{"check":null,"uid":"b8c20b9b1a0e63a4","title":"Lisa Keech v Information Commissioner","title_generated":false,"country":"Великобритания","organ":"Суды Англии и Уэльса","kind":"case","kind_name":"Судебная практика","lang":"en","date":"2026-07-22","summary":"Исключил заявление матери, добивавшейся по ст. 166(2) Data Protection Act 2018, чтобы Информационный комиссар глубже разобрал её жалобу на образовательное учреждение: неполный ответ на запрос субъекта данных, доступ посторонних сотрудников к сведениям о дочери, правка записей задним числом. Просрочку подачи судья простил, но по существу указал: комиссар выдал итог 22 января 2026 года, подтвердил его при пересмотре 15 апреля и 12 июня развёрнуто объяснил мотивы, так что процедурного дефекта, устранимого приказом, не осталось. Ст. 166 не позволяет оценивать вес доказательств и глубину проверки — это спор по существу.","snippet":"","topics":["Персональные данные"],"status":"ok","error":"","text_len":19029,"versions":1,"url":"https://caselaw.nationalarchives.gov.uk/ukftt/grc/2026/1067","first_seen":"2026-08-19","last_checked":"2026-09-17 01:45","relevance":"hit","score":21,"query":"","source_key":"caselaw_uk","verdict":{"relevance":"hit","score":21,"topics":["Персональные данные"],"need_body":3,"authorities":[{"kind":"орган","name":"Information Commissioner","topic":"Персональные данные"},{"kind":"акт","name":"GDPR","topic":"Персональные данные"},{"kind":"акт","name":"UK GDPR","topic":"Персональные данные"},{"kind":"акт","name":"Data Protection Act 2018","topic":"Персональные данные"}],"evidence":[{"topic":"Персональные данные","term":"data protection","weak":false,"pos":92,"ctx":"sa keech v information commissioner исключил заявление матери, добивавшейся по ст. 166(2) data protection act 2018, чтобы информационный комиссар глубже разобрал её жалобу на образовательное учре","zone":"название","weight":3},{"topic":"Персональные данные","term":"data protection","weak":false,"pos":89,"ctx":"1.  these proceedings involve an application to the tribunal under section 166(2) of the data protection act 2018 (“dpa”).  2.  the applicant complained to the information commissioner (the “com","zone":"текст","weight":1},{"topic":"Персональные данные","term":"data protection","weak":false,"pos":337,"ctx":"se of an educational institution to a subject access request and alleged infringements of data protection legislation concerning herself and her daughter.  3.  on 4 august 2025, the organisation","zone":"текст","weight":1},{"topic":"Персональные данные","term":"data protection","weak":false,"pos":4144,"ctx":"ata subjects to complain to the commissioner about infringement of their rights under the data protection legislation. under section 166 dpa a data subject can make an application to this tribuna","zone":"текст","weight":1},{"topic":"Персональные данные","term":"gdpr","weak":false,"pos":4426,"ctx":"s where, after a data subject makes a complaint under section 165 or article 77 of the uk gdpr, the commissioner –  (a)  fails to take appropriate steps to respond to the complaint,  (","zone":"текст","weight":1},{"topic":"Персональные данные","term":"personal data","weak":false,"pos":7336,"ctx":"cceeding.”  factual background  20.  the applicant's complaint concerned allegations that personal data and safeguarding information relating to herself and her daughter had been improperly acc","zone":"текст","weight":1},{"topic":"Персональные данные","term":"data protection","weak":false,"pos":7629,"ctx":"sar was incomplete and that further enquiries ought to have been undertaken into alleged data protection failings.  21.  the commissioner accepts within the response that the original outcome co","zone":"текст","weight":1},{"topic":"Персональные данные","term":"Information Commissioner","weak":false,"pos":13,"ctx":"Lisa Keech v Information Commissioner Исключил заявление матери, добивавшейся по ст. 166(2) Data Protection Act 2018, чтобы Инф","zone":"орган","weight":3},{"topic":"Персональные данные","term":"GDPR","weak":false,"pos":5087,"ctx":"s where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner –  (a)  Fails to take appropriate steps to respond to the complaint,  (","zone":"акт","weight":0},{"topic":"Персональные данные","term":"UK GDPR","weak":false,"pos":5084,"ctx":"lies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner –  (a)  Fails to take appropriate steps to respond to the complaint,  (","zone":"акт","weight":0},{"topic":"Персональные данные","term":"Data Protection Act 2018","weak":false,"pos":92,"ctx":"sa Keech v Information Commissioner Исключил заявление матери, добивавшейся по ст. 166(2) Data Protection Act 2018, чтобы Информационный комиссар глубже разобрал её жалобу на образовательное учреждение: н","zone":"акт","weight":0}],"dropped":[]},"last_changed":"2026-08-19","meta":{"neutralCitation":"[2026] UKFTT 01067 (GRC)","court":"United Kingdom First-tier Tribunal (General Regulatory Chamber)"},"source_url":"https://caselaw.nationalarchives.gov.uk/ukftt/grc/2026/1067","text":"1.