Aram Panossian v Information Commissioner

1. These proceedings involve an application to the Tribunal under section 166(2) of the Data Protection Act 2018 (“DPA”). The Applicant asks for an order in relation to a complaint to the Information Commissioner (the ‘Commissioner’). Legal Background

2. Under Rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers it does not have jurisdiction in relation to the proceedings or that part of them; and does not exercise its power under rule 5(3)(k)(i) (transfer to another court or tribunal) in relation to the proceedings or that part of them.

3. Under Rule 8(3)(c) of the Rules, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers there is no reasonable prospect of the applicant’s case, or part of it, succeeding.

4. Section 165 DPA sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under section 166 DPA a data subject can make an application to this Tribunal for an order as follows: 166 Orders to progress complaints (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner - (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner - (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

5. The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1) (a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166 . It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. Some key decisions are: a. Scranage v Information Commissioner [2020] UKUT 196 (AAC) , paragraph 6 - "In my experience – both in the present appeal and in many other cases – there is a widespread misunderstanding about the reach of section 166 . Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1) , which sets out the circumstances in which an application can be made to the Tribunal is procedural rather than substantive in its focus." (emphasis in original). b. Killock v Information Commissioner [2022] 1 WLR 2241 , Upper Tribunal at paragraph 74 - "… It is plain from the statutory words that, on an application under section 166 , the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals ." Background

6. The Appellant lodged his appeal using the GRC1 form on 23 December 2024.

7. The Respondent filed their response in accordance with rule 23 of the Tribunal Procedure Rules (they were granted an extension of time to do so). In that response, the Respondent asserted: ‘3. The Commissioner has, since the time of this application being made, provided the Applicant with an outcome addressing his concerns, and therefore invites him to withdraw his application. In the event that the Applicant is not prepared to do this, the Commissioner opposes the application, and invites the Tribunal to strike it out under either rule 8(2)(a)/and or rule 8(3)(c) of the Tribunal Rules, on the grounds: (i) that the Tribunal is without jurisdiction to make an order under section 166(2) of the DPA18 or (ii) that there is no reasonable prospect of success, given that an outcome has been provided, and as a consequence, an order cannot be made by the Tribunal under section 166(2) of the DPA18… Tribunal’s powers to strike out the present application for lack of jurisdiction

22. The Tribunal has power to strike out the proceedings where there is no jurisdiction to determine the matters before it. Rule 8(2)(a) provides: “The Tribunal must strike out the whole or a part of the proceedings if the Tribunal— (a) does not have jurisdiction in relation to the proceedings or that part of them; and (b) does not exercise its power under rule 5(3)(k)(i) (transfer to another court or tribunal) in relation to the proceedings or that part of them.”

23. However, for the reasons given below, the Tribunal has no jurisdiction to determine the present application, as the Commissioner has already determined the Applicant’s complaint when he sent an outcome to the Applicant on 22 April 2025. The Tribunal’s powers to strike out the present application on the ground that it has no reasonable prospect of success.

24. The Tribunal has the power to strike out the present application under rule 8(3)(c) of the Tribunal Rules on the ground that it has no reasonable prospect of success. Rule 8(3)(c) provides: “(3) The Tribunal may strike out the whole or a part of the proceedings if— (c) the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding.”

25. The present application shows no discernible grounds that would warrant the Tribunal exercising its powers under section 166(2) of the DPA18, given that the Commissioner provided an outcome to the Applicant’s complaint on 22 April 2025. There is therefore no reasonable prospect of persuading the Tribunal to make any form of order pursuant to section 166(2) of the DPA18….

37. The relief sought is predicated upon the delay by the Commissioner in both providing an outcome to the Applicant’s complaint and a response to the Application of 23 December 2024 in accordance with paragraph 2a of the Tribunal’s Directions. The Commissioner acknowledges the importance of complying with procedural requirements and regrets any inconvenience or delay. The Commissioner provided an outcome to the complaint on 22 April 2025 after the information he had requested was provided by the Applicant on 7 April 2025. This information was first requested on 29 January 2025. The subsequent delay in providing a response was due to an administrative error. The Applicant has made several s.166 DPA 2018 applications to the Tribunal (three of which have been struck out to date) and directions were received on two of these cases on the same date with similar case numbers and they were mistaken as one set of directions only. The Commissioner will ensure that all future correspondence is submitted in a timely and proper manner It’s respectfully requested that the Tribunal indulges in accepting this submission notwithstanding the delay.

