1. These proceedings concern an application (the “Application”) under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) for an order to progress the Applicant’s complaint against Denbighshire County Council (the “Council”) concerning a subject access request (“SAR”). The complaint was submitted to the Information Commissioner (“IC”) on 3 April 2026 and was dealt with under reference IC-499631-V4Q2. 2. The IC wrote to the Applicant on 27 May 2026 stating that he had considered the information the Applicant provided in line with the IC’s published framework and had decided not to undertake a more detailed investigation. He explained that based on the information provided he had not identified factors such as significant harm, wider impact or a broader data protection concern that would justify further investigation at that stage. The IC informed the Applicant that he would record the complaint for information purposes. 3. The Applicant requested a review on 28 May 2026 asking that a full investigation of the Council’s actions be undertaken. 4. The IC wrote to the Applicant again on 18 June 2026 having reviewed all the information provided and reviewed the Applicant’s additional submissions and informed the Applicant that his decision remained the same. The IC recognised the Applicant’s concerns about the Council’s handling of SARs and delay in responding to correspondence. He explained that from the information available, the Council had issued a response explaining it was not able to provide the requested information giving a number of reasons for this, including the rights of other individuals, confidentiality expectations and the potential for harm. The IC said that he had not seen sufficient evidence to demonstrate that the Council’s reliance on exemptions is clearly incorrect of that it has failed to meet its obligations under data protection law in a way that would require further regulatory intervention. He acknowledged the Applicant considered there to be significant impact, but considered that the matters raised did not demonstrate a level of non-compliance that would meet the threshold for further investigation, so would not be responding further on this matter. The IC advised the Applicant of his right to take the case to court and to complain to the Parliamentary and Health Service Ombudsman (PHSO). The Application 5. The Applicant applied to the Tribunal by way of form GRC3 dated 11 July 2026. He stated that the outcome he was seeking was as follows: “ I ask the Tribunal to direct the ICO to move forward with a full investigation into the Council’s actions ”. 6. In his grounds for the Application, the Applicant stated that he did not believe the IC’s decision not to take forward his complaint about the Council was consistent with his obligations as a regulator. In the addendum to the Application, in summary the Applicant raised the following points: a. He does not believe the IC’s decision to refuse to investigate is consistent with its published criteria, particularly in relation to assessment of harm. b. He disputes the IC’s finding that he had not seen sufficient evidence to demonstrate the Council’s reliance on exemptions is clearly incorrect, saying that the Council had applied the wrong test for an exemption and that the Applicant had provided documents and analysis to support this. c. He also argues that the Council made a blanket refusal to provide any information whatsoever. He said that even if there was a case for the exemption relied upon, there was no evidence it had been applied in a proportionate matter or redaction considered. d. The IC has not dealt in any way with the Council’s failure to respond at all to two subsequent assertions of data protection rights. The strike-out application 7. The IC applied by way of form GRC5 dated 10 August 2026 to strike out the Application on the basis that the Tribunal has no jurisdiction to consider it under Rule 8(2)(a) and/or that there is no reasonable prospect of it succeeding under Rule 8(3)(c) (the “strike-out application”). 8. The reasons which the IC gave for striking out the application were set out in its Response, particularly at paragraphs 27 to 33. In summary, these were as follows: a. By asking the Tribunal to order that the IC conducts a full investigation into the actions of the Council, it is clear that the Applicant disagrees with the substance of the IC’s decision, which is that he has not seen sufficient evidence of a level of non-compliance by the Council that would meet the threshold for an investigation to be required as per the IC’s published guidance. Notwithstanding the IC ‘s wide discretion to decide the extent to which he investigates as well as the intensity of any investigation he chooses to undertake, the remedy being sought here clearly demonstrates that the Applicant is using the s166 mechanism to ask the Tribunal to substitute its own view (in favour of a full investigation) for those of the IC in relation to the level of investigation required by him. This is clearly not permitted by the s166 statutory mechanism, which by s166(2) restricts the Tribunal to considering matters relating to procedural failure by the IC to progress an individual’s complaint about a possible infringement of their data protection rights only and does not permit a consideration of the substantive merits of any outcome that the IC might give, including as in the present case, as to the appropriate level of investigation. b. Further, as the Applicant is clearly seeking to attack the merits of the outcome by asking the Tribunal to order the IC to revisit his decision as to the level of investigation appropriate into the