Lisa Francine Djedje v The Information commissioner [2026] UKFTT 658 (GRC)

[2026] UKFTT 00658 (GRC)Case Reference: FT/EA/2025/0358/GDPR
First-tier Tribunal
General Regulatory Chamber
Date 06 May 2026
Section 166 DPA 2018
Decided without a hearing
Before
Judge BUckley
Between
LISA FRANCINE DJEDJEApplicantThe Information commissionerRespondentDECISION
[1]The application under section 166 of the Data Protection Act 2018 is STRUCK OUT under rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

REASONS

[2]In this decision, ‘the Application’ is a reference to the application made to the tribunal by Ms Djedje under section 166 of the Data Protection Act 2018 (DPA) and ‘the Applicant’ is a reference to Ms Djedje.

The application for strike out

[3]The Commissioner applies by way of a GRC5 submitted with his response for the Application to be struck out under rule 8(2)(a) (no jurisdiction) or 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. The basis for the application is that that Commissioner considered the complaint, investigated it as appropriate and provided an outcome on 25 July 2025 and case review outcome on 11 December 2025. The Commissioner says that section 166 of the DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint.

The Applicant’s response to the strike out application

[4]The Applicant’s response to the strike out application is, in essence, that the Application does not seek to challenge the substantive merits of the outcome. The Applicant submits that the Application concerns procedural failures including failures to properly engage with material evidence, failures of explanation and the premature closure of the complaint in circumstances where the Applicant says that the Commissioner itself accepted that key evidence had not been provided or assessed.[5]The Applicant says that the Commissioner failed to conduct a proportionate investigation once the complaint evolved and material issues arose concerning accuracy, rectification, transparency and ongoing processing. In particular she submits that:a. The Commissioner closed the complaint while acknowledging that it could not determine whether the Subject Access Request (“SAR”) was fully complied with;b. The Commissioner stated it could not assess compliance because the original SAR and scope were not available, yet did not take steps to obtain or clarify that information;c. The Commissioner failed to explain, in a procedurally adequate manner, why documentary evidence supplied by the Applicant was not taken into account;d. The Commissioner’s handling of the review process involved significant delay, uncertainty, and lack of transparency.

The grounds of the Application

[6]The Application is made on the following basis: I am submitting this application to the First-tier Tribunal because the ICO has failed to properly investigate my complaint regarding Westwood Park Primary School and Manchester City Football Club (MCFC). The ICO concluded there was “no evidence” to support my concerns, despite the existence of substantial documented evidence demonstrating breaches of data protection, mishandling of safeguarding matters, and threats made to prevent me from pursuin9g my complaint. I am requesting the Tribunal to require the ICO to conduct a full and proper review of my complaint and the supporting evidence to ensure that my legal rights and my son’s safeguarding are protected. This application is a necessary first step to: 1. Ensure the ICO properly enforces data protection law and investigates my complaint. 2. Confirm that MCFC and Westwood Park Primary School breached data protection obligations. 3. Require the organisations to release withheld information and correct their failures.[7]The Applicant said that the order she wanted the tribunal to make was: I am asking the Tribunal to order the Information Commissioner to properly consider all the evidence I have already submitted (including emails, SAR responses, and correspondence with Manchester City FC and Westwood Park Primary School), and to provide me with a full outcome and explanation in writing within a specified timeframe. I further request that the ICO be required to explain why documentary evidence I supplied was not taken into account before closing my complaint.

