Rahul Rajakrishnan v The Information Commissioner

Background and Chronology

1. On 4 th September 2025, Mr Rajakrishnan (“the Applicant”) made an application to the Tribunal under section 166(2) of the Data Protection Act 2018 (“ the Act ”) for an order requiring the Information Commissioner (“the Commissioner”) to take appropriate steps to respond to the complaint he made on 16 th March 2025 in respect of a company named Ivy Inventory, which provides property inventory services.

2. The Commissioner opposes the application and has made an application to strike out the proceedings under either Rule 8(2)(a) and/or Rule 8(3)(c) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, on the grounds that the Tribunal has no jurisdiction to the application, or alternatively that the application has no reasonable prospect of succeeding.

3. By way of background, the Applicant was a tenant at an address in Coventry in the latter part of 2022. Ivy Inventory (“the company”) were engaged by the landlord of that property to carry out an inspection of the property, and photographs were taken as part of that inspection. The Applicant then asked the company for a copy of the report, including any photographs, but this was not forthcoming. It is apparent from the exchange of correspondence between the Applicant and the company that he was most interested in obtaining copies of the photographs which had been taken at the address.

4. On 26 th February 2025, the Applicant made a Subject Access Request (SAR) to the company, and received some of the data he had requested, including a copy of the report that had initially been refused. However, the company informed the Applicant that they were unable to provide any of the 360-degree photographs taken for the report as they had stopped using such photographs in their reports in 2023, and that they no longer had the functionality to provide those images. Nevertheless, the company confirmed that all other photographs were present in the report and had been enlarged to assist in viewing them.

5. On 16 th March 2025, the Applicant made a complaint to the Commissioner about the company’s handling of his Subject Access Request, stating that he had only received some of the information that he had asked for. The specifics of his complaint were as follows: “Ivy Inventory carried out a photographic inspection [of] our rented property on behalf of my landlord. When I asked for a copy of the data in October 2022, Ivy Inventory refused claiming that since the landlord told them not to, they wouldn’t. When I sent a formal template based letter this year, I received some of the data. I was told that the rest of the data was either deleted due to their policy to do so after one year, or because they no longer supported the 360 degree format of some of the photos. I would have received all of this data had it been shared when first requested in 2022.”

6. The Applicant went on to state as follows: “The inspections shows proof that there are serious defects at the property and prove that the landlord was informed about it. The information would have been very useful to demonstrate to the council and the courts that the landlord knew that there was disrepair and did nothing about it.”

7. On 26 th July 2025, the Commissioner wrote to the Applicant to inform him that, based upon the information available, it was the Commissioner’s view that there is no evidence of a breach of data protection legislation. In response, on 30 th July 2025, the Applicant requested an internal review of the handling of the complaint.

8. On 1 st August 2025, the Commissioner provided an updated response, following further consideration, in which the Commissioner stated that although the company disclosed information in relation to the Applicant’s SAR, this did not mean that they were obliged to do so under the UK GDPR. In the absence of any evidence to the contrary, the Commissioner stated that he accepted the company’s assurance that no such obligation existed. In relation to the interior photographs, the Commissioner concluded that these did not constitute personal data for the purposes of the UK GDPR and were therefore not disclosable or subject to any retention obligations. Upon receipt of that further response, the Applicant requested an escalation of his internal review request of 30 th July 2025.

9. On 2 nd September 2025, following the internal review, the Commissioner notified the Applicant that he had concluded that the complaint had been handled appropriately and in accordance with the Information Commissioner’s Office’s procedures, and that the Commissioner had concluded that there was insufficient evidence of a breach of data protection legislation by the company to warrant further investigation.

10. The Applicant made his application for an order under section 166 DPA 2018 to the Tribunal on 4 th September 2025. In his application he states that he is seeking the following outcomes: (i) A declaration that the photographs, including the 360-degree images, are personal data under UK GDPR Article 4(1), overturning the ICO’s erroneous determination (ii) A declaration that Ivy Inventory has breached Article 15 (right of access), 5(1)(e) (storage limitation), 32 (security of processing), and any other relevant provisions of the UK GDPR. (iii) That the Tribunal takes into account the irreparable harm suffered by the data subject due to the permanent loss of the unique data, giving due weight to the ICO’s enforcement precedent in the Birthlink case. (iv) An order that the ICO exercises its full enforcement powers in this matter, including the consideration of monetary penalties against Ivy Inventory. (v) Any further relief the Tribunal deems appropriate. Applications under section 166 DPA 2018

11. Section 165 DPA 2018 stipulates that a data subject has a right to make a complaint to the Commissioner if they consider that the processing of personal data relating to them infringes the UK General Data Protection Regulations (“UKGDPR”), and/or Parts 3 or 4 of the Data Protection Act 2018 . Sections 165(1) and (2) provide as follows: “165(1) Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject’s right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR. (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act .”

12. Once it is established that an individual’s complaint falls within either section 165(1) or 165(2), then sections 165(3) -(5) set out what action the Commissioner must take in terms of the administration of the complaints process.

13. Section 166 of the DPA 2018 deals specifically with failures on the part of the Commissioner to progress and respond to the complaint as required by section 165 . A data subject may, in the particular circumstances detailed within section 166(1) , apply to the Tribunal for an order requiring the Commissioner to take appropriate steps to respond to the complaint ( s.166(2) (a)) or to inform the complainant of the progress of the complaint, or of the outcome of a complaint, within a period specified by the order.