complaint, this is a matter that should be pursued by judicial review proceedings in the Administrative Court (see Smith v Information Commissioner [2025] UKUT 74 (AAC) at [136]). In any event, there is no obligation upon the Commissioner to conduct an extensive investigation into the complaint, with external engagement with both the data controller and the data subject, and can include a desktop investigation of the complaint, as occurred in this case (see Evans v Information Commissioner [2025] UKFTT 1057 (GRC) at [39]). c. The IC has taken appropriate steps to investigate and respond to the Applicant’s complaint and has provided an outcome to him on 27 May 2026 with a review outcome on 18 June 2026. Accordingly, it is respectfully submitted that the IC has complied with the procedural requirements set out in section 166(1) of the DPA18, and there is therefore no basis for the Tribunal to make an order under section 166(2) DPA18. d. It is clear that the Applicant disagrees with the outcome provided on his complaint. However, as set out above, section 166 DPA18 does not provide a mechanism by which complainants can challenge the substantive outcome of a complaint. The relief available from the Tribunal on an application under section 166 DPA18 only applies where it is satisfied that the IC has failed in some procedural respect to comply with the requirements of section 166(1) DPA18, limited solely to those orders that are set out in section 166(2) . e. If the Applicant wishes to seek an order of compliance against the Council for any alleged breach of his data protection rights, the correct route for him to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18. 9. I directed on 12 August 2026 that the Applicant should provide representations in relation to the strike out application by 27 August 2026 under Rule 8(4) 10. The Applicant responded to the strike-out application on 27 August 2026 so I am satisfied that the Applicant has had an opportunity to make representations on the proposed striking out under rule 8(4). The points made by the Applicant, in summary, were as follows: a. He states that “ Appropriate steps involve a consideration of the nature of the complaint in light of the Commissioner’s own published guidance, a determination supported by a fair application of that guidance, and a decision that is logically coherent and consistent with the evidence before the Commissioner. A decision by the Commissioner that does not entail these reasonable criteria is not “appropriate” and leads to circumstances whereby decisions by the Commissioner can be inconsistent, at variance with published guidance, characterised by inherent contradictions and not supported by any reasonable interpretation of the evidence.” b. The IC in its review response dated 18 June appeared to move away from a key criterion of significant harm relied upon in its earlier response without explanation or justification. The Applicant states that this departure, “– whilst maintaining the same ultimate decision, does not demonstrate consistent, impartial, evidence-based decision-making required in the proper exercise of the Commissioner’s powers and responsibilities.” c. The Applicant disputes the IC’s findings about the adequacy of evidence before him as to the correctness of the exemptions applied by the Council. The Applicant maintains that the Council applied the wrong exemption. In light of the Applicant’s previous submissions he states that “ In his decision of 18 June 2026, the Commissioner does not engage at all with this argument which was clearly articulated with supporting evidence and legal analysis. Indeed, that review decision does not reflect any meaningful engagement whatsoever with the issues raised in the request for a review.” d. He states “ Completely withholding all the information requested should implicitly raise suspicions on the part of the Commissioner that the exemptions have been inappropriately applied and merit some degree of further investigation. It is of concern that not even the most basic step has been taken of asking the Council to justify its position .” e. The IC has not dealt with the further instances of non-response by the Council. f. He highlights inconsistency in the IC’s treatment of similar complaints of which he is aware. g. He accepts the IC’s wide discretion to determine the extent to which complaints should be investigated but that such decisions should be “ fairly made, consistent with published guidance and based on sound reasoning ”. h. He concludes that the IC has not made an appropriate decision on this matter and that his reasoning is inconsistent with his own published guidance and in direct contradiction of the evidence provided to his office. The IC has therefore failed to take appropriate steps to respond to the complaint. Legal framework 11. Section 165 DPA 2018 sets out the right of data subjects to complain to the IC about infringement of their rights under the data protection legislation. Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows: “Orders to progress complaints (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner - a. fails to take appropriate steps to respond to the complaint, b. fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or c. if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner - d. to take appropriate steps to respond to the complaint, or e. to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.” 12. The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1) (a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166 . It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. 