Marques v Information Commissioner: Tribunal confirms narrow scope of section 166 applications

The First-tier Tribunal has struck out an application by Jose Marques seeking to challenge the Information Commissioner's handling of his data protection complaint against Riverside Housing Association, confirming once again the limited jurisdictional scope of section 166 of the Data Protection Act 2018.

In Jose Marques v The Information Commissioner [2025] UKFTT 1230 (GRC), Judge Harris struck out the application on dual grounds: lack of jurisdiction under Rule 8(2)(a) and absence of reasonable prospects of success under Rule 8(3)(a).

The case arose from Marques's complaint to the Information Commissioner in September 2024 regarding Riverside Housing Association's alleged mishandling of his personal data, including unauthorised contact with Universal Credit and suspected alteration of email content. The Commissioner investigated and concluded in January 2025 that Riverside had complied with its data protection obligations, finding the data sharing with the Department for Work and Pensions was lawful.

Dissatisfied with this outcome, Marques sought internal review and threatened judicial review proceedings, citing the High Court's decision in R (Roberts) v Secretary of State for Work and Pensions [2025] EWHC 51 (Admin). The Commissioner maintained that the Roberts judgement was not relevant as it concerned DWP payment deduction processes rather than data sharing lawfulness. Following a review in April 2025 that upheld the original decision, Marques applied to the Tribunal seeking orders to set aside the Commissioner's decision and direct a fresh investigation.

Judge Harris's decision reinforces established jurisprudence on the narrow scope of section 166 applications. The judgement extensively references the Upper Tribunal's decision in Killock v Information Commissioner [2022] 1 WLR 2241, which established that tribunals have no power to deal with the merits of complaints or their outcomes under section 166. The provision is purely procedural, limited to situations where the Commissioner has failed to respond appropriately, provide progress updates, or inform complainants of outcomes within specified timeframes.

The Tribunal also drew upon Mostyn J's High Court judgement in R (Delo) v Information Commissioner [2023] 1 WLR 1327, subsequently upheld by the Court of Appeal, which confirmed the Commissioner's broad discretion in determining the scale and extent of investigations. The Commissioner can conclude matters by expressing a view on likelihood of infringement without making determinative findings.

Particularly significant was the Tribunal's application of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC), which noted that where an outcome has been produced, the scope for tribunals to find that appropriate steps have been omitted is extremely limited. This recognises both the procedural nature of section 166 and the Commissioner's wide regulatory discretion.

The judgement emphasises that section 166 cannot be used as a backdoor route to obtain remedies normally available only through judicial review or civil proceedings. Marques's acknowledgement that he was "not seeking to appeal the Commissioner's internal administrative handling, but rather the final outcome" proved fatal to his application. The appropriate route for challenging substantive decisions remains judicial review, whilst orders for compliance against data controllers must be sought through civil action under section 167.

This decision serves as a reminder that the First-tier Tribunal's jurisdiction under section 166 remains tightly constrained to procedural failings, with substantive challenges to the Commissioner's regulatory decisions requiring alternative legal avenues.