FT/EA/2025/0128/GDPR - [2025] UKFTT 01106 (GRC)

These proceedings concern an application under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) for an order to progress the Applicant’s data protection complaint dated 11 July 2024 (the “Second Complaint”, reference IC-320307-T1W5) concerning a Subject Access Request (the “SAR”) made to the Information Commissioner (“IC”) on 27 January 2024 (reference IC-28609-W6L8). This SAR was about an earlier data protection complaint the Applicant made to the IC in August 2023 concerning inappropriate disclosure of his personal information by Loughborough University Medical Centre (“LUMC”) (the “First Complaint”, reference IC-248770-J3D7).

The Applicant has confirmed that the application is in relation to the Second Complaint only.

In August 2023 the Applicant made the First Complaint to the IC that LUMC had inappropriately disclosed his personal information to Loughborough University (“LU”). On 3 August 2023, an IC case officer informed Dr Leaney that they were writing to the data controller, LU On 2 January 2024 the case officer again wrote to the Applicant. He explained that in his view the LUMC had complied with its data protection obligations, and had a legal basis to share the information directly with LU. There was a concern about how the information was shared and this part was noted.

On 27 January 2024, the Applicant made a SAR to the ICO, in its role as a controller, for information it had obtained in the course of the First Complaint. This request was acknowledged on 2 February 2024 and given the reference number IC-286091- W6L8. The Applicant was informed the case would be allocated to an Information Access Officer and that the response was due by 27 February 2024.

On 8 April 2024, the Applicant emailed the IC’s case officer expressing dissatisfaction with the response to the First Complaint and asking for a case review. On 24 April 2024, the case officer informed the Applicant that the review request had been received and that he would be contacted separately by a Reviewing Officer. On 22 May 2024, the IC’s Reviewing Officer wrote to the Applicant upholding the original decision on the First Complaint confirming that it had been dealt with appropriately by the case officer.

36. On 26 February 2024, the IC’s Information Access Officer responded to the Applicant’s SAR stating that the information requested was being withheld under paragraph 11 of Schedule 2 of the DPA 2018 on the basis it would likely to prejudice the IC’s function as a regulator. Consent to its disclosure had been sought but this was not forthcoming. Further, it was explained that section 132 of the DPA 2018 made it a criminal offence to disclose information provided to the IC for the purpose of carrying out its regulatory functions unless there is some lawful authority for doing so. Following further exchanges of correspondence with the Applicant, and additional enquiries being made, the case officer wrote to the Applicant on 3 May 2024 confirming that he was fully satisfied that the Integrated Care Board covering Leicester, Leicestershire and Rutland (“LLR ICB”) had not provided the IC with consent. The Applicant was informed that if he remained dissatisfied he could make a complaint to the IC, in its capacity as data protection regulator.

On 11 July 2024, the Applicant made the Second Complaint to the IC, in its role as the regulator under the DPA 2018, regarding the SAR that he had made. On 2 September 2024, the Applicant chased the matter stating he had not received a response and asking that his local MP, Mr James Naish MP, be copied into correspondence. On 16 September 2024, the Second Complaint was acknowledged.

On 4 November 2024, an IC case officer wrote to the Applicant confirming that she had been allocated the case and would inform him once work starts on his case. On 10 December 2024, following the Applicant’s MP contacting the ICO, he was informed that work will begin on the case that week.

On 13 December 2024, the IC’s case officer responded to the Applicant on the Second Complaint. The case officer explained that she was of the view that the IC had handled the Applicant’s appropriately, was satisfied with the IC’s decision to withhold the information requested, and that no further action would be taken. The IC considered that this provided an outcome to the Second Complaint.

On 19 January 2025, the Applicant provided further information regarding his views on why the complaint outcome should be reconsidered.

On 30 January 2025, the IC’s case officer again wrote to the Applicant apologising for the lack of direct response but that his elected representative had been informed along with his right to make a complaint in this regard. She reminded the Applicant that if he was unhappy with the outcome then a review can be requested. She reiterated that the concerns appeared to be in relation to the First Complaint, where an outcome was provided on 22 May 2024 following review.

The Applicant applied to the Tribunal by way of form GRC1 dated 26 February 2025 (the “Application”) seeking the following outcome:

“Allow the appeal and substitute a notice that orders the ICO to take steps in relation to the request for information and to subsequently review prior cases, relevant to the situation of this appeal, which were decided on the basis of any false information provided to the ICO by any organisation under investigation by the ICO. In particular review [the First Complaint] in light of the facts so far ignored by ICO.”

The Respondent applied by way of form GRC5 dated 13 August 2025 to strike out the Application (the “strike-out application”) to strike out the Application on the basis that the Tribunal has no jurisdiction to consider it under Rule 8(2)(a) and/or that there is no reasonable prospect of it succeeding.

The Applicant’s case set out in his form GRC1 identifies the following alleged failings by the Respondent in relation to the Second Complaint:

Following directions made by Judge Heald on 22 August 2025, the Applicant provided the following clarification about his case by email dated 28 August 2025.

“[The Second Complaint] is a complaint about how my ‘request for information’ (i.e. [the SAR]) was dealt with by the ICO concerning the information used to determine the outcome of a complaint I had previously made to the ICO (ie [the First Complaint]) and that as a data subject I had a right to see. The ICO refused to provide me with this information because they stated it had been supplied by a local authority ‘Leicester, Leicestershire and Rutland – Integrated Care Board’ which is an NHS organisation. The ICO has no basis for saying that the so called ‘statement’ came from the ‘local authority’ or that it came from the ‘LLR-ICB’. The LLR-ICB have made it clear to me through documentation that they did not supply this information to the ICO and had asked the ICO to change its record on this matter - which the ICO has never done. The ‘statement’ had, in fact, come directly from the organisation being investigated by the ICO (i.e. Campus View Medical Centre) and contained verifiably false and defamatory information. Once the ICO were made aware by both myself and the LLR-ICB of the situation they should have addressed the matter in an open, honest, fair and transparent way – but this did not happen. The result is that the ICO have come to a conclusion which has serious implications for the general public.

So the particular complaint in front of the Tribunal from me is [the Second Complaint] which is a complaint I submitted to the ICO on 11Jul24. Please note the small mistake in Respondent Response dated 31Jul25 paragraph 52 which mistaken states the date as 24Nov24 and not as 11Jul24 as it should be.

My GRC1 Section 8 requests a tribunal outcome that the ICO take (appropriate) steps (by the ICO) in relation to meeting my ‘request for information’ that is not misleading or false. Section 8 of GRC1 I made an additional request that previous cases (like IC-248770-J3D7) might then be possibly reviewed in light of the corrected information being openly acknowledged. I recognise this additional request might be outside the remit of the current Tribunal. This is why I also requested that I be allowed to take my broader case, with further evidence, to be considered by the Upper Tribunal. These ‘additional’ requests are maybe requests I am not allowed to make. If I am not allowed to make these additional requests then I withdraw them.”

The reasons given for the strike-out application in paragraphs 53-59 of the Response are as follows: