Collette chaddaAppellantThe Information CommissionerRespondentDecision: The appeal is struck out under Rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because the Tribunal considers there is no reasonable prospect of the Appellant's case succeeding.REASONS
Background
[1]The Appellant complained to the Respondent on 9 August 2025 concerning alleged systematic data protection failures by Computershare Investor Services Plc.[2]This led to an exchange of correspondence between the Appellant and the Respondent in relation to this complaint. Of particular relevance are communications by the Respondent to the Appellant on 19 March and 23 April 2025 recommending that the Appellant contact the ICO equivalent regulator in the Republic of Ireland given the complaint primarily related to processing in the Republic of Ireland by an Irish Controller registered with the Irish Data Protection Commissioner.[3]On the 28 April the Respondent wrote to the Appellant and informed them that their complaint had been considered, that no further action would be taken and an outcome to this complaint had been issued.[4]On the 09 May 2026 the Appellant applied to the Tribunal to make an order under s.166 of the Data Protection Act 2018 as regards the complaint. The Appellant requested that “the Tribunal to make an order under Section 166(2) DPA 2018 requiring the Commissioner to:(a) Determine whether Computershare Investor Services PLC is a data controller or joint controller for the processing of personal data in the administration of the GAM Fund Management Limited APSS, by conducting a factual assessment under UK GDPR Articles 4(7) and 26 rather than relying on the respondent's privacy policy;(b) If the UK PLC is a controller or joint controller, investigate each of my ten complaint points (COMP-001 to COMP-010) on their merits;(c) Inform me of the outcome of the complaint in respect of each complaint point individually, as required by Section 165(5)(b) DPA 2018;(d) Take these steps within 90 days of the Tribunal's order, or such other period as the Tribunal considers appropriate.”. The grounds for that application were twofold and set out in the Notice of Appeal:a. “The Commissioner failed to take appropriate steps to respond to my complaint. Ten specific failures are set out in the accompanying Grounds of Application. In summary the Commissioner relied on a privacy policy rather than conducting a factual assessment of controllership, ignored the question of joint controllership which I had raised with specific legal references, described my primary evidence as "standardised email footer disclaimers" when it was a substantive corporate disclosure in postal correspondence, stated incorrectly that I had not raised concerns with the organisation when the evidence on the Commissioner's own file showed otherwise, and left a UK-registered company's documented data protection failures outside any regulatory oversight, andb. In the final response of 28 April 2026, the Commissioner stated that "UKGDPR Section 166 applications are not accepted by the courts where the ICO has already...considered the submissions made to us and informed the complainant of the outcome of that complaint." This statement is wrong: Section 166 is part of the Data Protection Act 2018 not the UK GDPR, applications are made to the First-tier Tribunal not the courts, and the law is clear from the Upper Tribunal decision in Killock that Section 166 applies where the Commissioner has failed to take appropriate steps — not only where the Commissioner has failed to respond at all. This is an independently sufficient ground for this application.”[5]On the 24 June 2026 the Respondent made an application that this appeal should be struck out under either rule 8(2)(a) and / or 8(3)(c) of the Tribunal Rules.[6]On 30 June 2026 Judge Roper issued directions indicating that the Strike out application was to be considered and might be granted on the basis that:a. section 166 of the Act only permits the Tribunal to make an order for the Commissioner to either take appropriate steps to respond to the Appellant’s complaint, or to inform the Appellant of progress on (or the outcome of) the complaint;b. it appears that the Commissioner has now taken appropriate steps to respond to the complaint and has provided the Appellant with outcomes in respect of the complaint (including advising the Appellant that he does not have jurisdiction to handle their complaint);c. it therefore appears that there may be no basis for the Tribunal to make an order under section 166(2).[7]The Appellant replied to the Strike Out application on the 14 July 2026 making a consolidated reply under Rule 24 combined with submissions opposing strike out, alongside an application for case management directions. The Appellant asked for the matter to be determined on the papers without a hearing.
