Feras Akhras v The Information Commissioner [2026] UKFTT 1097 (GRC)

[2026] UKFTT 01097 (GRC)

Case Reference: FT/EA/2026/0188/GDPR

First-tier Tribunal

(General Regulatory Chamber)

Date 29 July 2026

Information Rights

Decided without a hearing

Before

JUDGE ARNELL

Between

FERAS AKHRASApplicant

THE INFORMATION COMMISSIONERRespondent

Decision: The application is struck out under Rule 8(3)(c) as it has no reasonable prospects of success.

REASONS

[1]These proceedings concern the Applicant’s application for an order pursuant to section 166(2) of the Data Protection Act 2018 (“DPA 2018”).

[2]On 01 July 2026 the Information Commissioner (“the Commissioner”) applied to strike out the application pursuant to Rule 8(2)(a) and/or Rule 8(3)(c) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“Rule”) on the grounds that this Tribunal lacks jurisdiction and/or there are no reasonable prospects of the application proceeding.

[3]The Applicant provided a Reply which included submissions in response to the Commissioner’s application to strike out on 09 July 2026. The Applicant resists the application.

[4]In accordance with Rule 32(3) I am not required to hold an oral hearing to determine this application. I have the benefit of submissions from both parties and as such I am satisfied I was satisfied I could proceed to determine this application on the papers.

Background

[5]The Applicant made a subject access request to the Home Office. On 24 November 2025 the Applicant complained to the Commissioner that the Home Office has failed to comply with their obligations under the General Data Protection Regulations (“GDPR”). The Commissioner acknowledged the complaint on 25 November 2025 but as no response had been received the Applicant contacted the Commissioner on 01 May 2026 seeking an update.

[6]On 07 May 2026 the Commissioner issued an outcome apologising for the delay and concluding that in their view the Home Office had infringed its data protection obligations it its handling of the Applicant’s SAR. The Commissioner confirmed they had written to the Home Office setting out their view and asking the Home Office to look again at the Applicant’s SAR and respond to the Applicant in that respect within one month. The Commissioner explained that whilst they had asked the Home Office to consider whether there was any further personal data due to the Applicant, it may be that the Home Office had applied exemptions to some of the personal date.

[7]On 08 May 2026 the Applicant raised concerns with the handling of the complaint and the outcome provided. Prior to the Commissioner’s response to the Applicant’s concerns, the Applicant submitted this application to the Tribunal on 14 May 2026. Within their application the Applicant sets out the remedy they are seeking as an order requiring the Information Commissioner to:

“1. Supervise and verify the Home Office’s compliance with the ICO’s direction of 7 May 2026 requiring a further SAR review, and confirm to me whether that review has been completed and whether further personal data has been disclosed; 2. In the event that the Home Office fails to respond adequately by 7 June 206, take appropriate steps to require compliance; 3. Examine whether the exemptions applied by the Home Office were applied on a document-specific basis with proper proportionality assessment rather than on a blanket basis; and 4, Provide a substantive, reasoned outcome addressing the completeness of the SAR disclosure and the propriety of the exemptions applied.”

[8]On 21 May 2026 the Commissioner responded to the concerns raised by the Applicant on 08 May 2026: acknowledging and explaining their previous delay; reiterating the findings within the outcome; and advising the Applicant of the option to request a review if dissatisfied with the outcome of 07 May 2026. Further correspondence took place between the Parties on 21 May 2026 which it is not necessary to set out in full here.

[9]On 22 May 2026 the Applicant requested a case review which was acknowledged by the Commissioner and assigned a reviewing officer. The Applicant received a further response from the Home Office (as directed within the Commissioner’s outcome of 07 May 2026) on 02 June 2026, which was sent to the Commissioner and placed before the reviewing officer. In response the reviewing officer requested further information from the Home Office. This information remained outstanding, despite several reminders from the Commissioner, at the date the application to strike out was made.

[10]On 16 June 2026 the Commissioner provided an update to the Applicant explaining the steps taken and confirming they would provide a review outcome as soon as possible upon receipt of the information requested from the Home Office.

The Commissioner’s application to strike out

[11]The Commissioner submits that the Tribunal’s jurisdiction is limited in this case to a consideration of any procedural failures by the Commissioner to progress a complaint. That an order may only be made it the Tribunal is satisfied the Commissioner has failed procedurally to comply with section 166(1) DPA 2018. They submit they have taken appropriate steps to investigate and respond to the Applicant’s complaint; that notwithstanding they have not yet issued their review decision, an outcome to the complaint was provided 07 May 2026; and there is therefore no basis on which the Tribunal may make an order pursuant to section 166(2) DPA 2018.

[12]The Commissioner submits the Tribunal has no jurisdiction to consider the Applicant’s application and/or the application has no realistic prospect of success.

The Applicant’s Response

[13]The Applicant’s provided detailed submissions in reply which I have considered in full. In summary they submit the Tribunal does have jurisdiction as although an outcome was provided on 07 May 2026, the Commissioner’s subsequent conduct of reengagement with the Home Office prior to issuing a review outcome means the complaint has not concluded. They further submit the Commissioner’s subsequent actions of reengagement are open to consideration of failures to comply with the requirements of section 165 DPA 2018. Finally, they submit that for the same reasons it cannot be said there are no reasonable prospects of the application succeeding as there have been several missed deadlines by the Commissioner which may amount to a failure to take appropriate steps.

