Lisa Keech v Information Commissioner [2026] UKFTT 1067 (GRC)

[2026] UKFTT 01067 (GRC)Case Reference: FT/EA/2026/0175/GDPR
First-tier Tribunal
(General Regulatory Chamber)
Date 22 July 2026
Information Rights
Decided without a hearing
Before
TRIBUNAL JUDGE KIAI
Between
LISA KEECHApplicantINFORMATION COMMISSIONERRespondentDecision: The proceedings are struck out under Rule 8(3)(c) because there is no reasonable prospect of the Applicant’s case, or part of it, succeeding.REASONS
[1]These proceedings involve an application to the Tribunal under section 166(2) of the Data Protection Act 2018 (“DPA”).[2]The Applicant complained to the Information Commissioner (the “Commissioner”) on 24 September 2025 regarding the response of an educational institution to a Subject Access Request and alleged infringements of data protection legislation concerning herself and her daughter.[3]On 4 August 2025, the organisation provided a response to the Applicant.[4]The Applicant raised two written complaints with the organisation on 7 August 2025 and 25 August 2025. She alleged that the Subject Access Request (“SAR”) was incomplete and that there had been data breaches in connection with the way the SAR data was collected and handled, amounting to dishonesty and cover-up.[5]The Commissioner issued an outcome letter on 22 January 2026.[6]Following a request for further clarification and review by the Applicant, the Commissioner maintained that outcome and issued a review decision on 15 April 2026.[7]The Applicant lodged the present application with the Tribunal on 5 May 2026.[8]By a response dated 16 June 2026, the Commissioner opposed the application and applied for it to be struck out pursuant to Rule 8(3) (c) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009, on the ground that it has no reasonable prospect of success.[9]Under Rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers there is no reasonable prospect of the applicant’s case, or part of it, succeeding.[10]By directions dated 22 June 2026, Judge Heald afforded the Applicant an opportunity to make representations regarding the proposed strike-out and regarding whether the application should be admitted.[11]The Applicant provided detailed written representations opposing strike-out on 25 June 2026.

Preliminary Issue: Time

[12]The Commissioner submits that the application was lodged out of time and should not be admitted pursuant to Rule 22(4)(b) of the Tribunal Rules. The Commissioner notes that the Applicant's complaint was submitted on 24 September 2025 and submits that the relevant time limit expired before the application was lodged on 5 May 2026. The Commissioner further submits that the Applicant has not adequately explained the delay following receipt of the review outcome on 15 April 2026. He submits “Taking all of the relevant circumstances into account (including the merits of her application), against the length of the delay and absence of an explanation fot [sic] the further 3 week delay post the review decision, they do not outweigh the need for litigation to be respected”.[13]The Applicant explains that she remained engaged in correspondence with the Commissioner regarding her complaint and review request, that she was attempting to resolve matters without proceedings, and that she is a litigant in person with no legal representation. She further notes that detailed reasons for the Commissioner's decision were not supplied until after the application had been lodged.[14]I have considered the parties' respective submissions regarding time. Whilst the application was not lodged within the prescribed period, I am prepared to admit it out of time.[15]I reach that conclusion because the delay is relatively modest, because the Applicant continued to engage actively with the Commissioner following the original outcome, because a review was not concluded until 15 April 2026, and because the Commissioner subsequently accepted that the original outcome correspondence did not adequately explain the reasons for the decision. In all the circumstances, and having regard to the overriding objective, I consider it appropriate to admit the application.[16]I therefore proceed to consider the Commissioner's application for strike out.

Statutory Framework

[17]Section 165 DPA sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under section 166 DPA a data subject can make an application to this tribunal for an order as follows: 166 Orders to progress complaints(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner – (a) Fails to take appropriate steps to respond to the complaint, (b) Fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) If the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner – (a) To take appropriate steps to respond to the complaint, or (b) To inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.[18]The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. Some key decisions are:a. Scranage v Information Commissioner [2020] UKUT 196 (AAC), paragraph 6 - "In my experience – both in the present appeal and in many other cases – thereis a widespread misunderstanding about the reach of section 166. Contrary tomany data subjects’ expectations, it does not provide a right of appeal againstthe substantive outcome of the Information Commissioner’s investigation on itsmerits. Thus, section 166(1), which sets out the circumstances in which anapplication can be made to the Tribunal is procedural rather than substantive inits focus." (emphasis in original).b. Killock v Information Commissioner [2022] 1 WLR 2241, Upper Tribunal at paragraph 74 - "…It is plain from the statutory words that, on an application undersection 166, the Tribunal will not be concerned and has no power to deal with themerits of the complaint or its outcome. We reach this conclusion on the plain andordinary meaning of the statutory language but it is supported by the ExplanatoryNotes to the Act which regard the section 166 remedy as reflecting the provisionsof article 78(2) which are procedural. Any attempt by a party to divert a tribunalfrom the procedural failings listed in section 166 towards a decision on the meritsof the complaint must be firmly resisted by tribunals."[19]Rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 provides:
“The Tribunal may strike out the whole or a part of the proceedings if— ... (c) the Tribunal considers there is no reasonable prospect of the applicant’s case, or part of it, succeeding.” (c) the Tribunal considers there is no reasonable prospect of the applicant’s case, or part of it, succeeding.”

