Info Gov

The First‑tier Tribunal has struck out an application brought under section 166 of the Data Protection Act 2018 (DPA 2018) after finding that the challenge sought remedies outside the Tribunal’s jurisdiction and had no reasonable prospect of success.

In Mohammadreza Shahmirzadi v Information Commissioner [2025] UKFTT 1566 (GRC), Judge Peri Mornington ruled that the Tribunal could not consider the applicant’s attempt to compel the Information Commissioner to issue an enforcement notice against Companies House, order rectification and erasure, or investigate a claim for compensation relating to the publication of his residential address.

Mr Shahmirzadi had complained to the Information Commissioner in September 2025 after Companies House published his home address on the public register. The ICO investigated and issued an outcome on 26 September, concluding that Companies House appeared to be complying with its data protection obligations and had explained the steps required for the applicant to suppress the address.

The applicant subsequently sought an order from the Tribunal requiring the Commissioner to take further action, including compelling Companies House to remove the address without charge.

Judge Mornington emphasised that section 166 DPA 2018 provides only a “procedural remedy” where the Commissioner has failed to take appropriate steps to respond to a complaint or failed to provide progress updates within the statutory timeframe.

Citing established authority including Scranage v ICO and Killock v ICO, the Tribunal reiterated that section 166 does not permit challenges to the merits or substantive outcome of an ICO investigation.

The judge noted that the ICO had investigated the complaint, communicated with both the applicant and Companies House, expedited the case when requested, and provided an outcome within days. As such, none of the statutory conditions for a section 166 order were met.

The Tribunal found that the applicant was seeking to challenge the ICO’s substantive conclusions and to obtain remedies - such as enforcement action and compensation - that fall outside the Tribunal’s powers under section 166.

Judge Mornington concluded that the application had “no reasonable prospect” of succeeding and struck it out under rule 8(3)(c) of the Tribunal Procedure Rules.

Also in this section

Jul 13, 2026

ICO refreshes law enforcement subject access guidance following DUAA 2025

The Information Commissioner's Office has updated its detailed guidance on the right of access under part 3 of the Data Protection Act 2018, incorporating the changes made by the Data (Use and Access) Act 2025 to how competent authorities handle subject access requests for law enforcement processing.
Jul 07, 2026

Section 166 application dismissed after ICO opens fresh investigations into school, council and diocese data sharing

The First-tier Tribunal (General Regulatory Chamber) has dismissed an application under section 166(2) of the Data Protection Act 2018 against the Information Commissioner, despite finding that the regulator's original response to a school employee's data sharing complaint was not an outcome to the Applicant's complaints, because a series of further investigations and outcome letters issued after…

InfoGov Masthead Newsletter 800