Jonathan Allweis v The Information Commissioner

I previously refused the Respondent’s application of 18th December 2025 to strike out the proceedings under Rule 8(3)(c) of The Tribunal Procedure (First-tier-Tribunal) (General Regulatory Chamber) Rules 2009 on 12th February 2026, as I was not satisfied, at that stage, that there was no reasonable prospect of the Applicant’s case succeeding. That refusal decision was sent to the parties on 6th March 2026.

On 26th March 2026, I granted permission for the Information Commissioner (“the Commissioner”) to file a supplementary response to the Applicant’s application for an order under section 166(2) of the Data Protection Act 2018 (“DPA 2018”) to progress his complaint. That supplementary response provided a chronology, dealing with events which took place after 18th December 2025, and averred that the Commissioner had provided the Applicant with an ‘outcome’ within the meaning of section 166(1) DPA 2018 on 23rd December 2025. Having read and considered that supplementary response and accompanying documents, I issued case management directions to the parties on 26th March 2026 which explained that I was reconsidering whether to strike out the application under Rule 8(3)(c), and the Applicant was given until 9th April 2026 to provide the Tribunal with any written representations in relation to the proposed striking out in compliance with Rule 8(4).

The Applicant provided the Tribunal with his written representations by way of a signed witness statement, which was signed and dated 27th March 2026. This was received by the Tribunal on the same date.

I have read and considered these representations, in addition to the previously submitted arguments advanced by both parties when I refused the Commissioner’s application to strike out the proceedings on 12th February 2026, and all of the other case papers which had been submitted before that point.

The Applicant submitted a complaint to the Information Commissioner (“the Commissioner”) on 21st March 2025 regarding the handling of his subject access request (“SAR”) of 7th February 2025 by the Solicitor’s Regulation Authority (“SRA”). He subsequently submitted an application to the Tribunal on 11th November 2025 for an order under section 166 of the Data Protection Act 1998 for the Commissioner to progress his complaint.

The Applicant’s SAR of 7th February 2025 had sought “access to all personal data held about [the Applicant] by the Solicitors Regulation Authority (SRA)”. On 11th August 2025, the SRA provided him with an outcome to his SAR, and a subsequent internal review, carried out by the SRA, at the request of the Applicant, concluded in a letter of 6th November 2025 that the Applicant had “been provided with the personal data we have concluded you are entitled under the right of access, and we have clearly set out the limited exemptions applied.”. The letter from the SRA concluded by stating that “While we remain committed to transparency and accountability, we are not able to revisit issues that have already been substantively addressed.”. The Applicant was then informed of the right to raise any concerns with the Commissioner or to take action in the courts, should he remain dissatisfied with the SRA’s handling of his personal data.

The Applicant made his complaint to the Commissioner on 21st March 2025, a number of months before he had received an outcome to his SAR and before that internal review had been carried out. It is understood that the Applicant nonetheless provided further supporting evidence and updates to the Commissioner on 24th March 2025, 27th March 2025, 2nd April 2025, 7th April 2025, 23rd April 2025, 30th April 2025 and 2nd May 2025.

On 15th May 2025, the Applicant spoke with a case handler via the Commissioner’s ‘Live Chat’ function. The case handler explained that the Commissioner was dealing with a backlog of complaints and that a case officer was yet to be allocated to his complaint. The case handler additionally raised a request for the case to be expedited. On the same date, a manager in the Commissioner’s Public Advice and Data Protection Complaints Service (PADPCS) wrote to the Applicant to explain that the Commissioner was dealing with “an unprecedented number of complaints at the moment, which means that it is taking longer than we would like to allocate your case to a Case Officer.”. That letter ended by stating “As your complaint came into the ICO on 21 March 2025, we would expect to be able to allocate your case in about 12 weeks.”.

The Applicant provided further supporting evidence for his complaint and updates on 24th July 2025, 31st July 2025 and 11th August 2025. However, as has already been referred to above, the SRA provided the Applicant with an outcome to his SAR on 11th August 2025.

On 31st August 2025, the Applicant wrote to the Commissioner seeking guidance in relation to the outcome of his complaint. Thereafter, the Applicant submitted an updated complaint to the Commissioner, regarding the SRA’s handling of his SAR on 3rd September 2025. What then followed can only be described as a deluge of further material being provided to the Commissioner by the Applicant on 10th September 2025, 7th October 2025, 9th October 2025, 10th October 2025, 11th October 2025, 16th October 2025, 19th October 2025, 20th October 2025, 21st October 2025, 22nd October 2025, 29th October 2025, 30th October 2025, 6th November 2025, 7th November 2025, 8th November 2025, 10th November 2025 and 11th November 2025.

