The First Tier Tribunal (FTT) has found that the Information Commissioner failed to comply with his statutory duty to update a complainant on the progress of her data protection complaint within the timescales required by the Data Protection Act 2018 but declined to order any remedy after concluding that the ICO ultimately provided a final outcome.
In Katherine Bishop v Information Commissioner [2026] UKFTT 402 (GRC), the Tribunal determined that although the Commissioner breached section 166(1)(b) DPA 2018 by failing to inform the applicant of progress within three months, the defect had been remedied by the time the matter came before it.
Ms Bishop had submitted a Subject Access Request (SAR) to Wirral University Teaching Hospital NHS Foundation Trust in July 2024 seeking CCTV and body‑worn camera footage relating to her. After what she considered to be significant delays by the Trust, she complained to the ICO on 5 September 2024
The ICO wrote to her on 20 January 2025 stating that no further action would be taken at that stage, but would keep the matter on file. Ms Bishop immediately challenged this, arguing that the Commissioner had failed to act on an alleged GDPR breach.
She filed a fresh complaint on 25 January 2025 and, receiving no update for months, applied to the Tribunal in September 2025 seeking an order requiring the ICO to “take appropriate steps” under section 166 DPA 2018. She argued that the Commissioner had failed to investigate, failed to progress her complaint, and failed to provide any outcome.
The ICO applied to strike out the claim, arguing that the application was out of time that section 166 provides only procedural, not substantive, remedies. The Commissioner also argued that he has wide discretion over whether and how to investigate complaints and that an outcome had already been given on 20 January 2025, removing any basis for enforcement under section 166.order. The ICO also contended that a complainant dissatisfied with the "merits" of an outcome must seek judicial review, not a section‑166 order.
Ms Bishop argued that the ICO had not taken “appropriate steps” within the meaning of section 165, that the Commissioner had failed to conduct any investigation before issuing the January 2025 letter and that the Commissioner had admitted administrative failings. She also argued that no outcome had ever been issued on her January 2025 complaint and that she submitted medical evidence supporting an extension of time.
Tribunal’s findings
The Tribunal rejected the ICO’s argument that the January 2025 correspondence constituted a statutory “outcome”. It noted that the ICO later apologised for failing to progress the complaint, that the Commissioner acknowledged administrative oversight in October 2025, all key correspondence used the original complaint reference, indicating a continuous investigation; and the ICO resumed investigation steps in late 2025, including contacting the Trust
The Tribunal concluded that the complaint “remained under investigation” from 5 September 2024 until 26 November 2025, when the ICO finally issued an updated and substantive outcome. Because no progress updates or outcomes were provided within three months of receipt of the complaint, the Commissioner had breached his statutory duty under section 166(1)(b) DPA 2018
However, as section 166 is solely a procedural mechanism, not a means to challenge the substance of ICO decisions, and as an outcome had been provided on 26 November 2025 (finding the Trust had infringed data‑protection obligations but had since complied), the Tribunal concluded that the Commissioner had now taken “appropriate steps” and no order was needed.
The decision reinforces that section 166 DPA 2018 is strictly procedural and is only available where the ICO has failed to progress or update a complaint, not where a data subject disputes the merits of the Commissioner’s actions or conclusions. Administrative delay by the ICO, even acknowledged delay, will not automatically result in a Tribunal order if the Commissioner ultimately provides an outcome before the Tribunal determines the application.
