Kariama Ofori-Anim v The Information Commissioner

Factual background

1. On 05 September 2025, the Applicant submitted a Data Subject Access Request (“DSAR”) to the Respondent requesting “all correspondence between parties” in relation to a separate data protection complaint case with the case reference IC-238885-S4C6. That case related to five heads of claim, including in relation to unlawful data processing and unlawful data sharing.

2. On the same date, the Respondent’s Information Access Team acknowledged the DSAR. It was subsequently allocated the case reference IC-330012-C7Q3.

3. On 04 October 2025, an Information Access Officer issued a response to the DSAR. The Applicant was provided with a bundle of disclosure and a detailed note explaining the scope of the disclosure. Certain material was either withheld or redacted pursuant to paragraph 16 of Schedule 2 of the Data Protection Act 2018 as it comprised of third-party information, and additional material was withheld under paragraph 11 of Schedule 2 of the Data Protection Act 2018 on the basis that disclosure would be likely to prejudice the Respondent’s regulatory functions.

4. Further communications took place via email between the Applicant and the Information Access Team between 16 October 2025 and 29 October 2025, in which the Applicant expressed dissatisfaction at the outcome of the DSAR.

5. The Applicant submitted a GRC1 in October 2025. The GRC1 form is undated, but was received by the Tribunal on 29 October 2025. In that GRC1, the Applicant stated that the appeal was against the decision with reference [IC]-330012-C7Q3 dated 23 October 2025, and requested that the Tribunal order disclosure of the requested information.

6. I note that the correct date of the decision with reference number IC-330012-C7Q3 was, in fact, 04 October 2025.

7. On 24 November 2025, the Respondent filed a Response to the GRC1. The Respondent noted that the GRC1 was undated and unsigned, and highlighted that the GRC1 form was the incorrect form to progress a data protection or GDPR complaint. The Respondent noted that the correct form relating to data protection complaints was a GRC3. He also submitted that, whilst the present application has been issued pursuant to section 166 of the Data Protection Act 2018 , that was also incorrect as that section relates to orders that are available to the Tribunal to progress complaints made by data subjects.

8. The Respondent submitted that the remedy sought by the Applicant, namely to “submit outstanding DATA” was not an outcome that could be granted by the Tribunal following an application pursuant to section 166 of the Data Protection Act 2018 against the Respondent. At paragraph 38 of their Response, the Respondent stated the following: “… the Application does not relate to a “complaint” within the meaning of section 166 of the DPA 2018. Section 166 only permits an individual to apply to the Tribunal where the Information Commissioner has failed to take appropriate steps in response to a complaint made under section 165. The present Application does not concern any such complaint, rather, it seeks to challenge the Commissioner’s handling of a DSAR”.

9. At paragraph 41, the Respondent went on to state: “… the Application falls outside the scope of section 166 of the DPA 2018. It does not concern a complaint under section 165, and the Commissioner has already taken appropriate steps by providing a substantive response and further clarification regarding the DSAR. There is no continuing failure to act and no remedy available under section 166 ”.

10. The Respondent submitted that the Tribunal has no jurisdiction to consider the Applicant’s application and/or it has no prospect of success. The Respondent therefore applied for the Applicant’s application to be struck out pursuant to either rule 8(2)(a) and/or rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

11. The Applicant filed a Reply on 24 November 2025. The Applicant submitted that the application pursuant to section 165 of the Data Protection Act 2018 arose from a valid complaint, that the Respondent had mischaracterised the matter as a SAR, and that the Respondent had failed to take appropriate steps in handling the complaint. The Applicant stated that the data protection complaint with case reference IC-238885-S4C6 was a complaint within the meaning of section 165(1) of the Data Protection Act 2018, and that the subsequent [D]SAR with reference IC-330012-C7Q3 was only made because the Respondent had withheld information relevant to the complaint.

12. The Applicant’s Reply focused on the response by the Respondent to the ‘initial’ data protection complaint case (reference IC-238885-S4C6). The remedy sought was “to order the Commissioner, under section 166(2) , to take appropriate steps to respond to the complaint under IC-238885-S4C6”. The Applicant submitted that the application for a strike-out should be rejected.

13. On 25 November 2025, the Respondent provided a response to the Applicant’s Reply. He noted that the GRC1 expressly referenced case IC-330012-C7Q3, which concerned a SAR, and made no reference whatsoever to the complaint filed under case reference IC-238885-S4C6. He noted that, as far as the Respondent was aware, there was no application relating to case IC-238885-S4C6 before the Tribunal.

