Mr Morris asks the Tribunal to order the Respondent to respond to his complaint of 18 February 2025 within 14 days. Significantly outside the 3 month time limit, and some time after Mr Morris applied to this Tribunal, the Respondent responded to the complaint on 4 August 2025. The Respondent invited Mr Morris to withdraw his application. By reply on 3 September 2025, he declined to do so.

A data subject has a right to make a complaint to the Commissioner if they consider that, in connection with the processing of personal data relating to them, there is an infringement of the [UK] General Data Protection Regulations [GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3 or 4 of the DPA18: see Article 77 [UK]GDPR, and section 165 (1) & (2) DPA2018.

Under section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.

Section 166 DPA18 as relevant states:

The powers of this Tribunal in determining an application under s.166 are limited to those set out in s.166(2). The jurisdiction to make an Order is limited to circumstances in which there has been a failure of the type set out in s.166(1) (a), (b) and (c). The Tribunal has no power to deal with the merits of the complaint to the Commissioner.

The Tribunal may consider whether a step is appropriate; the Information Commissioner’s view on this will not be determinative but should be taken into account by this Tribunal and accorded due weight given that the Commissioner is an expert regulator in the best position to decide what investigations should be undertaken into any particular issue and how that should be done. This Tribunal will not interfere with an exercise of regulatory judgement without good reason.

As the Upper Tribunal confirmed in Smith v ICO [2025] UKUT 74 (AAC) [at paragraph 60], “ the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited … That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.”

Now that the Respondent has provided an outcome, it is difficult to see what appropriate steps the Tribunal can require the Respondent to take. Mr Morris has his response. An order that the Respondent provide a response would be futile when it has already been provided.

In his reply to the application to strike out, Mr Morris complains that the subject of his complaint to the Respondent has not complied with the Respondent’s request. This Tribunal does not have the power to make any orders regarding the subject of his complaint. Mr Morris appears to acknowledge that fact.

For these reasons, the application has no reasonable prospects of success.