. The Applicant was not satisfied with this and commenced this Application.
The Application
The Applicant originally provided a form GRC1 dated 2 March 2026 but then the correct form GRC3 dated 11 March 2026. I have proceeded on the basis that the GRC3 was intended to replace the GRC1 which had been used by mistake.
The Application is supported by Grounds. I have considered the version dated 11 March 2026 (being the same date as the GRC3) and not the initial version dated 2 March 2026 (being the same date as the GRC1). The IC opposes the Application and has applied for it to be struck out by rule 8(2)(a) and/or rule 8(3)(c) 2009 Rules. The Applicant opposes the strike out and has replied to it.
DPA18
The relevant parts of section 165 DPA18 provide as follows:-
Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.
A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.
If the Commissioner receives a complaint under subsection (2), the Commissioner must
(a)take appropriate steps to respond to the complaint,
(b)inform the complainant of the outcome of the complaint,
(c)inform the complainant of the rights under section 166, and
(d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
(5)The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
(a)investigating the subject matter of the complaint, to the extent appropriate, and
(b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with foreign designated authority is necessary.
Section 166 DPA18 sets out the limit of the scope of any remedy available to an applicant. It provides that if, after a data subject makes a complaint, the IC fails to take appropriate steps to respond to the complaint or fails to provide the complainant with information about the outcome of the complaint then the Tribunal may order the IC:-
"(a)to take appropriate steps to respond to the complaint, or
(b)to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order."
and
"(3)An order under subsection (2)(a) may require the Commissioner—
(a)to take steps specified in the order;
(b)to conclude an investigation, or take a specified step, within a period specified in the order."
Authorities
In the Response the IC refers to a number of the relevant legal authorities regarding the extent of the Tribunal's jurisdiction, the focus of section 166 DPA18, the meaning of "appropriate steps" and the "broad discretion" of the IC. These are:-
the Judgment of Mostyn J in Delo R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 admin;
the Judgment of the Court of Appeal in Delo ( [2023] EWCA Civ 1141);
the Decisions of the Upper Tribunal ("UT") in Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC);
Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC);
Michael Smith v Information Commissioner [2025] UKUT 74 (AAC); and
Evans v Information Commissioner [2025] UKFTT 1057 (GRC).
I agree with the IC's submissions on the law and also had regard to:-
Cortes -v- The Information Commissioner [2023] UKUT 313 (AAC)
Leighton -v- Information Commissioner (no 2) [2020] UKUT 23 (ACC)
The Applicant's position
The Applicant has asked the Tribunal to:-
“... set aside the Commissioner’s decision dated 3 February 2026... and to remit the case to the Commissioner for reconsideration in accordance with the requirements of Articles 6(1)(e), 5(2), and 30 UK GDPR.”
In the Grounds the Applicant asserts that:-
there was an error of law in the application of Article 6(1)(e) UKGDPR;
there was a failure to apply the principle of accountability based on Article 5(2) UKGDPR;
the IC improperly excluded relevant evidence;
there was an internal contradiction in the Decision; and
the IC's decision was legally flawed by reference to Article 30 UKGDPR when the IC said “We are unable to look into the points raised about TDC's internal processes for handling customer requests and complaints. These concerns do not fall within our remit because they relate to customer service issues.”
The Applicant's conclusion is that:-
"...the decision was reached without the application of mandatory UK GDPR criteria and without consideration of relevant evidence. This constitutes a Material Error of Law and a failure by the Commissioner to discharge the supervisory duty prescribed by Section 165 of the Data Protection Act 2018.
The contested decision therefore cannot be regarded as legally justified. I respectfully ask the Tribunal to set aside the Commissioner’s decision and remit the case for a fresh investigation on its merits, taking into account all previously excluded facts and evidence."
In a response to the strike out application the Applicant also made these submissions:-
the Tribunal does have jurisdiction because "..the Respondent failed to take appropriate steps to investigate the complaint, as required by section 165 of the Data Protection Act 2018, and therefore failed properly to determine the complaint."
the Application raises "multiple arguable errors of law" and therefore it "meets the threshold of an arguable case and is not bound to fail."