Legal Framework
[8]Section 166 of the DPA 2018 provides the Tribunal with a narrow power that is explicitly limited to the supervision of procedural matters rather than substantive ones. The Upper Tribunal in the judgment of Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC) stated at [74] that “[i]t is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals”[9]Section 166 does not provide any power for considering or reviewing the substance of any decision made by the Commissioner. Even where s.166 is engaged, the powers of the Tribunal are limited to procedural ones, such as requiring the Commissioner to take appropriate steps to provide the required notification. Even as regards what such ‘appropriate steps’ are the Commissioner benefits from a very wide discretion with the caselaw confirming that this even “allows the Commissioner to decide, after investigating a complaint to a limited extent, that no further action should be taken” whether the complaint is spurious or not (see paragraphs 66 and 70 of R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022]EWHC 3046 (Admin)). It is established that neither s.165 nor s.166 of the DPA 2018 require the Commissioner “determine the merits of complaints” (See para 78, R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2023] EWCA Civ 1141).[10]Furthermore, there is a significant difference between cases where the Commissioner has provided an ‘outcome’ and ones where the ‘outcome’ is still pending. An outcome is a conclusive determination that marks the end of the Commissioner's handling of the relevant complaint. See para 60 of Smith v Information Commissioner [2025] UKUT 74 (AAC)) where it was stated “the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited”.[11]Where an outcome has been provided the scope of s.166 is necessarily much more limited. As noted in Killock at para 87 “s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate "steps to respond" and not with assessing the appropriateness of a response that has already been given (which would raise substantial Regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question” and “the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome”. Furthermore, in paragraph 86 the Upper Tribunal set out that “where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may in turn depend on the degree of regulatory judgment involved) and cannot simply substitute its own view”.[12]This position has since been reinforced by the case of Delo at the High Court in para 130 where it was ruled that “if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court”.[13]Once an outcome has been issued there is extremely limited power for the Tribunal to seek to order the Respondent to take some ‘appropriate step’ retrospectively, especially where such a step could lead to a substantive change in outcome. The appropriate forum for challenging whether steps taken to investigate the complaint were appropriate or whether relevant evidence was considered or taken into account as regards cases where an outcome has been provided is Judicial Review in the High Court.[14]A rare example of such an exceptional post-outcome ‘appropriate step’ is given in Paragraph 61 of the case Smith v Information Commissioner [2025] UKUT 74 (AAC)). Where the position is considered of two severable matters in a combined complaint and an outcome is provided in one, but as regards another where the ICO has not dealt with the second matter at all (because of an oversight or some other mistake). In that scenario there has in effect been no outcome for the severable matter, but as a matter of fact there has been an outcome in the case as a whole, because there was one issued relating to the combined complaint (albeit being partial in coverage). The Tribunal in such a circumstance retains the power to issue an order requiring ‘appropriate steps’ as regards that limited severable matter that has yet to be dealt with. It is noteworthy that the Upper Tribunal is at pains to point out that the retained ability to order appropriate steps is tied to a matter that has not been considered (rather than one that has been considered even just to a limited extent and then dismissed or not further actioned).[15]In Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC)), another hypothetical example is given of a potential post-outcome ‘appropriate step’ in paragraph 86 where the scenario of ordering that a Complainant should receive a response in Braille is discussed.[16]In demonstrating the very limited scope for post-outcome orders, it is notable that both of these examples are very clearly focused on procedural-administrative matters separate from substantive issues of regulatory judgment. The authorities tread a clear path on the very particular and circumscribed power of the Tribunal to order ‘appropriate steps’. Respondent’s application for a strike out[17]The Respondent argues that they have taken steps to comply with the procedural requirements set out in section 166(1) of the DPA18, by considering the complaint, investigating it to the extent appropriate and providing responses on 19 March as well as on 23 and 28 April 2026. The Respondent submits that there is therefore no basis for the Tribunal to make an order under section of the 166(2) DPA 2018 as the Respondent has not failed to comply with the procedural requirements as set out in s.166(1) DPA 2018. Furthermore the Respondent adds that in any event the Respondent has no jurisdiction to handle the complaint given the activity and controller are both governed by Irish not UK law. Appellants Grounds opposing the strike out[18]The Appellant’s response is lengthy and at times inconsistent. I considered the entirety of the reply and other documentation but have focused on only on the most relevant parts for this decision.[19]In the reply the Appellant asserts in paragraph 3 that they do “not invite the Tribunal to determine the merits of the underlying complaint, to decide controllership, to make any finding against Computershare, or to substitute its view for the Commissioner's regulatory judgment. The Application is procedural: it contends that the Commissioner's consideration did not result in the taking of an appropriate step that section 165(4) required”.[20]The Appellant in paragraph 11 objects to the Respondent’s argument that this matter should be struck out for lack of jurisdiction on the basis that the Respondent’s argument is flawed because the issue in the proceedings is not whether the underlying matter complained about is within the UK or Irish jurisdiction, but rather whether the application for a s.166 Order as regards a s.165 complaint is within the Tribunal’s UK jurisdiction.