Data protection
Baldwin v The Information Commissioner [2026] UKFTT 497 (GRC)
The First-tier Tribunal struck out the applicant’s application under rule 8(2)(a) because the tribunal does not have jurisdiction to deal with it, and under rule 8(3)(c) because there is no reasonable prospect of it succeeding. The applicant sought an order under s 166(2) of the Data Protection Act 2018 (DPA 2018) requiring the Information Commissioner (IC) to ‘take appropriate steps to respond to complaint’ regarding the Home Office’s handling of his personal data shared with external legal counsel. The tribunal held that the IC had provided outcomes to the applicant’s complaint on four occasions, thereby complying with the procedural requirements of s 165(4) and s 166(1), DPA 2018. The tribunal found that s 166 is limited to narrow procedural issues concerning the IC’s handling of complaints and does not permit challenges to the substantive outcome or merits of a complaint. The applicant’s dissatisfaction with the IC’s conclusion that the Home Office appropriately shared his data with external counsel under the ‘Public Task’ lawful basis did not constitute a procedural failing. The outcome