\n\nThese proceedings involve an application to the Tribunal under\nsection 166(2)\nof the\nData Protection Act 2018\n(“DPA”).\n\n2.\n\nThe Applicant complained to the Information Commissioner (the “Commissioner”) on 24 September 2025 regarding the response of an educational institution to a Subject Access Request and alleged infringements of data protection legislation concerning herself and her daughter.\n\n3.\n\nOn 4 August 2025, the organisation provided a response to the Applicant.\n\n4.\n\nThe Applicant raised two written complaints with the organisation on 7 August 2025 and 25 August 2025. She alleged that the Subject Access Request (“SAR”) was incomplete and that there had been data breaches in connection with the way the SAR data was collected and handled, amounting to dishonesty and cover-up.\n\n5.\n\nThe Commissioner issued an outcome letter on 22 January 2026.\n\n6.\n\nFollowing a request for further clarification and review by the Applicant, the Commissioner maintained that outcome and issued a review decision on 15 April 2026.\n\n7.\n\nThe Applicant lodged the present application with the Tribunal on 5 May 2026.\n\n8.\n\nBy a response dated 16 June 2026, the Commissioner opposed the application and applied for it to be struck out pursuant to Rule 8(3) (c) of the\nTribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009\n, on the ground that it has no reasonable prospect of success\n.\n\n9.\n\nUnder Rule 8(3)(c) of the\nTribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009,\nthe Tribunal may strike out the whole or part of the proceedings if the Tribunal considers there is no reasonable prospect of the applicant’s case, or part of it, succeeding.\n\n10.\n\nBy directions dated 22 June 2026, Judge Heald afforded the Applicant an opportunity to make representations regarding the proposed strike-out and regarding whether the application should be admitted.\n\n11.\n\nThe Applicant provided detailed written representations opposing strike-out on 25 June 2026.\n\nPreliminary Issue: Time\n\n12.\n\nThe Commissioner submits that the application was lodged out of time and should not be admitted pursuant to Rule 22(4)(b) of the Tribunal Rules. The Commissioner notes that the Applicant's complaint was submitted on 24 September 2025 and submits that the relevant time limit expired before the application was lodged on 5 May 2026. The Commissioner further submits that the Applicant has not adequately explained the delay following receipt of the review outcome on 15 April 2026.\nHe submits “\nTaking all of the relevant circumstances into account (including the merits of her application), against the length of the delay and absence of an explanation fot [sic] the further 3 week delay post the review decision, they do not outweigh the need for litigation to be respected”.\n\n13.\n\nThe Applicant explains that she remained engaged in correspondence with the Commissioner regarding her complaint and review request, that she was attempting to resolve matters without proceedings, and that she is a litigant in person with no legal representation. She further notes that detailed reasons for the Commissioner's decision were not supplied until after the application had been lodged.\n\n14.\n\nI have considered the parties' respective submissions regarding time. Whilst the application was not lodged within the prescribed period, I am prepared to admit it out of time.\n\n15.\n\nI reach that conclusion because the delay is relatively modest, because the Applicant continued to engage actively with the Commissioner following the original outcome, because a review was not concluded until 15 April 2026, and because the Commissioner subsequently accepted that the original outcome correspondence did not adequately explain the reasons for the decision. In all the circumstances, and having regard to the overriding objective, I consider it appropriate to admit the application.\n\n16.\n\nI therefore proceed to consider the Commissioner's application for strike out.\n\nStatutory Framework\n\n17.\n\nSection 165 DPA sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under\nsection 166\nDPA a data subject can make an application to this tribunal for an order as follows:\n\n166 Orders to progress complaints\n\n(1)\n\nThis section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner –\n\n(a)\n\nFails to take appropriate steps to respond to the complaint,\n\n(b)\n\nFails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or\n\n(c)\n\nIf the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.