Enter case reference FT/EA/2024/0243/GDPR - [2025] UKFTT 01217 (GRC)

the Tribunal has no jurisdiction to determine the present application, as the IC has already determined the Applicant’s complaint when he sent anoutcometo the Applicant on 15 April 2024 with the decision upheld on 5 June 2024 and a further outcome provided on 5 July 2024. The Applicant’s service complaint was upheld on 11 August 2025, which response also reaffirmed the original case decision.

the IC’s has taken steps to investigate and respond to the Applicant’s complaints.

The present application shows no discernible grounds that would warrant the Tribunal exercising its powers under section 166(2) of the DPA 2018, given that the IC provided an outcome to the Applicant’s complaint on 15 April 2024 with the decision upheld on 5 June 2024 and a further outcome provided on 5 July 2024. There is therefore no reasonable prospect of persuading the Tribunal to make any form of order pursuant to section 166(2) of the DPA 2018.

It is clear from the grounds in support of the application that the Applicant does not agree with the outcome of her complaint, but section 166 DPA 2018 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint. The relief available from the Tribunal on an application under section 166 DPA 2018 only applies where it is satisfied that the IC has failed in some procedural respect to comply with the requirements of section 166(1) DPA 2018, limited solely to those orders that are set out in section 166(2).

If the Applicant wishes to seek an order of compliance against the controller for breach of her data rights, the correct route for her to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

The IC refused on 15 April 2024 to investigate her complaint on the basis it had already dealt with this. It was a clear procedural failure that the IC did not tell the Trust it had more work to do or to ask if for further information at that stage. The IC did not consider the evidence of what had happened fairly and impartially. It was unfair to claim that she had “exhausted” the IC’s process when they had failed to look at the issue raised and failed to consider the evidence presented.

The IC case officer closed her case on 22 May 2024 alleging she had not yet submitted an SAR to the Trust for the information.

The case should not have been closed on 19 June 2024, and should not have been closed until the actions given by the IC to the Trust were complete. The IC ignored her response to this. The Trust did not contact her about the information. She says it is a procedural failure of the IC that they instructed the Trust that they must provide the information or the legal justification for refusing, but then allowed the Trust to do neither.

The IC did not weigh the facts impartially and fairly and took the claims by the Trust that it had addressed the issues as evidence of appropriate redaction at face value. The IC did not demand further information about the justification for the redaction from the Trust. She says the IC lied in saying that the Trust had provided an exemption that it had applied and it was a procedural failure for the IC not to have taken the necessary steps to get an explanation for the redactions from the Trust.

The IC has “demonstrated a determination to refuse investigation despite their terms for investigation being met, and then acted in a way profoundly biased towards the NHS organisation in breaching GDPR law”.

The IC has failed to comply with the procedural requirements set out in section 166(1) of the DPA 2018.

The Applicant therefore opposes the strike-out application.