Keith Kennaugh v The Information Commissioner [2026] UKFTT 648 (GRC)

[2026] UKFTT 00648 (GRC)Case Reference: FT/EA/2024/0349/GDPR
First-tier Tribunal
(General Regulatory Chamber)
Hearing Heard on: 30 April 2026Date 01 May 2026
Information Rights
Heard by Cloud Video Platform
Before
JUDGE HARRIS
Between
KEITH KENNAUGHApplicantTHE INFORMATION COMMISSIONERRespondentMr Kennaugh, representing himself for ApplicantSamuel Willis for RespondentDecision: The Application is Dismissed.REASONS

Background to the Application

[1]These proceedings concern an application (the “Application”) under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) for an order to progress the Applicant’s complaint against West Yorkshire Combined Authority (“WYCA”) regarding the processing of his personal data. The complaint was submitted to the Information Commissioner (“IC”) on 19 June 2023 and was dealt with under reference IC-239469-C4K7.[2]Following submission of the Applicant’s complaint, on 14 August 2023, the IC’s case officer wrote to the Applicant and requested that he provided evidence of his complaint, in order for the IC to consider the matter further. In particular, the case officer asked for copies of correspondence with WYCA and any final response. The Applicant responded on the same day and provided some correspondence with the WYCA.[3]On 15 August 2023, the case officer advised the Applicant to raise a formal complaint with WYCA before bringing the matter to the IC.[4]The Applicant and the case officer exchanged emails between 15 and 22 August 2023, clarifying the complaint made to WYCA and confirming that a final response had not been issued.[5]A telephone call between the case officer and the Data Protection Officer (DPO) at WYCA to discuss the complaint took place on 23 August 2023. An update was sent to the Applicant about this.[6]Also, on 23 August 2023 the DPO sent copies of the WYCA’s response to the Applicant’s complaint to the case officer. The case officer subsequently obtained permission from the DPO to share this with the Applicant.[7]On 5 December 2023, WYCA’s response was shared with the Applicant. The Applicant responded on the same day and advised that he had requested a copy of the warrant authorising the interception of his emails and the Decision Notice made under the WYCA’s Unreasonable Behaviour Policy, and that these documents were not provided in WYCA’s response.[8]On the same day, the Applicant also made a Data Subject Access Request (“DSAR”) to the WYCA requesting a copy of a log of his emails received by the WYCA. WYCA provided a response to the Applicant on 19 December 2023 informing him that the requested information was not held by the WYCA.[9]On 21 December 2023, the Applicant contacted the IC’s case officer and advised that the WYCA had not provided him with a record of his correspondence, nor a copy of the Decision Notice previously requested.[10]On 9 January 2024, the case officer emailed the Applicant to inform him that she hadcontacted the WYCA to discuss his outstanding concerns. She informed theApplicant that she would be in touch with him with an update as soon as she had spokento the WYCA.[11]On 11 January 2024, the case officer obtained permission from the Applicant to forward an email thread to the DPO which detailed his outstanding concerns. The correspondence was sent to the DPO on 12 January 2024.[12]On 26 January 2024, the DPO responded to the issues raised in the Applicant’s email.[13]The Applicant exchanged emails with the case officer on 16 February 2024, who confirmed that they were still waiting on a response from the DPO.[14]On 22 February 2024 and 27 April 2024, the Applicant emailed WYCA, copying in the IC, and expressed further concerns regarding his complaint.[15]On 1 May 2024, the Applicant was informed that the complaint had been re-assigned to a different case officer and that an outcome would be provided upon review of the file.[16]The Applicant sent further emails to the case officer between 10 May 2024 and 7 June 2024 and reiterated his concerns about the WYCA’s response to his SAR.[17]On 20 June 2024, having reviewed the information provided by the Applicant and WYCA, the IC’s case officer wrote to the Applicant. The case officer was of the view that WYCA had considered the Applicant’s request and provided an appropriate response, and as such there was nothing further that WYCA could be expected to do in relation to his request. The case officer was also satisfied with WYCA’s response in relation to the Applicant’s other concern about WYCA’s processing of his personal data. Information on next steps and judicial remedies was provided to the Applicant.[18]The Applicant responded on 24 June 2024 and expressed his dissatisfaction with the outcome and requested further information from the case officer.[19]On 10 July 2024, the case officer sent the Applicant a final response. It was reiterated that the IC did not intend to take the matter further but that his request for information had been passed to the IC’s Information Access Team to respond separately. The Applicant was informed of his rights to request a case review, or bring a service complaint in the event he was dissatisfied with the outcome to his complaint, or the way in which his case was handled. The Application[20]The Applicant wrote to the Tribunal on 16 August 2024 applying for an order under section 166 DPA 2018. In his grounds for the Application, the Applicant stated:
