UKFTT-GRC 2026 639 [2026] UKFTT 639 (GRC) InformationRights 1.7.1 f437420d3d31f967c46cb5695ecc9347c432c1dfcaa0ef5329f254eb474cb152 7.4.0
NCN: [2026] UKFTT 00639 (GRC)
Case No. FT/EA/2025/0354
In the First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Before: Judge Taft
Appellant: Mark Thomas
Respondent: Information Commissioner
Determined on the papers
Decision given on 30 April 2026
Decision: The application is struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because it does not have any reasonable prospects of success.
REASONS
1.
Before making this decision, I considered the following documents from the Tribunal file provided to me:
1.1
The GRC1 form and supporting document;
1.2
Various orders made by the Tribunal;
1.3
The IC’s response to the application;
1.4
The IC’s annex to that response;
1.5
The IC’s GRC5 application to strike out the claim; and
1.6
Mr Thomas’ various emails sent on 6, 9 and 11 April 2026 and their supporting documents.
2.
On 11 August 2025, Mr Thomas made a complaint to the Information Commissioner (IC) about alleged data breaches by Sefton Council. He referred to two alleged breaches: missing social care records and in respect of a response to a Data Subject Access Request (DSAR).
3.
On 22 September 2025, Mr Thomas filed a GRC1. It was not clear what Mr Thomas wanted the Tribunal to do, because Mr Thomas referred to a number of matters that this Tribunal does not have power to consider and because he referred both to the Freedom of Information Act 2000 (FOIA) and personal data matters covered by the Data Protection Act 2018 (DPA18) that it does. After seeking further information from Mr Thomas, Judge Harris clarified in an order on 4 February 2026 that the matter should proceed as an application under Section 166 DPA18 in relation to Mr Thomas’ complaint to the IC with reference IC-414030-N5S6.
4.
In doing so, Judge Harris referred to the Tribunal’s powers under Section 166 and noted that:
“the complaint was only submitted to the IC on 11 August 2025 and the Application was made 42 days (six weeks) later”
She suggested that Mr Thomas’ complaint may have been premature but that given the passage of time, it was appropriate to allow it to proceed rather than require Mr Thomas to make a further application.
5.
I have therefore limited my consideration to an application that the IC has failed to progress complaint numbered IC-414030-N5S6. I have not considered any other complaint to the IC whether under DPA18 or FOIA. If Mr Thomas seeks to have this Tribunal consider a failure to progress any other DPA18 complaint, he must make an application on GRC3. If he seeks to have this Tribunal consider a Decision Notice under FOIA, he must bring an appeal on GRC1.
6.
On 4 March 2026, the IC made an application on GRC5 to strike out the complaint on grounds that the Tribunal has no jurisdiction or that the application has no reasonable prospects of success. It relied on its response to the application, which confirmed that the IC had provided Mr Thomas with an outcome on 19 February 2026. A copy of that outcome was annexed to its response. Whilst Mr Thomas denies that there was an outcome, I can see therefore that an outcome was indeed provided by email timed at 09.46 on 19 February 2026.
7.
A data subject has a right to make a complaint to the Commissioner if they consider that, in connection with the processing of personal data relating to them, there is an infringement of the [UK] General Data Protection Regulation [GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3 or 4 of the DPA18: see Article 77 [UK]GDPR, and Section 165 (1) & (2) DPA2018.
8.
Under Section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.
9.
Section 166 DPA18 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—
(a)
fails to take appropriate steps to respond to the complaint,
(b)
fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c)
if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2)
The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
(a)
to take appropriate steps to respond to the complaint, or
(b)
to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
(3)
An order under subsection (2)(a) may require the Commissioner—
(a)
to take steps specified in the order;
(b)
to conclude an investigation, or take a specified step, within a period specified in the order.
10.
The powers of this Tribunal in determining an application under Section 166 are limited to those set out in Section 166(2) and (3). The Tribunal has no power to consider the merits of a complaint or the outcome. It has no power to sanction the Respondent for providing a late outcome, even one provided only after the application is made to this Tribunal.
11.
Killock & Veale v Information Commissioner [2021] UKUT 299 (AAC) is authority for the fact that Section 166 is a forward-looking provision intended to remedy ongoing procedural defects that stand in the way of a timely resolution of a complaint.
12.
In the Court of Appeal in Delo v Information Commissioner [2023] EWCA Civ 1141 , LJ Warby confirmed the Tribunal’s powers are to require the Commissioner to take a specified step, conclude an investigation or take a specified step within a specified period [at paragraph 23].
13.
As the Upper Tribunal confirmed in Smith v ICO [2025] UKUT 74 (AAC) [at paragraph 60], “ the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.”
14.
The Upper Tribunal goes on in paragraph 61 to confirm that an order could be made where an outcome has been provided for example when the outcome deals only with part of the complaint.
15.
Rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 provides that the Tribunal must strike out proceedings if the Tribunal does not have jurisdiction. Rule 8(3)(c) provides that the Tribunal may strike out proceedings if it considers that they have no reasonable prospect of success. Rule 8(4) confirms that the Tribunal may not strike out under either provision without first giving the appellant an opportunity to make representations in relation to the proposed striking out.
16.
Mr Thomas was directed to make representations in respect of the strike out and did so in his emails referenced above.
17.
As I have recorded, Mr Thomas’ original complaint includes matters about which this Tribunal does not have jurisdiction (power) to consider. It does have power to consider a complaint under Section 166 DPA18 but only in the limited circumstances described above.
18.
Mr Thomas’ various emails do not identify any further procedural steps for the IC to take. He does not identify, for example, that the IC responded to only part of his complaint. On its face, it can be seen that the IC dealt with both the allegation that there were missing records and the allegation in respect of the DSAR. The application cannot therefore have reasonable prospects of success.
Signed Date: 29 April 2026
Judge Taft