City Doctoral Researchers' Association v The Information Commissioner [2025] UKFTT 1108 (GRC)

[2025] UKFTT 01108 (GRC)Case Reference: FT/EA/2024/0214.GDPR
First-tier Tribunal
(General Regulatory Chamber)
Hearing Heard on: 24 June 2025Date 18 September 2025
Information Rights
Heard by Cloud Video Platform
Before
JUDGE WATTONMEMBER CHAFERMEMBER TAYLOR
Between
CITY DOCTORAL RESEARCHERS’ ASSOCIATIONApplicantTHE INFORMATION COMMISSIONERRespondentNo appearance for ApplicantEric Metcalfe, counsel for RespondentDecision: The application is dismissedREASONS
[1]The Applicant applies to the Tribunal following the Information Commissioner’s decision of 9 May 2024 (case reference IC-284890-V4Y8).[2]The parties do not agree which legal provision the application is brought under. The Applicant says it is an appeal brought under section 163 of the Data Protection Act 2018 (“the 2018 Act”) whereas the Commissioner states it is an application brought under section 166. The Tribunal has determined that the Commissioner’s analysis is correct, for the reasons given below. Factual background Subject access requests[3]The Applicant is City Doctoral Researchers’ Association. A Discord account was created for the association. The Applicant lost access to the @city.ac.uk email address associated with the account and asked Discord to update the address to a @gmail.com address. There was correspondence between the Applicant and Discord, which concluded in Discord failing or refusing to update the email address associated with the Discord account. The Applicant could therefore not access its Discord account.[4]The Applicant submitted a Subject Access Request directly to Discord on 17 January 2024, in these terms:
“Hello, Unfortunately, we no longer have access to that email address yet we are happy to provide any information to confirm that we are the account holders so to get a copy of all the data that has been submitted/collected for our account citydra as per the General Data Protection Regulation (GDPR). A change of the account's previous email address ([email address]@city.ac.uk) was requested for the account citydra (originally known as City PhD Society #4649) If there is no account associated with [email address]@gmail.com then it means that the transferring of the email linked to the account citydra (originally known as City PhD Society #4649) did not occur due to reasons beyond our responsibilities. Best, City DRA”
City DRA”[5]Discord responded on 18 January 2024 stating that it could only discuss account details with an email address associated with the specified account. It also set out the process for deleting information associated with deleted accounts.[6]The Applicant also submitted a second request through the Commissioner’s service on 22 January 2024. That was made in the name ‘City DRA’ and the @gmail.com email address for the Applicant was given. No data was provided in the ‘date of birth’ field. Complaint to the Commissioner[7]The Applicant filed a complaint with the Commissioner on 27 January 2024. Its name was recorded as ‘City DRA’ in the ‘organisation name’, ‘first name’ and ‘last name’ fields. The Commissioner responded on 9 May 2024. The Commissioner advised that it was for Discord to determine what information or document was acceptable to prove identity. The Commissioner stated that any confusion about the email address was a service matter which needed to be resolved between the Applicant and Discord. The Commissioner concluded that no further action was required and that the case was closed. Tribunal proceedings[8]The history of this application is much longer than warranted by the issues involved. On 4 June 2024 the Applicant filed its GRC1 notice. Attached to the GRC1 was the 9 May 2024 decision. The name given on the form was ‘City Doctoral Researchers’ Association’ and the statement of truth was signed in the same way, without any reference to any natural person’s name. The GRC1 states:
“We believe that Discord did not hand our subject access request (SAR)request appropriately and that it is unlawfully denying our access rights toour data, thereby failing to comply with Section 45 of the Data ProtectionAct 2018, while also seeking to collect more data from us beyond what italready holds, and is unlawfully not sharing with us. We also believe that the Information's Commissioner Officer is not meeting expectations, refusing to tell the organisation to do more work to help resolve our complaint, getting Discord to provide us with our information, and apologies for the damages caused, while also make recommendations to the organisation about how it can improve their information rights practices.”
[9]The outcome requested on the GRC1 is:
“Allow the appeal. Information's Commissioner Officer to meet its expectations, telling Discord to do more work to help resolve our complaint, getting Discord to provide us with our information, and apologies for the damages caused, while also make recommendations to the organisation about how it can improve their information rights practices. Discord to provide copies of our personal information, compensation for the damages caused, and a public apology.”