the IC's discretion to investigate a complaint to an appropriate extent must be exercised " on aproper evidential basis and in accordance with the statutory framework of the UKGDPR"
Review
DPA18 provides a remedy if the IC has failed to take appropriate steps to respond to the complaint and/or failed to provide an outcome. From the legal authorities and other First-tier Tribunal decisions (with which I agree) the following principles relevant to this Application can be stated as follows:-
the IC is an "expert regulator" and is in the best position to "consider the merits of a complaint and to reach a conclusion as to its outcome”(Killock at para 76);
the Tribunal has no power to deal with the merits of the original complaint or its outcome and "Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals"(Killock at para 74);
the IC has the discretion to decide:-
"...the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under Article 79. And then he decides whether he shall, or shall not, reach a conclusive determination" (Delo at para 57)
as was said in Evans at para 39:-
"...not every complaint must involve an investigation by the Commissioner, if by investigation what is meant is external engagement with a complainant and a data controller and the acquisition of relevant information from third parties such as the relevant data controller. That would be to overstate the meaning of “investigation” and to ignore the critical qualifying phrase in Article 57(1)(f) of the UK GDPR, that investigation is only required “to the extent appropriate”. In some, perhaps many cases, investigation may only require a desktop consideration of a complaint."
the IC's discretion extends to deciding "...whether to conduct a further investigation..." (Delo in the Court of Appeal at para 80);
where the IC has exercised its own regulatory judgment the Tribunal will need "good reason to interfere (which may in turn depend on the degree of regulatory judgment involved) and cannot simply substitute its own view."(Killock at para 86);
the Tribunal when deciding if a step is appropriate "will decide the question of appropriateness for itself" but in doing so the Tribunal "will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator"(Killock at paras 84-85);
when dealing with complaints "the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations" (Killock at para 85);
in Mahmood the Tribunal said:-
"53... any consideration by the tribunal, after an outcome has been issued, of whether steps taken to investigate the complaint were appropriate or whether relevant evidence was considered or taken into account is likely to step on the toes of the High Court. If the tribunal were to order the Commissioner to take those steps after an outcome has been issued, this would be likely to unpick or unwind that outcome. The tribunal has no power to order the Commissioner to retrospectively take a step that it deems appropriate, where taking such a step might lead to a different substantive outcome to the complaint"
but as was said in Smith (at para 60) the issuing of an outcome by the IC does not mean that there is no scope for the Tribunal to find that an appropriate step has been omitted but the scope for reaching such a conclusion is limited and it is unlikely that a Tribunal will conclude an appropriate step has been omitted where an outcome has been provided because:-
"60...section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review ofthe Commissioner, section 166 should not be used to obtain 'by the back door' a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an "appropriate" step has been omitted is limited."
the Tribunal's role is to specify, if necessary, appropriate steps that the IC should take to respond but not to assess "...the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)... "(Cortes at para 33)
in Leighton the UT said (at para 31) that:-
the purpose of section 166 DPA18 is to provide a remedy if the IC has failed to deal with a section 165 DPA18 complaint in a"procedurally proper fashion";
(ii) the focus of section 166 is on any procedural failings and “Appropriate steps” mean just that, and not an “appropriate outcome”; and
the Tribunal's powers include "making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant..."
Articles 6(1)(e), 5(2) and 30 of the UKGDPR are cited by the Applicant in support of this Application. However 6(1)(e) sets out one of the ways in which processing of personal data may be lawful, 5(2) requires a controller to be responsible for ensuring compliance with the principles if processing personal data in Article 5(1); and 30 deals with how a controller is to keep records of the processing but the Tribunal's concern, guided by the authorities, is limited to determining whether an outcome was produced by the IC and whether the steps taken were appropriate.
Outcome
On 3 February 2026 the IC wrote to the Appellant and said:-
"Having reviewed the 4 July 2025 response from TDC we are satisfied with their explanation and are of the view that the steps they have taken to respond to your request are reasonable. We therefore do not deem it necessary or appropriate to pursue this complaint further.
From the correspondence provided, we are satisfied with TDC's explanation that the transfer of your request was processed under the lawful basis of performing a public task in accordance with the Kent and Medway Information Sharing Agreement (KMISA).
It is also noted that TDC acknowledged that their joint response to you with OHA did not fully meet the formalities expected under the UK GDPR, and they have indicated that they will take this into account in future communications. In the circumstances, it does not appear that it would be a proportionate use of our resources to pursue this matter further.
It also may be helpful to explain that we would not expect TDC to carry out a Data Protection Impact Assessment (DPIA) for every individual decision to process data under the basis of carrying out a task in the public interest.
We are unable to look into the points raised about TDC's internal processes for handling customer requests and complaints. These concerns do not fall within our remit because they relate to customer service issues.
