UKFTT-GRC 2026 423 [2026] UKFTT 423 (GRC) InformationRights 1.6.1 89c9f2d07ede040d60292e14eed4e04bc90f01e4099434e96b243529f4e66794 7.4.0
Neutral citation number: [2026] UKFTT 00423 (GRC)
Case Reference: FT.EA.2025.0433.GDPR
First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Decided without a hearing
Decision given on: 25 March 2026
Before
JUDGE ARNELL
Between
Daniel Davies
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The application is struck out under Rule 8(2)(a) for a lack of jurisdiction and under Rule 8(3)(c) as it has no reasonable prospect of success.
REASONS
1.
These proceedings concern the Applicant’s application for an order pursuant to section 166(2) of the Data Protection Act 2018 (“DPA 2018”).
2.
On 12 January 2026 the Information Commissioner (“the Commissioner”) applied to strike out the application pursuant to Rule 8(2)(a) and/or Rule 8(3)(c) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“Rule”) on the grounds that this Tribunal lacks jurisdiction and/or there are no reasonable prospects of the application proceeding.
3.
The Applicant provided a Reply which included submissions in response to the Commissioner’s application to strike out on 26 January 2026. The Applicant resists the application.
4.
In accordance with Rule 32(3) I am not required to hold an oral hearing to determine this application. I have the benefit of submissions from both parties and as such I am satisfied I was satisfied I could proceed to determine this application on the papers.
Background
5.
The Applicant made a subject access request to Google regarding targeted advertising on the YouTube platform. On 28 August 2025 the Applicant complained to the commissioner that Google had failed to comply with their obligations under the General Data Protection Regulations (“GDPR”) and raised concerns of harassment and stalking.
6.
On 27 October 2025, the Commissioner issued an outcome, finding that a number of the matters raised by the Applicant fell outside of the Commissioner’s remit and that Google are not required to provide information relating to third party handling of the Applicant’s personal data. In relation to the Applicant’s submissions regarding stalking and harassment they recommended the Applicant raise these concerns with the police.
7.
The Applicant sought a review of the Commissioner’s outcome. On 27 November 2025 the Commissioner provided a review outcome to the Applicant. This concluded that they did not consider the Applicant’s complaint reflected a breach of data protection by Google and confirmed no further action would be taken.
8.
The Applicant initially submitted an incomplete application to the Tribunal on the 18 November 2025. Following the Tribunal issuing Directions, the Applicant filed an application using the correct form on 11 December 2025. The application was accompanied by extremely detailed grounds over several appendices.
9.
The Applicant sets out the remedies they are seeking including the following:
i.
That the Commissioner be ordered to revisit and properly investigate their complaint in accordance with Articles 57 and 58 of GDPR.
ii.
That the Commissioner be required to compel Google to fulfil their Subject Access Requests including: all profiling and ad-targeting related to them and identification of the third party responsible for placing or benefiting from the targeted advertising.
iii.
That the Commissioner be required to monitor Google’s adherence to its obligations and prevent similar misuse of their date in the future.
iv.
That the Commissioner be required to issue a formal apology to them.
The Commissioner’s application to strike out
10.
The Commissioner submits that the Tribunal’s jurisdiction is limited in this case to a consideration of any procedural failures by the Commissioner to progress a complaint. That an order may only be made it the Tribunal is satisfied the Commissioner has failed procedurally to comply with section 166(1) DPA 2018. They submit they have taken appropriate steps to investigate and respond to the Applicant’s complaint; that an outcome was provided; that a review was carried out; and there is therefore no basis on which the Tribunal may make an order pursuant to section 166(2) DPA 2018.
11.
The Commissioner submits the Tribunal has no jurisdiction to consider the Applicant’s application and/or the application has no realistic prospect of success.
The Applicant’s Response
12.
The Applicant confirms that their application is brought under section 166 DPA 2018. They contend that they do not seek a determination of the merits of the underlying complaint but it is their case that the Commissioner failed to take appropriate steps, including investigatory or enforcement steps, in response to their complaint; failed to meaningfully engage with the Subject Access Requests made to Google; and mischaracterised their complaint as a service issue.
13.
They submit the Tribunal does have jurisdiction as the issuing of an outcome in itself, where that outcome doesn’t engage with the substance of the complaint, does not preclude a finding of a procedural failure. They state the relief sought is an order requiring the Commissioner to take appropriate steps to respond to their complaint and to meaningfully assess Google’s compliance with the Applicant’s Subject Access Requests. This relief they contend it in the Tribunal’s powers.
The Law
14.
