Lei Yang v The Information Commissioner

1. This Application is made pursuant to section 166(2) Data Protection Act 2018 ("DPA18"). The Respondent ("the IC") has asked that it be struck out which the Applicant opposes. Rule 32(3) The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (" 2009 Rules") provides that the Tribunal may dispose of proceedings without a hearing under rule 8 as in this case. Background summary

2. The Applicant had a Telegram account which "disappeared" in April 2025. Telegram said that the account had never existed and the Applicant should create a new one. As well as this causing emotional harm the Applicant was unable to access "a large amount of privately stored electronic materials of significant worth". The Applicant contacted Telegram throughout April 2025 but received no response. The Applicant, on 1 May 2025, then complained to the IC. Law Section 165-complaint to the IC

3. The relevant parts of section 165 DPA18 provide as follows:- (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act . (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must (a)take appropriate steps to respond to the complaint, (b)inform the complainant of the outcome of the complaint, (c)inform the complainant of the rights under section 166 , and (d)if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5)The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a)investigating the subject matter of the complaint, to the extent appropriate, and (b)informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with a foreign designated authority is necessary. Section 166 - Application to the Tribunal

4. Section 166 DPA18 sets out the limit of the scope of any remedy available to an applicant. It does not have as its focus the merits of an applicant's original underlying complaint or the substantive outcome of the IC's investigation. It provides remedies the Tribunal may order if, after a data subject makes a complaint, the IC:- "(a)fails to take appropriate steps to respond to the complaint, (b)fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c)if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months"

5. In such a case the Tribunal may Order the IC:- (a)to take appropriate steps to respond to the complaint, or (b)to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order. Authorities

6. In the Response the IC refers to a number of the relevant legal authorities regarding the extent of the Tribunal's jurisdiction, the focus of section 166 DPA18, the meaning of "appropriate steps" and the discretion of the IC. These are:- (a) the Decision of the Upper Tribunal ("UT") in Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC) . (b) the Judgment of Mostyn J in Delo R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 admin. (c) the Judgment of the Court of Appeal in Delo ( [2023] EWCA Civ 1141 ). (d) Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) (e) the UT's Decision in Smith -v- the Information Commissioner [2025] UKUT 74 (ACC).

7. I agree with the IC's submissions on the law. Additionally as it was not specifically cited by the IC it is worth, in my view, also referring to:- (a) para 84 of Killock in which the UT said:- "84. There is nothing in the statutory language to suggest that the question of what amounts to an appropriate step is determined by the opinion of Commissioner. As Mr Black submitted, the language of s.165 and s.166 is objective in that it does not suggest that an investigative step in response to a complaint is appropriate because the Commissioner thinks that it is appropriate: her view will not be decisive. Nor has Parliament stated that the Tribunal should apply the principles of judicial review which would have limited the Tribunal to considering whether the Commissioner’s approach to appropriateness was reasonable and correct in law. In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself. " (b) Scranage v Information Commissioner [2020] UKUT 196 (ACC) where the UT said:- “... there is a widespread misunderstanding about the reach of section 166 . Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1) , which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus... The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three month period in which the Commissioner is still considering the complaint..." (c) Leighton v Information Commissioner (No.2) [2020] UKUT 23 (ACC) i n which the UT said as regards the meaning of "appropriate steps":- "31- “Appropriate steps” means just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant.” Strike out

8. When considering the striking out of an application the Tribunal must have regard to the overriding objective to deal with cases fairly and justly including as set out in rule 2(2) 2009 Rules. It is clear that the Applicant has had an opportunity to make representations as required by rule 8(4) 2009 Rules.

9. Rule 8(2)(a) 2009 Rules provides that "The Tribunal must strike out the whole or a part of the proceedings if the Tribunal does not have jurisdiction in relation to the proceedings or that part of them."

10. Rule 8(3)(c) 2009 Rules provides that "The Tribunal may strike out the whole or a part of the proceedings if (c) the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding. In considering striking out the Application I have had regard to legal authorities such as:- (a) HMRC -v- Fairford Group (in liquidation) and Fairford Partnership Group (in liquidation) [2014] UKUT 0329 (b) Kaur v Leeds Teaching Hospitals NHS Trust [2018] EWCA Civ 978 (c) AW-v-Information Commissioner and Blackpool CC [2013] 30 ACC The complaint

11. On 1 May 2025 the Applicant made a complaint about Telegram to the IC by section 165 DPA18. Having explained the background the Applicant said:- "I want access to my personal information I want the organisation to stop using my information, I want the organisation to fix the issue that led to the mistake, I want the ICO to confirm that the organisation was in the wrong " "I believe Telegram has failed to respond within the one- month GDPR time limit and may be misusing or deleting personal information without user consent."

