UKFTT-GRC 2026 645 [2026] UKFTT 645 (GRC) InformationRights 1.7.1 66f819ef0663a38d3b94aae05c9d4aafab05bb18a2bb5d4bfa8eb984a6f1fb64 7.4.0
NCN: [2026] UKFTT 00645 (GRC)
Case No. FT/EA/2026/0039/GDPR
In the First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Before: Judge Taft
Appellant: Fernando Melendez
Respondent: Information Commissioner
Determined on the papers
Decision given on: 30 April 2026
Decision: The application is struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because it does not have any reasonable prospects of success.
REASONS
1.
Before making this decision, I considered the following documents from the Tribunal file provided to me:
1.1
The GRC3 form and supporting document;
1.2
The IC’s Response to the application;
1.3
The IC’s annex 3 to that Response;
1.4
The IC’s GRC5 application to strike out the claim;
1.5
Mr Melendez’s Reply; and
1.6
Mr Melendez’s email sent on 4 April 2026.
2.
On 20 June 2025, Mr Melendez made a complaint to the Information Commissioner (IC) about a response to a Data Subject Access Request (DSAR) made to VulnCheck Inc. The IC issued an outcome on 19 January 2026.
3.
On 28 January 2026, Mr Melendez filed a GRC3 application for an order that the IC progress his complaint.
4.
On 4 March 2026, the IC made an application on GRC5 to strike out the complaint on grounds that the Tribunal has no jurisdiction or that the application has no reasonable prospects of success. It relied on its Response to the application, which confirmed that the IC had provided Mr Melendez with an outcome on 19 January 2026. A copy of that outcome was annexed to its Response.
5.
A data subject has a right to make a complaint to the Commissioner if they consider that, in connection with the processing of personal data relating to them, there is an infringement of the [UK] General Data Protection Regulation [GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3 or 4 of the DPA18: see Article 77 [UK]GDPR, and Section 165(1) & (2) DPA18.
6.
Under Section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.
7.
Section 166 DPA18 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—
(a)
fails to take appropriate steps to respond to the complaint,
(b)
fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c)
if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2)
The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
(a)
to take appropriate steps to respond to the complaint, or
(b)
to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
(3)
An order under subsection (2)(a) may require the Commissioner—
(a)
to take steps specified in the order;
(b)
to conclude an investigation, or take a specified step, within a period specified in the order.
8.
The powers of this Tribunal in determining an application under Section 166 are limited to those set out in Section 166(2) and (3). The Tribunal has no power to consider the merits of a complaint or the outcome. It has no power to sanction the Respondent for providing a late outcome, even one provided only after the application is made to this Tribunal.
9.
Killock & Veale v Information Commissioner [2021] UKUT 299 (AAC) is authority for the fact that Section 166 is a forward-looking provision intended to remedy ongoing procedural defects that stand in the way of a timely resolution of a complaint.
10.
In the Court of Appeal in Delo v Information Commissioner [2023] EWCA Civ 1141 , LJ Warby confirmed the Tribunal’s powers are to require the Commissioner to take a specified step, conclude an investigation or take a specified step within a specified period [at paragraph 23].
11.
As the Upper Tribunal confirmed in Smith v ICO [2025] UKUT 74 (AAC) [at paragraph 60], “ the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.”
12.
The Upper Tribunal goes on in paragraph 61 to confirm that an order could be made where an outcome has been provided for example when the outcome deals only with part of the complaint.
13.
Rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 provides that the Tribunal must strike out proceedings if the Tribunal does not have jurisdiction. Rule 8(3)(c) provides that the Tribunal may strike out proceedings if it considers that they have no reasonable prospect of success. Rule 8(4) confirms that the Tribunal may not strike out under either provision without first giving the appellant an opportunity to make representations in relation to the proposed striking out.
14.
Mr Melendez was directed to make representations in respect of the strike out and did so in his email referenced above, in which he confirmed that he relies upon the content of his Reply.
15.
Mr Melendez does not identify any further procedural steps for the IC to take. He does not identify, for example, that the IC responded to only part of his complaint. On its face, it can be seen that the IC dealt with the allegation in respect of the DSAR.
16.
His Reply, in its conclusion, claims that his application raises the narrow question of whether the IC failed to apply the correct statutory framework. That is a pithy summary of all that had preceded the conclusion both in the Reply and in the original application. All of the grounds relied upon are, in reality, an attack on the substance of the outcome disguised as a procedural attack on the steps taken by the IC. The application cannot therefore have reasonable prospects of success.
Signed Date: 29 April 2026
Judge Taft