Factual background

[20]The Applicant's complaint concerned allegations that personal data and safeguarding information relating to herself and her daughter had been improperly accessible to individuals within an organisation, that records had been amended, that the response to a SAR was incomplete and that further enquiries ought to have been undertaken into alleged data protection failings.[21]The Commissioner accepts within the Response that the original outcome correspondence did not adequately explain the reasons why no further action would be taken.[22]Following further correspondence, the Commissioner provided a detailed explanation of the reasons underlying the decision by letter dated 12 June 2026. That correspondence addressed the Commissioner's approach to the complaint and the reasons why no further regulatory action was considered appropriate.[23]The Applicant nevertheless maintains that the evidence she supplied was not properly considered and that the Commissioner failed meaningfully to engage with material which she believes demonstrates serious data protection failings.[24]I have considered whether it is necessary to reproduce in detail the contents of the safeguarding, welfare, medical and other records relied upon by the Applicant. Whilst those materials form part of the evidence before the Tribunal, the issue arising in this application concerns the scope of the Tribunal’s jurisdiction under section 166 DPA 2018 rather than the merits of the underlying complaint. I have therefore summarised the nature of the Applicant’s concerns without setting out unnecessary detail concerning personal information relating to her daughter. I consider that approach sufficient to explain the issues arising in this application whilst avoiding unnecessary publication of sensitive information.[25]I have also considered whether it is necessary to make any order under Rule 14 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 restricting the publication of information contained within these proceedings. Neither party has applied for such an order. Having regard to the principle of open justice, the limited issue requiring determination in this application, and the fact that I have avoided reproducing unnecessary details concerning the personal information of the Applicant's daughter, I do not consider it necessary or proportionate to make such an order. Application of the statutory framework to the present case The Applicant's complaint and evidence

Application of the statutory framework to the present case

[26]The Applicant's case is not simply that she disagrees with the outcome of her complaint. Rather, her contention is that the Commissioner failed properly to engage with material evidence before deciding not to pursue further regulatory action. She submits that the Commissioner reached a decision without adequately considering information which, in her view, demonstrated significant failures in the handling of personal and special category personal data.[27]In support of her position, the Applicant relied upon screenshots and records which she says demonstrate that personal data and highly sensitive personal data relating to her daughter was accessible within the organisation to individuals who had no operational need to view it. She contends that this gave rise to concerns regarding compliance with the integrity and confidentiality requirements of the UK GDPR.[28]The Applicant also relied upon records which she says demonstrate that records were amended after their original creation. The materials before me include apparent revision histories and other records which, the Applicant submits, support that contention. She considers those materials significant because they raise questions regarding the accuracy, completeness and reliability of information disclosed in response to the SAR, and because they form part of her wider contention that the Commissioner failed properly to engage with evidence which, in her view, warranted further enquiry.[29]The Applicant also relies upon an email from a member of staff which, she says, demonstrates that concerns regarding access to information were raised internally. In her written submissions she states that the member of staff reported that records relating to attendance, safeguarding, welfare and correspondence concerning the Applicant’s daughter could be accessed by staff who had no connection with the individual concerned. She submits that this constituted contemporaneous evidence originating from within the organisation itself rather than merely her own interpretation of events.[30]The Applicant states that the organisation concerned informed her that an internal review had been undertaken because staff had accessed emails relating to her daughter and that the matter was being addressed through HR procedures. She relies upon that information as providing an evidential basis for her belief that further records existed which had not been disclosed in response to her SAR.[31]The Applicant further emphasises that the information in question concerned safeguarding records and other sensitive personal information. She submits that such information constitutes particularly sensitive personal data and that the Commissioner failed adequately to engage with the significance of that fact when deciding not to pursue further enquiries.[32]The Applicant's central submission is therefore not merely that the Commissioner arrived at a conclusion with which she disagrees. Rather, she submits that the evidence she supplied, disclosed potentially serious concerns and that the Commissioner failed properly to examine that evidence before deciding not to investigate further.

