UKFTT-GRC 2026 360 [2026] UKFTT 360 (GRC) 1.6.0 584f4b13bc4a1fcc2b3c1fcbabb569952182ed250cb5dc6a13da7c2b8dd66d0b 7.4.0
NCN: [2026] UKFTT 00360 (GRC) Case No. FT/EA/2026/0022/GDPR
In the First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Before: Judge Taft
Appellant: Dominic Holland
Respondent: Information Commissioner
Determined on the papers
Decision given on: 16 March 2026
Decision: The appeal is struck out pursuant to rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because the Tribunal does not have jurisdiction to consider the complaint.
REASONS
1.
On 13 January 2026, the Appellant brought an appeal on GRC1 regarding the Respondent’s decision in respect of his complaint with reference IC-364029-M5C6. Although the Appellant used the wrong form, it was treated by the Tribunal and by the Respondent as an application under Section 166 Data Protection Act 2018 .
2.
On 11 February 2026, the Respondent made an application on GRC5 to strike out the complaint on grounds that the Tribunal has no jurisdiction or that the application has no reasonable prospects of success. It relied on its response to the application, which confirmed that the Respondent had provided the Appellant with an outcomes on 10 September 2025 and that there was no basis for an order under Section 166 .
3.
On 24 February 2026, the Appellant filed a Rule 24 reply, which dealt with the application for strike out.
4.
A data subject has a right to make a complaint to the Commissioner if they consider that, in connection with the processing of personal data relating to them, there is an infringement of the [UK] General Data Protection Regulations [GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3 or 4 of the Data Protection Act 2018 : see Article 77 [UK]GDPR, and Section 165 (1) & (2) Data Protection Act 2018.
5.
Under Section 166 , a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to his complaint.
6.
Section 166 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—
(a)
fails to take appropriate steps to respond to the complaint,
(b)
fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c)
if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2)
The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
(a)
to take appropriate steps to respond to the complaint, or
(b)
to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
(3)
An order under subsection (2)(a) may require the Commissioner—
(a)
to take steps specified in the order;
(b)
to conclude an investigation, or take a specified step, within a period specified in the order.
7.
The powers of this Tribunal in determining an application under Section 166 are limited to those set out in Section 166(2) and (3).
8.
The Upper Tribunal decision in Killock & Veale v Information Commissioner [2021] UKUT 299 (AAC) is authority for the fact that Section 166 is a forward-looking provision intended to remedy ongoing procedural defects that stand in the way of a timely resolution of a complaint. It confirms that the Tribunal should not assess the appropriateness of a response that has already been given.
9.
In the Court of Appeal in Delo v Information Commissioner [2023] EWCA Civ 1141 , LJ Warby confirmed the Tribunal’s powers are to require the Commissioner to take a specified step, conclude an investigation or take a specified step within a specified period [at paragraph 23].
10.
As the Upper Tribunal confirmed in Smith v ICO [2025] UKUT 74 (AAC) [at paragraph 60], “ the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.”
11.
Rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 provides that the Tribunal must strike out proceedings if the Tribunal does not have jurisdiction. Rule 8(3)(c) provides that the Tribunal may strike out proceedings if it considers that they have no reasonable prospect of success. Rule 8(4) confirms that the Tribunal may not strike out under either provision without first giving the Appellant an opportunity to make representations in relation to the proposed striking out.
12.
The Appellant did have opportunity to make representations in respect of the strike out application and did so.
13.
Although treated as an application under Section 166 , the appeal is on its face an appeal against the substance of the outcome that the Appellant acknowledges they received from the Respondent. The appeal complains that the Respondent misrepresents the Appellant’s “case” and accepted what it was told. It is an attack on the substance of the complaint outcome, not on the procedural steps taken by the Respondent. That is not something this Tribunal has the power to consider.
Signed Date: 6 March 2026
Judge Taft