The Applicant submitted his application to the Tribunal on the same date as the last of those dates referred to above, namely 11th November 2025. His completed GRC3 form states that the Applicant is seeking an order for the following:

The Applicant sent further material regarding his complaint to the Commissioner on 17th November 2025, 24th November 2025, 26th November and 27th November 2025.

On 2nd December 2025, the Applicant’s complaint was allocated to a case officer, who then wrote to the Applicant to inform him of this. Following that notification, the case officer wrote to the Applicant again on the same date, stating as follows:

The Applicant subsequently responded to the case officer’s request on the same day, providing a summary of his concerns.

That was the chronology of events as at the time of the Commissioner’s original response and application to strike out the proceedings on 18th December 2025. However, the supplementary response of 10th March 2026 and accompanying annexes (1 to 3) provide a further chronology covering what took place after 18th December 2025. This commenced with the Commissioner’s case officer writing to the Applicant on 23rd December with an outcome to his complaint. The case officer explained that the view taken was that the “SRA has more work to do”, and that they had therefore been informed that they should contact the Applicant within 28 days to address his outstanding concerns or to provide further clarity. Specifically, the case officer set out that the SRA had been asked to:

The Applicant responded to the Commissioner on the same date to express concerns about the case officer’s assessment and questioned whether there had been engagement with the central elements of the complaint. The Applicant asked a number of clarifying questions regarding the outcome and how the case officer had reached their assessment. Later that same day, the Applicant wrote to the case officer seeking clarification of how the Commissioner had engaged with the SRA, and requesting a copy of the correspondence sent to the SRA in relation his complaint. This was provided to the Applicant on the same day. However, upon receipt of that correspondence with the SRA, the Applicant responded to the case officer by expressing some concerns and again asked several clarifying questions.

On 6th January 2026, the Applicant wrote to the case officer with a number of concerns about the outcome.

On 20th January 2026, the SRA wrote to the Commissioner to confirm that they had contacted the Applicant and provided a copy of their response. The Applicant wrote to the Commissioner upon receipt of that response to express a number of concerns. The case officer responded to the Applicant on the same date to explain that the SRA had provided an explanation as to the handling of the Applicant’s SAR and had appropriately applied an exemption. The case officer explained that the Commissioner did not therefore expect the SRA to take any further action, and the Applicant was informed that he should pursue matters with the courts, should he remain concerned about the information which has been withheld.

The Applicant responded to the case officer’s explanation on the same date, providing further information on his complaint. That was followed by further correspondence on 22nd and 25th January 2026, when the Applicant provided further information and requested that the Commissioner launch investigative action.

The Applicant engaged in further correspondence with the Commissioner on 25th, 29th, 30th and 31st January 2026, and on 2nd and 3rd February 2026, providing further information regarding his complaint and requesting that the Commissioner take enforcement action.

The case officer responded to the Applicant on 3rd February 2026, noting the Applicant’s concerns, but explaining that their decision was based on circumstances and information provided. The case officer explained that any further correspondence regarding this matter would be “noted but not responded to”.

Section 165 DPA 2018 stipulates that a data subject has a right to make a complaint to the Commissioner if they consider that the processing of personal data relating to them infringes the UK General Data Protection Regulations (“UKGDPR”), and/or Parts 3 or 4 of the Data Protection Act 2018 (“DPA 2018”). Sections 165(1) and (2) provide as follows:

Once it is established that an individual’s complaint falls within either section 165(1) or 165(2), then sections 165(3)-(5) set out what action the Commissioner must take in terms of the administration of the complaints process.

Section 166 of the DPA 2018 deals specifically with failures on the part of the Commissioner to progress and respond to the complaint as required by section 165. A data subject may, in the particular circumstances detailed within section 166(1), apply to the Tribunal for an order requiring the Commissioner to take appropriate steps to respond to the complaint (s.166(2)(a)) or to inform the complainant of the progress of the complaint, or of the outcome of a complaint, within a period specified by the order (s.116(2)(b)).

