Tag: section 166 (DPA)

Section 166: a continued disappointment for dissatisfied data subjects

January 6th, 2026

In my first blog post of 2026, I return to a subject that I have written about before: section 166 of the Data Protection Act 2018.

Those who frequently look at decisions of the First-tier Tribunal exercising its information rights jurisdiction will be well aware that in 2025 there were a substantial number of applications under section 166 of the Data Protection Act 2018 struck out by the tribunal (and that this is a continuing trend from previous years). The end of 2025 was no exception with a number of such decisions being published over the Christmas and New Year period.

There continues to be a wide-spread misunderstanding by data subjects as to what section 166 provides. Data subjects have a right, under Article 77 of the UK GDPR and/or section 165 of the Data Protection Act 2018, to complain to the Information Commissioner about how a controller has dealt with a request to exercise their rights (most commonly their right of subject access but it could be other rights such as rectification or erasure). In response to such a complaint the Commissioner has an obligation to investigate the complaint “to the extent appropriate” and to inform the data subject about the progress of the complaint, including whether any further investigation is necessary. If the Commissioner does not provide an update or outcome within three months (or at intervals of three months after each update if no outcome has been reached), the First-tier Tribunal has the power, under section 166(2) of the Data Protection Act 2018 to make an order which requires the commissioner to either take appropriate steps to respond to the complaint or to inform, within a period specified in the order, the data subject of the progress of the complaint or of the outcome of the complaint.

Section 166 does not provide a substantive right of appeal against the outcome of such a complaint. It is a procedural jurisdiction only and is concerned with ensuring that data subjects get a final response to their complaint and are kept up to date with the progress of any investigation that the Commissioner deems to be appropriate. The Court of Appeal (England and Wales) determined in R (Delo) v Information Commissioner that the Commissioner is provided with a broad discretion to decide the level of intensity of any investigation and what action, if any, to take in response to such a complaint (including a decision to take no further action in response to a complaint). The terms of section 166 of the Data Protection Act 2018 therefore do not confer a jurisdiction on the First-tier Tribunal to review the decision of the Commissioner similar to that which is conferred on it by section 57 of the Freedom of Information Act 2000.

It is well known in data protection circles that the Commissioner rarely, if ever, takes any formal enforcement action in response to an individual complaint. Indeed, his office rarely, if ever, carries out an investigation of sufficient intensity to, for example, require a data controller to disclose material withheld in response to a subject access request. The Commissioner does have the tools and power to do so; but does not use his resources in that way. It is open to people to agree or disagree with the Commissioner’s approach, and I shall refrain from commenting on that debate in this post.

During the passage of the Data (Use and Access) Act 2025 attempts were made, notably by Liberal Democrat Peer Lord Clement-Jones, to introduce provisions which would have conferred upon the First-tier Tribunal a substantive jurisdiction in relation to data subject complaints. In essence, Lord Clement-Jones’ proposals would have had the effect of transferring the compliance order and compensation jurisdictions from the courts to the First-tier Tribunal. The proposals were not adopted by Parliament.

Data subjects almost never have legal advice or representation when they make applications under section 166 of the Data Protection Act 2018 to the First-tier Tribunal. It is very easy to see how an unrepresented data subject could read section 166 as conferring such a right (especially if they are familiar with the First-tier Tribunal’s role in relation to decisions of the Commissioner made under section 50 of the Freedom of Information Act 2000) and would proceed without knowledge of the existence of key decisions such as Delo and Killock v Information Commissioner.

So, what options are open to a dissatisfied data subject following a complaint to the Information Commissioner (soon to be replaced by the Information Commission)? Well, specifically in relation to the Commissioner’s decision there is the option of judicially reviewing it in the High Court, the High Court in Northern Ireland or the Court of Session depending on where the data subject is located. That is likely to be an unattractive option because judicial review is also concerned with process and procedure rather than a review of the substantive decision; a successful judicial review would most probably only result in the Commissioner’s decision being reduced/quashed and him having to make a new decision exercising his broad discretion. In short, a judicial review is very unlikely to result in a data subject, for example, receiving personal data withheld in response to a subject access request.

The other option doesn’t involve the Commissioner at all and can be taken without even complaining to the Commissioner: to seek a compliance order against the controller under section 167 of the Data Protection Act 2018. Compliance orders can be sought in the Sheriff Court or Court of Session (in Scotland) or the County Court or High Court (in England and Wales or Northern Ireland). The courts can, in response to an application under section 167 perform what might be termed “a full merits review” of the controller’s handling of the request. The courts can specifically order, for example, the disclosure of incorrectly withheld information (in response to a subject access request) or the rectification or the erasure of personal data where that has been incorrectly refused. The Data (Use and Access) Act 2025 has fixed a lacuna that has existed since 2018 making it clear that the courts can require controllers to make available such information as is available to the controller for inspection by the court without it being disclosed to the data subject until after a final determination in favour of the data subject.

Whether either of these solutions are realistic given their costs and, where it is technically possible to get, the availability of solicitors willing to provide legal aid services for such applications is an entirely separate matter on which I shall offer no commentary in this post. Section 167 applications appear comparatively rare; whether that is down to their cost (and the potential for an adverse award of expenses/costs if unsuccessful), a lack of knowledge on the part of data subjects or a combination thereof is not clear.

