Nestled among the well-known remedial provisions of the UK GDPR and DPA 2018 are Article 80 and section 187. These provisions enable data subjects to authorise a representative body to act on their behalf by exercising their rights under Articles 79 and 82 UK GDPR. Good Law Project’s claim against the Reform Party is the first claim brought under these provisions. The judgment in Reform’s strike out and/or summary judgment application, Good Law Project Ltd v Reform UK Part Ltd [2026] EWHC 1458 (KB), is therefore notable for being the first judicial consideration of the regime for representative data actions. Continue reading
AI and Policing: Thompson
It has been more than five years since the Courts last discussed the use of AI in public decision-making. That was in R (Bridges) v Chief Constable of South Wales Police (Information Commissioner and others intervening) [2020] 1 WLR 5037). In the universe of AI, five years is a mind-bendingly long time. Can we even remember a time before hallucinated authorities and lonely teenagers falling in love with chatbots? Many of us have been waiting with bated breath for the next word on how the Administrative Court will constrain public authorities’ use of AI.
After that long wait, we have been given R (Thompson and Carlo) v Commissioner of Police for the Metropolis [2026] EWHC 915 (Admin).
Russian bots and the expansion of human rights law to keep pace with tech
When will the Courts extend human rights law principles in order to keep up with emerging technology? The Strasbourg Court gave us some answers in Bradshaw & Others v United Kingdom (app no. 15653/22) . However, they may not have been the last word, because this week, the Applicants have sought a referral to the Grand Chamber.
The claim
A group of MPs argued that the Government was not doing enough to combat Russian interference in UK elections, including in the 2019 general election. They were concerned with credible allegations that Russia had engaged in deliberate cyber-attacks against election infrastructure, “hack and leak” operations, and the use of “cyber troops” and “troll farms” to manipulate public discourse and to sow discord between social groups.
Panopticon Podcast Returns! Data Protection and the Public Sector (feat. Christopher Knight)
Panopticon is pleased to announce the return of its auditory offering, the Panopticon Podcast. Episode 5 sees (or, rather, hears) Christopher Knight sharing his estimable experience and insight on the intersection between public law and data protection.
How can you use data protection arguments in judicial review without irritating judges or sending them to sleep? How to regulate data protection issues in the public sector without encroaching on other public authorities’ functions? Fresh from his readeption to his rightful place as Public Law Junior of the Year 2025 (having first ascended in 2022), Christopher answers these questions and more, and vaticinates where and how public lawyers may seek to deploy data protection arguments in the coming years.
You can listen and subscribe on all the usual platforms, including Apple, Spotify, Podcast Index and Podcast Addict.
Cumulative Public Interest Exemptions in the Supreme Court
Section 1(1)(b) of the Freedom of Information Act 2000 (“FOIA”) creates the right to have information held by a public authority communicated to a requestor. But as night follows day, this is not an absolute right. Part II of the Act sets out a series of exemptions to the right in section 1(1)(b). Some of these are absolute exemptions. Others are qualified. Section 2(2)(b) FOIA provides as follows:
(2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that–
…
(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.
This is the public interest balancing test. But what if a public authority relies on more than one qualified exemption? This was the issue in Department for Business and Trade v Information Commissioner [2025] UKSC 27. Where information falls within multiple qualified exemptions in the FOIA, does section 2(2)(b) require the public interest in maintaining each of those exemptions to be aggregated (“the cumulative approach”), or does it require the public interest in maintaining each exemption to be considered separately (“the independent approach”)? Continue reading
Data protection damages: Equiniti in the Court of Appeal
An individual suffers a data protection breach and claims compensation – often as part of a group. What kinds of consequence can they claim for? How serious do those consequences need to be for there to be a viable claim? These are pivotal issues in data protection litigation, from both commercial and legal perspectives. The Court of Appeal’s very recent judgment in the Equiniti litigation is hugely important on these fronts: see Farley and Others v Paymaster (1836) Limited (trading as Equiniti) [2025] EWCA Civ 1117. Continue reading