13. Section 165 deals with the complainant’s right to make a complaint and states that: “(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a)take appropriate steps to respond to the complaint, (b)inform the complainant of the outcome of the complaint, (c)inform the complainant of the rights under section 166 , and (d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a)investigating the subject matter of the complaint, to the extent appropriate, and (b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with foreign designated authority is necessary.” 14. In the case of Killock v Information Commissioner [2022] 1 WLR 2241 , the Upper Tribunal at paragraph 74 stated - " …It is plain from the statutory words that, on an application under section 166 , the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals." 15. Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327 , paragraph 57 - " The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination... ”. 16. Mostyn J’s decision in Delo was upheld by the Court of Appeal ( [2023] EWCA Civ 1141 ) – “ For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint .” (paragraph 80, Warby LJ). 17. The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo confirmed that the nature of section 166 is that of a limited procedural provision only. “ The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33). 18. The case of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC) , noted at paragraph 60 that “ it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an appropriate step has been omitted is limited.” I n considering this the Tribunal must, as set out in paragraph 85 of Killick “when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator.” 19. Paragraph 85 of Killick reads as follows: “ However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.” Discussion and conclusions 20. I have decided to deal with this matter without a hearing, despite the fact that the Applicant stated in his GRC3 that he wished the matter to be dealt with at a hearing. 21. The reason why I have done so is that the issue I need to determine at this stage is a straightforward one, namely whether the Tribunal has jurisdiction to hear the Applicant’s Application and whether there is any reasonable prospect of success. The Applicant has already filed extensive written submissions and documentary evidence addressing the Tribunal on these points. I am not persuaded that additional oral evidence from the Applicant is required in order fairly to determine the issue of strike out or indeed would add anything substantive to the issues already ventilated. The IC has not at this stage provided any witness evidence, so cross-examination would be inappropriate. I have taken into account the overriding objective, particularly dealing with the case in ways which are proportionate to the importance of the case, the complexity of the issues, the anticipated costs and the resources of the parties; avoiding unnecessary formality and seeking flexibility in the proceedings; ensuring, so far as practicable, that the parties are able to participate fully in the proceedings; and using any special expertise of the Tribunal effectively. While I recognise that the fair determination of this case is very important to the Applicant, I do not consider it a proportionate use of resources to require an oral hearing to determine the issue of jurisdiction. I note also that Rule 32(4) permits the Tribunal to strike out a case under Rule 8 without an oral hearing. 22. Turning to the questions before the Tribunal, the first question is whether the IC provided an outcome to the Applicant’s complaint. The IC provided the Applicant with a response to his complaint on 27 May 2026, with a further response after review on 18 June 2026. 23. I am satisfied that, when taken together, these responses have provided an outcome to the Applicant’s complaint, provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint. This is sufficient in my view to demonstrate that the IC has complied with the requirements of section 165(4). The fact that the Applicant does not agree with the outcome does not render it wrong in law. 24. It appears to me therefore that there are no further appropriate steps which the IC ought reasonably to take to progress the complaint. In making this decision I have given significant weight to the view of the IC as the expert regulator that there are no further appropriate steps he should have taken. 25. The outcome sought by the Applicant is, in effect, challenging the substantive outcome of the complaint to the IC which was a decision not to investigate the Applicant’s complaint further. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision. In an application under section 166 , the Tribunal has no power to direct the IC to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the UK GDPR. I also agree with the IC’s position that it is not a court or ombudsman and that orders for compliance need to be sought through civil action. Accordingly, I find that the Tribunal does not have the power to grant the outcomes sought. 26. Because I consider that there was an outcome determining the complaint and that there were no further appropriate steps which should be taken, I find the complaint has already been determined and therefore the Tribunal has no jurisdiction over it. I am also satisfied that there is no reasonable prospect of the case, or any part of it, succeeding because the outcome sought by the Applicant is not something which is within the Tribunal’s power to grant. 27. The proceedings are therefore struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with them and under Rule 8(3)(c) because there is no reasonable prospect of them succeeding.