Tribunal strikes out data protection claim

David Phillips vs Information Commissioner – First-tier Tribunal – [2025] UKFTT 307 (GRC) – Case Summary

The First-tier Tribunal (General Regulatory Chamber) delivered a decision on 12 March 2025, striking out the proceedings initiated by David Phillips against the Information Commissioner. The Tribunal, presided over by Tribunal Judge Hazel Oliver, concluded that there was no reasonable prospect of the applicant's case succeeding, thus invoking Rule 8(3)(c) of the Tribunal Procedure Rules 2009.

The case centred on an application by Phillips under section 166(2) of the Data Protection Act 2018 (DPA), seeking an order related to a complaint he had made to the Information Commissioner. The complaint involved alleged data protection failings by Cardiff and Vale University Health Board.

Phillips argued that the Information Commissioner failed to respond appropriately to his complaint, which was initially filed on 18 May 2024 and assigned the case reference IC308299-S6B1. The Commissioner had responded on 6 September 2024, indicating the complaint was outside its regulatory remit and could not be re-opened. Phillips subsequently sought further clarification, which led to procedural confusion.

The Tribunal noted that under section 166 of the DPA, its powers are strictly limited to addressing procedural issues, rather than evaluating the merits of a complaint. This was supported by several precedents, including Killock v Information Commissioner [2022] and R (Delo) v Information Commissioner [2023], which reinforced the procedural nature of section 166 applications.

The Information Commissioner contended that the Tribunal lacked jurisdiction to grant the remedies sought by Phillips, as they pertained to substantive issues outside the scope of section 166. The Commissioner argued that the application should be struck out due to this jurisdictional limitation.

Phillips' application to the Tribunal sought a response to his email dated 8 September 2024, as well as explanations regarding the applicability of Article 16 of the GDPR to his case. Although the Commissioner eventually responded to his email in February 2025, the Tribunal found that the procedural issues had been resolved and that there were no further procedural failings to address.

The Tribunal concluded that Phillips' application was essentially an attempt to challenge the substantive outcome of his complaint, a matter beyond its procedural jurisdiction. Consequently, the Tribunal determined there was no reasonable prospect of success and struck out the proceedings.

Learn More

For more information on data protection, see BeCivil's guide to English Data Protection Law.