[21]The majority of the Appellants reply focuses on the argument that the Respondent failed to take various specific ‘appropriate steps’. In paragraph 12 the Appellant asserts that ‘a factual controllership assessment’ and particular consideration of joint controllership should both have been completed. In paragraph 13 the Appellant asserts that no regulatory judgment was exercised on controllership, assuming every substantive technical ground requires regulatory judgment and entirely excluding the possibility of ‘regulatory judgments’ being higher level decisions as to the extent to which a case will be investigated. In paragraph 14 the Appellant states that the appeal is not a collateral attack on the substantive outcome because it is asking the Tribunal to order the Respondent to conduct specific substantive assessments as appropriate steps, not asking the Tribunal to do this itself. Conclusion[22]As regards the arguments made in favour of the matter being stuck out for lack of jurisdiction because the complained of processing relates to activity governed by Irish law, I reject these wholly. The Appellant is correct that in terms of jurisdiction of the Tribunal the question is not whether the original processing was or was not in scope of the Respondent’s jurisdiction as a regulator. But whether there was an application under UK law as regards a s.166 Order in relation to a s.165 complaint which falls within the UK jurisdiction of the Tribunal. The answer to that is unequivocally yes.[23]In considering whether the matter should be struck out under Rule 8(3)(c) for having no reasonable prospects of succeeding, it isnecessary to consider the point that under s.166(2) there are just 2 potential orders that the Tribunal can make:[24]Under subsection (b) this can be an order requiring the Respondent to inform the Appellant of the progress on the complaint or the outcome of the complaint. It is undeniable that by the 28 April 2026 the Appellant has been provided with an outcome, and therefore this potential order is not applicable in this context.[25]Under subsection (a) this can be an order requiring the Respondent to “take appropriate steps to respond to the complaint” and this necessarily infers that further procedural activity is still needed to respond to the complaint.[26]Where a legitimate substantive outcome has been properly communicated to the complainant there is in effect no power for the Tribunal to order an ‘appropriate step’ (given the wide discretion afforded to the ICO in terms of the range of legitimate responses and the restriction that it is not the Tribunal’s task to be ‘assessingthe appropriateness of a response that has already been given’ see para 11 above). This is because where at least a minimal investigation of the issue has taken place (i.e. unlike in the example provided in Smith see para 14 above) and where the ICO has properly communicated their final position on the complaint to the relevant individual (i.e. unlike the hypothetical example in Killock see para 15 above) there is no appreciable procedural step that could be ordered to ‘secure the progress of the complaint in question’ that would not impeach upon the regulatory supervision of the High Court.[27]The entirety of the Appellant’s case sought to require retrospective ‘appropriate steps’ be imposed upon the ICO so as to revisit substantive regulatory decisions made as regards how the ICO handled the complaint in terms of the extent and specifics of the investigation. They sought to require that particular actions be taken or sub-issues be re-investigated in a particular substantive way. Such as, requiring a specific assessment of the issue of Controllership. The final two points listed as c) and d) on the Notice of Appeal confirm that the Appellant is seeking an order requiring the Respondent to provide a particular reply to every one of the specific 10 complaint points they have made, to do so on an individual point by point basis, and to provide that response within 90 days.[28]The Appellant accepts that the ICO did take action of some kind to progress the complaint, but seeks to argue that additional action should have been taken by the ICO. As noted in previous paragraphs and approved by the caselaw it is open to the ICO to take no further action on a case following a minimal investigation and they are able to do so even where there is (or may be) merit in the underlying complaint. Taking no further action following even a very light touch investigation is therefore well within the realms of what is considered an ‘appropriate step’. In light of that low baseline position the Appellant’s arguments that specific types of action should have been taken in addition to (or instead of) those actually taken by the ICO to progress the complaint to the substantive outcome provided are qualitative not procedural arguments that are doomed to fail.[29]The Appellant’s appeal is aimed at challenging (post-outcome) the appropriateness of the ICO’s response in terms of the specific approach adopted (even though this was a case where the ICO had already done notably more than the absolute minimum required of them in this context). Applying the critical eye the Upper Tribunal indicated should be applied in such contexts, the Tribunal must consider whether the Appellant in such circumstances is in fact using the s.166 process to achieve a different complaint outcome. Additionally in line with the dicta in Delo about ‘sleight of hand’ attempts to surreptitiously challenge ultimate outcomes by seeking particular appropriate steps to that effect, the Tribunal rightfully had to consider whether the ‘appropriate steps’ sought were properly to progress the complaint or not.[30]The approach throughout the reply is explicit in that the Appellant does not seek to procedurally progress a complaint but rather seeks to assess or review the actions and decisions of the Respondent in producing the outcome that it did. The Appellant has sought to dress up these arguments in a way that does not explicitly offend the established law and precedent regarding s.166, however these are very thinly veiled arguments that are to my mind exactly the sort of ‘sleight of hand’ that is referred to in the Delo case. The Appellant believes that the Respondent has acted in some way that is legally improper and this is properly the jurisdiction of the High Court in Judicial Review not the Tribunal under s.166 DPA 2018.[31]Therefore for the reasons set out above, as regards the Appellant’s Ground 1 this is bound to fail and there is no reasonable prospect of success because the Appellant has failed to recognise the extremely narrow range of the power provided under s.166 coupled with the very wide discretion afforded to the Respondent under the caselaw as to just how little they are obliged to do in order for that to be sufficient for the purposes of s.166.[32]The Appellant’s Ground 2 is equally unsustainable, the incorrect references to the UK GDPR and the Courts instead of to the DPA 2018 and to the Courts and Tribunals are not material. It is correct that the law does in limited procedural contexts leave it possible for ‘appropriate steps’ to be ordered post outcome. However, none of the appropriate steps sought by the Appellant (in the factual context of this case and the actions of the Respondent) fall within the narrow scope as set out in the caselaw and so the order sought by the Appellant is therefore bound to fail.[33]In light of the above there is no reasonable prospect of the Appellant being able to successfully argue that the Tribunal should make an order pursuant to the power found in s.166(2) DPA 2018. I am therefore satisfied that is right, proper, and proportionate in all the circumstances that this case is struck out under Rule 8(3)(c) and I order that it is so. Signed T Barrett Date: 4/8/26