14. On 25 November 2025, the Applicant sent an email to the Tribunal and the Respondent titled “Clarification of Reference Numbers – FT/EA/2025/0404/GDPR” in the following terms: “I write to clarify that the present section 166 application arises from my data protection complaint under reference IC-238885-S4C6. This complaint concerns unlawful processing and continued enforcement action after the Ministry of Justice recorded the enforcement account as “closed”. The reference to IC-330012-C7Q3 on the GRC1 form was an administrative error arising because the Commissioner treated the matter as a SAR. The SAR was made only after the Commissioner withheld information relevant to the complaint. For the avoidance of doubt, the application before the Tribunal concerns the Commissioner’s failure to take appropriate steps in responding to the complaint under section 165 DPA 2018”.

15. It is apparent from the Applicant’s Reply dated 24 November 2025 and the email of 25 November 2025 that there has been a fundamental error in the approach to these proceedings. As is clear from the Reply, it is the Applicant’s case that (i) Case reference IC-238885-S4C6 is a complaint pursuant to section 165(1) of the Data Protection Act 2018 ; (ii) the Respondent has failed to take appropriate steps to respond to that complaint; and (iii) pursuant to section 166(2) of the Data Protection Act 2018, the remedy sought is an order requiring the Respondent to take appropriate steps to respond to the complaint and also to “reconsider the complaint correctly under section 165 ”.

16. The position that the Applicant now takes is wholly different to that which was put forward in the GRC1, in which the Applicant expressly stated that the appeal was against the decision reference IC-330012-C7Q3 which relates to a DSAR (albeit one that flowed from the initial data protection complaint).

17. In my view, the email from the Applicant dated 25 November 2025 is not sufficient to correct the errors that exist in this case. The current proceedings, which have been commenced using the wrong form and in relation to the wrong decision, cannot simply be ‘put back on track’ by an email from the Applicant purporting to do so.

18. If the Applicant wishes to apply for an order pursuant to section 166(2) of the Data Protection Act 2018 to progress a complaint made to the Respondent in relation to the complaint with case reference IC-238885-S4C6, then the Applicant must commence proceedings in the correct manner, using form GRC3. I note that the Respondent indicates that any such application would now be likely to be out of time, but any such considerations would fall to be determined if and when proceedings are properly commenced. Strike out application The Law

19. Rule 8 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 states as follows: Striking out a party’s case (1) The proceedings, or the appropriate part of them, will automatically be struck out if the appellant has failed to comply with a direction that stated that failure by the appellant to comply with the direction would lead to the striking out of the proceedings or that part of them. (2) The Tribunal must strike out the whole or a part of the proceedings if the Tribunal – (a) does not have jurisdiction in relation to the proceedings or that part of them; and (b) does not exercise its power under rule 5(3)(k)(i) (transfer to another court or tribunal) in relation to the proceedings or that part of them. (3) The Tribunal may strike out the whole or a part of the proceedings if – (a) the appellant has failed to comply with a direction which stated that failure by the appellant to comply with the direction could lead to the striking out of the proceedings or part of them; (b) the appellant has failed to co-operate with the Tribunal to such an extent that the Tribunal cannot deal with the proceedings fairly and justly; or (c) the Tribunal considers there is no reasonable prospect of the appellant’s case, or part of it, succeeding. (4) The Tribunal may not strike out the whole or a part of the proceedings under paragraph (2) or (3)(b) or (c) without first giving the appellant an opportunity to make representations in relation to the proposed striking out. Analysis and decision

20. The Respondent submits that the claim should be struck out on the basis that the Tribunal does not have jurisdiction to deal with all or part of the claim and / or that it has no reasonable prospect of success.

21. The claim that has been currently accepted under case reference FT/EA/2025/0404 relates to a [purported] appeal against the decision of the Respondent, reference 330012-C7Q3. This case reference refers to a request by the Applicant for correspondence between the parties in relation to a data protection case, reference IC-238885-S4C6. The remedy sought by the Applicant is for the data that was requested in case reference IC-238885-S4C6 to be provided.

22. The only rights available to be exercised by the Applicant in relation to case reference 330012-C7Q3 would be to complain to the Respondent if the Applicant (data subject) considers that, in connection with their personal data, there has been an infringement of the UK GDPR ( section 165(1) Data Protection Act 2018 ). If, on making such a complaint, the Applicant asserted that the Respondent had failed to progress the complaint, then an application could be made to the Tribunal pursuant to section 166(2) of the Data Protection Act 2018.

23. No such complaint has been lodged with the Respondent relating to a complaint by the Applicant that there has been an infringement of the UK GDPR in connection with personal data relating to the Applicant. As such, there is no valid ground of appeal to this Tribunal in relation to case reference 330012-C7Q3.

24. In line with rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009, the Applicant has had the opportunity to respond to the application to strike out, as contained within the Applicant’s Reply dated 24 November 2025.

25. For the reasons above, I am satisfied that the claim as currently filed under case reference FT/EA/2025/0404 has no reasonable prospect of success and it is therefore struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. Signed: Tribunal Judge Muzaffer Date: 26 January 2026