Discussion and conclusions

[8]On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner[2021] UKUT 299 (AAC) (Killock & Veale).[9]It is important to state that the fact that an outcome has been provided does not automatically mean that an Application has no reasonable prospects of success. The Upper Tribunal decision in Smith v Information Commissioner[2025] UKUT 74], by which I am bound, makes that clear.[10]However, once an outcome to a complaint has been provided, the circumstances in which the tribunal has the power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint are limited. That is because the principal remedies for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner and section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in these proceedings. (Killock & Vealeand R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2023] EWCA Civ 1141 and Smith v Information Commissioner[2025] UKUT 74].[11]Further, when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, the tribunal must take into account and give weight to the views of the Commissioner as an expert regulator. The extent of respect due to the Commissioner’s view depends on the degree of regulatory judgment involved (Smithat paragraph 88). Where the Commissioner has already produced an outcome then, given this very wide discretion, as to what and how to investigate and as to outcome, the scope for the tribunal to say that an ‘appropriate’ step has been omitted is limited.[12]A failure to ‘properly consider’ the evidence submitted by the Applicant in her complaint to the Commissioner is, in reality, a challenge to the merits of the complaint and to the correctness of the outcome. Challenges to the weight that was given to particular evidence or whether evidence before the Commissioner was properly taken into account when reaching his decision, amount in substance to challenges to the conclusions that the Commissioner reached.[13]To the extent that the Application challenges the steps taken by the Commissioner, I have looked at the steps that were indisputably taken by the Commissioner on the basis of the documents before me, and I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing.[14]The Applicant complains that the Commissioner should have requested a copy of her Subject Access Request (SAR) before issuing an outcome, given that the outcome dated 25 July 2025 stated: “…please note that the ICO has not been able to consider your concerns regarding if the organisation provided all information to which you are entitled due to the fact that we have not been provided a copy of your original Subject Access Request which outlines the scope and criteria of your request”.[15]The Commissioner had informed the Applicant that he would be making a decision on the basis of the supporting evidence provided and the Applicant had had the opportunity to provide a copy of the SAR. In a letter dated 12 July 2025, the Commissioner said:
“Please note that as an evidence-based regulator, we base our decisions on the supporting evidence provided. As such, we need to see evidence that this matter has been raised with the organisation in the first instance, and that they have been given the opportunity to respond and resolve the issues raised. Before we can consider your concerns further, we require some further information from you. Please respond to this e-mail, providing copies of all correspondences between yourself and the organisation regarding this matter.”
[16]Following the outcome, on 15 August 2025 the case officer informed the Applicant that whilst the complaint had been closed and an outcome provided based on the evidence available, the matter could be reopened and re-visited if further information came to light, and ‘once the ICO receives any further information you are able to provide the ICO will be able to consider as much as possible’.17. On 10 November 2025, after reviewing further information provided by the Applicant, the case officer explained that he had reviewed the additional information provided and was satisfied that this did not demonstrate any contravention of data protection law. He reiterated that there was no evidence that the School’s response to your SAR was incomplete, or that any information was inappropriately processed, explaining that he was of the view that any sharing of personal data between the School and MCFC was likely compliant.18. Finally, the Commissioner carried out a review on 11 December 2025, which considered all the information available and concluded, inter alia:
“Although you referred to concerns regarding MCFC’s handling of your SAR and the accuracy of statements it had made, the information we received in relation to these concerns was limited. It’s not clear that any concerns regarding your SAR or the accuracy of any statements have been raised with MCFC and the limited information provided does not suggest that any contravention of data protection law has occurred, nor that further investigation in this regard is appropriate.”
[19]On that basis, it is clear that the Applicant has been given a number of opportunities to provide further information and the Commissioner has concluded on the basis of the information provided that ‘the limited information provided does not suggest any contravention of data protection law nor that further investigation in this regard is appropriate’.[20]Taking into account the Commissioner’s role as expert regulator in this field and the Commissioner’s very wide discretion as to what and how to investigate, I find that there are no reasonable prospects of the tribunal concluding that the Commissioner had not taken appropriate steps to investigate this particular complaint, whether because of any failure to, for example, specifically seek specific information from the Applicant or to investigate further.[21]In relation to the complaint that ‘the Commissioner failed to explain, in a procedurally adequate manner, why documentary evidence supplied by the Applicant was not taken into account’, insofar as this is a challenge to the adequacy of the Commissioner’s reasons, that is a merits challenge and falls outside section 166. Insofar as it is a complaint that the Commissioner failed to take proper account of documentary evidence provided by the Applicant, that is, in substance, a challenge to the merits as explained above.[22]In relation to the complaint that the Commissioner’s handling of the review process involved significant delay, uncertainty, and lack of transparency, section 166 is a forward-looking provision. The review has now been concluded and a detailed outcome letter provided. It is not arguable that any appropriate steps remain to be taken. A section 166 application is not a process of considering, in retrospect, whether there was, for example, unreasonable delay in the process leading up to the outcome or the review. There are no reasonable prospects of this argument succeeding.[23]Having concluded that there are no reasonable prospects of success, I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.[24]For those reasons I strike out the Application under rule 8(3)(c). Signed Date: Sophie Buckley 30 April 2026