Info Gov

The First‑tier Tribunal has struck out an application brought under section 166 of the Data Protection Act 2018 (DPA 2018) after finding that the challenge sought remedies outside the Tribunal’s jurisdiction and had no reasonable prospect of success.

In Mohammadreza Shahmirzadi v Information Commissioner [2025] UKFTT 1566 (GRC), Judge Peri Mornington ruled that the Tribunal could not consider the applicant’s attempt to compel the Information Commissioner to issue an enforcement notice against Companies House, order rectification and erasure, or investigate a claim for compensation relating to the publication of his residential address.

Mr Shahmirzadi had complained to the Information Commissioner in September 2025 after Companies House published his home address on the public register. The ICO investigated and issued an outcome on 26 September, concluding that Companies House appeared to be complying with its data protection obligations and had explained the steps required for the applicant to suppress the address.

The applicant subsequently sought an order from the Tribunal requiring the Commissioner to take further action, including compelling Companies House to remove the address without charge.

Judge Mornington emphasised that section 166 DPA 2018 provides only a “procedural remedy” where the Commissioner has failed to take appropriate steps to respond to a complaint or failed to provide progress updates within the statutory timeframe.

Citing established authority including Scranage v ICO and Killock v ICO, the Tribunal reiterated that section 166 does not permit challenges to the merits or substantive outcome of an ICO investigation.

The judge noted that the ICO had investigated the complaint, communicated with both the applicant and Companies House, expedited the case when requested, and provided an outcome within days. As such, none of the statutory conditions for a section 166 order were met.

The Tribunal found that the applicant was seeking to challenge the ICO’s substantive conclusions and to obtain remedies - such as enforcement action and compensation - that fall outside the Tribunal’s powers under section 166.

Judge Mornington concluded that the application had “no reasonable prospect” of succeeding and struck it out under rule 8(3)(c) of the Tribunal Procedure Rules.

Also in this section

Oct 14, 2026

ICO reprimands Met Police over unlawful data sharing

The Metropolitan Police Service (MPS) has been reprimanded by the Information Commission’s Office (ICO) after officers and staff unlawfully shared personal information through an unapproved third-party platform used to identify suspected shoplifters.
Oct 02, 2026

Campaigners invoke UK GDPR to challenge NHS Palantir platform

Campaign group 38 Degrees has coordinated legal objections from more than 44,000 people asking NHS England to stop the Federated Data Platform (FDP), which runs on Palantir software, from sharing, storing or using their health records, the Guardian has reported.
Sep 28, 2026

NHS staff suspended or removed from duty over access to Noah Woods' medical records

East Suffolk and North Essex NHS Foundation Trust (ESNEFT) has suspended or removed from active duty ten members of staff and reported itself to the Information Commissioner's Office after concerns that the medical records of three-year-old Noah Woods were viewed without a legitimate clinical reason following his disappearance.

InfoGov Masthead Newsletter 800