Tag Archives: data protection

July 18, 2026 · 12:09 pm

The extent of the purely personal and household carve-out

(Reposted from LinkedIn)

In a judgment handed down on 17 July, Mrs Justice Hill ruled on a claim in harassment, breach of confidence, misuse of private information and data protection, arising out of disputes at the Yacht Club involving its former “Commodore” (who knew yacht clubs had commodores?) and another member, over mooring payments in relation to the claimant’s Dutch barge.

Who knew that the Greenwich Yacht Club was such a hotbed of complaints and recriminations?

The defendant had engaged in communications on a club WhatsApp group and “Facebook feed”, which the claimant said gave rise to claims, and had also created a website (“barge-gate dot com”).

The defendant sought strike-out of the claims, or, in the alternative, reverse summary judgment. In short, although he failed to get strike-outs he mostly succeeded on summary judgment.

On harassment, while the defendant’s actions may well have caused the claimant “a measure of irritation…annoyance…[and] upset” there was no real prospect of showing at trial that the conduct crossed the boundary of being “oppressive and unacceptable” thus meeting the threshold of seriousness for harassment.

On the breach of confidence claim (arising from publication of an investigation report on the barge-gate website), the judge found that the claimant himself had used the information for his own purposes at a forum of the club, and this had occurred before the defendant uploaded it to the website, so the argument for confidentiality fell away.

On misuse of private information, the issues with claimant’s own disclosure of information (as with the BoC claim) “apply with equal force“ to defeat the privacy claim.

For data protection practitioners, however, there are findings of some interest. This is because the judge drew a line between processing that was out of scope of the UK GDPR, per Article 2(2)(a), because it was in the course of purely personal or household activities, and processing that could not avail itself of this carve-out. Here, the WhatsApp group and Facebook feed used by the Claimant were groups “entirely internal to the private members of the Club”, and – as the defendant submitted – his “activities of posting on social media such as WhatsApp or Facebook are quintessentially personal and household activities”.

The position was different with the barge-gate website. Here, the Article 2(2)(a) carve-out could not apply, based on the prehistoric CJEU precedent in Lindqvist that it would not be available in relation to processing “consisting in publication on the internet so that those data are made accessible to an indefinite number of people”.

It still wasn’t good news for the claimant though, because the judge then ruled (subject to further submissions from the parties) that to allow this one sole UK GDPR claim to go forward to trial would not be worth the candle (ie it would be a Jameel abuse).

Phillips v Oloffs [2026] EWHC 1821 (KB)

The views in this post (and indeed most posts on blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, judgments, Purely personal and household, UK GDPR

Tagged as data protection, UK GDPR

May 14, 2026 · 8:27 am

Anonymity application in databreach proceedings fails

Rather unsurprisingly, a rather surprising application, in databreach proceedings, for anonymity for all 2502 claimants has been dismissed by the High Court.

In Secake & Ors v Shared Services Connected Ltd (Rev1) [2026] EWHC 1022 (KB), Mr Justice Saini was asked to grant the application by claimants who are current or former members of HM Crown Forces (or partners/children of such persons).

The defendant is a processor (on behalf of the Ministry of Defence) which administers pensions schemes of the claimants, and appears to have been subject to a third party attack leading to access to and exfiltration of the claimants’ data.

The claimants submitted that unless the order sought was made, their personal details would be disclosed to the public for an indeterminate period; and to disclose the names and other personal details of the victims of a personal data breach is not a neutral thing – by placing these details in the public domain and associating them with a data breach would ‘magnify’ the victims’ ‘harm and hurt’, and strike at the their privacy right”. Additionally, because the personal details are those of HM Armed Forces, and their immediate families, in relation to their service to the country, this placed a ‘premium’ on their anonymity, because otherwise their data could be exploited by “malicious persons”, including “hostile nation states”.

