Iftikhar Ahmed (formerly trading as AP Dairies Ltd) v Information Commissioner

This Tribunal is concerned with an application for a Section 166 Order to Progress made about ICO reference number IC-461234-P0Y4.

The underlying issue is about Aviva Insurance and its handling of data. I note that any actions taken by Aviva Insurance in respect of events in December 2022 only came about because someone permitted an uninsured driver to use a vehicle. Had that not happened, there would have been no accident, no claim and no complaints about Aviva Insurance.

On 07 October 2025 (Footnote: ²) Mr Khan filed with the ICO a complaint about data handling at Aviva Insurance and the Financial Conduct Authority (FCA) that complaint included mention of the following legal entities:

On 24 March 2026, the ICO declined to investigate; the copy of that communication provided as Annex 2 does not appear to have a reference number. On 26 March 2026 the ICO sent another communication (with the reference of IC-416234-P0Y4) to Mr Khan: they still declined to make further investigations. Further responses (again with the reference number and declining to investigate) were provided to Mr Khan on 02 April 2026 and 07 May 2026.

Mr Khan (acting on behalf of Mr Ahmed, the Appellant) lodged a GRC3 with the Tribunal by email sent on 12 May 2026.

As a matter of fact, the GRC3 Application was lodged out of time; time having expired on 05 May 2026 as that was the date 6 months plus 28 days from the date of the complaint (07 October 2025).

Standard directions were issued on 14 May 2026 and the ICO provided a response to the application which also sought strike out under rule 8(2)(a) and/or rule 8(3)(c). Those directions gave the ICO until 11 June 2026 to respond and make any application to the application and the Appellant a further 14 days to reply to the response and/or any application.

The ICO’s response was, on 11 June 2026 sent to the Tribunal and Mr Khan along with a GRC5 application for strike out. Mr Khan sent a reply to the response and strike out application on 12 June 2026 (copied to the ICO).

Both parties have consented to consideration without a hearing, the Applicant in their GRC3, the ICO in their CMQ.

I consider it appropriate to deal with this strike out application without a hearing; I also consider it appropriate to take Mr Khan’s reply as all he wishes to say on behalf of the Applicant and, accordingly, formally shorten the date for reply.

I find that Mr Khan is seeking a substantive review of the decision, it is the only conclusion I can reasonably draw. Mr Khan was told that the ICO (partly due to lack of clarity about who owned the policy of insurance) was declining to investigate. I can see that a document has been provided to the Tribunal (Footnote: ³) which appears to show that there may have been an individual who held a policy with Aviva, but I note that it records:

It seems, from correspondence with the Financial Ombudsman Service, that the complaint to them was made by a corporate entity (they refer to “an employee of A, who was driving one of its vehicles at the time”, emphasis added). There remains a lack of clarity as to whose data was held by Aviva: an individual’s or a company’s.

I consider that, collectively (and for some, individually) the 4 letters detailed above sent to Mr Khan fully explain why the ICO declined to investigate any complaint about the handling of Mr Iftikhar Ahmed’s personal data by Aviva Insurance.

Whilst I can see that Mr Khan is very aggrieved by Aviva Insurance’s actions; he has received an outcome from the ICO and that is what Mr Ahmed is entitled to under section 166 of the Data Protection Act 2018.