Section 166 application dismissed after ICO opens fresh investigations into school, council and diocese data sharing

The First-tier Tribunal (General Regulatory Chamber) has dismissed an application under section 166(2) of the Data Protection Act 2018 against the Information Commissioner, despite finding that the regulator's original response to a school employee's data sharing complaint was not an outcome to the Applicant's complaints, because a series of further investigations and outcome letters issued after proceedings began had answered all outstanding issues.

Judge Harris, deciding the case (Kathryn Fox v The Information Commissioner [2026] UKFTT 992 (GRC) without a hearing in a decision issued on 6 July 2026, found that the Commissioner's April 2025 responses to Kathryn Fox, an employee of St Patrick's Catholic Voluntary Academy in Sheffield, focused on the data protection obligations of the School only and did not deal with the wider context of information sharing by other parties, even though her complaint had made clear that Sheffield Local Authority, Hallam Diocese and St Clare Catholic Multi Academy Trust were also involved.

Fox complained to the ICO in December 2024 that a governor of the school had shared personal information about her with the local authority rather than directing it to the school, in breach of the school's policies, that the information was then shared among several people at the authority and passed to the diocese, which took steps to carry out an investigation, and that following a decision that the school would join the trust, her personal information was also shared with the trust's senior management. The ICO's case officer responded in April 2025 that the school appeared to have met its data protection obligations and that no further action would be taken.

Fox applied to the tribunal seeking an order for the ICO to look at her complaint correctly and address the different areas where she felt her data, privacy and confidentiality had been breached, arguing that the regulator had addressed only the issue with the school and not the individual governor, the local authority, the diocese or the trust.

The Commissioner opposed the application and sought to strike it out, arguing that section 166 is a procedural remedy only which cannot be used to interrogate the substance of an outcome, and that the tribunal had no jurisdiction because an outcome had already been sent in April 2025. Judge Buckley refused the strike-out in December 2025, finding it at least arguable that no outcome had been issued in relation to some parts of the complaint, since the outcome letter appeared to deal only with allegations against the school.

The application ultimately failed because of steps the ICO took after proceedings were issued. Following a case review offered in October 2025, the regulator's reviewing officer concluded that Fox's concerns warranted further consideration and investigation of the disclosure of her personal data between the governor, the local authority, the diocese and the trust, reallocated the complaints and carried out further work, opening separate case references for the local authority and diocese complaints.

Between November 2025 and February 2026 the ICO issued a sequence of outcome letters. In relation to the school, the case officer concluded it appeared likely that the school could justify the sharing of Fox's personal data with the trust and the diocese as necessary and proportionate, but was concerned that opportunities were missed by the school to provide more clarity around the handling of her personal data, and provided the school with guidance asking it to review and strengthen its data protection policies, procedures and staff training in relation to the right to be informed.

A further outcome in February 2026 found that the governor had likely received the information in their governance role, making the school the data controller when the information was shared with Ofsted and the local authority, and that the school likely had an appropriate lawful basis and condition for the sharing.

On the local authority complaint, the ICO wrote to the authority providing guidance on its data protection obligations and requiring it to review its handling of the personal data and give Fox a direct response within 28 days, later chasing the authority when no response arrived. On the diocese complaint, the ICO concluded the diocese could likely justify the sharing as necessary and proportionate but was again concerned about missed opportunities for transparency, and issued guidance asking it to strengthen its policies, procedures and training.

Section 165 of the DPA 2018 gives data subjects the right to complain to the Commissioner about infringements of data protection legislation and requires the regulator to take appropriate steps to respond and inform the complainant of the outcome. Section 166 allows the tribunal to order the Commissioner to take appropriate steps to respond to a complaint or to inform the complainant of progress or outcome, but only where one of the conditions in section 166(1) is met.

The established authorities - Killock v Information Commissioner, R (Delo) v Information Commissioner, Cortes v Information Commissioner and Dr Michael Guy Smith v Information Commissioner - confirm that the tribunal's powers are limited to procedural issues rather than the merits or substantive outcome of a complaint, and that section 166 should not be used to obtain by the back door a remedy normally only available through a claim against the data controller or judicial review of the Commissioner.

Judge Harris found that the post-application responses, taken together, provided an outcome to all the key elements of the complaint, answered all outstanding issues and demonstrated that the Commissioner had considered whether other appropriate steps could be taken, satisfying the requirements of section 165(4). The fact that the applicant did not agree with the outcome did not render it wrong in law, and the judge gave significant weight to the view of the Commissioner as the expert regulator that no further appropriate steps should have been taken.

Because an outcome had been provided and no further appropriate steps remained, none of the conditions in section 166(1) were met and the application was dismissed.