Dhanwantee Hooper v The Information Commissioner [2026] UKFTT 1102 (GRC)
Introduction
[1]This is an application made by Dhanwantee Hooper (“The Applicant”) under s.166(2) of the Data Protection Act 2018 (the “DPA 2018”) for an order requiring the Information Commissioner (“IC”) to take appropriate steps to respond to a complaint made by the Applicant. The Applicant considers that the IC failed adequately to respond to complaints lodged by the Applicant under section 165 DPA 2018 concerning the handling of their personal data by the Department for Work and Pensions ("DWP") and the Child Maintenance Service ("CMS"). Legal Framework[2]Section 165 DPA sets out the right of data subjects to complain to the IC about infringement of their rights under the data protection legislation. Under section 166 DPA a data subject can make an application to this Tribunal for an order as follows: 166 Orders to progress complaints(1) This section applies where, after a data subject makes a complaint under section165 or Article 77 of the UK GDPR, the Commissioner - (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on thecomplaint, or of the outcome of the complaint, before the end of the periodof 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded duringthat period, fails to provide the complainant with such information during asubsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiringthe Commissioner - (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcomeof the complaint, within a period specified in the order.[3]The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1) (a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.[4]The Tribunal's jurisdiction in proceedings of this nature is limited. Section 166 does not confer a right of appeal against the IC's assessment of a data protection complaint, nor does it permit the Tribunal to determine the merits of the underlying allegations made against a data controller. The Tribunal is not concerned with whether DWP or CMS breached the UK GDPR, whether personal data was inaccurate, or whether the IC ought ultimately to reach a particular substantive conclusion. Rather, section 166 is concerned with procedural compliance by the IC in the discharge of his statutory functions under section 165 DPA 2018.[5]Section 165(4) provides that where the IC receives a relevant complaint, he must take appropriate steps to respond to it, inform the complainant of the outcome of the complaint, inform the complainant of their rights under section 166 and, if requested, provide further information about how to pursue the complaint. Section 165(5) provides that taking appropriate steps includes investigating the subject matter of the complaint to the extent appropriate and informing the complainant about progress on the complaint.[6]Section 166(1) provides that the section applies where, after a complaint has been made, the IC fails to take appropriate steps to respond to the complaint, fails to provide information about progress or the outcome of the complaint within three months of receipt, or, where consideration of the complaint has not concluded within that period, fails to provide such information during a subsequent period of three months. Where one or more of those conditions is satisfied, section 166(2) permits the Tribunal to make an order requiring the IC to take appropriate steps to respond to the complaint or to inform the complainant of progress or outcome within a specified period.[7]The Tribunal therefore has a limited but important supervisory jurisdiction. The focus of the present application is whether the IC complied with his procedural obligations under sections 165 and 166. It is not whether the Applicant's underlying complaints are well-founded.Background to the Application
[8]The procedural history in this case is material. The Applicant lodged complaints with the IC during July 2025. It is common ground that the IC did not provide information regarding progress within the initial three-month period prescribed by section 166(1)(b). In correspondence dated 18 December 2025 the IC apologised for the delay and indicated that the matter would be expedited. A case officer was subsequently allocated and correspondence followed in January 2026. On 7 January 2026, the IC’s case officer wrote to the Applicant explaining that they had written to DWP/CMS asking them to review their handling of her subject access requests and to provide a response to her other concerns; the Applicant was told that, if dissatisfied with DWP/CMS’s response, she could forward it to the ICO for further review.[9]The IC contends that those subsequent communications in December 2025 and January 2026 cured any procedural deficiency and rendered the application academic. That position was advanced in the IC’s Response to this application and formed the basis of the IC's application for strike out.The IC’s application for strike out
