Jennifer Johnston v The Information Commissioner

Background

2. This decision relates to the applicant’s application for an order pursuant to section 166(2) of the Data Protection Act 2018 (the DPA).

3. The Commissioner applied to strike out the application pursuant to rule 8(2)(a) and/or 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (the Procedure Rules) because the tribunal has no jurisdiction and/or because the application has no realistic prospect of succeeding.

4. The applicant made a subject access request and a rectification request to Sciensus Pharma Services Limited (Sciensus) on 6 May 2025. Sciensus refused the subject access request as being manifestly excessive.

5. The applicant made a complaint to the Information Commissioner (the Commissioner) on 14 May 2025, which was allocated to a case officer.

6. On 20 June 2025, the case officer issued an outcome, finding that Sciensus had likely complied with its data protection obligations when refusing the subject access request but found that Sciensus had not met its obligations in relation to the rectification request and had not adequately addressed the applicant’s concerns. The case officer instructed Sciensus to respond to the applicant within 28 days.

7. Sciensus confirmed on 24 June 2025 that a full response had been issued to the applicant. On 15 July 2025 the applicant asked the case officer to re-open her compliant, because she was not satisfied with the response from Sciensus.

8. On 24 July 2025 the case officer informed the applicant that the Commissioner would not re-open the complaint, as having reviewed the information she had provided, did not consider that further action was necessary. The applicant was advised that she could enforce her rights through the courts, but that service related concerns and issues under the Patient Rights (Scotland) Act were outside the Commissioner’s remit.

9. On 25 July 2025 the applicant requested clarification of Sciensus’ response because she remained unhappy with the outcome of her complaint. On 30 July 2025 the case officer advised the applicant that her case had been referred for a case review. The applicant sent further clarification requests on 31 July 2025 and 18 August 2025 and noted that she had not requested a case review.

10. The reviewing officer issued an outcome on 1 September 2025. It was concluded that the case officer had handled the complaint appropriately and that the Commissioner did not intend to take further action. The reviewing officer explained the role of the Commissioner and noted that as this was the final stage of the process, her complaint would not be considered further. The applicant was also reminded that she could pursue her own action through the courts.

11. The reviewing officer sent a further response on 18 November 2025. This was to address the applicant’s clarification requests of 31 July 2025 and 18 August 2025 and a further email relating to a separate request dealt with under a different reference. It was noted that a review was appropriate in circumstances where an outcome had been issued but the applicant remained dissatisfied. It was also stated that the case officer’s reasons for not re-opening the complaint were correct. The applicant was advised that no further correspondence would be entered into.

12. The applicant’s application to this tribunal is dated 4 December 2025 and was accompanied by extremely detailed grounds of some 75 pages. She set out the remedy she was seeking including: (i) That the Commissioner be directed to reconsider her complaint in accordance with the law. (ii) That the Commissioner be required to identify all correct controllers or joint controllers. (iii) That the Commissioner be required to assess all withheld data and outstanding requests. (iv) That the Commissioner be required to take appropriate steps to secure access to all relevant personal data (article 15(3)); ensure rectification of inaccurate or misleading data (article 16); and ensure accuracy and completeness of data (article 5(1)(d)). (v) That the Commissioner be directed to consider the use of warnings; reprimands; information notices; assessment notices; and/or enforcement notices, making it clear that such measures fall within the scope of appropriate steps under section 166(1) (a) of the DPA. (vi) That the Commissioner be directed to issue a fresh decision. The respondent’s application to strike out

13. The Commissioner submits that the tribunal may only make an order whether it is satisfied that he has failed in some procedural respect to comply with section 166(1) . He contends that he has taken appropriate steps to investigate and respond to the applicant’s complaint; that an outcome was provided; that a review was carried out and further clarification was given; and that he has therefore complied with the procedural requirements of section 166(1) and that there is therefore no basis on which for the tribunal to make an order pursuant to section 166(2) .

14. The Commissioner submits that the tribunal has no jurisdiction to consider the applicant’s application (rule 8(2)(a)) and/or that the application has no realistic prospect of success (rule 8(3)(c)). The applicant’s response

15. The applicant confirms that her application is made solely under section 166 of the DPA and that it is limited to the procedural handling of her complaint under section 165 of the DPA.