“I am writing to apply for an order under section 166 of the Data Protection Act 2018 as I do not believe the commissioner has taken appropriate steps to respond to the complaint. The complaint relates to a policy operated by West Yorkshire Combined Authority in which members of staff are entitled to deem an individual as "Unreasonable" and having so deemed, they are able to divert to themselves any and all email sent by that individual to the authority and thereby ensure that it is ignored. This includes mail addressed personally to the mayor or deputy mayor. This means that, for example, if a member of staff was anti semitic, and they identified a service user as Jewish, then they could deem them "Unreasonable" and thereby deny them any service or democratic representation. I have been deemed "Unreasonable" without fair warning, by unspecified staff for reasons which are unclear. The request sought a copy of the decision to impose that policy, the evidence supporting that decision or indeed any record whatsoever of due process. WYCA says that they do not have any. This is simply irrational. If all that there is is the settings on their mail server that cause all my mail to go to the unspecified individuals, then that is a record to which the request applies. Likewise if they have sent a note out asking people to forward it manually. If there is any semblance of proper process, then there should be a formal written decision, showing who made it and for what reasons. Apparently there is none of it. It is not clear what action the Commissioner has taken. They only say they are satisfied that the authority has considered the response and responded. They appear to have done nothing more than hold a few telephone conversations with the unspecified individual, and they've refused to divulge any of the correspondence or notes on the grounds it was given in confidence where there is no discernible reason why it should be confidential, unless the unspecified individuals actually are the crooks that they appear to be and the Commissioner is sympathetic to their cause. That seems extremely unlikely.

(c) ”

[21]The Application was not made in the prescribed form. I am aware that the Upper Tribunal (“UT”) is currently considering an appeal (reference UA-2025-000372-GIA) in relation to the use of forms in connection with earlier case management decisions in this Application. However, it appears to me that the outcome of the UT appeal is not determinative and, indeed, has no bearing on the substantive matters in issue in this Application, so I have proceeded to determine it without waiting for the appeal to the UT to be concluded. The IC’s Response to the Application[22]The IC filed a response to the Application on 6 August 2025, opposing the Application. In, summary, it made the following points: 1. The relief available from the Tribunal on an application under section 166 DPA 2018 only applies where it is satisfied that the IC has failed in some procedural respect to comply with the requirements of section 166(1) DPA 2018, limited solely to those orders that are set out in section 166(2). 2. The IC has taken steps to investigate and respond to this complaint and has provided an outcome to the Applicant’s complaint on 20 June 2024. Accordingly, the IC submits that he has taken steps to comply with the procedural requirements set out in section 166(1) of the DPA 2018, and there is therefore no basis for the Tribunal to make an order under section 166(2) DPA 2018. 3. If the Applicant wishes to seek an order of compliance against the controller for breach of his data rights, the correct route for him to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18. The Applicant’s Reply[23]The Applicant filed a response to the Response on 18 August 2025. In this he explained that that the case is about the operation of WYCA’s Unreasonable Behaviour policy, under which correspondence from a complainant deemed ‘unreasonable’ is directed to a single point of contact within WYCA. He said that the principal purpose of the information request was to find the lawful authority for this and what he described as “the interception of these emails”.[24]In summary, the Applicant made the following points: 1. The Applicant made a number of complaints to the Respondent about WYCA but the Respondent refers only to a specific complaint; he says that “the first question to be determined is of whether the Commissioner is entitled to disregard subsequent complaints about a data controller just because they have a case open on that data controller.” 