[10]Case management directions were issued by a Registrar on 2 August 2024. The Registrar required the Applicant to state how it considered section 3 of the 2018 Act (and Article 4 UK GDPR) to apply to it, what statutory provision it considered gave the Tribunal jurisdiction to consider the matter, and reasons why the Tribunal should not strike the application out.[11]The Applicant responded on 19 August 2024. It addressed each point of the Registrar’s order, including the submission that:
“the Applicant qualifies as a "data subject" because: -The Applicant's data (such as email address(es), password(s), and other personal data) is being processed by the controller. -The Applicant can be identified through this data. For example, the email address(es), account information, posts, and other content are linked to the Applicant. Even though the email address previously linked to the account is no longer accessible, the account information, posts and other personal data (e.g., passwords, photos) still distinctly identify the Applicant.”
[12]On 27 September 2024 the Registrar issued further directions requiring the Applicant to explain why the case should not be struck out.[13]On 9 October 2024 the Applicant provided submissions as to why it should be considered a data subject. The Applicant argued that case law supported its claim to be a data subject for the purpose of the 2018 Act.[14]Further case management directions were issued on 22 November 2024. The Registrar required the Commissioner to provide a response to the application.[15]The Commissioner responded on 16 December 2024. The response indicated that the Commissioner understood the application to be made under section 166(2) of the Data Protection Act 2018. The Commissioner also invited “the Applicant to withdraw his [sic] application on the basis that it has no sustainable case in law as to suggest that it meets the definition of a data subject for the purposes of both Article 4 of the UKGDPR and section 3(5) of the DPA18.”[16]The Commissioner also requested that the Tribunal strike out the application under Rule 8(2)(a) or Rule 8(3)(c) on the ground of either there being no jurisdiction to consider it or that it had no reasonable prospect of succeeding. A GRC5 application notice requesting the same was also filed.[17]On 1 January 2025 the Applicant filed a GRC5 application notice requesting the Tribunal issue preliminary legal determinations by the Tribunal on:
“a) The Appellant's status as a "data subject" under the Data Protection Act 2018 (DPA 2018) and UK GDPR; b) The Respondent's authority to close the Appellant's complaint without taking further action; c) Whether the Respondent's decision to close the complaint was based on a thorough review and if it was consistent with its "Regulatory Action Policy”; d) Whether the Respondent properly exercised discretion in labeling the issue of email and identity verification, and the data controller’s failure to provide alternative verification methods, as a "service matter"; e) Whether the Respondent is permitted to rely on the information from complaints to build a case for future regulatory actions and whether this influenced the decision to close the Appellant's complaint prematurely; g) The Respondent's duty to assist in the enforcement of data subject rights under the DPA 2018 and UK GDPR.”
[18]The Applicant requested the application be determined at a hearing. On 13 January 2025 the Applicant filed a reply to the Commissioner’s response of 16 December 2024.[19]On 29 January 2025 Judge Swaney refused the Commissioner’s application to strike out the appeal, and the Applicant’s application to have matters determined as preliminary issues. Judge Swaney also directed the applicant to provide a response to the Commissioner’s submissions in respect of section 166. The Applicant responded in detailed submissions on 24 February 2025.[20]The hearing was listed for 24 June 2025. Case management directions were sent to the parties on 17 March 2025.[21]On 12 May 2025 the Applicant filed a GRC5 application notice to vacate the hearing of 24 June 2025, extend time for service of bundles and to list a hearing to determine preliminary issues.[22]On 21 May 2025 the Commissioner provided a detailed response to the applications, which it opposed. The Applicant filed a reply on 2 June 2025. The Registrar refused the application on 5 June 2025.[23]On 10 June 2025 the Applicant filed another GRC5 application notice, seeking a direction for the Commissioner to file a Rule 11 notice before any new representative was allowed. The Applicant also requested that the directions of 26 February 2025 be stayed.[24]On 12 June 2025 the Applicant filed a GRC5 application to reconsider the Registrar’s decision of 5 June 2025.[25]On 13 June 2025 the Registrar refused the application of 10 June 2025 in its entirety. It is worth setting out paragraph 6 of the Registrar’s directions in full:
“Directions issued on 05 June 2025 make it clear that any reconsideration of the directions will not suspend the effect of the directions and that a party must still comply (see paragraph of those directions). It will be a matter for the judge/ panel to consider whether or not the Appellant has failed to comply with a direction of the Tribunal and consider whether a sanction pursuant to rule 10(1)(b) should be imposed.”