38. As the above summary demonstrates, the Applicant did not provide the Commissioner with the necessary information in support of the complaint until 7 April 2024 after which the Commissioner took steps to investigate and responded to the complaint on 22 April 2025. It is accepted that there had been an initial delay in acknowledging the Applicant’s complaint, nevertheless and notwithstanding the delay, an outcome was sent to the Applicant on 22 April 2025, which concludes the Commissioner’s handling of his complaint, the provision of an outcome is the end point of the process (see R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2023] EWCA Civ 1141 at [64]). Accordingly, the resolution of the complaint can no longer be considered as pending and it is respectfully submitted that the Commissioner has taken steps to comply with the procedural requirements set out in section 166(1) of the DPA18, 11 and there is therefore no basis for the Tribunal to make an order under section 166(2) DPA18.

39. It is clear from the grounds in support of the application that the Applicant does not agree with the outcome of his complaint, however, as the Tribunal has already established, section 166 DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint. The relief available from the Tribunal on an application under section 166 DPA18 only applies where it is satisfied that the Commissioner has failed in some procedural respect to comply with the requirements of section 166(1) DPA18, limited solely to those orders that are set out in section 166(2) . Accordingly, it is respectfully submitted that the Commissioner has taken steps to comply with the procedural requirements set out in section 166(1) of the DPA18, and there is accordingly no basis for the Tribunal to make an order under section 166(2) DPA18.

40. If the Applicant wishes to seek an order of compliance against the controller for breach of his data rights, the correct route for him to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18’.

8. The Respondent made an application to strike out the Appellant’s application using the GRC5 form on 9 June 2025: ‘For the reasons set out at paragraphs 22 to 25 and 37 to 40 of the Commissioner’s Response, it is submitted that the Tribunal has no jurisdiction to consider the Applicant’s application and/or that the Applicant’s application has no prospect of success, and the Tribunal is invited to strike out the application under either rule 8(2)(a) and/or 8(3)(c) of the Tribunal Rules’

9. In Case Management Directions dated 6 August 2025, the Appellant was invited to respond to the Information Commissioner’s application to strike out by no later than 27 August 2025. Those directions stated that the matter would be placed before a Registrar or Judge of the Tribunal for consideration after 27 August 2025.

10. The Appellant provided no response. I now consider the Respondent’s application, without the benefit of a response from the Appellant. Conclusions

11. I find that the Commissioner provided an outcome to the complaint on 22 April 2025. In that document he concluded ‘Having considered the information provided, I am of the opinion that HMRC have complied with their data protection obligations. This is because…’.

12. Contrary to the expectations of many Appellants, section 166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits. The Tribunal is bound to take into consideration and give weight to the views of the Commissioner, as described by the Chamber President in Barbara Rogers v ICO EA/2021/0348: ’14…In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively: Killock & Ors v Information Commissioner [2021] UKUT 299 . The obligation of the Commissioner is to take appropriate steps to respond to the complaint’.

13. The Appellant has not responded to the application to strike out his application. Indeed, there has been no correspondence from him at all since that date, other than a general email dated 22 nd September which states that he has active cases before the Tribunal, he will be aware from 8-31 October 2025 and will be unlikely to be in email contact during that time. It is not clear if he is seeking to challenge the substantive outcome of the complaint to the Commissioner. Eitherway, the Tribunal does not have the power under section 166 to consider the merits or substantive outcome of a complaint.

14. Section 166 is limited to procedural issues . The Commissioner took steps to investigate and respond to the complaint. It provided an outcome to the complaint. For this reason, I find that the Commissioner has not failed to comply with the procedural requirements set out in section 166(1) of the DPA. I therefore find that there is no reasonable prospect of the case or any part of it, succeeding. The proceedings are therefore struck out.

15. For completeness, I add here that there are further rights of action against the data controller or data processor contained at sections 167 to 169. These may only be pursued in the High Court or the County Court. The Tribunal’s powers are limited by statute, and I have no power to consider matters outside it’s jurisdiction. Signed Date: Judge Kiai 1 December 2025