First-tier tribunal rules it cannot reconsider ICO’s handling of the complaint
The First-tier Tribunal (General Regulatory Chamber) has struck out an application brought by Giovanni Wallace against the Information Commissioner, ruling that it had no jurisdiction to reconsider the substance of the regulator’s decision.
In Giovanni Wallace v The Information Commissioner [2026] UKFTT 205 (GRC), the Tribunal concluded that Mr Wallace’s application under section 166 of the Data Protection Act 2018 could not proceed. The hearing took place by Cloud Video Platform on 4 February 2026, with the decision issued on 12 February 2026.
Mr Wallace had complained to the Information Commissioner’s Office (ICO) on 5 December 2024 about Plymouth City Council’s handling of his personal data. He alleged that the council breached the UK General Data Protection Regulation (UK GDPR) when a debt collection agency sent a post addressed to his stepson to his home address in connection with council tax arrears. He maintained that his stepson had never lived at his address and that the council obtained it from a former landlord.
On 18 March 2025, the Commissioner informed Mr Wallace that an infringement of data protection obligations had not taken place. The outcome letter stated that the council had relied on “Contract” and legitimate interests as lawful bases and suggested that an address alone would not be personal data. Following a request for review, the ICO acknowledged on 9 April 2025 that, in context, the address was likely to constitute personal data. However, it maintained that the contract was potentially a valid, lawful basis and confirmed that it would not pursue the complaint further.
Mr Wallace applied to the Tribunal on 30 April 2025. He argued that the Commissioner’s decision was legally flawed and factually inaccurate, and asked the Tribunal to direct the ICO to reopen and reconsider his complaint. He also sought correction of what he described as legal and factual errors in the Commissioner’s reasoning.
The Commissioner opposed the application, submitting that an outcome had been provided and that section 166 of the Data Protection Act 2018 concerns procedural failures only, not the merits of a complaint. Counsel for the Commissioner relied on authorities including Killock v Information Commissioner [2021] UKUT 299 (AAC) and R (Delo) v Information Commissioner [2023] EWCA Civ 1141.
Judge Armstrong-Holmes, sitting with Members De Waal and Yates, held that the Tribunal’s powers under section 166 are limited to procedural issues. It found that Mr Wallace was, in substance, challenging the merits of the Commissioner’s decision rather than alleging a procedural failure. The Tribunal concluded that it lacked jurisdiction and struck out the application under Rule 8(2) of the Tribunal Procedure Rules.