[26]On 23 June 2025 (after office hours) the Applicant emailed the Tribunal to follow up on the 5 June 2025 application for reconsideration of the Registrar’s order. The email only reached the panel on 26 June, after the hearing had already taken place. A minor correction was sent on 24 June 2025, also after the hearing had already taken place.[27]Tribunal staff had emailed the Applicant at 09:00 on the day of the hearing to find out whether the Applicant would attend. The Applicant responded at 16:48 confirming that the decision not to attend or be represented was “a deliberate and procedural decision, not due to technical difficulties. This is because, as explained in that correspondence, substantive consideration cannot occur until the urgent GRC5 issues are determined.”[28]The Applicant added:
“under Rule 36(4), the Tribunal could have proceeded in its absence, bar the Respondent for Rule 11(2) non-compliance, and enter summary determination in the Appellant's favour.”
[29]The hearing took place in the Applicant’s absence on 24 June 2025. Mr Metcalfe of counsel represented the Commissioner. The judge determined that the hearing would proceed in the absence of the Applicant for the reasons set out below. We reserved our decision on the substantive application. Case management matters[30]Case management issues are matters for the judicial panel member and have been determined by the judge alone. Application to reconsider Registrar’s decision of 5 June 2025[31]I refuse this application in its entirety. I have addressed each of the Applicant’s points below using the Applicant’s own titles. As a general point, it seems to me that the Applicant has unfortunately lost perspective on the material legal issues in the case. This may be because the Applicant does not appear to understand the legal basis for the Tribunal’s jurisdiction (addressed by the panel below). The Tribunal has tried to assist the Applicant’s understanding of the issues through its case management directions, but the Applicant has not engaged with the substantive merits of the case.[32]The Applicant has instead spent an inordinate amount of time attempting to persuade the Tribunal to designate certain issues as preliminary matters. Some of the issues the Applicant seeks to have determined as preliminary issues are not even within the jurisdiction of the Tribunal.[33]The Tribunal has limited resources and it is entitled to limit the amount of time allocated to a particular case, so long as it does so in a way that is fair and compatible with proper consideration of the issues. In rejecting the reconsideration application, I am satisfied that proceeding at a single hearing is fair and compatible with proper consideration of the issues in this case. Failure to Apply Established Legal Framework for Preliminary Issues[34]The Applicant is wrong to criticise the decision of the Registrar for relying on Judge Swaney’s earlier determination of the issue of whether a preliminary hearing was required. The Applicant fails to understand that seeking to repeatedly re-open case management issues in this way was inappropriate. The Registrar’s point was that the matter was settled and the Applicant has not identified any good reason for a further application.[35]In support of the application to designate certain matters as preliminary issues the Applicant relies on McLoughlin v Grovers (A Firm) [2001] EWCA Civ 173 and Steele v Steele [2001] CP Rep 106.[36]Though these authorities relate to proceedings under the Civil Procedure Rules, which do not directly apply to the Tribunal, I accept the principles may be relevant. The Upper Tribunal has applied case law concerning the CPR in similar ways, for example in Information Commissioner v Dr Gary Spiers and Garstang Medical Practice[2022] UKUT 93 (AAC).[37]However, it is also important to set out some factors that distinguish these proceedings. First, the Tribunal is a specialist jurisdiction. It is expected to be able to swiftly deal with complex matters of law within its field of expertise. This point was made in SCA Packaging Ltd v Boyle [2009] UKHL 37 at [9]. Although this case originated in Northern Ireland it is analogous to the present case because it involved a specialist Tribunal. The jurisdiction of the civil courts is much broader.[38]Second, the financial expenditure in civil claims is likely to be much higher than in this jurisdiction. For example, in this case no expert evidence is required.[39]Third, many cases of this type can be determined within a single day of legal argument, and I find that this case specifically can be. It is unlikely to benefit the parties and Tribunal to come back for a second day in those circumstances.[40]Turning to McLoughlin v Grovers (A Firm) [2001] EWCA Civ 173, at [66] Steele J held:
“66. In my judgment, the right approach to preliminary issues should be as follows: a. Only issues which are decisive or potentially decisive should be identified; b. The questions should usually be questions of law. c. They should be decided on the basis of a schedule of agreed or assumed facts; d. They should be triable without significant delay, making full allowance for the implications of a possible appeal; e. Any order should be made by the court following a case management conference.” a. Only issues which are decisive or potentially decisive should be identified; b. The questions should usually be questions of law. c. They should be decided on the basis of a schedule of agreed or assumed facts; d. They should be triable without significant delay, making full allowance for the implications of a possible appeal; e. Any order should be made by the court following a case management conference.”