The Law

[14]Section 165 DPA 2018 provides for an individual to complain to the Commissioner if they consider there has been an infringement of GDPR and/or Parts 3 or 4 of DPA 2018. The relevant parts provide as follows: (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act. (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—(a) take appropriate steps to respond to the complaint,

(b) inform the complainant of the outcome of the complaint,

(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a) investigating the subject matter of the complaint, to the extent appropriate, and (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with [a] foreign designated authority is necessary.

[15]Individuals may make a complaint to the First-tier Tribunal for an order requiring the Commissioner to take appropriate steps pursuant to section 166 DPA 2018. The focus of section 166 DPA 2018 is not the merits of the Applicant’s complaint to the Commissioner nor the substantive outcome of the Commissioner’s investigation. The Tribunal can only make an order to progress an individual’s complaint if one of the conditions at section 166(1)(a), (b) or (c) DPA 2018 is met.

[16]The relevant parts of section 166 DPA 2018 provide as follows: 1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the [F1UK GDPR], the Commissioner—a. fails to take appropriate steps to respond to the complaint,

b. fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

c. if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. 2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— a. to take appropriate steps to respond to the complaint, or b. to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order. 3) An order under subsection (2)(a) may require the Commissioner— a. to take steps specified in the order; b. to conclude an investigation, or take a specified step, within a period specified in the order.

[17]The Commissioner provides a detailed summary of the relevant authorities regarding the focus of section 166 DPA 2018, the extent of the Tribunal’s jurisdiction, the broad discretion of the Commissioner and the meaning of “appropriate steps” within their Response. I agree with the Commissioner’s submission on the law. It is not my intension to rehearse those submissions here in full, but a summary of the relevant points is as follows:a. Section 166 DPA 2018 is forward looking provision concerned with remedying procedural defects. The Tribunal is tasked with specifying appropriate steps to respond but not with assessing the appropriateness of a response.

b. The Commissioner has broad discretion as to how he investigates complaints and is the expert regulator. The tribunal does not have an oversight role over the Commissioner’s exercise of his functions or his internal processes. The Commissioner’s view carries weight but is not necessarily determinative.

c. It is for the tribunal to decide, applying an objective test, if an ‘appropriate step’ has been omitted, but in practice that is unlikely to be the case where an outcome has been issued. That is because section 166 is procedural and cannot be used effectively as a back door route to obtaining a remedy that should be pursued by making a claim against the data controller or by judicial review of the Commissioner.

Conclusions

[18]In determining this application, I have had due regard to the Overriding Objective (Rule 2), the statutory framework, relevant authorities and both party’s submissions.

[19]It is clear from the above authorities that, where the Commissioner has dealt with a complaint by arriving at and informing the Applicant of some form of “outcome”, having first investigated the subject matter to the extent appropriate in the circumstances, that neither of the remedies in 166(2) and (3) DPA 2018 can apply because those remedies are directed to steps or actions that have already been taken – even where the outcome is to take no further action, or where an outcome was provided late.

[20]In the case of Delo at paragraph 64, Warby LJ stated:

“An “outcome” must be the end point of the Commissioner’s “handling” of a complaint. A conclusive determination or ruling on the merits that brings an end to the complaint is certainly an “outcome” but that word is intended to have broader connotations. […]”

[21]It is not disputed that the Commissioner provided an outcome to the complaint on 07 May 2026. However, the Commissioner has chosen, after the date this application was made to the Tribunal, to take further steps to progress the complaint and to delay issuing a review outcome pending input from the Home Office. Therefore, it cannot be said that the outcome of 07 May 2026 was an “end point” to the Commissioner’s handling of the complaint and I find I cannot be satisfied that it amounts to an “outcome” for the purpose of the legislation.

[22]It is also not disputed that there was a delay in the Commissioner providing an update on the progress of the complaint or an outcome to the Applicant prior to the issuing of the outcome on 07 May 2026. However, whilst the Commissioner can not be said to have concluded the complaint, they have continued to take steps they consider appropriate to progress the complaint since receipt of the Applicant’s request for a review and have provided updates to the Applicant on the progress of the complaint. I am satisfied, giving significant weight to the view of the Commissioner as the expert regulator, that there are no further steps the Commissioner ought reasonably be taking to progress the Applicant’s complaint at this time.

[23]Accordingly, I find that were the application to proceed at this time there are no orders which the Tribunal could make to progress the appeal under section 166(2) DPA 2018. The outcomes sought by the Applicant are not within the Tribunal’s powers to grant and I am satisfied there is no reasonable prospect of the application or any part of it succeeding. The application is therefore struck out pursuant to Rule 8(3)(c).

[24]There is nothing in this decision which prevents the Applicant from making a fresh application to the Tribunal should the Respondent fail to comply with the requirements under section 165 DPA 2018 in relation to the review outcome going forward. Signed Judge Arnell Date: 28 July 2026