The First-tier Tribunal has struck out an application under section 166 of the Data Protection Act 2018 after finding that the Information Commissioner's October 2024 outcome letter was a valid outcome even though the ICO subsequently changed its view on the lawful basis for the processing complained of.
In Warner v Information Commissioner [2026] UKFTT 1198 (GRC), Judge Armstrong-Holmes granted the Commissioner's strike-out application under Rule 8(2) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, holding that the tribunal had no jurisdiction. The Commissioner did not attend the hearing on 14 August 2026 and relied on written submissions. Roy Warner, the applicant, appeared in person.
Warner complained to the ICO on 11 June 2024 about Waddesdon Estates LLP, which had photographed him in connection with the service of court documents and refused his request for erasure. More than three months later no case officer had been assigned. When Warner telephoned the ICO helpline in September 2024 to say he intended to apply to the tribunal, he was told a case officer was likely to be allocated within a couple of weeks. He applied to the tribunal on 10 October 2024, the day after the ICO issued its outcome, although the tribunal did not send the application to the Commissioner until April 2025.
Section 165 DPA 2018 gives data subjects the right to complain to the Commissioner about an alleged infringement of the UK GDPR. Section 166(1) applies where the Commissioner fails to take appropriate steps to respond to a complaint, fails to inform the complainant of progress or outcome within three months, or fails to do so during a subsequent three-month period.
Under section 166(2) the tribunal may order the Commissioner to take appropriate steps or to inform the complainant of progress or outcome within a specified period. Article 6(1)(e) UK GDPR provides a lawful basis where processing is necessary for a task carried out in the public interest or in the exercise of official authority, and Article 6(1)(f) where processing is necessary for the controller's legitimate interests.
The ICO's outcome of 9 October 2024 accepted the LLP's explanation, given through its solicitors, that the photograph was taken in the performance of a public task, namely the administration of justice, as evidence of service of formal process, and that none of the Article 17(1) erasure grounds applied. The case officer said the ICO was satisfied the personal data was being handled appropriately and closed the case. A review on 25 October 2024 upheld the outcome.
On 4 June 2025, after the application had reached the Commissioner, a second reviewing officer reconsidered both the complaint and the first review and took a different view, concluding that the correct basis the LLP might rely on was legitimate interests rather than public task. The officer said the taking of the photograph as evidence of service was likely not to have infringed the Act and that this might not change the outcome, but wrote to the LLP with compliance advice and reminded Warner of his right to bring proceedings against the organisation and to complain to the Parliamentary and Health Service Ombudsman.
Warner argued that he was not seeking a merits appeal but that the Commissioner had never delivered a procedurally sufficient outcome. The letters were vague, contradictory and inconsistent, and the shift from public task to legitimate interests showed confusion rather than a clear and final determination, so the question whether appropriate steps had been taken under section 166(1)(a) remained live.
Reviewing Killock v Information Commissioner [2021] UKUT 299 (AAC), R (Delo) v Information Commissioner in the High Court and Court of Appeal, Cortes v Information Commissioner and Smith v Information Commissioner [2025] UKUT 74 (AAC), the judge said the tribunal's powers under section 166 are limited to procedural failings and that, where an outcome has been produced, the scope for finding that an appropriate step has been omitted is limited given the Commissioner's wide discretion.
Armstrong-Holmes found that the 9 October 2024 email was an outcome for the purposes of section 166, expressing the Commissioner's view that the photograph was being processed lawfully. The later review did not change that position. It left intact the Commissioner's view that the LLP had a lawful basis under Article 5(1)(a) and simply moved the Article 6 basis from public task to legitimate interests.
Given that the photograph was taken in connection with service of documents in civil proceedings, the judge said it was "not entirely surprising" that both the LLP and the Commissioner initially treated it as a public task, since a party assisting the court might consider itself to be exercising official authority vested in it by the court, even if that was not the true position.
The fact that the Commissioner reviewed the matter a second time, having already issued an outcome and one review, demonstrated full and proper consideration of the complaint, the judge said, adding that the Commissioner was not required to conduct a further review at all. This was not a case of the kind contemplated in Smith, where an outcome has been provided but an appropriate step omitted. The tribunal had no jurisdiction and the application was struck out.
