[2025] UKFTT 01130 (GRC)

The grounds of the Application are, in essence, that the Commissioner was wrong to conclude that the data controller (a credit management company) had provided the Applicant with all the information in response to her subject access request.

On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner[2021] UKUT 299 (AAC) (Killock & Veale). That is the sole focus of this Application.

Further, once an outcome to a complaint has been provided, the circumstances in which the tribunal has the power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint is very limited. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock & Vealeand R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2023] EWCA Civ 1141 and Smith v Information Commissioner[2025] UKUT 74].

The Applicant complained to the Commissioner on 2 April 2024. The Commissioner communicated the outcome of the complaint to the Applicant on 3 June 2024. This outcome was upheld on 17 July 2024. The tribunal does not have any remit to consider whether or not that outcome was substantively correct.

There is in this Application no challenge to the ‘appropriate steps’ taken by the Commissioner, and certainly none which would not involve reopening that outcome. I conclude therefore that this case does not fall within the narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint) after the complainant has been informed of the outcome of their complaint.

For those reasons, I do not consider that there is any reasonable prospect of the tribunal making any order under section 166(2).

I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.

I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.

As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

For the above reasons the Application is struck out.