Andrew White v The Information Commissioner [2026] UKFTT 739 (GRC)

[2026] UKFTT 00739 (GRC)Case Reference: FT/EA/2025/0274/GDPR
First-tier Tribunal
(General Regulatory Chamber)
Date 20 May 2026
Information Rights
Decided without a hearing
Before
JUDGE SANGERMEMBER COSGRAVEMEMBER TAYLOR
Between
ANDREW WHITEApplicantTHE INFORMATION COMMISSIONERRespondentDecision: The appeal is DismissedREASONS

Preliminary matters

[1]This decision is to be provided to the Appellant in 18 point font, which is an adjustment required by the Applicant for the reasons he gave in his submissions and in his appeal form.[2]References to UK GDPR are to Regulation (EU) 2016/679 of the European Parliament and of the Council.[3]References to DPA 2018 are to the Data Protection Act 2018.

Background

[4]The Applicant applied to the Tribunal by way of form GRC1 dated 12th July 2025. The Tribunal notes that the Application was made on an incorrect form but it was, nonetheless, accepted by the Tribunal in accordance with Rule 5 of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 and the overriding objective.[5]The appeal was against a decision which had been made by the Respondent on 30th June 2025, under Decision Number IC-325960-W7Z8.[6]The Applicant had made a Subject Access Request (“SAR”) from RVM Partnership Chartered Surveyors on 29th July 2024. His request was for documents relating to a drainage survey and a contractor’s insurance policy.[7]On 10th August 2024 the Applicant filed a complaint with the Respondent and on 3rd December, an outcome letter was provided to the Applicant to say that the matter had been investigated and there was no further action to be taken.[8]There followed further correspondence between the two parties, as a result of which the Respondent reconsidered his position. Some data was directed to be disclosed and it was confirmed that RVM had been advised that it had failed to comply with its duties. Mandatory training was directed. On 23rd May 2025, the Respondent confirmed to the Applicant that the CCTV drainage report did not amount to personal data.[9]Certain data was provided to the Applicant. However some of it was in an inaccessible format. The Respondent directed RVM to provide it in an accessible format. RVM confirmed that it has already done so and that the Applicant had confirmed receipt of that on 11th September 2024.[10]Subsequent correspondence between the Applicant and the Respondent focused on the issues of whether or not a drain report did constitute personal data and how effective the search for the undisclosed documents had been.[11]On 10th June 2025 an internal review was requested and a final response to that was issued on 30th June 2025.[12]The Respondent confirmed that he was satisfied that it had taken all necessary steps as required under s165 DPA 2018. The earlier complaint had been dealt with appropriately and the Respondent upheld its view that the drain report did not constitute personal data.

The appeal

[13]On 12th July 2025 the Applicant filed an appeal with the Tribunal.[14]At that time the grounds of appeal were as follows:a. The ICO had failed to apply the authority of Michael Ashley v HMRC [2025] EWHC 134 (KB) which established that property-related information constitutes personal data when it affects an individual's legal rights and obligations.b. The ICO failed to investigate documentary evidence (RVM's 2019 email) proving that RVM Partnership provided an incomplete SAR response by failing to disclose internal correspondence about missing documents, constituting a clear Article 15 UK GDPR breach.c. The ICO failed to consider the Applicant’s formal disability notification (severe sight impairment) despite providing medical evidence, breaching Section 149 public sector equality duty.[15]Those were later refined, in response to a strike out application that was made by the Respondent. The strike out was refused and at the time that we considered the case, the grounds of appeal read as follows: The Applicant asks the Tribunal to consider whether the Commissioner has omitted appropriate procedural steps, and, if so, to make one or more of the forward-looking orders expressly contemplated by section 166(2). In particular, the Applicant seeks an order that the Commissioner:a. reconsider and complete his response to the complaint so far as it concerns:(i) the completeness of RVM's SAR response, including any internal correspondence and records relating to the missing contractor's insurance, CCTV drainage report, letter of comfort and photographs identified in the complaint; and(ii) the accessibility of RVM's SAR response and the Commissioner's own complaint handling communications in light of the Applicant's known severe sight impairment; andb. following that reconsideration, send the Applicant a clear, accessible written outcome addressing those points within a specified period;c. for absolute clarity, the Applicant accepts that the Tribunal cannot: (i) determine whether particular documents are 'personal data'; (ii) evaluate the substantive merits of the Commissioner's assessment; or(iii) direct any enforcement action. None of these outcomes are sought. The only question is whether the Commissioner omitted procedural steps required by section 166(1).

