Section 166 application succeeds as tribunal finds ICO left complaints unresolved

The First-tier Tribunal (General Regulatory Chamber) has ordered the Information Commissioner to take further steps and issue a written outcome on a data protection complaint after finding that the regulator invited the complainant to return if dissatisfied with the department's response, received her further material but then did not demonstrate that it had concluded the complaints.

In Dhanwantee Hooper v The Information Commissioner [2026] UKFTT 1102 (GRC), Tribunal Judge Peri Mornington allowed an application under s.166(2) of the Data Protection Act 2018 and directed the Commissioner, within 28 days, to take further appropriate steps to respond to the complaints and to provide the applicant with a written outcome.

Section 165 of the DPA 2018 gives data subjects the right to complain to the Commissioner about infringements of data protection legislation, and s.166 allows the tribunal to order the Commissioner to progress a complaint where he fails to take appropriate steps to respond, fails to provide progress or outcome information within three months, or fails to provide such information in a subsequent three-month period where consideration is not concluded.

The jurisdiction is limited to procedural compliance andconfers no right of appeal against the Commissioner's assessment of a complaint and does not permit the tribunal to determine whether the underlying allegations against a controller are well founded.

Ms Hooper complained to the ICO in July 2025 about the Department for Work and Pensions (DWP) and the Child Maintenance Service's (CMS) handling of her personal data.

It was common ground that the Commissioner failed to provide progress information within the initial three-month period. After apologising for the delay in December 2025, a case officer wrote to her on 7 January 2026 explaining that the ICO had asked DWP/CMS to review their handling of her subject access requests and respond to her other concerns, telling her she could forward the response to the ICO for further review if dissatisfied.

The Commissioner argued that the December and January correspondence cured any procedural deficiency and rendered the application academic, and applied for strike out on the basis the application had no prospect of success. Judge Roper refused that application in April 2026, observing that there "may be an argument about whether the Commissioner's investigation of the Complaints is ongoing".

The evidence showed DWP/CMS did respond following the ICO's intervention, Ms Hooper remained dissatisfied, and consistent with the course the ICO itself had identified, she returned the response to the regulator and requested further consideration.

Judge Mornington found the January 2026 correspondence did not read as a final outcome, and the bundle contained no evidence that the Commissioner thereafter provided a concluded outcome or informed her that his consideration had formally ended. The evidence instead disclosed "an unresolved complaint process in which the IC invited the Applicant to return with further information if dissatisfied, the Applicant did so, but no subsequent concluded outcome is evidenced".

Having invited her back, Judge Mornington held, the Commissioner was required either to continue taking appropriate steps and inform her of progress, or to provide a concluded outcome. On the evidence he had done neither, this constituted a procedural defect capable of remedy under s.166. The judge stressed that s.166 is not a mechanism for supervising the quality of the Commissioner's investigation, and the appropriate remedy was not to direct how the complaints should be determined but to require the Commissioner to complete the statutory process.

Successful s.166 applications are rare as the tribunal routinely strikes them out where the ICO has issued any form of response. The finding that a "come back to us if dissatisfied" letter keeps the complaint open and the statutory clock running is unusual.