Sharon Hobbs v Information Commissioner

1. These proceedings concern the Applicant’s application for an order pursuant to section 166(2) of the Data Protection Act 2018 (“DPA 2018”).

2. On 02 February 2026 the Information Commissioner (“the Commissioner”) applied to strike out the application pursuant to Rule 8(2)(a) and/or Rule 8(3)(c) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“Rule”) on the grounds that this Tribunal lacks jurisdiction and/or there are no reasonable prospects of the application proceeding.

3. On 12 February 2026 the Tribunal issued directions providing the Applicant with an opportunity to make any representations about the application to strike out by no later than 27 February 2026.

4. The Applicant provides submissions in response to the application to strike out on 21 February 2026. Although not expressly stated by the Applicant within those submissions it is clear the Applicant resists the application.

5. In accordance with Rule 32(3) I am not required to hold an oral hearing to determine this application. I have the benefit of submissions from both parties and as such I am satisfied I was satisfied I could proceed to determine this application on the papers. Background

6. The Applicant submitted a complaint to the Commissioner on 09 September 2024. The complaint raised concerns with the way in which Goldsworth Medical Practice had responded to her Subject Access Request and handled her personal data.

7. On 10 February 2025 the Commissioner issued an outcome concluding that, on the balance of probabilities, Goldsworth Medical Practice had provided the Applicant with all of her medical records and had complied with its data protection obligations. They advised the Applicant that is she still considered parts of her medical records were missing, she could make an application to the court under section 94(11) DPA 2018.

8. Following the Applicant providing further information to the Commissioner, further steps were taken by the Commissioner, at the conclusion of which the Commissioner wrote to the Applicant on 14 March 2025 confirming the original outcome.

9. The Applicant sought a review of the Commissioner’s outcome. On the 03 June 2025, the Commissioner provided a review outcome to the Applicant. This concluded the Commissioner considered the Applicant’s complaint had been handled appropriately, upheld the initial outcome explaining the reasons for the conclusions reached and confirmed no further action would be taken on the complaint.

10. The Applicant initially submitted an incomplete application to the Tribunal on the 11 November 2025. Following the Tribunal issuing Directions, the Applicant filed an application using the correct form on 02 January 2026.

11. The Applicant sets out the remedy they are seeking as follows: “[…] I would like in writing from the information commissioners office an explanation in writing, from my doctors surgery to what has happened to me medical note[…]” The Commissioner’s application to strike out

12. The Commissioner submits that the Tribunal’s jurisdiction is limited in this case to a consideration of any procedural failures by the Commissioner to progress a complaint. That an order may only be made it the Tribunal is satisfied the Commissioner has failed procedurally to comply with section 166(1) DPA 2018. They submit they have taken appropriate steps to investigate and respond to the Applicant’s complaint; that an outcome was provided; that a review was carried out; and there is therefore no basis on which the Tribunal may make an order pursuant to section 166(2) DPA 2018.

13. The Commissioner submits the Tribunal has no jurisdiction to consider the Applicant’s application and/or the application has no realistic prospect of success. The Applicant’s Response

14. The Applicant’s submissions in reply do not acknowledge the issues raised regarding the scope and purpose of s.166 DPA 2018 nor the Tribunal’s jurisdiction. The Applicant submits they want proof that they have received all of their medical records and details the reasons why she requires access to the information sought. The Applicant details the impact that not possessing this information has had and continues to have on her and submits withholding the information from her is a breach of DPA 2018 and General Data Protection Regulations (“GDPR”). The Law

15. Section 165 DPA 2018 provides for an individual to complain to the Commissioner if they consider there has been an infringement of GDPR and/or Parts 3 or 4 of DPA 2018. The relevant parts provide as follows: (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act . (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a) take appropriate steps to respond to the complaint, (b) inform the complainant of the outcome of the complaint, (c) inform the complainant of the rights under section 166 , and (d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a) investigating the subject matter of the complaint, to the extent appropriate, and (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with [F2a] foreign designated authority is necessary.

