Case Reference: FT/EA/2026/0115/GDPR
Information Rights
Decided without a hearing
Before
JUDGE HEALD
Between
XINXIN XU
Applicant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The Application is dismissed.
REASONS
This Application is brought by section 166(2) Data Protection Act 2018 ("DPA18"). The Respondent ("the IC") opposes it and has applied for it to be struck out by rule 8(3)(c) 2009 Rules. In summary the IC says that on 26 March 2026 (since the Application was lodged) an outcome of the complaint has been provided and there is therefore no basis for the Tribunal to make an order under section 166(2) DPA18.
Mode of determination
Rule 32(3) The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 ("2009 Rules") provides that "The Tribunal may in any event dispose of proceedings without a hearing under rule 8 (striking out a party's case)."
In considering whether to deal with the strike out application on the papers or at a hearing I have had regard to the overriding objective of the 2009 Rules which is to enable the Tribunal to deal with cases fairly and justly. I have also considered the decision of the Upper Tribunal ("UT") in Warner -v- The Information Commissioner [2026]UKUT 109 (ACC). I have concluded that it is fair and just (and in the interests of justice) to deal with this matter without a hearing because:-
doing so will not prevent the parties being able to participate as fully as is needed in light of the issues and what has been provided to the Tribunal;
doing so will not prevent the Applicant from being able to participate as fully as appears to be sought bearing in mind that the Applicant has not Replied to the Response, opposed the strike out or provided any representations as Directed by Judge Buckley and provided for in rule 8(4) 2009 Rules;
the Applicant has not asked that the strike out be dealt with at a hearing; and
requiring a hearing could cause there to be unnecessary delay.
Background in summary
The Applicant expressed concern with the way in which certain personal data and a dog's microchip details were shared and the response to these concerns. On 28 July 2025 the Applicant made a complaint about this to the IC. The relevant chronology, prior to the issue of this Application thereafter is as follows:-
10 December 2025: the IC acknowledged the complaint, explained the IC's role and asked for an update;
10 December 2025: the Applicant confirmed that the issues had not been resolved; and
11 March 2026: the Applicant asked for an update from the IC in the absence of having heard anything further.
The Application
The Application is dated 18 March 2026. The Applicant says for example:-
"I received a reply on 10/12/2025 asking for more updated details, and I responded. Their auto-reply said they would review my case within three months. However, they never got back to me. I followed up after three months, but I still haven't received any response."
"I reported it to the ICO, and after five months they contacted me to ask for more information. However, they never got back to me. I followed up after three months, but I still haven't received any response."
The Applicant asked the Tribunal to make this order:-
"I request that the ICO investigate Identibase and Animal Tracker for sharing my personal data without consent, providing false and misleading explanations, deleting records during the investigation, refusing to identify who authorised the transfer, and ignoring threatening emails from Animal Tracker.
I also request a full refund of the £36 “Transfer of Keepership Fee”, which I paid for a process that was unauthorised and illegal. Thank you."
Although the Application is not expressed in the precise terms of DPA18 I am satisfied that the Applicant (as a litigant in person) intended to make an application pursuant to section 166(2) DPA18.
Developments after the Application was issued
On 25 March 2026 the IC first made contact with Identicare. This was followed up on 26 March 2026. I have not seen it but the IC says in his Response that:-
"On 26 March 2025, the case officer sent an email to Identicare’s contact point advising that the Commissioner had received a complaint about they way Identicare had processed the Applicant’s personal information. The case officer advised that it was her view that there was more work for Identicare to do and requested that they revisit the way they had handled the complaint and consider what further action they could now take to resolve matters."
I have seen the IC's letter, also of 26 March 2026, which is referred to by the IC as the outcome of the complaint. For completeness I also note that:-
Identicare wrote to the Applicant on 2 April 2026
the Applicant wrote to the IC on 13 April 2026 and said, for example,:-
"I therefore respectfully request that the ICO continues its investigation into this matter. I am happy to provide supporting evidence including my bank transfer record, my Identibase account activation email dated 20th April 2025, and my Vets4Pets registration confirmation email dated 29th April 2025, should these be required"
the IC replied on 14 April 2026.