\n\n(2)\n\nThe Tribunal may, on an application by the data subject, make an order requiring the Commissioner –\n\n(a)\n\nTo take appropriate steps to respond to the complaint, or\n\n(b)\n\nTo inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.\n\n’\n\n18.\n\nThe Tribunal can only make an order under\nsection 166(2)\nif one of the conditions at\nsection 166(1)\n(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of\nsection 166\n. It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. Some key decisions are:\n\na.\n\nScranage v Information Commissioner\n[2020] UKUT 196 (AAC)\n, paragraph 6\n\n-\n\"In my experience – both in the present appeal and in many other cases – there\nis a widespread misunderstanding about the reach of\nsection 166\n. Contrary to\nmany data subjects’ expectations, it does not provide a right of appeal against\nthe substantive outcome of the Information Commissioner’s investigation on its\nmerits. Thus,\nsection 166(1)\n, which sets out the circumstances in which an\napplication can be made to the Tribunal is procedural rather than substantive in\nits focus.\"\n(emphasis in original).\n\nb.\n\nKillock v Information Commissioner\n\n[2022] 1 WLR 2241\n, Upper Tribunal at paragraph 74 - \"…\nIt is plain from the statutory words that, on an application under\nsection 166\n, the Tribunal will not be concerned and has no power to deal with the\nmerits of the complaint or its outcome. We reach this conclusion on the plain and\nordinary meaning of the statutory language but it is supported by the Explanatory\nNotes to\nthe Act\nwhich regard the\nsection 166\nremedy as reflecting the provisions\nof article 78(2) which are procedural. Any attempt by a party to divert a tribunal\nfrom the procedural failings listed in\nsection 166\ntowards a decision on the merits\nof the complaint must be firmly resisted by tribunals\n.\"\n\n19.\n\nRule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 provides:\n\n“The Tribunal may strike out the whole or a part of the proceedings if—\n\n...\n\n(c)\n\nthe Tribunal considers there is no reasonable prospect of the applicant’s case, or part of it, succeeding.”\n\nFactual background\n\n20.\n\nThe Applicant's complaint concerned allegations that personal data and safeguarding information relating to herself and her daughter had been improperly accessible to individuals within an organisation, that records had been amended, that the response to a SAR was incomplete and that further enquiries ought to have been undertaken into alleged data protection failings.\n\n21.\n\nThe Commissioner accepts within the Response that the original outcome correspondence did not adequately explain the reasons why no further action would be taken.\n\n22.\n\nFollowing further correspondence, the Commissioner provided a detailed explanation of the reasons underlying the decision by letter dated 12 June 2026. That correspondence addressed the Commissioner's approach to the complaint and the reasons why no further regulatory action was considered appropriate.\n\n23.\n\nThe Applicant nevertheless maintains that the evidence she supplied was not properly considered and that the Commissioner failed meaningfully to engage with material which she believes demonstrates serious data protection failings.\n\n24.\n\nI have considered whether it is necessary to reproduce in detail the contents of the safeguarding, welfare, medical and other records relied upon by the Applicant. Whilst those materials form part of the evidence before the Tribunal, the issue arising in this application concerns the scope of the Tribunal’s jurisdiction under\nsection 166\nDPA 2018 rather than the merits of the underlying complaint. I have therefore summarised the nature of the Applicant’s concerns without setting out unnecessary detail concerning personal information relating to her daughter. I consider that approach sufficient to explain the issues arising in this application whilst avoiding unnecessary publication of sensitive information.\n\n25.\n\nI have also considered whether it is necessary to make any order under Rule 14 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 restricting the publication of information contained within these proceedings. Neither party has applied for such an order. Having regard to the principle of open justice, the limited issue requiring determination in this application, and the fact that I have avoided reproducing unnecessary details concerning the personal information of the Applicant's daughter, I do not consider it necessary or proportionate to make such an order.