Erwan Firdaus Bin Ab Razak v The Information Commissioner

Erwan Firdaus Bin Ab Razak v The Information Commissioner

The Tribunal does not have jurisdiction to grant the orders sought because section 166(2) DPA 2018 is limited to procedural remedies for complaints under section 165 or Article 77 GDPR, not for DSAR compliance. An outcome has already been provided to the Complaint, and there are no further appropriate steps for the Information Commissioner to take. The Application is therefore struck out under Rule 8(2)(a) and Rule 8(3)(c).

Parties
Applicant: Erwan Firdaus bin Ab Razak; Respondent: The Information Commissioner
Jurisdiction
England and Wales
Judgment Date
31 March 2026
Procedural Posture
Application Under Section 166(2) Data Protection Act 2018 / Strike Out Decision
Outcome
Application struck out for lack of jurisdiction and no reasonable prospect of success.
Legal Topics
Data Subject Access Request, Procedural Jurisdiction, Complaint Handling, Section 166 DPA 2018
Data Protection Information Rights Data Subject Access Request Procedural Jurisdiction Complaint Handling Section 166 DPA 2018

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 4 Authorities cited 7 Party arguments 2
Sign in to unlock

Parties

Erwan Firdaus bin Ab Razak

Applicant

The Information Commissioner

Respondent

Procedural Posture

Application Under Section 166(2) Data Protection Act 2018 / Strike Out Decision

Legal Issues

  1. 1 Whether the Tribunal has jurisdiction to order compliance with a DSAR under section 166(2) DPA 2018
  2. 2 Whether the Tribunal can grant an order to progress a complaint where an outcome has already been provided
  3. 3 Whether section 166(2) DPA 2018 provides a remedy for substantive breaches or only procedural failings

Ratio Decidendi

The Tribunal does not have jurisdiction to grant the orders sought because section 166(2) DPA 2018 is limited to procedural remedies for complaints under section 165 or Article 77 GDPR, not for DSAR compliance. An outcome has already been provided to the Complaint, and there are no further appropriate steps for the Information Commissioner to take. The Application is therefore struck out under Rule 8(2)(a) and Rule 8(3)(c).

Court Disposition

Application struck out for lack of jurisdiction and no reasonable prospect of success.

Orders

  • The Application is struck out under Rule 8(2)(a) because the Tribunal does not have jurisdiction to deal with it.
  • The Application is struck out under Rule 8(3)(c) because there is no reasonable prospect of it succeeding.