12. On 7 May 2025 the IC provided the Applicant a case reference (IC-384296-J1R2) and said that due to a significant number of complaints being handled the IC hoped to be able to allocate this case in the next 16 weeks but that was only an estimate. Nothing more then happened despite chasing communications from the Applicant. The Application

13. On 24 December 2025 the Applicant commenced this Application. The Applicant sought "An Order requiring the Information Commissioner to take appropriate steps to progress and determine my complaint or to provide a substantive update and outcome within a specified period determined by the Tribunal."

14. In summary the grounds were based on the failure of the IC to report to the Applicant or (as it appeared) to take any steps to progress or conclude the complaint. The Applicant said that more than six months had elapsed but the complaint was unresolved despite multiple follow up communications and:- " The prolonged failure to progress my complaint has caused ongoing detriment I remain unable to access or recover my personal data associated with the account and I cannot safely re register without risking the loss of evidence relevant to the complaint This continuing uncertainty has adversely affected both my personal and professional activities."

15. On 6 January 2026 the IC replied to the complaint. This email said:- "Part of our role is to consider complaints from individuals who believe that there has been an infringement of the data protection law. The Data Protection Act 2018 (DPA) requires us to investigate a complaint to the extent we feel is appropriate and to inform you of the outcome. We do not always act against an organisation based on one complaint, rather we monitor their overall performance against their role and responsibilities as a data controller under the DPA. You can read more about possible outcomes of complaints to the ICO on our website. We have considered your complaint and the information provided, the ICO will keep a record of your complaint and the organisation’s actions. We use the information gathered from complaints to build a picture of an organisation’s data protection practices. We may use the information you have provided to take further regulatory action in the future but no further action is being taken at this time. When we do take action against an organisation, it is published on the action we’ve taken page of our website. If you wish to pursue your complaint further or you are seeking personal redress/compensation for the way an organisation has dealt with your personal information, you will need to pursue this independently through the courts or with an industry's own ombudsman or regulatory body."

16. On 30 January 2026 the IC provided a Response the Application. By it, in summary, the IC:- (a) apologised for the failure to reply to the complaint with an outcome which it said was an oversight. (b) referred to the terms of the Application itself and said that the IC had investigated the complaint to the extent appropriate and provided an outcome and there was therefore no basis for an order to be made pursuant to section 166 (2) DPA18. (c) said that the information provided by the Applicant had been reviewed and the complaint was recorded for monitoring purposes but no regulatory action was considered necessary. (d) directed the Applicant's attention to the ability to apply to a court for a remedy.

17. On 30 January 2026 the IC also made a request that the Application be struck by either rule 8(2)(a) and/ or 8(3)(c) 2009 Rules for the reasons explained in the Response. On 31 January 2026 the Applicant provided a Reply to the IC's Response and the strike out request. The Applicant said the Application did not seek to challenge the IC's discretion nor did it require any particular regulatory outcome but " 10. The appeal concerns whether the Commissioner has fulfilled the statutory duty to investigate the complaint to an appropriate extent. That issue is properly arguable on the facts and cannot be said to have no reasonable prospect of success."

18. The Applicant said:- "5. The letter of 6 January 2026 contains no reference to the specific facts of the complaint, no explanation of any investigative steps taken, and no reasoning addressing the alleged data protection issues arising from the unexplained loss of the Appellant’s Telegram account.

6. In particular, the correspondence does not indicate: (a) whether the Commissioner engaged with the data controller; (b) what aspects of the complaint were assessed; or (c) why no regulatory action was considered appropriate in this case

8. Whether the Commissioner’s eventual correspondence adequately remedies that delay, or amounts to a meaningful progression of the complaint, is a matter capable of judicial scrutiny and is not suitable for summary disposal."

19. In closing the Applicant said that "11. If a generic administrative closure letter were sufficient, in all cases, to defeat an application under section 166 , the supervisory purpose of that provision would be substantially undermined."