[41]Thougha. andb. would be satisfied in this case, it is not clear that pointc. would be. No agreed facts have been provided to the Tribunal. I find that pointsd. ande. would not be satisfied in any event. Holding a preliminary hearing would cause unnecessary significant delay, as would holding a case management hearing to organise a further hearing. This authority does not assist the Applicant.[42]The Applicant says that the Registrar failed to consider the 10 factors set out in Steele v Steele [2001] CP Rep 106. For the reasons set out at paragraph 34 I do not consider that this was an error. However, I have considered them and concluded they do not support the Applicant’s application for a preliminary hearing. I will not set out all ten in this judgment, but applying those factors I do consider that the question of whether the Applicant is a ‘data subject’ is capable of disposing of the case. However, I do not consider that the risk of delay and expense justifies determining that issue at a preliminary hearing. It is not just to delay the case further when the Applicant has been given considerable opportunity to develop its case in respect of the data subject question and the Commissioner has been given the opportunity to respond.[43]Nothing in the authorities cited by the Applicant requires the Tribunal to hold a preliminary hearing when it would cause an undue burden on the Tribunal and the parties, with no discernible benefit to the determination of the issues. Fundamental Misreading of Judicial Direction[44]The Registrar was correct that Judge Swaney refused the application. This could not have been in clearer terms, set out at paragraph 2 of the decision. The judge’s additional comments at paragraph 3 of the reasons simply meant that the Tribunal could regulate its own procedure on the day of the hearing.[45]It was inappropriate for the Applicant to make a further application. A judge had already determined the point and there was no change of circumstances to justify a new application. Failure to Address Mandatory GRC Bundles Guide Requirements[46]It is true that the GRC Bundles Guide requires the parties to keep the bundle as relevant and compact as possible. However, this is to facilitate efficient hearing of the case. The Guide serves the hearing, not the other way round. The bundles are well-organised and easy to follow, though they do contain irrelevant material.[47]The Applicant has also failed to specify what more it would include in the bundle if it could. The Applicant relies on procedural unfairness without telling the Tribunal what unfairness has actually been caused. There is no evidence before me that the Applicant has been unable to participate in proceedings as a result of these issues. Indeed, the Applicant has communicated with the Tribunal frequently and at length. There is no evidence before me that the Applicant actually has any additional relevant further evidence or authorities.[48]Moreover, the submission loses any remaining force when some of the matters the Applicant wishes to have determined as preliminary issues are outside the jurisdiction of the Tribunal, such as “Whether the Respondent is permitted to rely on the information from complaints to build a case for future regulatory actions and whether this influenced the decision to close the Appellant's complaint prematurely;” Critical Failure to Recognise Threshold Jurisdictional Questions and Interconnected Preliminary Issues: Unreasonable Decision Contrary to Established Case Management Principles[49]It is convenient to address these points together. The Applicant says that the Registrar failed to recognise that whether the Applicant is a ‘data subject’ for the purposes of the 2018 Act is a threshold jurisdictional question. The Applicant’s concern is that resources will be wasted on proceedings where the Tribunal has no jurisdiction.[50]The Applicant also says that no reasonable Tribunal could conclude that conflating preliminary and final issues promotes efficiency in these circumstances.[51]For the reasons set out above, it is for the Tribunal to say which issues are preliminary and which are final issues. The only issue that I would have been prepared to designate as a preliminary issue is the issue of whether the Applicant could be a data subject for the purposes of the 2018 Act. I remind myself that the underlying trigger for the dispute is recovering access to a Discord account. In those circumstances, I am satisfied it is both efficient and just to proceed to hear all issues in one hearing.[52]The Applicant is correct that the Tribunal is required to conduct proceedings in ways which are proportionate to the importance of the case, complexity of the issues and the costs and resources of the parties. I do not consider that this case raises particularly important or complex issues. Any complexity results from the Applicant’s prolix submissions. The legal issues are straightforward. I have no information about either party’s resources so I consider that a neutral factor. The Applicant’s proposed case management directions would likely delay an uncomplicated application for months and cause both parties and the Tribunal unnecessary expense. Considering the Registrar’s decision afresh[53]I uphold the decision of the Registrar, which appropriately balanced the considerations in the overriding objective and correctly applied the Procedure Rules for the reasons I have given above. Rule 11[54]The Applicant has spent considerable time addressing whether the Commissioner has complied with Rule 11 of the Procedure Rules as the staff member who is responsible for the case changed from Michelle Jones to Edward Fyle.