FT/EA/2025/0305/GDPR - [2025] UKFTT 01312 (GRC)

I start by addressing the nature and effect of section 166. The Commissioner, in his response to the Application (and his associated strike out application), referred to various authorities from case law in that regard (in decisions of the Upper Tribunal, the High Court and the Court of Appeal). It is not necessary for me to refer to that case law again in this decision, but I accept the relevance to the Application of the various authorities which the Commissioner referred to.

I consider that it is appropriate, though, to briefly summarise the legal position based on those authorities. In essence (and so far as is relevant for current purposes) the following are the relevant legal principles.

An application under section 166:

In other words, an application under section 166 does not address the merits or substance of a complaint but rather is merely procedural in nature: it is concerned only with procedural actions which the Commissioner is required to take in respect of the complaint.

The test (in section 166(1)(a)) as to whether the Commissioner has failed “to take appropriate steps to respond to the complaint” is exactly as it says – namely “appropriate steps” and not an ‘appropriate outcome’ (or similar). Likewise, the Tribunal’s powers where the Commissioner has failed to take appropriate steps include making an order that the Commissioner must “take appropriate steps to respond to the complaint” (and not to ‘take appropriate steps to resolve the complaint’).

It is also well established that the Tribunal does not undertake an oversight role over the Commissioner’s exercise of his functions or internal processes. In considering an application under section 166, the Tribunal must bear in mind that the Commissioner is the expert regulator and so is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. Likewise, the Commissioner has a very broad discretion as to how he investigates complaints. However, whilst the Commissioner’s view carries weight, it is not decisive.

A key point regarding section 166 is that, as specified in section 166(1), it only applies in respect of a complaint made by a data subject under section 165 or under Article 77. Section 165 and Article 77 are concerned with rights given to data subjects to complain to the Commissioner if the data subject considers that, in connection with their personal data relating to him or her, there is an infringement of the UK GDPR or the DPA.

It is important to note, therefore, that the right for individuals to make an application to the Tribunal for an order under section 166(2) only applies if there has a relevant complaint to the Commissioner concerning an infringement of the UK GDPR or the DPA with regard to the complainant’s personal data.