Cristiana Buica v Information Commissioner

1. On 21 October 2025, Ms Buica made an application on GRC3 complaining that the Respondent had failed to act on her complaint with reference IC-389734-D2H2.

2. On 21 November 2025, the Respondent made an application on GRC5 to strike out the complaint on grounds that the Tribunal has no jurisdiction or that the application has no reasonable prospects of success. It relied on its response to the application, which confirmed that the Respondent had provided Ms Buica with an outcome on 27 October 2025. A copy of that outcome was annexed to its decision.

3. On 24 November 2025, Ms Buica filed a rule 24 reply that expressly deals with the application to strike out. The reply confirms that the Respondent sent an outcome on 27 October 2025 but complains that it was late and provided after she had made her application to this Tribunal and the Tribunal had provided directions. She goes on to ask the Tribunal to direct the Respondent to reconsider her complaint.

4. A data subject has a right to make a complaint to the Commissioner if they consider that, in connection with the processing of personal data relating to them, there is an infringement of the [UK] General Data Protection Regulations [GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3 or 4 of the DPA18: see Article 77 [UK]GDPR, and section 165 (1) & (2) DPA2018.

5. Under section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.

6. Section 166 DPA18 as relevant states: 166 (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order. (3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order.

7. The powers of this Tribunal in determining an application under s.166 are limited to those set out in s.166(2) and (3). It has no power to sanction the Respondent for providing a late outcome, even one provided only after the application is made to this Tribunal.

8. Ms Buica refers to the Upper Tribunal decision in Killock & Veale v Information Commissioner [2021] UKUT 299 (AAC) and High Court decision in Delo v Information Commissioner [2022] EWHC 3046 (Admin) as well as the Court of Appeal decision - Delo v Information Commissioner [2023] EWCA Civ 1141 . Ms Buica is right that Killick is authority for the fact that Section 166 is a forward-looking provision intended to remedy ongoing procedural defects that stand in the way of a timely resolution of a complaint.

9. In the Court of Appeal in Delo , LJ Warby confirmed the Tribunal’s powers are to require the Commissioner to take a specified step, conclude an investigation or take a specified step within a specified period [at paragraph 23]. This decision is not authority for the proposition asserted by Ms Buica that this Tribunal has any power to sanction the Respondent for a late outcome; neither is the first instance decision.

10. As the Upper Tribunal confirmed in Smith v ICO [2025] UKUT 74 (AAC) [at paragraph 60], “ the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.”

11. Rule 8(2)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 provides that the Tribunal must strike out proceedings if the Tribunal does not have jurisdiction. Rule 8(3)(c) provides that the Tribunal may strike out proceedings if it considers that they have no reasonable prospect of success. Rule 8(4) confirms that the Tribunal may not strike out under either provision without first giving the appellant an opportunity to make representations in relation to the proposed striking out.

12. Ms Buica did have opportunity to make representations in respect of the strike out and did so in her Rule 24 reply.

13. Plainly, when Ms Buica made her application on 21 October 2025, the Tribunal did have jurisdiction to consider her complaint, which had reasonable prospect of success: at that time the Respondent had not provided an outcome. However, once that outcome was provided on 27 October, the application had no reasonable prospect of success: there was no longer anything for the Tribunal to do. The Tribunal does not have jurisdiction to do what Ms Buica asks in her reply and order the Respondent to reconsider the complaint. Signed Date: 9 December 2025 Judge Taft