Saini J had little truck with this: the application failed “by some margin”. Firstly, there was no justification for the application being made on a general basis across the whole class of claimants. Secondly, the mere fact that the claimants work or worked in the forces was wholly inadequate as evidence to assert that their Convention rights were engaged. Thirdly, the proposition that anonymity was required so as not to exacerbate the effects of the data breach had the logical extension that the same would apply to *any* data breach claim: “That would be a major and unjustified encroachment on the open justice principle”. Fourthly, no specific evidence about individual claimants’ need for anonymity had been supplied. Fifthly, the “hostile nation state” argument was pure speculation. Sixthly, an argument advanced orally by counsel that malign third parties might try to buy the claimants’ data from the hackers was also speculative.

The risks of applying a general anonymity cloak across the class was illustrated by the fact that at least four of the claimants were shown to have LinkedIn profiles which announced that they were members of HM Forces.

Finally, the judge noted that prior notice of the anonymity application should have, but had not, been provided to the media.

As the judgment records, “The principle of open justice prevails.”

The views in this post (and indeed most posts on blog) are my personal ones, and do not represent the views of any organisation I am involved with.

1 Comment

Filed under Anonymity, Data Protection, judgments, litigation, Open Justice

Tagged as data protection, litigation

March 28, 2026 · 8:29 am

Erasure request in Children Act proceedings

[reposted from my LinkedIn account]

This is a rather extraordinary judgment in Children Act proceedings in the Family Court, in which a person who is an unregistered barrister and holds herself out as a lawyer, started out as a lay advocate to mother, then put herself forward to care for all of the children, seeking three times to be joined as a party.

In her skeleton argument in support of her final application to be joined, the court established – in a now wearily familiar way – that there were a number of cases of citations and propositions that were included as a result of using a “widely known publicly available AI tool to assist her in preparing [the argument]”.

She then informed the court that she was unable to continue to offer a home for the children or be part of the proceedings, that she no longer wished to proceed with the assessment to be either a special guardian or foster carer for the children, and sought for her assessment to be “formally withdrawn”. At the same time she asked for her data and that of her family members in the court bundle to be destroyed.

Unsurprisingly, the judge declined to do so (X v The Transcription Agency LLP and another [2024] 1 WLR 33 applied).

But more than that, in a judgment in which all of the parties’ identities (including the applicant public authority) are anonymised, she has been named, with the judge saying that she is “…a person who holds herself out as a lawyer. She offers, or has offered, paid legal work to members of the public. This is an important consideration. I am satisfied having read her written submissions lodged since the hearing that [she] still does not really acknowledge or accept that her actions in not checking the citations and propositions she included in her skeleton argument were serious”.

I think it’s important to note that the judge expresses some (although by no means complete) sympathy for aspects of the person’s position and personal circumstances, and the judgment states that she has self-referred to the Bar Standards Board. For that reason, I’m not naming in her in this post itself.

A, B, C, D, Re (Extension of assessment; Use of AI: hallucinations) [2026] EWFC 71 (B)

The views in this post (and indeed most posts on blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, erasure, judgments

Tagged as data protection

February 18, 2026 · 8:50 am

Freemasonry, JR and data protection

The High Court has refused to give permission to apply for judicial review upon an application by representative bodies of Freemasons, and by two Freemasons who are serving officers in the Met Police. The respondent was the Commissioner of the same force, and the impugned decisions relate to a new policy under which police officers and staff of the Met who are or have been members of “an organisation that has confidential membership, hierarchical structures and requires members to support and protect each other” to declare that fact, confidentially, to their local professional standards unit.

Among the proposed challenges were claims that the policy was an unlawful interference with officers’ and staffs’ qualified Convention rights under Articles 8 (right to respect for private and family life), 10 (freedom of expression) and 11 (freedom of assembly). On an assumption that the policy involved an interference with these rights, at this permission stage, said the judge, the question was whether there was a real prospect that the Court would find any interference with ECHR rights not to be justified, and the “key question” was whether any interference with the rights was proportionate. He could answer that question “confidently…even at this early stage”: the interference was modest, and the factors on the other side of the scales were compelling.