DPA18
The relevant parts of section 165 DPA18 provide as follows:-
A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.
If the Commissioner receives a complaint under subsection (2), the Commissioner must
(a)take appropriate steps to respond to the complaint,
(b)inform the complainant of the outcome of the complaint,
(c)inform the complainant of the rights under section 166, and
(d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
(5)The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
(a)investigating the subject matter of the complaint, to the extent appropriate, and
(b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with foreign designated authority is necessary.
Section 166(2) DPA18 sets out the limit of the scope of any remedy available to an applicant. It provides that if, after a data subject makes a complaint, the IC fails to take appropriate steps to respond to the complaint or fails to provide the complainant with information about the outcome of the complaint then the Tribunal may order the IC:-
"(a)to take appropriate steps to respond to the complaint, or
(b)to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order."
Strike out
Rule 8(3)(c) 2009 Rules provides that "The Tribunal may strike out the whole or a part of the proceedings if (c) the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding."
In HMRC -v- Fairford Group (in liquidation) and Fairford Partnership Group (in liquidation) [2014] UKUT 0329 the UT said that:-
41... The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance) prospect of succeeding on the issue at a full hearing,... A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable..., The tribunal must avoid conducting a ‘mini-trial’..."
In AW-v-Information Commissioner and Blackpool CC [2013] 30 ACC the UT said that the strike out power should only be used in "plain and obvious cases" and it:-
" 8...It is, moreover, plainly a decision which involves a balancing exercise and the exercise of a judicial discretion, taking into account in particular the requirements of Rule 2 of the GRC Rules."
Rule 2 (which I have considered) refers to the overriding objective to deal with cases fairly and justly. Rule 2(3) 2009 Rules provides that the Tribunal must seek to give effect to the overriding objective when it (a) exercises any power under these rules or (b) interprets any rule or practice direction.
In the GRC5 the IC says:-
"For the reasons set in the Commissioner's Response, it is submitted that should the Applicant be unwilling to withdraw the application, the Commissioner opposes the application and invites the Tribunal to strike it out under rule 8(3)(c) of the Tribunal Rules on the grounds that the application has no reasonable prospect of succeeding."
The IC in the Response:-
accepts that there was a delay in initially communicating with the Applicant in relation to the complaint but says that since the Application was issued "... the Commissioner has...provided the Applicant with an outcome on the complaint in correspondence dated 26 March 2026";
says that the IC has (now) complied with section 166(1) DPA18;
submits that there is therefore no basis for the Tribunal to make an order under section of the 166(2) DPA18; and
asserts that therefore the Application has no prospect of success.
In the Response the IC also notes that part of the complaint may relate to the Applicant's pet but that a pet's data is not protected by the UKGDPR and/or DPA18. The IC says that his "...handling of the complaint, and this response, relates only to the extent that some or all of the data constitutes the Applicant’s personal data." For the purposes of this strike out application I have assumed that the complaint did not raise issues about a pet's data.
Rule 8(4) 2009 Rules provides that:-
The Tribunal may not strike out the whole or a part of the proceedings under paragraph (2) or (3)(b) or (c) without first giving the appellant an opportunity to make representations in relation to the proposed striking out."
I note that:-
the IC set out his view on strike out in the Response of 15 April 2026;
the IC says a copy of the GRC5, seeking the strike out, was sent to the Applicant; and
on 30 April 2026 Judge Buckley gave the Directions below which appear to have been sent to the Applicant on 1 May 2026:-
If the Applicant wishes to make representations in response to the Respondent's application to strike out the Application the Applicant must provide those representations to the Tribunal and to the Respondent within 14 days of being sent these directions."