16. The applicant’s application centres on whether Sciensus’ response of 24 June 2025 was a satisfactory response to the outcome of 20 June 2025 and whether, having been notified of the unsatisfactory nature of Sciensus’ response, the Commissioner should have taken any further procedural steps before bringing the complaint to an end. The law

17. A detailed summary of the relevant law is set out in the Commissioner’s response and is not repeated in full here. A summary of the relevant law and principles is as follows: (i) Section 165 of the DPA provides for a an individual to complain to the Commissioner if they consider that there is an infringement of the UK GDPR and or Parts 3 or 4 of the DPA. (ii) Section 165(4) sets out the steps the Commissioner must take if he receives a complaint under subsection (2). They include investigating the complaint; informing the complainant about progress of the complaint and informing them of the outcome of the complaint. (iii) Section 166 of the DPA provides for an individual to make an application to the First-tier Tribunal for an order requiring the Commissioner to take appropriate steps. Subsection (1) sets out the circumstances in which the tribunal may make an order; and subsection (2) sets out the orders the tribunal may make. (iv) An application under section 166 is not concerned with the merits of the relevant complaint and does not provide a right of challenge to the substantive outcome of the Commissioner’s investigation into the complaint. (v) The phrase ‘appropriate steps to respond to the complaint’ required by section 166(1) means simply that. The Commissioner is not required to reach an appropriate outcome or to resolve the complaint, merely to respond to it. (vi) The Commissioner has broad discretion as to how he investigates complaints and is the expert regulator. The tribunal does not have an oversight role over the Commissioner’s exercise of his functions or his internal processes. The Commissioner’s view carries weight but is not necessarily determinative. (vii) It is for the tribunal to decide, applying an objective test, if an ‘appropriate step’ has been omitted, but in practice that is unlikely to be the case where an outcome has been issued. That is because section 166 is procedural and cannot be used effectively as a back door route to obtaining a remedy that should be pursued by making a claim against the data controller or by judicial review of the Commissioner. Consideration

18. I was satisfied that I could determine the application for strike out without a hearing, as neither party had objected to that and because I had the benefit of written submissions from both parties.

19. The applicant does not dispute that the Commissioner provided an outcome to her complaint on 20 June 2025. I find that the Commissioner did provide an outcome on that date. The applicant contends that the Commissioner ought to have taken further procedural steps after she informed him that she was not satisfied as to Sciensus’ response to the outcome of her complaint.

20. The applicant states in her response to the strike out application: The Case O ffi cer had stated on 20 June 2025 that it did not intend to take further action at that time . Thereafter, when Sciensus maintained its position, I notified the Case O ffi cer of that development. My application concerns only whether any procedural step was followed.

21. The applicant refers to her subsequent correspondence in which she raised the unsatisfactory nature of Sciensus’ response and appears to assert that the Commissioner failed to have regard to that correspondence, which she contends is the failure to take a procedural step.

22. This is to ignore the review outcome dated 1 September 2025 and the further response from the reviewing officer dated 18 November 2025. I find that the Commissioner did take appropriate procedural steps having received the applicant’s correspondence post-dating Sciensus’ response to the outcome of 20 June 2025.

23. On 1 September 2025, the reviewing officer reviewed the information relating to the complaint; considered the points raised by the applicant; considered whether the complaint was dealt with reasonably; considered whether the matter was handled in line with casework processes; and considered whether there were any outstanding matters to pursue. I am satisfied that a review was properly conducted and that the applicant has not identified any procedural step that the Commissioner could or should have taken but which he did not.

24. The reviewing officer then carried out a further review to address the applicant’s further correspondence, which is what appears to be the basis of her application. The outcome of that further review is dated 18 November 2025. It is plain from that response that the reviewing officer had regard to the points raised by the applicant and addressed them.

25. In her response to the strike out application, the applicant does not identify any specific procedural step that she states the Commissioner should have taken pursuant to section 165(4). I am satisfied that the outcome, the review and the further review demonstrate that the Commissioner complied with the requirements of section 165(4) of the DPA. The fact that the applicant does not agree with the Commissioner’s conclusions does not make the response wrong.

26. I am satisfied that there are no other steps that the Commissioner ought reasonably to have taken to progress the applicant’s complaint. I have given significant weight to the view of the Commissioner as the expert regulator that there are no further steps he should have taken.

27. Notwithstanding the applicant’s assertion that her application is solely a procedural one, it can be seen that the applicant is in fact concerned about the outcome of her complaint and her dissatisfaction with Sciensus’ response. Section 166 is limited to procedural matters and does not give the tribunal any power to consider the merits or substantive outcome of a complaint. I am satisfied that there is no procedural failing by the Commissioner and no order pursuant to section 166(2) which the tribunal has the power to grant.

28. Accordingly, I find that as there was an outcome to the complaint, it has already been determined, and the tribunal has no jurisdiction. In addition, for the same reasons, I am satisfied that even if the tribunal did have jurisdiction, there is no reasonable prospect of the application or any part of it succeeding.

29. The application is therefore struck out under rule 8(2)(a) and 8(3)(c). Anonymity direction

30. The appellant applied for an anonymity direction. I considered her application but determined that in light of the fact that her appeal has been struck out and that this decision does not contain any information likely to cause harm to the appellant, one is not necessary and the interests of open justice are not outweighed. Signed J K Swaney Date: 6 March 2026 Judge J K Swaney Judge of the First-tier Tribunal