20. Importantly, in my view, on 2 February 2026 the IC gave an insight into its decision making. Decision-rule 8(2)(a)

21. In my view it would not be right to strike out the Application summarily on the basis that the Tribunal has no jurisdiction because:- (a) when it was issued the IC had not provided the Applicant with information about progress on the complaint, or of the outcome of the complaint within 3 months. (b) when it was issued the IC's consideration of the complaint had not been concluded during a subsequent period of 3 months. Decision – rule 8(3)(c)

22. Based on just the IC's Response I would also not have struck out the Application on the basis it had no reasonable prospect of success. This is because whether taking no steps was appropriate in light of the IC's broad discretion (if that is the case here) or whether the steps taken were appropriate is not " determined by the opinion of Commissioner" as the "Tribunal will decide the question of appropriateness for itself." In the Response the IC in effect merely asserts that the IC considered the Applicant’s complaint and investigated it to the extent appropriate. This provided to the Tribunal no insight into the IC's expert view and provided no means for the Tribunal to thus decide appropriateness for itself on a summary basis.

23. However on 2 February 2026 the IC explained its position further. The IC said:- "I consider the issue of your account being deleted or you losing access to your account to be more of a customer service issue that one relating to the organisations data protection practices. The legislation the ICO regulates does not oversee how organisation's manage 'account's and whether they allow an individual to have an 'account' with them. The data protection legislation does not require an organisation to retain personal data for any specific length of time, whether an organisation continues to process your personal data is the organisations decision and they are not compelled by the legislation to keep your account open. There is no evidence that the organisation has failed to comply with its data protection obligations. Due to the above we do not consider it necessary for the ICO to take any further action. You can read more about possible outcomes to complaints here..."

24. From this, together with its Response and letter of 30 January 2026 it appears that the IC allocated a reference number to the complaint and considered it but took matters no further and certainly did not carry out the steps identified by the Applicant in the reply to the strike out request. Importantly the 2nd February 2026 explanation gave an insight into why the IC had decided to respond to the complaint in this way.

25. I have had regard in particular to:- (a) Delo in which Mostyn J held:- "82. It is clear to me that Parliament was putting a s.165(2) complaint on what it perceived to be the same footing as a general complaint under Article 77.1 of the Regulation. It is noteworthy that when specifying the things that the Commissioner had to do when he received such a s.165(2) complaint, Parliament did not say that he had to render a conclusive determination of the complaint. To be sure, the Commissioner has to provide an outcome, and the complainant has to be told about that, but, as has been seen, an outcome can include taking no action on the complaint following investigation. Moreover, Parliament did not tell the Commissioner what degree of investigation he had to apply to a s.165(2) complaint" and (b) " In my judgment, for the reasons I have given at some length, Mr Bedenham correctly submits that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation, and, if so, to what extent. He correctly submits, further, that this discretion properly recognises that the Commissioner is an expert Regulator who is best placed to determine on which cases he should focus." (c) Delo in the Court of Appeal where it was held that:- "77. The Commissioner is plainly expected to bring specialist knowledge and expert judgment to bear in performing these functions. But as I have shown, there is nothing that spells out any duty to reach a conclusion on the merits of every complaint." (d) Killocck where the UT held:- "73...As the expert regulator, the Commissioner is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. Such decisions will be informed not only by the nature of a complaint itself, but also by a range of other factors of which the Tribunal will have no or only second-hand knowledge, including, for example, (i) the Commissioner’s regulatory priorities; (ii) other investigations that the Commissioner may have undertaken in the same subject area; (iii) the Commissioner’s judgment on how to deploy her limited resources most efficiently and effectively. The effect of the other parties’ submissions would be that the Tribunal would trespass upon the Commissioner’s complex judgements about how best to balance the respective rights and interests of data subjects, controllers and processors in a wide variety of different circumstances" and even though "84...In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself." the UT held:- "85... in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator.......It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations....her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively..."

26. DPA18 provides a remedy only if the Tribunal concludes that the IC has failed to take appropriate steps to respond to the complaint and/or failed to provide the complainant with an outcome of the complaint .

27. The Applicant accepts that an outcome was provided after the Application was issued. For the avoidance of doubt it is my view that the letter of 30 January 2026 did inform the Applicant of the outcome as required by section 165(4) DPA18 especially when viewed with the Response to the Application and the letter of 2 February 2026.

28. As regards "appropriate steps" I have considered the position of the parties, the relevant parts of DPA18 and the legal authorities noting that it can be appropriate for no steps to be taken. I have kept in mind the need to comply with rule 2 2009 Rules when considering the request to strike out the Application. I have taken note of the need for the Tribunal to consider objectively whether any steps (or no steps) were appropriate while having regard to and giving weight to the view of the IC as the expert regulator with discretion to deal with complaints.

29. For the purposes of a strikeout request I am satisfied on this basis that the limited steps taken were "appropriate" . I therefore do not consider this Application has a reasonable prospect of succeeding and it is struck out by rule 8(3)(c) 2009 Rules. Signed: Judge Heald Date: 27 February 2026