Enter case reference FT/EA/2024/0243/GDPR - [2025] UKFTT 01217 (GRC)

The IC provided the Applicant with a response to her complaint on 15 April 2024 with the decision upheld on 5 June 2024 and a further outcome provided on 5 July 2024. I consider that the response dated 15 April 2024 was in fact an outcome to the complaint.  I consider it to be an outcome, because the IC has no power to compel compliance by the Trust and it took the steps which it considered to be appropriate to resolve the matter at that time. However, even if I am wrong on this, I am satisfied that when taken together with the further responses dated 5 June 2024 and 5 July 2024, these responses have provided an outcome to the Applicant’s complaint, provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint. This is sufficient in my view to demonstrate that the IC has complied with the requirements of section 165(4). The fact that the Applicant does not agree with the outcome does not render it wrong in law.  

It appears to me therefore that there are no further appropriate steps which the IC ought reasonably to take to progress the complaint.  In making this decision I have given significant weight to the view of the IC as the expert regulator that there are no further appropriate steps he should have taken.   

The Applicant’s proposed outcomes are, in effect, challenging the substantive outcome of the complaint to the IC. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision.   In an application under section 166, the Tribunal has no power to direct the IC to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the UK GDPR. I also agree with the IC’s position that orders for compliance need to be sought through civil action. Accordingly, I find that the Tribunal does not have the power to grant the remedies sought.

Because I consider that there was an outcome determining the complaint and that there were no further appropriate steps which should be taken, I find the complaint has already been determined and therefore the Tribunal has no jurisdiction over it.  I am also satisfied that there is no reasonable prospect of the case, or any part of it, succeeding because the remedies sought by the Applicant are not ones which is within the Tribunal’s power to grant.

The proceedings are therefore struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with them and under Rule 8(3)(a) because there is no reasonable prospect of them succeeding.