While we appreciate that you have also requested that we investigate data protection concerns regarding OHA, we are unable to do so. The ICO can only assess concerns about a single organisation within one complaint. If you wish us to consider the actions of OHA, a separate complaint would need to be submitted for that organisation."
This letter informs the Appellant about the IC's view of the response from the Council, that the IC has concluded that the IC does not "deem it necessary or appropriate to pursue this complaint further" and that the IC does not think it to be "a proportionate use of our resources to pursue this matter further." I acknowledge that the Appellant does not think this was an adequate outcome. However, in my view, this letter does satisfy the IC's obligation set out in section 165(4)(b) DPA18 because it does inform the Appellant of the outcome of the complaint.
Appropriate steps
The conclusion above on the outcome means that the scope for the Tribunal to find that an appropriate step has been omitted is limited. It appears, from what has been provided, that the IC did not for example get in touch with the Council and ask for their comments but this, in my view, does not mean, in this case, that there was a failure to take appropriate steps. From the content of the outcome letter I am satisfied that the IC, having received the detailed complaint and the supporting evidence considered it at least some detail. The IC also considered what more it might do and it provided a suggestion as to how the Appellant might re-visit any concern with Orbit.
I also do not, for example, accept the Applicants submission that the IC's broad discretion to investigate a complaint to an appropriate extent must be exercised " on aproper evidential basis..." because in my view such a required approach would extend the role of the Tribunal towards supervising the IC and beyond that which is permitted by the DPA18 and the legal authorities.
I have considered whether the steps taken, judged objectively, were appropriate while also having due regard to the view of the IC as the expert regulator. In my view these steps were appropriate as required by section 165(4)(a) DPA18.
Strike out
Rule 8(2) 2009 Rules provides that "The Tribunal must strike out the whole or a part of the proceedings if the Tribunal does not have jurisdiction in relation to the proceedings or that part of them."
Rule 8(3)(c) 2009 Rules provides that "The Tribunal may strike out the whole or a part of the proceedings if (c) the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding."
In HMRC -v- Fairford Group (in liquidation) and Fairford Partnership Group (in liquidation) [2014] UKUT 0329 the Upper Tribunal ("UT") said that:-
"41... The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance) prospect of succeeding on the issue at a full hearing,... A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable..., The tribunal must avoid conducting a ‘mini-trial’..."
In AW-v-Information Commissioner and Blackpool CC [2013] 30 ACC the UT said that the strike out power should only be used in "plain and obvious cases" and it:-
" 8...It is, moreover, plainly a decision which involves a balancing exercise and the exercise of a judicial discretion, taking into account in particular the requirements of Rule 2 of the GRC Rules."
Rule 2 (which I have considered) refers to the overriding objective to enable deal with cases fairly and justly. Rule 2(3) 2009 Rules provides that the Tribunal must seek to give effect to the overriding objective when it (a) exercises any power under these rules or (b) interprets any rule or practice direction.
Decision
In the Grounds attached to the GRC3 the Applicant asks the Tribunal:-
"...to set aside the Commissioner’s decision and remit the case for a fresh investigation on its merits, taking into account all previously excluded facts and evidence."
which adds to section 6.1 of the Application in which the Applicant asks the Tribunal to:-
“... set aside the Commissioner’s decision dated 3 February 2026... and to remit the case to the Commissioner for reconsideration in accordance with the requirements of Articles 6(1)(e), 5(2), and 30 UK GDPR.”
While having regard to the Applicant's status as a litigant in person and the overriding objective to deal with this Application fairly and justly including by avoiding unnecessary formality I accept the IC's submission that these remedies requested in the GRC3 are not remedies that the Tribunal can grant in a section 166 DPA18 application.
I have also concluded that an outcome was provided and appropriate steps were taken. Accordingly the complaint has already been determined, the IC has not failed in one of the ways referred to in section 166(1) DPA18 and so the Tribunal's jurisdiction in section 166(2) DPA18 has not been activated. On that basis I am satisfied that the Tribunal does not, in this matter, have the jurisdiction set out in section 166(2) DPA18 and so it follows that the Application must be struck out by rule 8(2)(a) 2009 Rules.
For completeness it is also my view that:-
there is no reasonable prospect of the Applicant's case, or part of it, succeeding and it is also struck out by rule 8(3)(c) 2009 Rules; and
this decision would have been the same had the Applicant relied on the GRC1 and its attached grounds.
Signed Judge Heald Date: 2 June 2026