2. The IC has not shown any evidence of having engaged with any data controller, whether WYCA or not. He states “the repeated failures and ongoing delays suggest that the Commissioner was dealing with the Policing and Crime Office”. 3. The IC has not included WYCA’s response to the information request and has refused to do so relying on section 132 DPA 2018. He argues that the consent described in section 132(2)(a) is implicit in the request for the information. 4. WYCA’s only known response to the IC’s investigation was sent to the IC on 23 August 2023 and passed to the Applicant on 5 December 2023. The Applicant replied on the same day to explain why the response was inadequate. The IC’s case officer said they had relayed those concerns to WYCA. 5. The IC’s response to the Applicant’s complaint dated 20 June 2024 referred only to the initial complaint “not the ongoing concerns raised in the course of proceedings”. 6. There was nothing on the record to suggest there was no more that WYCA could do. The Applicant said “Were there a written assurance from an identifiable data protection officer stating clearly what they understood the request was asking for and stating that they had no information within the scope of that request, or citing exemptions for why they should not disclose it, then that might give grounds to justify the commissioner’s conclusion”. He further argued that “Given that the Commissioner had accepted the appellant’s ongoing concerns and relayed them to the authority, it is not an appropriate step to then walk away without a further response from the authority”. 7. The Applicant states “the essence of the Respondent’s argument appears to be that the “Broad discretion” they refer to entitles them to accept anything as a valid response to a data request; they might respond with a shopping list or a printer test page and the commissioner can accept it as valid. Broad discretion has to have limits: the response provided by the authority is one that no reasonable person, in view of the relevant facts, would accept as a valid response to the information required.” 8. The Applicant asserts that in its response to his complaint the IC has “accepted without question a dishonest account of events by West Yorkshire Police and as a consequence have judged the appellant to be utterly unreasonable on the basis of his expectation that the General Data Protection Regulations should apply. That assessment appears to form the basis of the Commissioner’s decisions across multiple cases: the Commissioner knows that the appellant is unreasonable, therefore anything the authority might do is a reasonable response to the appellant’s abject unreasonableness.” Legal framework[25]Section 165 DPA 2018 sets out the right of data subjects to complain to the IC about infringement of their rights under the data protection legislation. Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows:
“Orders to progress complaints (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner - (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner - (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.”
[26]The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.[27]Section 165 deals with the complainant’s right to make a complaint and states that:
“(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a)take appropriate steps to respond to the complaint, (b)inform the complainant of the outcome of the complaint, (c)inform the complainant of the rights under section 166, and (d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a)investigating the subject matter of the complaint, to the extent appropriate, and (b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with foreign designated authority is necessary.”
[28]In the case of Killock v Information Commissioner [2022] 1 WLR 2241, the Upper Tribunal at paragraph 74 stated - "…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."[29]Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 - "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...”.[30]Mostyn J’s decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141) – “For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.” (paragraph 80, Warby LJ).[31]The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo confirmed that the nature of section 166 is that of a limited procedural provision only. “The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33).[32]The case of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC), noted at paragraph 60 that “it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an appropriate step has been omitted is limited.” In considering this the Tribunal must, as set out in paragraph 85 of Killick “when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator.”[33]Paragraph 85 of Killick reads as follows:
“However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.”
