Victor Frances v The Information Commissioner

1. These proceedings concern an application (the “Application”) under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) for an order to progress the Applicant’s complaints against Croydon ICB (“CICB”) regarding the handling of his and his mother’s personal data. The complaint was submitted to the Information Commissioner (“IC”) on 8 December 2024 and was dealt with under reference IC-351559-B5Z3.

2. On 4 June 2025, the IC’s case officer requested further evidence that the issues had been raised with the CICB and that the Applicant had the authority to communicate with the IC as the data involved the Applicant’s Mother.

3. On 9 June 2025, the Applicant provided evidence of his authority to represent his mother and an extract of correspondence from CICB.

4. On 2 July 2025, the IC’s case officer wrote to the Applicant about the complaint. The letter found that CICB had infringed their obligations and noted that CICB had admitted an error but confirmed that the integrity of the Funding Nursing Care (“FNC”) report had not been affected. The case officer explained that that the information provided by the Applicant had been recorded and may be used for any future action the IC may take.

5. On 31 July 2025, the Applicant responded to the IC’s letter taking issue with its findings and reiterating his request that the IC investigate his complaint.

6. On 19 August 2025, the IC’s case officer wrote to the Applicant stating that there is no evidence that the integrity of the FNC report had been affected and that CICB had confirmed it. The case officer invited the Applicant to provide any evidence he had that demonstrated that the integrity of the FNC report had been affected by the inclusion of third party data in the Applicant’s mother’s data.

7. On 12 September 2025 the Applicant wrote again to the IC’s case officer reiterating his assertion that the FNC report had been affected.

8. On 17 September 2025, the case officer responded stating that there was no evidence to suggest that the integrity of the report had been affected and that the IC would take no further action on this case. The Application

9. The Applicant applied to the Tribunal by way of form GRC1 dated 13 October 2025, which application was incomplete as it was on the wrong form. He subsequently submitted form GRC3 dated 15 December 2025. He stated that the outcome he was seeking was, in summary, as follows: a. For the Tribunal to set aside the original DST report on his mother and all subsequent FNC reviews as corrupt and to reinstate the original assessment made of her needs with full funding. b. A new assessment to be done on his mother, with an independent clinical assessor which is voice recorded during the assessment. The final report should be produced at the same time as the meeting

10. In his grounds for the Application, the Applicant stated: “ I am complaining about the ICO's handling of my case, and their failure to act on any of the serious data breaches of the NHS South West London ICB which we have experienced for the last 7 years. At the start of the ICO taking on my case, they said the ICB had serious failings and the ICO would continue to monitor the conduct of the ICB. Then in the last correspondence from the ICO, they contradicted their earlier statement and said they couldn't find anything wrong with the ICB's data breaches. With their attitude, there would be no point in government bodies making true and accurate reports, instead creating reports that are a work of fiction, and no bodies would take complaints seriously. The ICO didn't even know their own GDPR rules, we had to point out the rules to them, listed one by one. They never made any attempt to answer any of these points. Our experiences to date amount to at least 22 GDPR breaches, probably a lot more than that. When the PHSO gave mine and my Mother's data to an external marketing company, the ICO didn't take any action at all against the PHSO. In the most recent complaint against the ICB alongside the PHSO's final report, the ICO failed to take and enforce any of the PHSO's obvious recommendations, such as using other people's medical records within my Mother's DST/FNC Report. Incredibly, the ICO found that conduct acceptable, as well as the ICB's previous report forgeries. In the ICO's final email summary, [name], the Case Officer, didn't even know there was an appeals process against the ICO decisions, which we knew existed. In our experience appeals are usually pointless because no one is prepared to listen, or they change their original answer. This whole process has been painfully slow, with the ICO being very slow to respond to emails. [The Case officer] has the misconception that everything the ICB tells him is true, without checking for its accuracy, never verifying the facts. He should be establishing the truth of the matter. Such heavy bias defeats the object of making a complaint. He tried to marginalise the case with a very narrow viewpoint, rather than look at the whole conduct and procedures of the ICB. This is a clear case of organisational failure. The ICO have breached their own code of conduct which is laid out in their own document; [the case officer] should have acted with integrity, impartiality, objectivity, honesty, accountability, openness, and great leadership in accordance with the ICO values. They should not knowingly mislead members of the public. [the case officer] has completely failed to answer any of the GDPR points which we raised, and he also, by the tone of his decision letter, that was the final decision and the case was closed. He was trying purposely to avoid any mention of an appeal process that exists. Therefore, he tried to mislead the fact that there was a process of appeal. This is in contrary to the ICO Code of Conduct. Only when we mentioned to him that there was an appeals process did he make a concession. His final assumptions were totally incorrect as well. The ICO needs to take complaints seriously without bias to the organisations they investigate. The ICO is failing in their duty to this country.” The strike-out application