\n\nApplication of the statutory framework to the present case\n\nThe Applicant's complaint and evidence\n\n26.\n\nThe Applicant's case is not simply that she disagrees with the outcome of her complaint. Rather, her contention is that the Commissioner failed properly to engage with material evidence before deciding not to pursue further regulatory action. She submits that the Commissioner reached a decision without adequately considering information which, in her view, demonstrated significant failures in the handling of personal and special category personal data.\n\n27.\n\nIn support of her position, the Applicant relied upon screenshots and records which she says demonstrate that personal data and highly sensitive personal data relating to her daughter was accessible within the organisation to individuals who had no operational need to view it. She contends that this gave rise to concerns regarding compliance with the integrity and confidentiality requirements of the UK GDPR.\n\n28.\n\nThe Applicant also relied upon records which she says demonstrate that records were amended after their original creation. The materials before me include apparent revision histories and other records which, the Applicant submits, support that contention. She considers those materials significant because they raise questions regarding the accuracy, completeness and reliability of information disclosed in response to the SAR, and because they form part of her wider contention that the Commissioner failed properly to engage with evidence which, in her view, warranted further enquiry.\n\n29.\n\nThe Applicant also relies upon an email from a member of staff which, she says, demonstrates that concerns regarding access to information were raised internally. In her written submissions she states that the member of staff reported that records relating to attendance, safeguarding, welfare and correspondence concerning the Applicant’s daughter could be accessed by staff who had no connection with the individual concerned. She submits that this constituted contemporaneous evidence originating from within the organisation itself rather than merely her own interpretation of events.\n\n30.\n\nThe Applicant states that the organisation concerned informed her that an internal review had been undertaken because staff had accessed emails relating to her daughter and that the matter was being addressed through HR procedures. She relies upon that information as providing an evidential basis for her belief that further records existed which had not been disclosed in response to her SAR.\n\n31.\n\nThe Applicant further emphasises that the information in question concerned safeguarding records and other sensitive personal information. She submits that such information constitutes particularly sensitive personal data and that the Commissioner failed adequately to engage with the significance of that fact when deciding not to pursue further enquiries.\n\n32.\n\nThe Applicant's central submission is therefore not merely that the Commissioner arrived at a conclusion with which she disagrees. Rather, she submits that the evidence she supplied, disclosed potentially serious concerns and that the Commissioner failed properly to examine that evidence before deciding not to investigate further.\n\nThe Commissioner's response\n\n33.\n\nThe Commissioner issued an outcome letter on 22 January 2026 and subsequently maintained that outcome following a review completed on 15 April 2026.\n\n34.\n\nThe Commissioner accepts that the original outcome correspondence did not adequately explain the reasons why no further action would be taken. That concession is expressly made within the Response before the Tribunal.\n\n35.\n\nHowever, the Commissioner maintains that any deficiency in the original explanation was subsequently remedied. In particular, the Commissioner relies upon correspondence dated 12 June 2026 in which the Commissioner provided detailed reasons for the decision not to take further action. In that correspondence, the Commissioner explained that the issues raised by the Applicant primarily concerned the specific circumstances of her case and did not disclose evidence of systemic failings or a significant ongoing risk to individuals' information rights such as would justify formal regulatory intervention.\n\n36.\n\nThe Commissioner also addressed the Applicant's concerns regarding the accuracy and completeness of records, alleged amendments to records, alleged concealment of information, alleged personal data breaches, information sharing, and complaint handling. The Commissioner explained why, notwithstanding those concerns, further regulatory action was not considered necessary or proportionate and identified other routes available to the Applicant if she wished to challenge the accuracy of personal data or seek relief through the courts.