[34]The Upper Tribunal also said in Smith at paragraph 136 “It is clear from Killock and Veale and Delo that challenges to the legal merits of the outcome of a complaint (and challenges to the adequacy of the Commissioner’s reasons for his decision are also challenges to the legal merits) should be taken to the High Court on judicial review. They should not be ‘dressed up’ as procedural errors and brought as section 166 applications to the First-tier Tribunal… the appellant’s complaints are in reality challenges to the merits of the Commissioner’s outcome decision and, as such, they belonged in the High Court and not in the First-tier Tribunal.” Procedural matters concerning the hearing[35]The hearing was held remotely by cloud video platform (CVP). The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.[36]The Tribunal considered a hearing bundle (157 pages) and an authorities bundle (153 pages). It also had the benefit of s skeleton argument from Mr Willis for the IC.[37]It became apparent at the beginning of the hearing that the initial email from Mr Kennaugh dated 16 August 2024 had not been sent to the IC. Upon my forwarding this to the parties present in the hearing chat box, the IC had an opportunity to consider this and make submissions as to whether or not the hearing should proceed. The IC commented on the procedural fairness of not having seen what is, in effect, the Applicant’s grounds before the hearing. Mr Kennaugh commented that he did not consider the issue of whether or not he had been informed of his rights was sufficiently significant to warrant adjourning and delaying the hearing further. Having heard from both parties, I considered that the only matter raised in that email which was not also raised in the Reply was the issue of whether IC had informed Mr Kennaugh of his rights under section 165. Accordingly, taking into account the overriding objective and, in particular, avoiding unnecessary formality and seeking flexibility in the proceedings and ensuring, so far as practicable, that the parties are able to participate fully in the proceedings, it appeared to me appropriate to proceed with the hearing rather than adjourning it as the parties had had an opportunity to understand the main thrust of each other's cases before the hearing. Evidence and submissions[38]We heard oral evidence from Mr Kennaugh, who also made submissions in the hearing. In summary, he made the following points: 1. His complaint concerned the decision by WYCA to impose an arrangement through which his communication with WYCA is through a single point of contact on the grounds of “unreasonable behaviour”. 2. He said that the IC had not looked at the response provided by WYCA to his request to see if it provides what was requested. 3. He expected the IC to instruct WYCA to provide the information requested. He was unsatisfied with the IC’s response because the IC dismissed his complaint and said that WYCA had responded and that was good enough. 4. He is seeking from the Tribunal an order that the IC should order WYCA to provide the information requested. Specifically, he wants from WYCA a copy of the decision deeming him to be unreasonable and the evidence leading to that decision. 5. He said that the IC appears to have an entrenched view of him from earlier interactions and that this coloured their approach to responding to his complaint. He explained that this arose from an earlier incident where he reported crimes during the pandemic but did not include his date of birth and address on the form because the form asked for the victim’s details and he did not consider himself to have been the victim. The IC found against him in that context and he said that this attitude has informed all the IC’s decisions against him. 6. He said that the IC is supposed to enforce data protection regulations but has not. 7. He said that his complaint involved three separate information requests, relating to a warrant, evidence for it and processing of his data. He said that the IC had focused only on a single complaint, not subsequent complaints and clarifications about the same issues.[39]The IC, in summary, made the following submissions in its skeleton argument and at the hearing: 1. The Applicant has refused to use any of the Tribunal’s forms and has not provided the IC with any supporting documents setting out the basis of his application. The parties are entitled to know the essentials of the other party’s case in advance. 2. The response dated 20 June 2024 was in fact an outcome to the complaint, which was confirmed and reiterated in the response dated 10 July 2024. The Application is, in effect, a challenge to this outcome, which is an impermissible use of section 166. 3. The Applicant appears to be bringing a judicial review-style challenge to the outcome of his complaint and/or the procedure which the IC followed in handling his complaint. This includes allegations of misdirection as to the application of UK GDPR, irrationality, bias and predetermination. If the Applicant wishes to challenge the outcome, whether on the grounds of legal or factual errors or the decision-making process leading to it, the Applicant can apply for permission for judicial review. The High Court is the appropriate forum for the challenge in this application, not the First-tier Tribunal. Alternatively, if the Applicant wishes to apply for a compliance order under section 167 of the DPA 2018, it is open to him to do so in the County Court or High Court, but not in this Tribunal. 