11. The IC applied by way of form GRC5 dated 8 January 2026 to strike out the Application on the basis that the Tribunal has no jurisdiction to consider it under Rule 8(2)(a) and/or that there is no reasonable prospect of it succeeding under Rule 8(3)(c) (the “strike-out application”).

12. The reasons which the IC gave for striking out the application were set out in its Response. In summary, these were as follows: a. The application is out of time. The initial complaint was made on 8 December 2024. Rule 22(5)(f) of the Tribunal Rules require an application under section 166 to be made within 28-days of the expiry of six months from the date on which the IC received the complaint. The time limit therefore expired 28-days after 8 June 2025; namely, 6 July 2025. On any view of the Applicant’s application, whether by GRC1 or GRC3 form, the application is significantly out of time. b. The remedies sought by the Applicant are not outcomes that the Tribunal can grant in a section 166 of the DPA18 application against the Commissioner. An Application under section 166 DPA18 permits a Tribunal to make an order against the IC only if he has failed in some procedural respect. c. The IC has taken appropriate steps to investigate and respond to the Applicant’s complaint, providing them with an outcome on 2 July 2025. Accordingly, the IC has taken steps to comply with the procedural requirements set out in section 166(1) of the DPA18, and there is therefore no basis for the Tribunal to make an order under section 166(2) DPA1 d. It is clear that the Applicant disagrees with the outcome reached by the IC on their complaint. However, as set out above, section 166 of the DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint. The relief available from the Tribunal on an application under section 166 of the DPA18 only applies where it is satisfied that the IC has failed in some procedural respect to comply with the requirements of section 166(1) of the DPA18, limited solely to those orders that are set out in section 166(2) . e. If the Applicant wishes to seek an order of compliance against the controller for breach of their data rights, the correct route for him to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

13. The Applicant provided response by email dated 19 January 2026 which deals with the strike-out application as well as the substantive response, so I am satisfied that the Applicant has had an opportunity to make representations on the proposed striking out under rule 8(4). The points made by the Applicant were as follows: “I was shocked to read of the ICO's threatening statement of what they can do in response to my case accusations and their failure of their Duty. The ICO PRETENDS to follow Lord Nolan's fine principles of Public Life Governances of Accountability, Integrity, Objectivity, Openness, Honesty, Selflessness and Leadership. How badly the ICO fails these important principles which the ICO even has the audacity to incorporate them in their core operating beliefs. The ICO needs to practise what they preach. The ICO took the biased view of the Croydon ICB very conveniently, and accepted the ICB "have confirmed that this has not affected the integrity of the FNC report that has been created". Therefore, rather than the ICO forming their own independent view, they took the ICB at their word, which is a great mistake. You notice that the ICO or the ICB do not mention that the ICB Nurse Assessor did not have my consent to do the assessment on my Mother, which the ICB claimed they did have my written consent which was forged on their own form (otherwise I would have been in personal attendance if I was made aware the assessment was going ahead, due to the numerous examples of dishonesty from the ICB, which I made very clear that all contact from the ICB needed to be in writing). The ICO has even accepted the ICB's "improvements" to the form, without actually examining what the effects will be on other peoples' future assessments. E.G By the removal from the form clause whereby written consent has been obtained from the next of kin. This is the very point that they had gotten caught cheating on in our case, and by removing that, it would mean that the ICB would not require written consent and they would be able to go gung ho and falsely claim verbal consent had been obtained. The ICO's rubber stamping of the new amendment on the form has gifted the ICB with further ways to cheat. You will also notice the ICO, in their assessments, do not mention any of the other GDPR infringements which I raised, such as the validity of the other FNCs and the errors they contain, and more importantly, the two forged DST Reports, which all of the subsequent FNCs derived from. The ICO does not mention that it is a criminal offence for a Public Servant to forge reports. The ICO made no rulings nor statement AT ALL as to the validity or accuracy of these reports, a glaring omission. Obviously the ICO and the ICB have something to hide from the Tribunal's investigation. How quick the ICO tried to flex their legal status in such bullying overtones that "the Tribunal does not have authority" and the ICO's legal victories in past cases, with such bravado rather than HONESTY, ACCOUNTABILITY and OPENNESS. The Tribunal might not be able to change the ICO's decision, but THE TRIBUNAL CAN REVIEW THIS CASE AND PUBLISH THE TRUTH. It is very obvious that the ICO, instead of embracing Lord Nolan's fine principles which they subscribe to, they have something to hide. I STRONGLY URGE THE TRIBUNAL TO REVIEW THIS WHOLE CASE.” Legal framework