\n\n37.\n\nThe Commissioner therefore submits that the outcome letter of 22 January 2026, the review decision of 15 April 2026 and the detailed explanatory letter of 12 June 2026 together constitute both an outcome and an explanation of that outcome for the purposes of sections 165 and 166 DPA 2018.\n\n38.\n\nThe Commissioner accepts neither that the evidence relied upon by the Applicant required further investigation nor that any continuing procedural failure existed. The Commissioner's position is that the Applicant's continuing dissatisfaction arises from disagreement with the assessment of the evidence and the decision not to pursue further regulatory action rather than from any failure to provide an outcome or explanation.\n\nAnalysis\n\n39.\n\nI accept that the Applicant's concerns are genuine, detailed and supported by specific examples. The Applicant has identified particular records, alleged amendments to records and concerns regarding access to sensitive information. I am satisfied that she has clearly articulated concerns she wishes to advance.\n\n40.\n\nThe Applicant submits that the evidence she relies upon demonstrates matters which warranted further enquiry by the Commissioner. For present purposes, however, I make no finding as to whether the Applicant's allegations are ultimately correct, whether any breach of the UK GDPR occurred, whether records were improperly amended or whether additional regulatory investigation would have been justified. Those are not matters which I am required to determine in order to resolve the present application.\n\n41.\n\nThe difficulty for the Applicant is that, even taking her case at its highest, that does not answer the question which arises under\nsection 166\nDPA 2018.\n\n42.\n\nThe question before this Tribunal is not whether the Commissioner ought to have reached a different conclusion. Nor is it whether the Commissioner ought to have attached greater weight to particular pieces of evidence. Nor is it whether the Commissioner ought to have conducted a more extensive investigation.\n\n43.\n\nThe issue for present purposes is whether, even accepting the Applicant's case at its highest, there remains a live issue falling within the limited jurisdiction conferred by\nsection 166\nDPA 2018 such that the Tribunal could properly grant the relief sought.\n\n44.\n\nI have considered carefully the fact that the Commissioner accepts that the original outcome correspondence did not adequately explain the reasons for the decision. Had the position remained as it stood following the outcome letter of 22 January 2026, a more substantial question may have arisen as to whether the Commissioner had taken appropriate steps to respond to the complaint.\n\n45.\n\nHowever, that is not the position which exists at the date of determination. The Commissioner has now provided an outcome, undertaken a review and supplied a detailed explanation of the reasons underpinning the decision by correspondence dated 12 June 2026.\n\n46.\n\nThe Tribunal's powers under\nsection 166\nare directed towards ensuring that a complainant receives an outcome, information about progress, or an appropriate procedural response to a complaint. The Tribunal does not have power under\nsection 166\nto determine whether the Commissioner should have attached greater weight to particular evidence, undertaken different enquiries, or reached a different substantive conclusion.\n\n47.\n\nIn those circumstances, I am unable to identify any continuing procedural defect capable of remedy by means of an order under\nsection 166\n. The Applicant's complaint now concerns the adequacy of the Commissioner's assessment of the evidence and the conclusions reached. Whether those conclusions are persuasive is not a matter falling within the jurisdiction conferred by\nsection 166\n.\n\n48.\n\nProperly analysed, the Applicant's case has therefore moved beyond the territory governed by\nsection 166\n. What remains is a challenge to the substance of the Commissioner's reasoning and to the exercise of the Commissioner's regulatory judgment.\nSection 166\ndoes not confer jurisdiction upon the Tribunal to determine such matters.\n\n49.\n\nI therefore conclude that, even taking the Applicant's case at its highest and assuming the evidence relied upon by her is capable of supporting further investigation, no order capable of being made under\nsection 166\nDPA 2018 could properly be granted. The proceedings accordingly have no reasonable prospect of success.\n\nSigned\nDate:\n\nJudge. G Kiai\n9\nth\nJuly 2026","changes":[]}