[10]On 14 January 2026, The IC made an application inviting the Tribunal to strike out the Applicant’s application under Rule 8(3)(c)on the basis that there is no prospect of the Applicant’s application succeeding since any procedural deficiency had now been remedied by the IC.[11]In his ruling dated 9 April 2026, Judge Roper refused the IC’s strike-out application. In doing so, he observed that the evidence before him suggested that the IC had taken some steps after the application was issued, but Judge Roper also identified a potentially significant issue as to whether the IC's investigation remained ongoing.[12]Judge Roper noted that the IC's correspondence of 7 January 2026 indicated that the IC had written to DWP and CMS requesting that they review matters and respond to the Applicant. The Applicant was informed that if she was dissatisfied with any response received, she could provide it to the ICO for review. Judge Roper expressly stated that there "may be an argument about whether the Commissioner's investigation of the Complaints is ongoing" and further noted that a period of three months had elapsed since the IC's latest correspondence. Those observations formed the basis upon which the application was permitted to proceed to determination.[13]Subsequent material was filed pursuant to Judge Roper's determination upon the strike out application. The Applicant filed supplementary evidence on 19 April 2026. In that submission they contended that the IC had not concluded the complaint, had not undertaken a sufficient assessment and had not provided a reasoned determination. More significantly, the Applicant pointed to events following the IC's January 2026 correspondence.Conclusions
[14]The evidence before the Tribunal demonstrates that DWP/CMS did provide a response following the IC's intervention. The Applicant, however, remained dissatisfied with that response. Consistent with the course expressly identified by the IC in January 2026, the Applicant returned to the ICO, supplied the response received from DWP/CMS and requested further consideration of the complaints. The IC had invited precisely that course of action in the event that the Applicant remained dissatisfied.[15]The Tribunal is unable to conclude on the evidence before it that the IC's consideration of the complaints ended with the January 2026 correspondence. That correspondence does not read as a final outcome. Rather, it informed the Applicant that DWP/CMS had been asked to review matters and that she should return to the IC if dissatisfied with the response received. The Applicant did exactly that. Once she did so, and furnished the response obtained from DWP/CMS, the complaints remained before the IC for further consideration.[16]Significantly, the bundle contains no evidence that the IC thereafter provided a concluded outcome to the Applicant addressing the complaints in light of the DWP/CMS response. Nor is there evidence that the IC informed the Applicant that his consideration of the complaints had formally concluded following receipt of that material. The evidence instead discloses an unresolved complaint process in which the IC invited the Applicant to return with further information if dissatisfied, the Applicant did so, but no subsequent concluded outcome is evidenced before the Tribunal.[17]I accept that section 166 is not a mechanism by which the Tribunal supervises the quality of the IC's investigation. The Tribunal cannot direct the IC to reach particular findings, conduct specific enquiries or determine the complaint in the Applicant's favour. However, the Tribunal is satisfied that section 166 is engaged in the present case for a different reason.[18]Having invited the Applicant to return to the ICO if dissatisfied with the DWP/CMS response, and having received further material from her following that response, the IC was required either to continue taking appropriate steps in response to the complaints and inform the Applicant of progress, or to provide a concluded outcome. On the evidence presently before the Tribunal, neither has been demonstrated. The IC has not produced evidence establishing that the complaints were finally determined after receipt of the Applicant's further submissions, nor evidence demonstrating that further progress information was provided during the succeeding period contemplated by section 166(1)(c).[19]Accordingly, I am satisfied that the conditions set out in section 166(1) are met. In particular, the IC has failed to demonstrate that his consideration of the complaints concluded following the Applicant's return to the ICO after receipt of the DWP/CMS response, and the evidence does not establish that the Applicant was thereafter provided with a concluded outcome. In those circumstances, there remains a procedural defect capable of remedy under section 166.[20]The appropriate remedy is not to direct the IC on how the complaints should be determined. It is instead to require the IC to complete the statutory process. I therefore direct the IC to take further appropriate steps in response to the complaints and to provide the Applicant with a written outcome within 28 days. Signed: Judge Peri Mornington Date: 29 July 2026