14. Section 166 DPA 2018 reads as follows: “166(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner– (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months, beginning when the Commissioner received the complaint, or (c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner– (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order. (3) An order under subsection (2)(a) may require the Commissioner– (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order.”

15. As is made clear from these provisions, the Tribunal may only exercise its powers under section 166(2) if one of the 3 conditions cited within section 166(1) exist. There have been a number of appeal decisions which have considered the scope of section 166 , and it is well established that the Tribunal’s powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. Some key decisions are as follows:

16. In Killock v Information Commissioner [2021] UKUT 299 (AAC) , The Upper Tribunal stated at paragraph 74: “It is plain from the statutory words that, on an application under section 166 , the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language, but it is supported by the Explanatory Notes to the Act , which regard the s.166 remedy as reflecting the provisions of Article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals.”

17. In the High Court in R (Delo) v Information Commissioner [2022] EWHC 3046 (Asmin), Mostyn J, at paragraph 57, commented upon the handling of complaints by the Commissioner as follows: “The treatment of such complaints by the Commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under Article 79. And then he decides whether he shall, or shall not, reach a conclusive determination.”

18. Mostyn J’s decision in Delo was upheld by the Court of Appeal ( [2023] EWCA Civ 1141 ), with Warby LJ, commenting as follows at paragraph 80: “For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so, the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.”

19. The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA), which applied both Killock and Delo in confirming that the nature of section 166 is that of a limited procedural provision only. Judge Wikeley commented at paragraph 33 as follows: “The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question” (Killock and Veale, paragraph 87). As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.”

20. Whilst the Upper Tribunal decision in Smith v Information Commissioner [2025] UKUT 74 (AAC) , does not preclude an order being made for an appropriate step to be taken where an outcome has already been provided, the scope for a Tribunal to conclude that an appropriate step has been omitted is limited. One example of such a situation given by the Upper Tribunal in Smith is where “…the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complain as a result of an oversight or other mistake.”. Tribunal’s powers to strike out the proceedings for lack of jurisdiction

21. The Tribunal must strike out the proceedings where there is no jurisdiction to determine the matters before it. Rule 8(2) reads as follows: “8(2) The Tribunal must strike out the whole or part of the proceedings if the Tribunal– (a) Does not have jurisdiction in relation to the proceedings or that part of them; and (b) Does not exercise its power under rule 5(3)(k)(i) (transfer to another court or tribunal) in relation to the proceedings or that part of them.” Tribunal’s power to strike out the proceedings where no reasonable prospect of success

22. The Tribunal may strike out the proceedings where the Tribunal considers there is no reasonable prospect of the case succeeding. Rule 8(3)(c) provides: “8(3) The Tribunal may strike out the whole or part of the proceedings if– … (c) the Tribunal considers there is no reasonable prospect of the appellant’s case, or part of it succeeding.” Discussion and Conclusions

23. The Applicant has provided the Tribunal with written representations, opposing the Commissioner’s application to strike out the proceedings. I have read and considered those representations, the Commissioner’s application to strike out the proceedings, and the 148-page bundle of documents provided by the Respondent.

24. As I have already set out above, the Tribunal’s powers in respect of the application under section 166 DPA 2018 are, in this instance, limited to a situation where the Commissioner has failed to take an appropriate step to respond to a complaint. To that extent, the outcomes being sought by the Applicant are not matters which the Tribunal has the power to order. This includes the making of any declarations or findings in relation to matters of fact which the Commissioner has considered. Should the Tribunal find that the Commissioner has failed to take an appropriate step to respond to the complaint, then the Tribunal may then make an order requiring the Commissioner to take appropriate steps to respond to the complaint.

25. In the present matter, the Applicant made a complaint to the Commissioner, which he initially responded to on 26 th July 2025, informing him that, having investigated, there was no evidence of a data protection breach on the part of the company. The updated and more detailed response of 1 st August 2025, which was in response to the Applicant’s request for a review, then explained the rationale for the decision, which reiterated that there was no evidence of any breach, and that additionally, the photographs concerned did not constitute personal data for the purposes of the UK GDPR. That outcome was upheld upon an internal review being carried out, but in any event, this was an outcome to the Applicant’s complaint. The fact that he is not satisfied by this outcome does not provide him with a mechanism for the Commissioner’s decision to be overturned by this Tribunal.

26. In the circumstances of this case, I do not consider that the Commissioner has failed to take any appropriate steps to respond to the complaint. The Commissioner carried out an investigation of the complaint and has discharged his duty by providing the Applicant with an outcome to that complaint. In seeking to overturn the Commissioner’s decision, the Applicant is seeking to have this Tribunal consider the merits of the complaint and its outcome. That is not something which the Tribunal has the power to do, and I am therefore satisfied that the Tribunal lacks jurisdiction to deal with this application. Any such redress may only be granted by the High Court following an application to judicially review the Commissioner’s decision.

27. The application is struck out under Rule 8(2) for lack of jurisdiction, and I do not exercise the Tribunal’s power to transfer the proceedings to another court or Tribunal.