Fernando Melendez v The Information Commissioner

Before making this decision, I considered the following documents from the Tribunal file provided to me:

On 20 June 2025, Mr Melendez made a complaint to the Information Commissioner (IC) about a response to a Data Subject Access Request (DSAR) made to VulnCheck Inc. The IC issued an outcome on 19 January 2026.

On 28 January 2026, Mr Melendez filed a GRC3 application for an order that the IC progress his complaint.

On 4 March 2026, the IC made an application on GRC5 to strike out the complaint on grounds that the Tribunal has no jurisdiction or that the application has no reasonable prospects of success. It relied on its Response to the application, which confirmed that the IC had provided Mr Melendez with an outcome on 19 January 2026. A copy of that outcome was annexed to its Response.

A data subject has a right to make a complaint to the Commissioner if they consider that, in connection with the processing of personal data relating to them, there is an infringement of the [UK] General Data Protection Regulation [GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3 or 4 of the DPA18: see Article 77 [UK]GDPR, and Section 165(1) & (2) DPA18.

Under Section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.

Section 166 DPA18 as relevant states:

The powers of this Tribunal in determining an application under Section 166 are limited to those set out in Section 166(2) and (3). The Tribunal has no power to consider the merits of a complaint or the outcome. It has no power to sanction the Respondent for providing a late outcome, even one provided only after the application is made to this Tribunal.

Killock & Veale v Information Commissioner [2021] UKUT 299 (AAC) is authority for the fact that Section 166 is a forward-looking provision intended to remedy ongoing procedural defects that stand in the way of a timely resolution of a complaint.

In the Court of Appeal in Delo v Information Commissioner [2023] EWCA Civ 1141, LJ Warby confirmed the Tribunal’s powers are to require the Commissioner to take a specified step, conclude an investigation or take a specified step within a specified period [at paragraph 23].

As the Upper Tribunal confirmed in Smith v ICO [2025] UKUT 74 (AAC) [at paragraph 60], “the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.”

The Upper Tribunal goes on in paragraph 61 to confirm that an order could be made where an outcome has been provided for example when the outcome deals only with part of the complaint.

Rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 provides that the Tribunal must strike out proceedings if the Tribunal does not have jurisdiction. Rule 8(3)(c) provides that the Tribunal may strike out proceedings if it considers that they have no reasonable prospect of success. Rule 8(4) confirms that the Tribunal may not strike out under either provision without first giving the appellant an opportunity to make representations in relation to the proposed striking out.

Mr Melendez was directed to make representations in respect of the strike out and did so in his email referenced above, in which he confirmed that he relies upon the content of his Reply.

Mr Melendez does not identify any further procedural steps for the IC to take. He does not identify, for example, that the IC responded to only part of his complaint. On its face, it can be seen that the IC dealt with the allegation in respect of the DSAR.

His Reply, in its conclusion, claims that his application raises the narrow question of whether the IC failed to apply the correct statutory framework. That is a pithy summary of all that had preceded the conclusion both in the Reply and in the original application. All of the grounds relied upon are, in reality, an attack on the substance of the outcome disguised as a procedural attack on the steps taken by the IC. The application cannot therefore have reasonable prospects of success.