Info Gov

The First‑tier Tribunal has struck out an application brought under section 166 of the Data Protection Act 2018 (DPA 2018) after finding that the challenge sought remedies outside the Tribunal’s jurisdiction and had no reasonable prospect of success.

In Mohammadreza Shahmirzadi v Information Commissioner [2025] UKFTT 1566 (GRC), Judge Peri Mornington ruled that the Tribunal could not consider the applicant’s attempt to compel the Information Commissioner to issue an enforcement notice against Companies House, order rectification and erasure, or investigate a claim for compensation relating to the publication of his residential address.

Mr Shahmirzadi had complained to the Information Commissioner in September 2025 after Companies House published his home address on the public register. The ICO investigated and issued an outcome on 26 September, concluding that Companies House appeared to be complying with its data protection obligations and had explained the steps required for the applicant to suppress the address.

The applicant subsequently sought an order from the Tribunal requiring the Commissioner to take further action, including compelling Companies House to remove the address without charge.

Judge Mornington emphasised that section 166 DPA 2018 provides only a “procedural remedy” where the Commissioner has failed to take appropriate steps to respond to a complaint or failed to provide progress updates within the statutory timeframe.

Citing established authority including Scranage v ICO and Killock v ICO, the Tribunal reiterated that section 166 does not permit challenges to the merits or substantive outcome of an ICO investigation.

The judge noted that the ICO had investigated the complaint, communicated with both the applicant and Companies House, expedited the case when requested, and provided an outcome within days. As such, none of the statutory conditions for a section 166 order were met.

The Tribunal found that the applicant was seeking to challenge the ICO’s substantive conclusions and to obtain remedies - such as enforcement action and compensation - that fall outside the Tribunal’s powers under section 166.

Judge Mornington concluded that the application had “no reasonable prospect” of succeeding and struck it out under rule 8(3)(c) of the Tribunal Procedure Rules.

Also in this section

May 26, 2026

Key Data Protection Issues for Automated Recruitment in the Public Sector

The need to recruit faster in a competitive market, the need to minimise costs in the recruitment process, and the need to secure the best candidate quickly, makes the use of AI an appealing option for any employer including public bodies. But there are pitfalls for the unwary write David Leach and Charlotte Smith.
May 08, 2026

Schools warned over AI blackmail threat as guidance urges rethink on pupil images

Schools across the UK are being urged to review or remove identifiable photographs of pupils from their websites and social media accounts, following warnings that criminals are using artificial intelligence tools to manipulate those images into child sexual abuse material (CSAM) and then threaten to release it unless a ransom is paid.
Apr 28, 2026

AI in Education: Why Data Protection Must Come First

Artificial Intelligence promises a lot. It can undoubtedly do amazing things. But secretly (or maybe not so secretly), it also makes us slightly nervous. Adam Halsey looks at what this means for schools, and why data protection needs to sit at the centre of any decision to use AI.
Apr 22, 2026

Preparing for the new complaints regime

From 19 June 2026, all organisations acting as data controllers are required to have in place an effective process to enable individuals to raise complaints about how their personal data is handled. Ashleigh Dibb looks at what this will mean in practice.
Apr 17, 2026

When data protection doesn’t protect you

Recently, the Information Commissioner’s Office published the outcome of a criminal prosecution. The title? Just two names: Christopher Munro and William Chipoma. No explanation. No softening. No anonymity. And that, in itself, is a powerful lesson in how data protection law really works.

InfoGov Masthead Newsletter 800