[55]I agree with the Commissioner’s submission that paragraph 6(3) of schedule 12 of the Data Protection Act 2018 allows the Commissioner to authorise officers or staff to act on his behalf. For that reasons I do not consider that either Ms Jones or Mr Fyle would constitute a ‘representative’ for the purpose of Rule 11.[56]However, if I am wrong about that, I consider it furthers the overriding objective to use the general power in Rule 5 to waive the requirement for the Commissioner to comply with Rule 11 to change its representative. The Applicant was promptly told in writing that that Mr Fyle was the staff lawyer responsible for the case. The Applicant can only point to procedural rigour by way of opposition to the change. The Applicant does not cite any actual prejudice caused to it. Even if there is some minor administrative burden to the Applicant, I find that is outweighed by the Applicant’s excessively lengthy correspondence on the subject. The parties are required to help the Tribunal further the overriding objective.[57]The only person who was inconvenienced was the Commissioner, who had to ensure communications were forwarded internally. The Tribunal is required to avoid unnecessary formality and seek flexibility. There is no reason not to do so in this case. Applicant’s absence at hearing[58]I was satisfied it was in the interests of justice to proceed in the absence of the Applicant pursuant to Rule 36 and ruled so at the hearing. I was satisfied that the Applicant had received notice of the hearing and had not at that time responded to the Tribunal’s attempts to make contact.[59]Moreover, I was not satisfied that it would be a proportionate use of the Tribunal’s resources to adjourn or set any of the case management directions sought by the Applicant when the Applicant continually failed to engage with the jurisdictional issue at the heart of the application. The Tribunal’s task in this appeal is much more straightforward than the Applicant submits. The Applicant had filed extensive written submissions so the Tribunal was aware of its position.[60]After receiving the email of 23 June on 26 June I considered whether it was appropriate to re-visit that decision. I determined it was not. The Applicant’s email of 24 June 2025 was clear that the Applicant was aware a decision could be made in its absence. The 5 and 13 June 2025 directions of the Registrar both made it clear that applications for reconsideration would not suspend the effect of the directions. The Applicant was aware of the consequences of non-attendance and declined to attend the hearing. The Tribunal continued to have sight of the Applicant’s extensive written submissions. It remained just to have proceeded in the Applicant’s absence. Legal Framework[61]The Applicant submits the Tribunal has jurisdiction to hear this matter under section 163 of the 2018 Act. The Applicant is mistaken. The Tribunal has no jurisdiction to consider an appeal under that section in this case. It reads: 163 Determination of appeals(1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3).(2) The Tribunal may review any determination of fact on which the notice or decision against which the appeal is brought was based.(3) If the Tribunal considers— (a) that the notice or decision against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice or decision involved an exercise of discretion by the Commissioner, that the Commissioner ought to have exercised the discretion differently, the Tribunal must allow the appeal or substitute another notice or decision which the Commissioner could have given or made.(4) Otherwise, the Tribunal must dismiss the appeal.(5) On an appeal under section 162(2), if the Tribunal considers that the enforcement notice ought to be cancelled or varied by reason of a change in circumstances, the Tribunal must cancel or vary the notice.(6) On an appeal under section 162(4), the Tribunal may cancel the Commissioner's determination.[62]Section 163 refers to section 162 which states: 162 Rights of appeal(1) A person who is given any of the following notices may appeal to the Tribunal— (a) an information notice; (b) an assessment notice; (c) an enforcement notice; (d) a penalty notice; (e) a penalty variation notice.(2) A person who is given an enforcement notice may appeal to the Tribunal against the refusal of an application under section 153 for the cancellation or variation of the notice.(3) A person who is given a penalty notice or a penalty variation notice may appeal to the Tribunal against the amount of the penalty specified in the notice, whether or not the person appeals against the notice.(4) Where a determination is made under section 174 in respect of the processing of personal data, the controller or processor may appeal to the Tribunal against the determination.[63]None of the notices listed in section 162 have been issued to the Applicant. Consequently, the Tribunal does not have jurisdiction under section 162 or section 163. The Applicant is incorrect in its submission that “Section 163(3)(a) grants the Tribunal the authority to review decisions that are not in accordance with the law, and Section 163(3)(b) allows for review when the Respondent should have exercised discretion differently.”