Info Gov

The First‑tier Tribunal has struck out an application brought under section 166 of the Data Protection Act 2018 (DPA 2018) after finding that the challenge sought remedies outside the Tribunal’s jurisdiction and had no reasonable prospect of success.

In Mohammadreza Shahmirzadi v Information Commissioner [2025] UKFTT 1566 (GRC), Judge Peri Mornington ruled that the Tribunal could not consider the applicant’s attempt to compel the Information Commissioner to issue an enforcement notice against Companies House, order rectification and erasure, or investigate a claim for compensation relating to the publication of his residential address.

Mr Shahmirzadi had complained to the Information Commissioner in September 2025 after Companies House published his home address on the public register. The ICO investigated and issued an outcome on 26 September, concluding that Companies House appeared to be complying with its data protection obligations and had explained the steps required for the applicant to suppress the address.

The applicant subsequently sought an order from the Tribunal requiring the Commissioner to take further action, including compelling Companies House to remove the address without charge.

Judge Mornington emphasised that section 166 DPA 2018 provides only a “procedural remedy” where the Commissioner has failed to take appropriate steps to respond to a complaint or failed to provide progress updates within the statutory timeframe.

Citing established authority including Scranage v ICO and Killock v ICO, the Tribunal reiterated that section 166 does not permit challenges to the merits or substantive outcome of an ICO investigation.

The judge noted that the ICO had investigated the complaint, communicated with both the applicant and Companies House, expedited the case when requested, and provided an outcome within days. As such, none of the statutory conditions for a section 166 order were met.

The Tribunal found that the applicant was seeking to challenge the ICO’s substantive conclusions and to obtain remedies - such as enforcement action and compensation - that fall outside the Tribunal’s powers under section 166.

Judge Mornington concluded that the application had “no reasonable prospect” of succeeding and struck it out under rule 8(3)(c) of the Tribunal Procedure Rules.

Also in this section

Oct 19, 2026

ICO audit finds "limited" assurance over Derbyshire Constabulary data protection governance

The Information Commissioner's Office (ICO) has given Derbyshire Constabulary a "limited" assurance rating for governance and accountability following a consensual data protection audit, finding that the force does not hold a comprehensive record of processing activities and is not yet meeting the logging requirements for law enforcement processing under section 62 of the Data Protection Act 2018.
Oct 19, 2026

DSG to pay £200,000 as consent order ends long-running cyber attack penalty dispute with ICO

The Information Commission (ICO) has confirmed that its long-running enforcement action against DSG Retail Ltd over the 2017 malware attack on Currys PC World and Dixons Travel tills has ended, after the First-tier Tribunal approved a consent order under which the retailer will pay £200,000 of the monetary penalty imposed by the tribunal rather than contest a fresh hearing.
Oct 14, 2026

ICO reprimands Met Police over unlawful data sharing

The Metropolitan Police Service (MPS) has been reprimanded by the Information Commission’s Office (ICO) after officers and staff unlawfully shared personal information through an unapproved third-party platform used to identify suspected shoplifters.