Richard Rawlins v The Information Commissioner

Facts

The applicant, Richard Rawlins, complained to the Information Commissioner about the British Medical Association's processing of his personal data and its handling of his data subject access request. The complaint was submitted on 16 June 2025 and dealt with under reference IC-394796-V1R9. After correspondence in which the case officer sought further information, and after the applicant said he had lost his complaint form, the officer wrote on 7 May 2026 explaining that the BMA had shared the information only with staff, investigators, panel members and external advisers involved in managing, investigating and determining a complaint and any appeals, subject to confidentiality obligations and in accordance with its Resolution Process and Privacy Policy; in the Commissioner's view the BMA had complied with the UK GDPR and no further action would be taken. The applicant asked for reconsideration, and on 21 May 2026 the officer maintained that conclusion, adding that the application of internal disciplinary rules fell outside the Commissioner's remit. The applicant applied to the Tribunal under section 166(2) of the Data Protection Act 2018, seeking findings about the confidentiality of the data, the setting aside of the Commissioner's decision, and disclosure of the BMA's explanations. The Commissioner applied to strike out the application.