Enter case reference FT/EA/2025/0157/GDPR - [2025] UKFTT 01230 (GRC)

The strike-out application

The IC applied by way of form GRC5 dated 6 October 2025 to strikeout the Application on the basis that the Tribunal has no jurisdiction to consider it under Rule 8(2)(a) and/or that there is no reasonable prospect of it succeeding (the “strike-out application”).

The reasons which the IC gave for striking out the application were set out in its Response, particularly at paragraphs 23-26 and 43-45. In summary, these were as follows:

the Tribunal has no jurisdiction to determine the present application, as the IC has already determined the Applicant’s complaint when he sent anoutcometo the Applicant on 30 January 2025 and a review outcome on 2 April 2025.

The present application shows no discernible grounds that would warrant the Tribunal exercising its powers under section 166(2) of the DPA 2018, given that the IC provided an outcome to the Applicant’s complaint on 30 January 2025 and a review outcome on 2 April 2025. There is therefore no reasonable prospect of persuading the Tribunal to make any form of order pursuant to section 166(2) of the DPA 2018.

It is clear from the grounds in support of the application that the Applicant does not agree with the outcome of his complaint, but section 166 DPA 2018 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint. The relief available from the Tribunal on an application under section 166 DPA 2018 only applies where it is satisfied that the Commissioner has failed in some procedural respect to comply with the requirements of section 166(1) DPA 2018, limited solely to those orders that are set out in section 166(2).

The IC acknowledges that there was a delay in providing the Applicant with outcome to his complaint and apologises for this oversight. However, the IC has taken steps to investigate and respond and provided an outcome to the Applicant’s complaint on 30 January 2025 and a review outcome on 2 April 2025. Accordingly, the IC has taken steps to comply with the procedural requirements set out in section 166(1) of the DPA 2018, and there is therefore no basis for the Tribunal to make an order under section 166(2) DPA 2018.

If the Applicant wishes to seek an order of compliance against the controller for breach of his data rights, the correct route for him to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

The Applicant provided a Reply which included a response to the strikeout application on 7 October 2025. He stated that he opposed the strike-out application on the following grounds

the appeal discloses a valid and arguable challenge to a decision of the IC under the DPA 2018 and UK GDPR