4. It is within the IC's regulatory discretion when handling the section 165 complaint of 19 June 2023 to focus on the substance of that complaint not subsequent complaints. It is clear that the IC has undertaken investigation which falls well within the IC’s discretion to do so and reached an outcome, so the Tribunal has limited power to order further steps. 5. There is no requirement on the IC to provide copies of evidence it has obtained from the public authority in investigating a complaint to the complainant, only to inform the complainant of progress and/or an outcome. The issues[40]The key issue in dispute is whether the IC took appropriate steps in responding to the Applicant’s complaint.[41]Other issues are whether an outcome to the Applicant complaint was issued and whether the Tribunal has the jurisdiction to grant the outcomes which the Applicant seeks.[42]The Applicant also complains that the IC did not inform him of his right to refer the matter to the Tribunal under section 165(4)(c). The Applicant commented that this possibly had prejudiced him given the tight timescale for applying for judicial review, but that it was not a big enough issue to warrant adjourning the hearing to deal with it. As the IC had not had notice of this point before the hearing, it did not make submissions on this other than to say that procedurally ordering the IC to take this step at this stage would not achieve anything. Discussion and conclusions[43]This Application is in relation to the Applicant’s complaint reference IC-239469-C4K7. The Applicant may have made other complaints to the IC about WYCA, and I find that he did provide a number of comments and clarifications in the course of the IC dealing with this complaint, but this is the complaint before the Tribunal in the context of this Application.[44]The first question is whether the IC has provided an outcome to the Applicant’s complaint. The IC provided the Applicant with a response to his complaint on 20 June 2024 with a further response on 10 July 2024. I consider that the response dated 20 June 2024 was in fact an outcome to the complaint, because it provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint.[45]Even if I am wrong on this, I am satisfied that when taken together with the response dated 10 July 2024 these responses have provided an outcome to the Applicant’s complaint, provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint. This is sufficient in my view to demonstrate that the IC has complied with the requirements of section 165(4). The fact that the Applicant does not agree with the outcome does not render it wrong in law.[46]I have considered the steps taken by the IC to investigate and liaise with WYCA set out in the chronology of facts in the Response and also the criticisms of this approach set out in the Applicant’s Reply. As a matter of fact I find it was not correct that there was no evidence that the IC had not engaged with WYCA. The Tribunal, as explained in the Court of Appeal decision in Delo referred to at paragraph 30 above, has a broad discretion to investigate to the extent it sees fit and I find that the engagement it had with WYCA falls well within this discretion.[47]The Applicant’s primary concern in relation to appropriate steps appears to be that he did not consider it was appropriate for the IC to decide not to take the matter further once it had received a response from WYCA. At this point, the IC had determined that WYCA had provided an appropriate response, and as such there was nothing further that WYCA could be expected to do in relation to the Applicant's request.[48]I have taken into account the relevant passages of Cortes and Smith referred to above. The scope of the Tribunal’s power under section 166(2) is to make an order specifying appropriate steps which the IC should take, not assessing the appropriateness of a response already given. Whilst the Tribunal can specify such steps after an outcome has been, for the reasons set out in Smith, in all the circumstances of this case I consider it is not appropriate to do so. Challenges to the adequacy of a response or outcome are ones which should be dealt with by judicial review.[49]It appears to me therefore that there are no further appropriate steps which the IC ought reasonably to take to progress the complaint. In making this decision I have given significant weight to the view of the IC as the expert regulator that there are no further appropriate steps he should have taken.[50]The outcome sought by the Applicant is also, in effect, challenging the substantive outcome of the complaint to the IC and the adequacy of WYCA’s response. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision. In an application under section 166, the Tribunal has no power to direct the IC to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the UK GDPR. I also agree with the IC’s position that orders for compliance need to be sought through civil action.[51]Although this was not an issue dealt with at the hearing, I observe that orders under section 166(2) are procedural remedies which require the IC to take positive steps to progress an investigation. Those rights only arise where an investigation is ongoing. Where an investigation has been concluded, there is no ongoing investigation to progress, so it would be inappropriate to signpost a complainant to a course of action not open to them.[52]Because I consider that there was an outcome determining the complaint and that there were no further appropriate steps which should be taken by the IC in handling the complaint, I dismiss the Application. Signed: Judge Harris Date: 30 April 2026