Fox v Information Commissioner: section 166 application fails after regulator addresses wider data-sharing complaints

The First-tier Tribunal (General Regulatory Chamber) has dismissed an application by Kathryn Fox to compel the Information Commissioner to progress her data protection complaint, holding that the regulator had, by the time of the decision, addressed every strand of her complaint about the handling and sharing of her personal data.

In Fox v Information Commissioner [2026] UKFTT 992 (GRC), decided without a hearing by consent, Judge Harris considered an application under section 166(2) of the Data Protection Act 2018. That provision permits a data subject to seek an order requiring the Commissioner to take appropriate steps in response to a complaint, but confers no power to revisit its substance.

Ms Fox, an employee of St Patrick's Catholic Voluntary Academy, had complained in December 2024 that a school governor shared her personal information with Sheffield Local Authority in breach of policy, that the authority passed it to Hallam Diocese, and that her data was subsequently shared with St Clare Catholic Multi Academy Trust. The Commissioner's initial responses in April 2025 concluded that the school had a lawful basis for its actions and that no further action would be taken.

Dissatisfied that only the school's conduct had been examined, Ms Fox applied to the tribunal. The Commissioner opposed the application and sought a strike-out, contending that section 166 is a purely procedural remedy that cannot be used as a back door to challenge an outcome already reached. Judge Buckley refused the strike-out in December 2025, finding it arguable that no outcome had been issued in relation to the governor's conduct or the local authority's role.

Judge Harris accepted that, at the point the application was made, the Commissioner's responses had focused on the school alone and did not amount to an outcome covering the wider information-sharing she had described. Taken together, they neither answered every outstanding issue nor demonstrated that other appropriate steps had been considered.

The position had since changed. Following the application and an internal review, the Commissioner reallocated the complaint and investigated the conduct of the school, the trust, the governor, the local authority and the diocese under separate references. Outcomes were provided in November 2025 and in January and February 2026, in each case with guidance issued to the relevant body but no requirement to take further action. The judge was satisfied that these responses, read together, addressed all the key elements of the complaint and discharged the Commissioner's duty under section 165(4). That Ms Fox disagreed with the outcome did not render it wrong in law.

Reaffirming the settled boundaries of the jurisdiction, the judge noted that the tribunal's role under section 166 is confined to procedural failings and does not extend to the merits or substantive outcome of a complaint. She drew on the Upper Tribunal in Killock, on Mostyn J and the Court of Appeal in Delo, and on the Upper Tribunal in Smith, for the propositions that the Commissioner enjoys a broad discretion over how complaints are investigated and that, once an outcome has been produced, the scope for finding an omitted step is limited. Significant weight was owed to the Commissioner as an expert regulator.

With an outcome delivered and no further appropriate step outstanding, none of the conditions in section 166(1) was met. The tribunal could not direct an investigation, order enforcement or determine whether a breach had occurred, remedies available only through civil action. The application was accordingly dismissed.