I suspect that 2026 will continue to see a flow of struck out section 166 applications as data subjects dissatisfied (rightly or wrongly) with the decision of the controller in relation to their request and the outcome of their complaint to the Commissioner continue to seek to challenge those decisions.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}
Appropriate steps and section 166

November 4th, 2022

Last month I highlighted an interesting decision from the First-Tier Tribunal on the much-litigated section 166 of the Data Protection Act 2018 (a section which often results in data subjects being disappointed as to its scope). Yesterday, the Tribunal gave another interesting decision in relation to section 166.

In August 2021, the applicant made a subject access request to a company called Contactout Limited. In November 2021, the applicant complained to the Information Commissioner as the company had not responded to their subject access request. In February 2022, the Commissioner responded to the applicant essentially telling the applicant that there was nothing that the Commissioner could do as the controller was based in the USA. Another fact of key importance is that the applicant was based in the Netherlands and that nothing had been put forward to connect either the applicant or the controller to the UK.

As the Commissioner had provided a response to the applicant, he asked the tribunal to strike out the application as having no reasonable prospect of success. The Tribunal declined to do this (but ultimately dismissed the application). The applicant argued that no adequate explanation had been provided as to why the Commissioner was not the relevant supervisory authority. The Tribunal considered that such an argument had, at least, the potential to fall within the scope of section 166 application [para 14]. The Tribunal was somewhat critical of the Commissioner’s submission which “failed to engage with the applicant’s actual pleaded case.” [para 14] The Tribunal went on to state that it was not going “so far as holding that a sufficiency of reasoning is required in a public law sense, but the applicant must at least know what the outcome is.” [para 14]

The Tribunal found that the wording of the Commissioner’s response letter to the applicant (quoted in its decision), when taken in isolation, risked misleading the reader of the letter that the commissioner was unable to take regulatory action against a controller based in a third country; Article 3 of the UK GDPR and section 207 of the Data Protection Act 2018 create, at least, some scope for such regulatory action. However, the Tribunal decided that the phrase “In relation to your case” within the decision letter from the Commissioner was sufficient to clear-up any misunderstanding. The complaint disclosed that there was nothing linking the applicant, their personal data or the controller to the United Kingdom and it was for that reason that the Commissioner had no jurisdiction. So, with that misunderstanding cleared up there was nothing left that the Commissioner could do that could form the basis for the Tribunal issuing an order under section 166.

The application was dismissed.

Section 166 continues to be a disappointment to data subjects; the limited scope of its terms has been affirmed repeatedly by both the FtT and Upper Tribunal. It does not afford a mechanism for appeal for a data subject who is unhappy with the outcome of their complaint to the Commissioner. It is clear, however, that where there remains scope for the Commissioner to take reasonable steps to address the complaint, then there may be some scope for orders under section 166. There is a fine line between considering whether appropriate steps have been taken to respond and whether the response itself was appropriate. The Tribunal is tasked with casting “a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.” (Killock and ors v Information Commissioner [2021 UKUT 229 at [87]).
When no complaint is found

October 3rd, 2022

Section 166 of the Data Protection Act 2018 has produced a reasonable amount of litigation arising out of what appear to be repeated fundamental misunderstandings by data subjects as to what section 166 provides them with. The Upper Tribunal has authoritatively, on more than one occasion, sated that the right afforded by section 166 of the 2018 Act is limited and does not provide a route for an unhappy data subject to appeal the outcome of their complaint to the Information Commissioner.

A recent FTT decision on section 166 took a slightly different approach, striking out the appeal on the grounds that the applicant had not even made a complaint to the Commissioner and so the Commissioner’s obligation to provide information as to the progress of the complaint was not even engaged.

On 25 May 2021, the applicant copied the Information Commissioner’s Office into an E-mail that had been sent to various other organisations. In that E-mail, the applicant raised a number of issues, none of which seem to have engaged the data protection legislation. There was, attached to the E-mail, an annotated copy of an E-mail that she had received days earlier from the Home Office.

On 8 June 2021, a case officer at the ICO wrote to the applicant to inform her that none of the issues she had raised fell within the jurisdiction of the Commissioner and advised her to complete one of the ICO’s complaint forms if she wished to raise a complaint under the data protection legislation.

The Commissioner argued that as no valid complaint had been made to his office there was no complaint to progress and therefore the application under section 166 of the Data Protection Act 2018 had no reasonable prospect of success.

Judge O’Connor agreed with the Commissioner and concluded that there was no reasonable prospect that the applicant could establish the contrary. Therefore, the application was dismissed. Judge O’Connor did go on to state that even if he was wrong on this, the Commissioner’s letter dated 8 June 2021 was a response and so the Tribunal would have had no jurisdiction under section 166 of the Act in any event.

This case is rather different to the usual section 166 cases that have been seen until now. It suggests that the Information Commissioner is taking a robust approach to what is and what is not a complaint. It has been the case for many years that the ICO would not typically respond to E-mails where they have simply been copied in. The Tribunal appears to be willing, at least in this case, to conclude that no complaint in terms of Article 77 of the UK GDPR or section 165 of the Data Protection Act 2018 has been made to the Commissioner where that is appropriate, and strike out section 166 applications which follow on the back of correspondence not amounting to a proper complaint.

Tag: section 166 (DPA)

Section 166: a continued disappointment for dissatisfied data subjects

Appropriate steps and section 166

When no complaint is found