Shervin Sameni Fallah v Information Commissioner

1. This case concerns the handling of a complaint made on 20 August 2025 to the Respondent in relation to a third party’s handling of a subject access request that the Applicant had previously made. The Applicant followed up the complaint with further correspondence providing additional information to the Respondent on the 22 December 2025 and the 6 January 2026.

2. The Applicant lodged a Notice of Appeal dated 7 January 2026 with the Tribunal seeking an order to require the Respondent to take “appropriate steps to progress, investigate and determine the complaint” as well as inform the Applicant of the progress or outcome of the complaint.

3. On the 13 January 2026 the Respondent contacted the Applicant for information regarding the subject access request and the response of the third party. The Applicant replied providing this to the Respondent on the same day.

4. The Respondent wrote to the Applicant on 14 January 2026 providing an outcome to the complaint, indicating that they had also written to the third party. The Applicant acknowledged the response on the same day.

5. The Respondent applied on the 26 January 2026 for the case to be struck out, if the Applicant did not follow the invitation to withdraw the application. The strike out application was made on the basis that the Applicant’s application has no prospect of success under Rule 8(3)(c) of the relevant Tribunal Rules.

6. The Applicant responded to the strike out application on the 26 January 2026 and stated that the “ appeal relates to the Information Commissioner’s handling of my GDPR complaint ... I have engaged with the ICO process as set out in the attached materials and maintain that the ICO has not adequately addressed the seriousness, urgency, or evidentiary issues raised ”.

7. Section 166 of the DPA 2018 provides the Tribunal with a narrow power that is explicitly limited to the supervision of procedural matters rather than substantive ones. The Upper Tribunal in the judgment of Killock & Veale & others v Information Commissioner stated at [74] that “ [2021] UKUT 299 (AAC) [i]t is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals ”

8. Section 166 does not provide any power for considering or reviewing the substance of any decision made by the Commissioner. Even where s.166 is engaged, the powers of the Tribunal are limited to procedural ones, such as requiring the Commissioner to take appropriate steps to provide the required notification. Even as regards what such ‘appropriate steps’ are the Commissioner benefits from a very wide discretion with caselaw confirming that this even “ allows the Commissioner to decide, after investigating a complaint to a limited extent, that no further action should be taken ” whether the complaint is spurious or not (see paragraphs 66 and 70 of R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin) ). It is established that neither s.165 nor s.166 of the DPA 2018 require the Commissioner “determine the merits of complaints” (See para 78, R (on the application of Delo) v Information Commissioner and Wise Payments Ltd . [2023] EWCA Civ 1141 )

9. Furthermore, there is a significant difference between cases where the Commissioner has provided an ‘outcome’ and ones where the ‘outcome’ is still pending. An outcome is a conclusive determination that marks the end of the Commissioner's handling of the relevant complaint (See para 60 of Smith v Information Commissioner ). [2025] UKUT 74 (AAC)

10. Where an outcome has been provided the scope of s.166 is necessarily much more limited. As noted in Killock at para 87 “ s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate "steps to respond" and not with assessing the appropriateness of a response that has already been given (which would raise substantial Regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question ”.

11. This position has since been reinforced by the case of Delo at the High Court in para 130 where it was ruled that “ if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court ”.

12. Once an outcome has been issued there is no power for the Tribunal to seek to order the Respondent to take some ‘appropriate step’ retrospectively especially where such a step could lead to a substantive change in outcome. The appropriate forum for challenging whether steps taken to investigate the complaint were appropriate or whether relevant evidence was considered or taken into account as regards cases where an outcome has been provided is Judicial Review in the High Court.

13. The Respondent provided a substantive outcome to the Applicant’s complaint on the 14 January 2026. Albeit that prior to that there was, by the Respondent’s own admission, delay in dealing with the complaint. The Tribunal notes that the progress notification obligation under s.166(1)(b) expired on 20 November 2025 without it seems any communication being made. Had this matter come before the Tribunal prior to 14 January 2026 there is no doubt that there would have been no reasonable grounds for this strike out application to be made.

14. Consequently, though the Applicant may not like the manner in which the complaint was handled, there can be no question that the complaint has not been responded to.

15. If the Applicant contests the legality and/or reasonableness of the Respondent’s actions as regards the now completed process of this complaint, then the correct forum is the High Court.

16. If the Applicant wishes to seek to enforce a rectification claim against the third-party controller this must be done by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA 2018.

17. In light of the above there is no reasonable prospect of the Applicant being able to successfully argue that the Tribunal should make an order pursuant to the power found in s.166(2) DPA 2018. Because the procedure for dealing with the complaint is complete and the substantive content and outcome of the Respondent’s investigation is out of scope. It is therefore ordered that this case is struck out under Rule 8(3)(c). Signed: Judge T Barrett Date: 2 February 2026