Nestled among the well-known remedial provisions of the UK GDPR and DPA 2018 are Article 80 and section 187. These provisions enable data subjects to authorise a representative body to act on their behalf by exercising their rights under Articles 79 and 82 UK GDPR. Good Law Project’s claim against the Reform Party is the first claim brought under these provisions. The judgment in Reform’s strike out and/or summary judgment application, Good Law Project Ltd v Reform UK Part Ltd [2026] EWHC 1458 (KB), is therefore notable for being the first judicial consideration of the regime for representative data actions.
The Good Law Project (“GLP”) claims that Reform UK Party Limited (“Reform”) breached the UK GDPR. GLP states in its Particulars of Claim that it brings the claim in its capacity as a representative mandated by a group of 51 individuals (the “Relevant Individuals”) to pursue proceedings on their behalf under Article 80 UK GDPR and section 187 DPA 2018. The core allegations in the claim are that Reform failed to respond to DSARs sent by the Relevant Individuals within the statutory time limit, and that the late responses were substantively deficient, causing non-material damage to the Relevant Individuals.
Reform applied for strike out, or for summary judgment in its favour, of this claim on various grounds, including by challenging GLP’s standing to bring the claim on behalf of the Relevant Individuals under section 187 DPA 2018. This blog is concerned with this ground.
Section 187(1)(a) DPA 2018 provides that a data subject may authorise a body or other organisation which meets two conditions to exercise the data subject’s rights under Article 79 UK GDPR on the data subject’s behalf (e.g. by seeking a compliance order under section 167). Section 187(1)(b) provides that the authorised body may exercise the data subject’s rights to compensation under Article 82 UK GDPR.
The two conditions are set out in section 187(3) and (4). The first condition in subsection (3) is as follows:
(3) The first condition is that the body or organisation, by virtue of its constitution or an enactment–
(a) is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes,
(b) is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and
(c) has objectives which are in the public interest.
The second condition in subsection (4) is as follows:
(4) The second condition is that the body or organisation is active in the field of protection of data subjects’ rights and freedoms with regard to the protection of their personal data.
As a threshold matter, Reform contended that GLP does not meet these two conditions ([19]).
Reform submitted that GLP did not satisfy the first condition in section 187(3) by reference to GLP’s Articles of Association (set out at [22] of the Judgment).
Reform submitted that provisions of GLP’s Articles which permit payments to third parties, as exceptions to the rule that GLP’s assets must be applied solely to the promotion of its objects, meant that section 187(3)(a) and (b) were not satisfied. Dismissing this argument, the Court concluded that GLP’s Articles of Association provide a reasonable basis for arguing that all of GLP’s income and capital must be applied solely towards its objects, and that all its objects fall broadly within the broad definition of “charitable or public purpose” ([71]). In summary, Murray J accepted GLP’s submission that the exceptions relied on by Reform as irreconcilable with subsection (3) “are reasonable and narrow exceptions that permit GLP to operate effectively as a corporate body in pursuit of its objects” ([68]). It seems, therefore, that Articles of Association which permit the following payments will not per se run afoul of section 187(3): payments to directors or persons connected to a director for supplies, goods, or other property provided to the body; provision of reasonable remuneration to a director who provides legal services to the body; and the purchasing and maintaining of insurance for directors and officers in respect of relevant losses.
Reform also submitted that it was “telling” that GLP had constituted itself as a company limited by guarantee without share capital without than as a community interest company (“CIC”) ([65]). This argument did not go anywhere. GLP submitted that, as a threshold matter, section 187 does not require a representative body to be established as a CIC, charity, or any other specific legal form. Murray J did not squarely address the argument (perhaps because Reform does not appear to have argued this point beyond submitting that it was “telling”).
In relation to section 187(3)(c), Reform submitted that at least some of GLP’s objects were “sectional interests” rather than objectives in the public interest, such as the object in Article 2.7 “to address imbalances of economic power in the application of the law” ([63]). The Court held that GLP has a reasonable for basis for arguing at trial that it has objectives that are each in the public interest. Murray J noted that the “term “public interest” is, of course, a broad one”, and concluded that the majority of GLP’s objects were uncontroversially in the public interest. In relation to the objects alleged to be “sectional interests”, Murray J noted that there will inevitably be disagreement between reasonable individuals as to what is constitutive of “the public interest”, and that it would be wrong to strike out and/or grant summary judgment because a couple of GLP’s objects are ones on which reasonable persons could differ as to whether they were “in the public interest”, given the broad scope of that concept.
Reform also argued that section 187(3) required (“presumably by implication”, in the words of Murray J) that the public interest needed to relate to “the law relating to data protection” ([80]). GLP argued that “it is in the public interest that the law should be complied with, including in relation to data protection”, a submission with which Murray J agreed. Murray J did not expressly say whether he agreed that such a requirement arose by implication.
In relation to the second condition, the Court held that neither subsection (3) nor (4) requires a representative body “to have an express object concerning activity in data protection and/or an express object to promote compliance with the law relating to data protection” ([81]). Section 187(4) “simply requires that the representative body should be “active” in the field of data protection” ([81]). Having reviewed the witness statements of the Founder and Executive Director of GLP and the Head of Technology and Data at GLP, the Court concluded there was sufficient evidence “to show that there is a genuine factual dispute on this point”, which meant strike out and/or summary judgment was not appropriate at that point.
Reform also challenged the mandate of GLP to bring the claim on behalf of the Relevant Individuals. The Court concluded this was a matter appropriate for resolution at trial. Whilst the Applicant had highlighted some deficiencies in the formal confirmation and scope of the mandates, the Court concluded that those deficiencies could and should be addressed by the time of trial, and provided no basis for strike out and/or summary judgment ([84]).
Murray J dismissed Reform’s other grounds for strike out and/or summary judgment. Accordingly, the first representative claim Article 80 and section 187 DPA 2018 lives to fight another day. A number of issues in this application were decided as threshold matters. It may be that, if this case goes to trial and results in a judgment, the Court has more to say about the application of section 187 to this claim. For now, this judgment is the key authority for practitioners trying to assess how the courts might apply section 187 to the facts of other cases, and provides some guidance as to the kinds of arguments which are unlikely to succeed under a threshold standard.
11KBW’s Andrew Sharland KC acted for the Good law Project together with George Molyneaux of Blackstone Chambers, instructed by Matt Getz, Kelly Lillas, and Louise Lau at Pallas Partners LLP.