Section 165 DPA 2018 provides for an individual to complain to the Commissioner if they consider there has been an infringement of GDPR and/or Parts 3 or 4 of DPA 2018. The relevant parts provide as follows:
(2)
A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act .
(4)
If the Commissioner receives a complaint under subsection (2), the Commissioner must—
(a)
take appropriate steps to respond to the complaint,
(b)
inform the complainant of the outcome of the complaint,
(c)
inform the complainant of the rights under section 166 , and
(d)
if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
(5)
The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
(a)
investigating the subject matter of the complaint, to the extent appropriate, and
(b)
informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with [F2a] foreign designated authority is necessary.
15.
Individuals may make a complaint to the First-tier Tribunal for an order requiring the Commissioner to take appropriate steps pursuant to section 166 DPA 2018. The focus of section 166 DPA 2028 is not the merits of the Applicant’s complaint to the Commissioner nor the substantive outcome of the Commissioner’s investigation. The Tribunal can only make an order to progress an individual’s complaint if one of the conditions at section 166(1) (a), (b) or (c) DPA 2018 is met.
16.
The relevant parts of section 166 DPA 2018 provide as follows:
1)
This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the [F1UK GDPR], the Commissioner—
(a)
fails to take appropriate steps to respond to the complaint,
(b)
fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c)
if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
2)
The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
(a)
to take appropriate steps to respond to the complaint, or
(b)
to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
3)
An order under subsection (2)(a) may require the Commissioner—
(a)
to take steps specified in the order;
(b)
to conclude an investigation, or take a specified step, within a period specified in the order.
17.
The Commissioner provides a detailed summary of the relevant authorities regarding the focus of section 166 DPA 2018, the extent of the Tribunal’s jurisdiction, the broad discretion of the Commissioner and the meaning of “appropriate steps” within their Response. I agree with the Commissioner’s submission on the law. It is not my intension to rehearse those submissions here in full, but a summary of the relevant points is as follows:
i.
Section 166 DPA 2018 is forward looking provision concerned with remedying procedural defects. The Tribunal is tasked with specifying appropriate steps to respond but not with assessing the appropriateness of a response.
ii.
The Commissioner has broad discretion as to how he investigates complaints and is the expert regulator. The tribunal does not have an oversight role over the Commissioner’s exercise of his functions or his internal processes. The Commissioner’s view carries weight but is not necessarily determinative.
iii.
It is for the tribunal to decide, applying an objective test, if an ‘appropriate step’ has been omitted, but in practice that is unlikely to be the case where an outcome has been issued. That is because section 166 is procedural and cannot be used effectively as a back door route to obtaining a remedy that should be pursued by making a claim against the data controller or by judicial review of the Commissioner.
Conclusions
18.
In determining this application I have had due regard to the Overriding Objective (Rule 2), the statutory framework, relevant authorities and both party’s submissions.
19.
The Applicant does not dispute that the Commissioner provided an outcome, and indeed a review outcome, to their complaint on 27 October 2025 and 27 November 2025 respectively. For completeness I am satisfied that an outcome to the complaint was provided.
20.
Within their submissions in response to the application to strike out the Applicant submits that the Commissioner’s failure to address Subject Access Request compliance is a procedural omission not a merits determination. I note however that both the Commissioner’s outcome and review outcome contain information in response to this part of the Applicant’s complaint to the Commissioner.
21.
I have given significant weight to the view of the Commissioner as the expert regular that there are no other appropriate steps they should have taken. I am satisfied there are no further steps the Commissioner ought reasonably to have taken to progress the Applicant’s complaint. I am satisfied that the outcome and the review outcome demonstrate the Commissioner has complied with the requirements of section 166(4) DPA 2018.
22.
Notwithstanding the Applicant’s submission that their application is purely procedural, it can be seen that the Applicant is challenging the substantive outcome of the complaint. The outcomes sought by the Applicant in their application do not fall within the remit of the Tribunal’s powers in this case. This position is the same in relation to the more limited outcomes sought by the Applicant in their Reply. Section 166 DPA 2028 is limited to narrow procedural issues. The Tribunal has no power to direct the Commissioner to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the GDPR.
23.
Accordingly, I find that there has been an outcome, there were no further appropriate steps to be taken, the complaint has been determined and consequently the Tribunal does not have jurisdiction. I am also satisfied there is no reasonable prospect of the application or any part of it succeeding because the outcomes sought by the Applicant are not within the Tribunal’s power to grant.
24.
The application is therefore struck out pursuant to Rule 8(2)(a) and Rule 8(3)(c).
Signed: Judge Arnell Date: 17 March 2026