Legal framework

[16]Section 165 of the DPA 2018 deals with the complainant’s right to make a complaint and states that: Complaints by data subjects … (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a)take appropriate steps to respond to the complaint, (b)inform the complainant of the outcome of the complaint, (c)inform the complainant of the rights under section 166, and (d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a)investigating the subject matter of the complaint, to the extent appropriate, and (b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with foreign designated authority is necessary.[17]Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows: Orders to progress complaints(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner - (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner - (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.”[18]The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It has been clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.[19]In the case of Killock v Information Commissioner [2022] 1 WLR 2241, the Upper Tribunal at paragraph 74 stated - "…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."[20]Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 - "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...”.[21]Mostyn J’s decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141) – “For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.” (paragraph 80, Warby LJ).[22]The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo confirmed that the nature of section 166 is that of a limited procedural provision only. “The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33).[23]The case of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC), noted at paragraph 60 that “it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an appropriate step has been omitted is limited.” In considering this the Tribunal must, as set out in paragraph 85 of Killock “when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator.”[24]Paragraph 61 goes on to say:
“However, the authorities do not preclude an order being made for an appropriate step to be taken even where an outcome has already been provided. One ready example where that is likely to be appropriate is (it seems to me) where the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complaint as a result of oversight or other mistake. In other words, a case where effectively a single complaint is dealt with in part as the Commissioner dealt with the complaint in the Killock and Veale case itself, while the other part is treated like the complaint in the EW v IC case that was considered by the Upper Tribunal at the same time.”
[25]Paragraph 85 of Killock reads as follows:
“However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.”
[26]The recent Upper Tribunal case of Christina Buica v The Information Commissioner (UA-2026-000018-GIA) provides a useful summary of the principles to be applied in cases such as this. The decision in that case was to refuse to allow permission to appeal against a decision of this Tribunal. At paragraph 10 it states:
“For the purpose of this application, the main relevant principle derived from the authorities is that Section 166 is a forward-looking provision intended to remedy ongoing procedural defects that standing the way of the timely resolution of a complaint. The FtT has no power to deal with the merits of a complaint nor of the outcome”
.

Discussion and conclusions

[27]The first question is whether the IC provided an outcome to the Applicant’s complaint.[28]The IC provided his response to the Applicant on 3rd December 2024. In response to a complaint he revised his position, progressed the investigation and provided a further outcome on 20th February 2025, directing that action be taken by RVM.[29]In an undated email sent by the Applicant to the Respondent, he clarified that his concern related more to the efforts made by RVM to comply with his SAR, rather than the response itself. The relevant request for action (insofar as it translates into the grounds of appeal as they fall to be considered) is for the IC to: “Require RVM to disclose all correspondence and records concerning their awareness of and attempts to obtain the Contractor’s Insurance and CCTV Drainage Report; Ask RVM to explain why this material was not referenced or disclosed in their SAR response, and whether any legal exemption was considered or applied”.[30]The documents he is requesting do not appear to form part of the original SAR; rather they are documents that may have been produced by RVM when responding to it.[31]On 30th June 2025 the Respondent provided a final response to the Applicant.[32]The panel consider that the response dated 30th June 2025 was in fact an outcome to the complaint. The response concluded that(a) there was no evidence of “internal correspondence and records” relating to the missing reports which constituted the personal data of the Applicant and(b) that any information which was personal data had been provided. It demonstrated that the IC had given consideration to whether there were any other appropriate steps which could be taken to progress the Applicant’s complaint and had determined that there were not.[33]This was sufficient, in our view, to demonstrate that the IC has complied with the requirements of section 165(4). The fact that the Applicant does not agree with the outcome does not render it wrong in law. In making this decision we have given significant weight to the view of the IC as the expert regulator that there are no further appropriate steps he should have taken.[34]Returning to the grounds of appeal: The Applicant asks the Tribunal to consider whether the Commissioner has omitted appropriate procedural steps, and, if so, to make one or more of the forward-looking orders expressly contemplated by section 166(2). In particular, the Applicant seeks an order that the Commissioner:a. reconsider and complete his response to the complaint so far as it concerns:(i) the completeness of RVM's SAR response, including any internal correspondence and records relating to the missing contractor's insurance, CCTV drainage report, letter of comfort and photographs identified in the complaint; and(ii) the accessibility of RVM's SAR response and the Commissioner's own complaint handling communications in light of the Applicant's known severe sight impairment; andb. following that reconsideration, send the Applicant a clear, accessible written outcome addressing those points within a specified period;c. for absolute clarity, the Applicant accepts that the Tribunal cannot: (i) determine whether particular documents are 'personal data'; (ii) evaluate the substantive merits of the Commissioner's assessment; or(iii) direct any enforcement action. None of these outcomes are sought. The only question is whether the Commissioner omitted procedural steps required by section 166(1).

Ground (a)

[35]This is a request to “reconsider” the response. The Applicant concedes that a response has been provided and then, when issues of accessibility were raised, perfected. s166 does allow for the order of an additional step if the Applicant can show that an oversight or mistake has led to an aspect of the complaint not being dealt with. That was not the Applicant’s case and we did not find that to be the position. The case law is clear that we have no jurisdiction to step into the Respondent’s shoes and direct a different investigation or outcome. It is not the case that an aspect of the complaint has not been addressed. It is the case that the Applicant is concerned with how the complaint was investigated.[36]In respect of ground (a) we also found that any correspondence or requests arising from the subject access request made on 29th July 2024 would, by definition, post-date the subject access request. If that is indeed what the Applicant seeks, it is out of the scope of the request and there is no basis upon which the Tribunal has jurisdiction to make an order.[37]Finally, the Tribunal has no power to make any order in respect of the accessibility of the response or the Respondent’s complaint handing communications.

Ground (b)

[38]Given that there is no order made in respect of ground (a), this falls away.

Ground (c)

[39]In light of the above, we find that the Commissioner did not omit any procedural steps required by s166(1).

Conclusion

[40]Given the law set out above, the decision of the Tribunal was that we have no power to make any direction provided for by s166(2).[41]The purpose of s166 is to direct an outcome where one has not been provided, or where one has been partially provided but aspects of the complaint have been overlooked.[42]The outcome sought by the Applicant is, in effect, challenging the substantive outcome of the complaint to the IC. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision. In an application under section 166, the Tribunal has no power to direct the IC to investigate, in a particular way or at all or to take enforcement action to secure compliance with a request.[43]The appeal is therefore dismissed.