I also note that the Applicant does not appear to have:-
Replied to the IC's Response as was provided for in the initial CMD of 24 March 2026 at para 2 b;.
opposed the IC's application to strike out; or
made representations on the strike out, within the 14 days allowed or subsequently, despite Judge Buckley's Directions.
Review
In Leighton -v- Information Commissioner (no 2) [2020] UKUT 23 (ACC) the UT (para 31) said that the purpose of section 166 DPA18 is to provide a remedy if the IC has failed to deal with a section 165 DPA18 complaint in a"procedurally proper fashion." I am satisfied that, as at the date the Application was issued, the IC had not informed the Applicant of the outcome of the complaint. However the IC's letter of 26 March 2026 said (after an apology for delay):-
"You have expressed concern to the ICO following an email you received from Animal Tracker on 17 July 2025. In this email, Animal Tracker explained that your pet, Kiki, had been microchipped and invited you to legally register as their keeper. You replied to this message the next day, stating that you had never registered with Animal Tracker and never consented for your pet’s details to be stored on this database.
It is the ICO’s understanding that Identicare responded to this email directly on 20 July 2025, advising that a transfer had been initiated by Dundee Vets4Pets. It added that Kiki was already registered on Identibase so it had removed the transfer records and microchip from Animal Tracker.
You got back in touch with Identicare on 21 July 2025, forwarding across confirmation you had received from Dundee Vets4Pets that it had not taken any action on transferring Kiki’s microchip. You therefore remained confused as to who had initiated the transfer and asserted that a data breach may have occurred. Identicare was unable to provide more information in its subsequent reply.
What we will do now
When we receive a complaint like yours we start by looking at how the organisation has dealt with it. It is important to us that organisations earn your trust by showing that they’ve done all they can to deal with your data protection concerns.
We have considered the issues that you have raised with us and, based on this information, it is our view that there is more work for the organisation to do. We have therefore raised your complaint with Identicare directly, explaining that we want it to work with you to resolve any outstanding matters.
If the organisation believes it has complied with the law, we expect it to clearly explain that to you. If something has gone wrong, we expect it to work with you to put things right and to learn from its experiences and improve its practices accordingly.
We have allowed the organisation 28 days to consider the issues that you have raised and to consider next steps in your case. It should be in touch with you in due course. If you do not hear back from the organisation after 28 days then please let us know.
Please be advised that you have the right to take your own action on any data protection matters through the courts regardless of any decisions that the ICO may make. This is not a process with which we are able to assist, and we would strongly recommend that you seek independent legal advice if this is something you would like to pursue.
Thank you for bringing this matter to our attention. Should you wish to discuss this case any further, or require any clarification, please do not hesitate to contact me. Additionally..."
In my view this letter of 26 March 2026 did satisfy the IC's obligation set out in section 165(4) DPA18 because, as can be seen, it does inform the Applicant of the outcome of the complaint. The later letter of 14 April 2026 also said:-
"Given that Kiki’s details have been removed from the Animal Tracker database and that Identicare believes it has identified a likely root cause that it is working to resolve, I do not believe it would a proportionate use of the ICO’s limited resources to pursue this case further. However, I can assure you that we will retain a record of your complaint and your latest email on our systems for intelligence..."
and this reinforces my view that an "outcome" has now been provided to the Applicant.
Decision
I have concluded that after the Application was issued an outcome was provided. Accordingly by the time of this decision the IC has not failed in one of the ways referred to in section 166(1) DPA18 and this section 166(2) DPA18 Application has no reasonable prospect of succeeding.
Rule 8(3)(c) 2009 Rules provides that if the Tribunal considers there is no reasonable prospect of the Applicant's case succeeding it may strike it out. In my view (based on a consideration of the overriding objective in rule 2 2009 Rules striking out the Application is fair and just.
The Application is therefore struck out.
Signed Judge Heald Date: 22 June 2026