Section 166 DPA 2018 reads as follows:

As is made clear from these provisions, the Tribunal may only exercise its powers under section 166(2) if one of the three conditions cited within section 166(1) exist. There have been a number of appeal decisions which have considered the scope of section 166, and it is well established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. Some key decisions are as follows:

In Killock v Information Commissioner [2021] UKUT 299 (AAC), The Upper Tribunal stated at paragraph 74:

In the High Court in R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin), Mostyn J, at paragraph 57, commented upon the handling of complaints by the Commissioner as follows:

Mostyn J’s decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141), with Warby LJ, commenting as follows at paragraph 80:

The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA), which applied both Killock and Delo in confirming that the nature of section 166 is that of a limited procedural provision only. Judge Wikeley commented at paragraph 33 as follows:

More recently, the Upper Tribunal decision in Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC) noted at paragraph 60 that:

In considering whether any further ‘appropriate steps’ need to be taken by the Commissioner, the Tribunal must give weight to the views of the Commissioner as an expert regulator. This requirement is identified in Killock at paragraph 85, which is as follows:

The Tribunal may strike out the proceedings where the Tribunal considers there is no reasonable prospect of the case succeeding. Rule 8(3)(c) provides:

The Applicant’s written submissions are advanced by way of his signed witness statement, dated 27th March 2026. He submits that the Commissioner’s response is inadequate as it does not analyse the facts, address contradictions, consider Article 9 of the UK GDPR (Special Category Data), consider the absence of a Data Protection Impact Assessment (DPIA) or a Record of Processing Activities (ROPA), address the SRA’s reliance on privilege, demonstrate that there was any investigation, or apply the case of Killock or Veale. In addition to making a number of submissions in respect of the SRA, the Application made a number of further submissions, which are summarised as follows:

Before I deal with the Applicant’s other submissions, I firstly address his submissions in respect of the case managements directions of other judges in this case, which I consider are, at the very least, unattractive submissions, if not deliberately misleading. Firstly, case management directions are generally issued to progress a case, and they are not to be taken to provide any indication that the judge in question has articulated a view as to the merits of any case, unless the contrary has been expressed specifically by the judge. Secondly, the fact that a judge has provided directions which the Applicant considers had “tight compliance deadlines” does not provide him with any proper basis to submit that “the Tribunal considered further scrutiny necessary and that the ICO’s deference to the SRA was inappropriate.”, or that this indicates that the judge “did not accept the ICO’s position at face value and recognised that the ICO had not properly interrogated the SRA’s role or evidence”. Judge Mornington’s directions of 25th March 2026 were simply general case management directions which were issued to progress the case to a final hearing of the application, following my earlier decision of 12th February 2026 to refuse the Commissioner’s application to strike out the proceedings. My directions of 26th March 2026, which required compliance by 9th April 2026, were addressed solely to the Applicant, in order to provide him with an opportunity to make representations in relation to the proposed striking out of the appeal at that stage of the proceedings in compliance with Rule 8(4).

The Commissioner provided the Applicant with an outcome to his complaint on 23rd December 2025. The view reached by the Commissioner was that the SRA “had more work to do”, and the SRA was asked to carry out a number of tasks within 28 days, which included the following:

As has been made clear by the case law which I have set out above, section 166(2) DPA 2018 is a procedural, forward-looking provision which requires the Tribunal to identify appropriate steps to be taken by the Commissioner to respond to a complaint. The Tribunal does not have the power to deal with the merits of a complaint or its outcome. The fact that the Applicant does not agree with the scope or scale of the investigation, or indeed its outcome, does not provide him with a remedy in this Tribunal.

The approach to be taken to complaints by the Commissioner was addressed by Mostyn J in R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin), when he stated as follows:

That decision was upheld by the Court of Appeal in R (Delo)v Information Commissioner [2023] EWCA Civ 1141, when it was stated as follows:

In this matter, the Commissioner did conduct an investigation, and he did reach a view. The Commissioner then identified tasks which he asked the SRA to carry out. This is not a case in which the Commissioner, having carried out his investigation, took no further action, which was of course an option available to him. There can therefore be no suggestion that the Commissioner has in any way failed to discharge his duty to inform the Applicant of the outcome to his complaint. Nevertheless, the main thrust of the Applicant’s submissions is that the outcome he was provided with was inadequate and failed to address matters which he considers to be particularly important. In effect, he is seeking to go behind the outcome provided by the Commissioner and for the Tribunal to consider the merits of the application, and indeed the outcome provided. That is not permissible and would be treading on the toes of the High Court in matters of judicial review. That is the proper route through which the Applicant should seek to challenge the Commissioner’s decision, and not via this Tribunal. That is of course a view which was shared in Killock v Information Commissioner [2021] UKUT 299 (AAC), which preceded the decisions in Delo.

For the reasons set out above, I am satisfied that there is no reasonable prospect of the Applicant’s case succeeding, and I therefore strike out the application under Rule 8(3)(c).