There was also a challenge on data protection grounds, to the effect, in part, that there was no lawful basis identified for the processing, and nor were purposes or limitations identified. Furthermore, special category data was involved. In answer to this, the judge pointed to the Met’s “appropriate policy document” (see paras 5 and 39 of Sch 1 Data Protection Act 2018) which provided “sufficient clarity”.

The judge also – and here I think he fell into minor error – said that any individual claimants had an alternative remedy, by way of complaint to the Information Commissioner’s Office and “if still dissatisfied, an appeal to the First-tier Tribunal”: but as the authorities make clear, there is no right of appeal to the Tribunal under such circumstances (section 166 Data Protection Act 2018 only allows a data subject to apply for a steps Order, where the ICO has failed to take appropriate steps to investigate a complaint – it does not provide a right of appeal). I doubt very much, though, that this apparent slight error has any real substance in the round.

The views in this post (and indeed most posts on blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, judgments, judicial review

Tagged as data protection, judicial review

February 13, 2026 · 7:47 am

Data protection complaints – a missed opportunity

Has the Information Commissioner’s Office ducked an opportunity to improve data subjects’ rights and provide regulatory clarity to data controllers?

Section 103 of the Data (Use and Access) Act 2025, which will come into effect on 19 June this year, inserts a new section 164A into the Data Protection Act 2018. It confers a right on data subjects to make a complaint to a data controller, and imposes a duty on controllers to facilitate this, and take appropriate steps to respond to any such complaint.

Perhaps surprisingly, Parliament chose to say that controllers must acknowledge receipt of complaints within 30 days (!), but chose not to specify a time frame for actually responding to them. Instead, controllers must simply “inform the complainant of the outcome…without undue delay”.

Last year the ICO ran a consultation on draft guidance for handling data subject complaints. In their now-published summary of responses to the consultation, the ICO explained that some people who responded questioned whether the ICO should lay down some guidance for how long a controller should take to respond to a complaint. In declining to do so, the ICO says

We recognise that organisations would like us to set out a specific time period within which we expect they should investigate the complaint. The legislation says “without undue delay”, which is context dependent. We’ve therefore provided advice around how to complete the investigation “without undue delay”./This will vary from one complaint to another, and from one organisation to another. A timeframe that is justifiable for one complaint may be unjustifiable for another.

All this is true, but I don’t really buy it. Legislation will quite often provide a broad framework for a procedure, with regulators or other overseers then producing good practice guidance.

It strikes me that it would have been straightforward for the ICO to say “Complaints must be responded to without undue delay. In most cases we would expect controllers to do so within [say] 40 days. Where this timeframe is exceeded we will expect controllers to explain why this did not constitute an undue delay”.

As it is, I can readily foresee some controllers taking many months to respond. As the ICO generally won’t accept complaints themselves until the data subject has received a response from the controller, this has the potential to build in even greater delay for data subjects.

(And all that is before we get to the issue of delays at the ICO’s end, and their new approach to complaints where, in effect, they will peremptorily dismiss some.)

The views in this post (and indeed most posts on blog) are my personal ones, and do not represent the views of any organisation I am involved with.

2 Comments

Filed under Data (Use and Access) Act, Data Protection, Data Protection Act 2018, Information Commissioner

Tagged as data protection, ICO

February 7, 2026 · 9:48 am

Beware invisible law

An interesting aspect of domestic law-making is what I think of as the “invisible provisions”. Here is an example which finally made it off the statute books recently.

If, prior to the last week, you went to the Data Protection Act 1998 page on legislation dot gov dot uk, and opened the “latest version”, you would get the words:

Act repealed (except s. 62, Sch. 15 paras. 13, 15, 16, 18, 19) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 44 (with ss. 117, 209, 210, Sch. 20 paras. 2-9, 17-25, 27-46, 53, 54, 58); S.I. 2018/625, reg. 2(1)(g)

Straightforward, then? It’s all been repealed (except for some minor provisions dealing with consumer credit and interpretation of Northern Ireland access to medical records law). And “repealed” means, “no longer in force”, yes? Well, not necessarily.