. Section 163(3)(a) only does so where an index decision under section 162 has been made.[64]We agree with the Commissioner that the only provision the Applicant could be bringing this matter under is section 166 of the 2018 Act. That provides: 166 Orders to progress complaints(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a)to take appropriate steps to respond to the complaint, or (b)to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.(3) An order under subsection (2)(a) may require the Commissioner— (a)to take steps specified in the order; (b)to conclude an investigation, or take a specified step, within a period specified in the order.(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).[65]Section 166(4) refers to section 165(4)(a) and (5), which state: (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—(a) take appropriate steps to respond to the complaint, […] (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a) investigating the subject matter of the complaint, to the extent appropriate, and(b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with foreign designated authority is necessary.[66]“Data subject” is defined in section 3(5): “Data subject” means the identified or identifiable living individual to whom personal data relates.[67]Article 4(1) of the UK General Data Protection Regulation also defines ‘data subject’:
“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
Issues[68]The issues are therefore:a. Is the Applicant a ‘data subject’ for the purposes of section 3 of the 2018 Act?b. If yes, did the Commissioner fail to take appropriate steps to respond to the complaint?c. If yes, should the Tribunal make an order under section 166(2)? Documents[69]We received a 233 page hearing bundle, together with a 278 page authorities bundle. We were also sent the procedural correspondence between the Tribunal and the parties. The hearing bundle included a witness statement for the Applicant, signed by Flavio Fellica as its General Secretary.[70]Not all of the documents in the bundle are helpful to the Tribunal in determining this application. For example, in a section of the bundle labelled in the index as “Public Concerns regarding Discord’s adherence to GDPR” there are some screenshots from the forum Reddit, specifically the subreddit ‘r/gdpr’. There are obvious problems with relying on anonymous forum posts in legal proceedings. In addition, the post author appears to have successfully made a subject access request to Discord, so its relevance to the current proceedings is doubtful. The Tribunal only has the jurisdiction granted to it by Parliament; its role is not to generally scrutinise Discord’s privacy policies. Findings Is the Applicant a ‘data subject’ for the purposes of section 3 of the 2018 Act?[71]It is clear from section 3 of the 2018 Act and Article 4(1) UKGDPR that ‘data subject’ refers to a living individual person. An association cannot be a data subject. The Applicant is an association and is therefore not a data subject.[72]We agree with Mr Metcalfe’s submissions that these words admit no ambiguity. The wording of the legislation is clear and there is no reason for us to go behind them.[73]We also agree with Mr Metcalfe’s submission that the right of a data subject to request access to their personal data under Article 15(1) can only be read as the right of a natural person to do so.[74]The Applicant’s case on this point was set out in numerous detailed written submissions, including those dated 19 August 2024, 9 October 2024, 13 January 2025 and 24 February 2025. It is not possible to respond to each and every point raised by the Applicant. We have focused on the points relevant to the issues we need to determine.[75]We find the submissions can be summarised as follows: We should interpret ‘data subject’ as including any entity, regardless of its legal form.[76]We have addressed this above. The language of the legislation is clear. If Parliament had intended to give rights to associations, organisations or other legal bodies then it would have done so.[77]We agree with Mr Metcalfe that the authorities cited by the Applicant do not assist it. The Applicant cited the following authorities:a. Breyer v Germany (C-582/14). The Applicant appears to argue that this is authority for the proposition that a ‘data subject’ can be inferred from non-personal data when the data controller has access to additional information that allows for the identification of the data subject. We do not accept that proposition. Breyer concerns the definition of personal data for the purpose of Directive 95/46. Paragraph 49 of that judgment makes it clear that an IP address could be personal data where the controller has the legal means to identify a natural person from it. It does not then follow that the owner of the IP address is necessarily a natural person. As Mr Metcalfe points out, the CJEU did not in any way extend the definition of a ‘natural person’ in its judgment.b. Wikimedia Foundation, Inc. v Turkey (App. No. 25479/19). The Applicant argues that “the case established that legal entities (such as “Associations” or “Foundations”) are entitled to the same protections of individuals, including those under the European Convention on Human Rights”. No English language translation of this authority was provided and so we are unwilling to take it into account. We were only provided with a summary of the case from a legal website and submissions made by an intervener.c. Facebook Ireland Ltd v. Gegevensbeschermingsautoriteit (C-645/19). The Applicant considers this to be authority for the proposition that legal entities are entitled to the same protection of rights as individuals. We disagree with that reading of the judgment and agree with Mr Metcalfe that once again this judgment does not address the meaning of a ‘natural person’. The principal concern of the law is the safeguarding of data, rather than who is the data subject. The specific data requested in this case included personal data.