Tribunal strikes out s.166 DPA 2018 application over medical records dispute

The First‑tier Tribunal has rejected a complaint against the Information Commissioner (ICO), deeming that an application under section 166 Data Protection Act 2018 against an ICO finding was seeking a ruling on the substantive merits of a complaint when s166 should only be applied to procedural defects in an ICO investigation.

Consequently, it concluded that the Tribunal lacked jurisdiction and that the claim had no reasonable prospects of success.

The case centred on Sharon Hobbs’ long‑running dispute with Goldsworth Medical Practice over whether she had been provided with all of her medical records following a subject access request. After several rounds of correspondence, the Information Commissioner determined - first in February 2025 and again on review in June 2025 - that the Practice had complied with its data protection obligations.

In her application, Ms Hobbs sought written confirmation from both the ICO and her GP practice explaining what had happened to her medical notes. The Tribunal emphasised that section 166 DPA 2018 is a narrowly drawn, procedural remedy, available only where the Commissioner has failed to take appropriate steps in handling a complaint—such as not updating the complainant on progress or failing to issue an outcome within statutory timescales.

The Tribunal found that that as the ICO had issued an outcome (February 2025) and had issued a review outcome (June 2025), the procedural requirements under s.166(4) were satisfied. Therefore, the Tribunal could not intervene simply because the Applicant disputed the merits of the ICO’s conclusions.

Tribunal Judge Arnell stressed that s.166 does not allow the Tribunal to:

• reconsider the substantive data protection issues;
• require the ICO to reopen or expand its investigation;
• determine whether the GP Practice breached the GDPR; or
• order the disclosure of medical records.

The judgment reiterated that challenges to the outcome of an ICO complaint cannot be reframed as s.166 applications. Instead, if Ms Hobbs believes her GP failed to disclose all personal data to which she is entitled, the correct remedy lies with the courts under section 94(11) DPA 2018, rather than the Tribunal, the judge said.