WordPress + Bootstrap

Following a 2-day Part 8 trial, Heather Williams J has handed down a lengthy and important judgment concerning the application of the concept of “personal data”, the extent of searches required by Article 15 UK GDPR, the provision of contextual information and the proper approach to the application of the “tax exemption” under paragraph 2 of schedule 2 to the DPA 2018.

Michael Ashley v Commissioners for His Majesty’s Revenue and Customs [2025] EWHC 134 (KB) concerned a claim brought by the well-known British businessman, Mike Ashley, against HMRC for breach of his subject access rights under the UK GDPR. Mr Ashley made a subject access request (“SAR”) in the context of a (then) ongoing tax dispute. HMRC initially maintained that all of Mr Ashley’s personal data were exempt and therefore not disclosable. When it did subsequently provide Mr Ashley with some data, Mr Ashley contended that its response was incomplete and inadequate. He argued that HMRC failed: properly to construe his SAR; to conduct adequate searches when responding to it; properly to apply the concept of personal data and the tax exemption; and to provide him with copies of his personal data in a sufficiently contextualised manner so as to render them intelligible.

Heather Williams J found in Mr Ashley’s favour on each of those points, albeit rejecting his wider argument that all data relating to HMRC’s assessment of his tax liability in respect of the tax enquiry amounted to his personal data. Her judgment contains useful guidance for practitioners dealing with SARs at every stage of the process from construing a SAR when first made, to providing copies of the personal data in a manner that is intelligible and transparent for the data subject. More widely, the judgment contains important guidance as to how the foundational concept of “personal data” is to be construed and applied in practice.

The judgment is here.

Anya Proops KC and Zac Sammour acted for Mr Ashley. James Cornwell acted for HMRC.

Multi-party claims for misuse of data: how do you take them forward? GLOs yes, though they are often seen as too unwieldy. Straightforward multi-claimant litigation using ‘omnibus’ claim forms is fine, but doesn’t get litigation funders the maximum volumes they seek. Representative actions under CPR 19.8 are the ideal vehicle in that sense, but Lloyd v Google effectively killed them as regards data protection claims (no loss of control damages; individualised assessment needed). Can misuse of private information claims (loss of control damages available; individualised assessment perhaps not needed) fare better? The Prismall action was the leading post-Lloyd candidate on this front, but it has suffered another death this Advent. Continue reading →

Nearly five years into the life of the GDPR/DPA 2018 regime, the dust is finally settling on the first monetary penalty notice issued by the ICO under that regime. This was against Doorstep Dispensaree, whose multiple challenges to that MPN have finally run aground Continue reading →

Jamie Susskind has joined Jasveer Randhawa from Herbert Smith Freehills on the latest episode of their Public Law Podcast series. The episode delves into the regulation of AI, exploring the balance needed between regulation and innovation, and comparing the previous Conservative approach with what we can expect from Labour. They also discuss the use of AI in the public sector, reflecting on the challenges of transparency and accountability for those subject to AI, be they individuals or businesses.

This podcast can be listened to on SoundCloud, Apple and Spotify.

The High Court (Steyn J) has today handed down judgment in Harrison v Cameron and ACL [2024] EWHC 1377 (KB), a case full of notable legal points and rather colourful facts. On phone calls with one of the defendants, the claimant had repeatedly made threats of violence, without realising that the calls were being recorded. Via subject access requests under Article 15 of the UK GDPR, he sought the identities of individuals to whom the content of the recordings had been disclosed. The defendants refused, relying inter alia on the ‘personal data of others’ exemption (see DB v General Medical Council, etc), in light of the claimant’s conduct. In dismissing the claimant’s claim for the identities of the recipients, Steyn J’s judgment addresses not only that exemption, but a range of important data protection issues including the ‘personal/household’ exemption, the definition of ‘data controller’, the right to request specific identities of recipients and the application of post-Brexit CJEU case law (Austrian Post). I acted for the defendants, instructed by Charles Fussell & Co LLP, so for now I’ll just post this.