[78]This adds nothing to the Applicant’s argument. Being able to identify the data subject is part of being able to safeguard the data. Otherwise, a request for personal data could be made by anybody. The distinction between natural persons and other entities is less relevant as the range and depth of information gathered and automation increases.[79]This point is irrelevant. Our task is to determine the law as it is now, not as the Applicant wishes it to be. The terms ‘data subject’ and ‘data controller’ are mere functional roles in the legislative framework.[80]We do not need to make any findings on the role of the data controller in this case. However, a data subject is more than a functional role in the legislative framework. The 2018 Act creates enforceable rights for that data subject. A data subject is also the person who can bring the present application. They are not merely a conduit for making requests. The question of whether the Applicant is a data subject is irrelevant to the question of whether the Commissioner resolved the Applicant’s complaint or whether Discord refused to comply with its obligations under the 2018 Act.[81]This submission is misconceived. Section 166(2) only allows the Tribunal to make an order to progress on an application by the data subject. Being a data subject is what would bring this particular complaint within the jurisdiction of the Tribunal. If the Applicant is not a data subject, it cannot make the application as the Tribunal lacks jurisdiction. Did the Commissioner fail to take appropriate steps to respond to the complaint? Should the Tribunal make an order under section 166(2)?[82]As we have found that the Applicant is not a data subject there is no need for us to make findings on either of these issues. However, we would not have made any order even if we had found the Applicant was a data subject. The Commissioner responded to the Applicant’s complaint. Data controllers must satisfy themselves of the identity of the requester and it is difficult to see how Discord could have been satisfied with the Applicant’s identity in these circumstances. In our view the Commissioner was correct that the email address changeover amounted to a service complaint, outside the remit of the Commissioner. Should the Commissioner have interpreted the request differently?[83]It is not entirely clear which legal issue the Applicant intends for this to be relevant to. We have addressed it in the context of the definition of a data subject above. Mr Metcalfe has read it as the Applicant arguing that the Commissioner should have interpreted the request as a subject access request made on behalf of the natural persons who are its members. However, we agree that there are fatal legal and practical problems with this argument. First, Article 15(1) is clearly in the terms of an individual (“the data subject” – emphasis added) requesting personal data.[84]Second, we agree that the Applicant made no attempt to identify any natural person in the request. At every stage the Applicant only gave the name of the Association. The only documents we have seen that refer to a natural person are documents prepared for this Tribunal which give Flavio Fellica’s name as a point of contact and a witness. It was therefore impossible for both the Commissioner and Discord to identify whose personal data they should search for and disclose.[85]Third, the Applicant’s submission would still come up against the hurdle of the data controller having to satisfy themselves of the requester’s identity, and authority to act on behalf of another person. The purpose of the 2018 Act is to protect personal data, it would seem to defeat its purpose if any association or other legal entity could simply make requests on its members’ behalf without identification and authority to do so. Other submissions[86]The Applicant also made submissions on various other matters including the principle of data minimisation and alternatives for verifying identity. Though we have read all documents provided we have not considered those submissions because they are of no relevance to the issues before the Tribunal in this application, and in most cases fall outside the Tribunal’s jurisdiction. As well as being irrelevant, many are incorrect, such as the submission in the 24 February 2025 letter that “The Tribunal can assess whether the Commissioner’s failure to act was disproportionate, irrational or inconsistent with its statutory duties, which is beyond the scope of judicial review.” Conclusion[87]The application is dismissed. City Doctoral Researchers’ Association is not a living individual and therefore not a data subject. It had no right to bring this application pursuant to section 166. It also had no right to bring an appeal pursuant to section 163 as none of the conditions in section 162 were met. Designating those issues as ‘preliminary issues’ would have made no difference to the decision. Signed: Date: Judge Watton 17 September 2025