16. Individuals may make a complaint to the First-tier Tribunal for an order requiring the Commissioner to take appropriate steps pursuant to section 166 DPA 2018. The focus of section 166 DPA 2028 is not the merits of the Applicant’s complaint to the Commissioner nor the substantive outcome of the Commissioner’s investigation. The Tribunal can only make an order to progress an individual’s complaint if one of the conditions at section 166(1) (a), (b) or (c) DPA 2018 is met.

17. The relevant parts of section 166 DPA 2018 provide as follows: 1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the [F1UK GDPR], the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. 2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order. 3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order.

18. The Commissioner provides a detailed summary of the relevant authorities regarding the focus of section 166 DPA 2018, the extent of the Tribunal’s jurisdiction, the broad discretion of the Commissioner and the meaning of “appropriate steps” within their Response. I agree with the Commissioner’s submission on the law. It is not my intension to rehearse those submissions here in full, but a summary of the relevant points is as follows: a. Section 166 DPA 2018 is forward looking provision concerned with remedying procedural defects. The Tribunal is tasked with specifying appropriate steps to respond but not with assessing the appropriateness of a response. b. The Commissioner has broad discretion as to how he investigates complaints and is the expert regulator. The tribunal does not have an oversight role over the Commissioner’s exercise of his functions or his internal processes. The Commissioner’s view carries weight but is not necessarily determinative. c. It is for the tribunal to decide, applying an objective test, if an ‘appropriate step’ has been omitted, but in practice that is unlikely to be the case where an outcome has been issued. That is because section 166 is procedural and cannot be used effectively as a back door route to obtaining a remedy that should be pursued by making a claim against the data controller or by judicial review of the Commissioner. Conclusions

19. In determining this application, I have had due regard to the Overriding Objective (Rule 2), the statutory framework, relevant authorities and both party’s submissions.

20. The Applicant does not dispute that the Commissioner provided an outcome on 10 February 2025. Nor does she dispute that the Commissioner provided a review outcome on 03 June 2025. Whilst the Commissioner failed to provide the Applicant with information about progress of the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, I am satisfied the Applicant has received an outcome. Therefore the need for any order to remedy this failure is negated.

21. I have given significant weight to the view of the Commissioner as the expert regular that there are no other appropriate steps they should have taken. I am satisfied there are no further steps the Commissioner ought reasonably to have taken to progress the Applicant’s complaint. I am satisfied that the outcome and the review outcome demonstrate the Commissioner has complied with the requirements of section 166(4) DPA 2018.

22. It is clear that the issue under complaint is of great importance to the Applicant. However, it is also evident that the Applicant is challenging the substantive outcome of the complaint. The outcome sought by the Applicant in their application do not fall within the remit of the Tribunal’s powers in this case. Section 166 DPA 2018 is limited to narrow procedural issues. The Tribunal has no power to direct the Commissioner to investigate, in a particular way or at all, to take enforcement action to secure compliance with a request or determine whether or not there has been a breach of the GDPR.

23. Further, as was explained to the Applicant by the Commissioner in their outcome, if the Applicant believes Goldsworth Medical Practice have failed to provide personal data she is entitled to obtain, then the appropriate avenue for remedy may be to seek an order from the court under section 94(11) DPA 2018. I understand the reference to section 94(11) DPA 2018 to have been an error and was intended to refer to section 167 DPA 2018 (Compliance Orders). For the sake of clarity, this Tribunal does not have jurisdiction to consider applications under section 167 DPA 2018.

24. Accordingly, I find that there has been an outcome, there were no further appropriate steps to be taken, the complaint has been determined and consequently the Tribunal does not have jurisdiction. I am also satisfied there is no reasonable prospect of the application or any part of it succeeding because the outcomes sought by the Applicant are not within the Tribunal’s power to grant.

25. The application is therefore struck out pursuant to Rule 8(2)(a) and Rule 8(3)(c).