Because, what you wouldn’t see anywhere on the legislation pages for the 1998 Act, is paragraph 58 of Schedule 20 to the Data Protection Act 2018 (the Act that repealed the 1998 Act), where you will see “The repeal of a provision of the 1998 Act does not affect its operation for the purposes of the Privacy and Electronic Communications (EC Directive) Regulations 2003”.

So, even though the enforcement provisions of the 1998 Act were repealed, that repeal did not affect their operation for the purposes of enforcing PECR. They remained in effect even though they were repealed.

The commencement of section 115 of the Data (Use and Access) Act 2025 finally takes PECR enforcement away from the 1998 Act.

There are myriad examples of this. Take the Freedom of Information Act 2000. Nothing in its own provisions would suggest that its enforcement provisions also apply to the Environmental Information Regulations 2004. To understand that point, you have to refer to the Regulations themselves, which say “The enforcement and appeals provisions of the Act shall apply for the purposes of these Regulations as they apply for the purposes of the Act”.

How is one meant to know if an invisible provision is affecting a statute or other instrument? The simple answer is, you will only know if you know, or if you undertake sufficiently diligent research. Some have access to expensive legal research tools, but that’s not a luxury open to all.

All I can say is that it is a potential pitfall to be aware of, for anyone advising on the law.

The views in this post (and indeed most posts on blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data (Use and Access) Act, Data Protection Act 2018, Environmental Information Regulations, FOIA, Legislation

Tagged as data protection, FOI

February 5, 2026 · 4:39 pm

DUAA commencement – what’s hot and what’s not

I’ve written for the Mishcon de Reya website on the commencement on 5 February of the majority of the data protection and eprivacy provisions of the Data (Use and Access) Act 2025:

https://www.mishcon.com/news/data-protection-and-electronic-privacy-reform-whats-hot-and-whats-not

Leave a comment

Filed under charities, Data (Use and Access) Act, Data Protection, Data Protection Act 2018, marketing, PECR, UK GDPR

Tagged as data protection, PECR

January 30, 2026 · 7:55 am

CoA: County Court is appropriate forum for routine data protection claim

This is a helpful short Court of Appeal judgment on the appropriate forum for a data protection of relatively low value and limited complexity (spoiler: it’s the County Court, folks).

The claimant had originally incorrectly issued his claim as a High Court media and communications claim in the Cardiff District Registry (if data protection claims are to be issued in the High Court, they must be issued in the King’s Bench Division at the Royal Courts of Justice). The judge in the High Court in Cardiff transferred the claim to the County Court but his order arguably contained insufficient reasons, and did not explain that either party could apply to have it set aside or varied (as required by CPR 3.3(5)(b). The claimant tried to make representations, by way of an email, as to why the High Court was the appropriate forum, but this was rejected on the basis that it had been filed in the wrong court. By that stage, the transfer to the County Court had taken effect. Accordingly, the matters arising could only be determined by way of appeal.

In its determination, the CoA found that the case (involving disclosure, in separate proceedings, of medical information by a court security guard to an usher and a solicitor for a third party) did not appear to involve any factual or legal complexity, and the claimed sum of £30,000 was clearly within the ambit of the County Court.

(I interject here to observe that, on the brief facts as recorded in the judgment, there might have been some legal complexity – it seems likely that the disclosure would have been made orally by the security guard, so was there “processing” involved?)

Wysokinski v OCS Security Ltd [2026] EWCA Civ 26

The views in this post (and indeed most posts on blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, Data Protection Act 2018, judgments, UK GDPR

Tagged as data protection

Tag Archives: data protection

Anonymity application in databreach proceedings fails

Erasure request in Children Act proceedings

Freemasonry, JR and data protection

Data protection complaints – a missed opportunity

Beware invisible law

Blogroll

Recent Posts

Follow Blog via Email

RSS Links

Privacy Notice