14. Section 165 DPA 2018 sets out the right of data subjects to complain to the IC about infringement of their rights under the data protection legislation. Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows: “Orders to progress complaints (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner - a. fails to take appropriate steps to respond to the complaint, b. fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or c. if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner - d. to take appropriate steps to respond to the complaint, or e. to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.”

15. The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1) (a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166 . It is clearly established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.

16. Section 165 deals with the complainant’s right to make a complaint and states that: “(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a)take appropriate steps to respond to the complaint, (b)inform the complainant of the outcome of the complaint, (c)inform the complainant of the rights under section 166 , and (d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a)investigating the subject matter of the complaint, to the extent appropriate, and (b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with foreign designated authority is necessary.”

17. In the case of Killock v Information Commissioner [2022] 1 WLR 2241 , the Upper Tribunal at paragraph 74 stated - " …It is plain from the statutory words that, on an application under section 166 , the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."

18. Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327 , paragraph 57 - " The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination... ”.

19. Mostyn J’s decision in Delo was upheld by the Court of Appeal ( [2023] EWCA Civ 1141 ) – “ For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint .” (paragraph 80, Warby LJ).

20. The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo confirmed that the nature of section 166 is that of a limited procedural provision only. “ The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of (paragraph 33). section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.”

21. The case of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC) , noted at paragraph 60 that “ it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an appropriate step has been omitted is limited.” In considering this the Tribunal must, as set out in paragraph 85 of Killick “when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator.”

22. Paragraph 85 of Killick reads as follows: “ However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.” Discussion and conclusions

23. The first question is whether the IC provided an outcome to the Applicant’s complaint. The IC provided the Applicant with a response to his complaint on 2 July 2025. I consider that the response dated 22 May 2025 was in fact an outcome to the complaint, because provided an answer to all outstanding issues and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant’s complaint. This is sufficient in my view to demonstrate that the IC has complied with the requirements of section 165(4). The fact that the Applicant does not agree with the outcome does not render it wrong in law.

24. It appears to me therefore that there are no further appropriate steps which the IC ought reasonably to take to progress the complaint. In making this decision I have given significant weight to the view of the IC as the expert regulator that there are no further appropriate steps he should have taken.

25. The outcome sought by the Applicant in the Application relates to the setting aside of certain decisions by CICB and providing a fresh assessment of his mother. These are not outcomes which the Tribunal has the powers to grant under section 166 of the DPA 2018 . Its powers are limited to ordering the IC to progress its handling of the Applicant’s complaint.

26. The outcome sought by the Applicant is also, in effect, challenging the substantive outcome of the complaint to the IC. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision. In an application under section 166 , the Tribunal has no power to direct the IC to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the UK GDPR. I also agree with the IC’s position that it is not a court or ombudsman and that orders for compliance need to be sought through civil action. Accordingly, I find that the Tribunal does not have the power to grant the outcomes sought.

27. Because I consider that there was an outcome determining the complaint and that there were no further appropriate steps which should be taken, I find the complaint has already been determined and therefore the Tribunal has no jurisdiction over it. I am also satisfied that there is no reasonable prospect of the case, or any part of it, succeeding because the outcome sought by the Applicant is not something which is within the Tribunal’s power to grant.

28. The proceedings are therefore struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with them and under Rule 8(3)(a) because there is no reasonable prospect of them succeeding.