The Commissioner's response

[33]The Commissioner issued an outcome letter on 22 January 2026 and subsequently maintained that outcome following a review completed on 15 April 2026.[34]The Commissioner accepts that the original outcome correspondence did not adequately explain the reasons why no further action would be taken. That concession is expressly made within the Response before the Tribunal.[35]However, the Commissioner maintains that any deficiency in the original explanation was subsequently remedied. In particular, the Commissioner relies upon correspondence dated 12 June 2026 in which the Commissioner provided detailed reasons for the decision not to take further action. In that correspondence, the Commissioner explained that the issues raised by the Applicant primarily concerned the specific circumstances of her case and did not disclose evidence of systemic failings or a significant ongoing risk to individuals' information rights such as would justify formal regulatory intervention.[36]The Commissioner also addressed the Applicant's concerns regarding the accuracy and completeness of records, alleged amendments to records, alleged concealment of information, alleged personal data breaches, information sharing, and complaint handling. The Commissioner explained why, notwithstanding those concerns, further regulatory action was not considered necessary or proportionate and identified other routes available to the Applicant if she wished to challenge the accuracy of personal data or seek relief through the courts.[37]The Commissioner therefore submits that the outcome letter of 22 January 2026, the review decision of 15 April 2026 and the detailed explanatory letter of 12 June 2026 together constitute both an outcome and an explanation of that outcome for the purposes of sections 165 and 166 DPA 2018.[38]The Commissioner accepts neither that the evidence relied upon by the Applicant required further investigation nor that any continuing procedural failure existed. The Commissioner's position is that the Applicant's continuing dissatisfaction arises from disagreement with the assessment of the evidence and the decision not to pursue further regulatory action rather than from any failure to provide an outcome or explanation.

Analysis

[39]I accept that the Applicant's concerns are genuine, detailed and supported by specific examples. The Applicant has identified particular records, alleged amendments to records and concerns regarding access to sensitive information. I am satisfied that she has clearly articulated concerns she wishes to advance.[40]The Applicant submits that the evidence she relies upon demonstrates matters which warranted further enquiry by the Commissioner. For present purposes, however, I make no finding as to whether the Applicant's allegations are ultimately correct, whether any breach of the UK GDPR occurred, whether records were improperly amended or whether additional regulatory investigation would have been justified. Those are not matters which I am required to determine in order to resolve the present application.[41]The difficulty for the Applicant is that, even taking her case at its highest, that does not answer the question which arises under section 166 DPA 2018.[42]The question before this Tribunal is not whether the Commissioner ought to have reached a different conclusion. Nor is it whether the Commissioner ought to have attached greater weight to particular pieces of evidence. Nor is it whether the Commissioner ought to have conducted a more extensive investigation.[43]The issue for present purposes is whether, even accepting the Applicant's case at its highest, there remains a live issue falling within the limited jurisdiction conferred by section 166 DPA 2018 such that the Tribunal could properly grant the relief sought.[44]I have considered carefully the fact that the Commissioner accepts that the original outcome correspondence did not adequately explain the reasons for the decision. Had the position remained as it stood following the outcome letter of 22 January 2026, a more substantial question may have arisen as to whether the Commissioner had taken appropriate steps to respond to the complaint.[45]However, that is not the position which exists at the date of determination. The Commissioner has now provided an outcome, undertaken a review and supplied a detailed explanation of the reasons underpinning the decision by correspondence dated 12 June 2026.[46]The Tribunal's powers under section 166 are directed towards ensuring that a complainant receives an outcome, information about progress, or an appropriate procedural response to a complaint. The Tribunal does not have power under section 166 to determine whether the Commissioner should have attached greater weight to particular evidence, undertaken different enquiries, or reached a different substantive conclusion.[47]In those circumstances, I am unable to identify any continuing procedural defect capable of remedy by means of an order under section 166. The Applicant's complaint now concerns the adequacy of the Commissioner's assessment of the evidence and the conclusions reached. Whether those conclusions are persuasive is not a matter falling within the jurisdiction conferred by section 166.[48]Properly analysed, the Applicant's case has therefore moved beyond the territory governed by section 166. What remains is a challenge to the substance of the Commissioner's reasoning and to the exercise of the Commissioner's regulatory judgment. Section 166 does not confer jurisdiction upon the Tribunal to determine such matters.[49]I therefore conclude that, even taking the Applicant's case at its highest and assuming the evidence relied upon by her is capable of supporting further investigation, no order capable of being made under section 166 DPA 2018 could properly be granted. The proceedings accordingly have no reasonable prospect of success. Signed Date: Judge. G Kiai 9th July 2026