Michael Ashley v The Commissioners for HMRC [2025] EWHC 134 (KB)

[2025] EWHC 134 (KB)Case No KB-2024-000136
IN THE HIGH COURT OF JUSTICE
KING'S BENCH DIVISION
Venue Royal Courts of Justice, Strand, London, WC2A 2LLDate 24/01/2025
Before
MRS JUSTICE HEATHER WILLIAMS DBE
Between
MICHAEL ASHLEYClaimantTHE COMMISSIONERS FOR HIS MAJESTY'S REVENUE AND CUSTOMSDefendant
Anya Proops KC and Zac Sammour (instructed by Reynolds Porter Chamberlain LLP) for ClaimantJames Cornwell (instructed by HMRC Solicitors Office and Legal Services) for DefendantHearing Hearing dates: 2 December and 3 December 2024
Approved JudgmentThis judgment was handed down remotely at 10.30am on 27 January 2025 by circulation to the parties or their representatives by e-mail and by release to the National Archives..............................MRS JUSTICE HEATHER WILLIAMS

Introduction

[1]Mr Ashley claims that the Defendant has breached his subject access rights under Article 15 of the UK GDPR. The claim arises from a subject access request which he made through his solicitors on 13 September 2022 (the “SAR”). By the SAR, he sought access to his personal data processed by HMRC in connection with its enquiry into his tax return for the 2011/12 tax year (the “Enquiry”). The Enquiry was conducted by the Defendant’s Wealthy and Mid-Size Business Compliance department (“the WMBC”).[2]The parties agreed that the claim could be brought under the CPR Part 8 procedure as the material facts were not in dispute.[3]Following the issue of proceedings, the Defendant provided the Claimant with a schedule of his personal data extracted from 118 documents on 15 February 2024 (“Schedule 1”). A second schedule containing additional personal data extracted from 180 documents was provided on 28 February 2024 (“Schedule 2”). On 2 July 2024, the Defendant provided a further version of Schedule 2 containing additional personal data from 19 documents (“Schedule 3”). On 15 October 2024, the Defendant provided a schedule of additional personal data extracted from a further 15 documents (“Schedule 4”). Schedules 1 – 4 related to data processed by the WMBC. On 15 October 2024, the Defendant also provided a schedule of personal data extracted from 311 documents held by the Valuation Office Agency (the “VOA”), an executive agency within HMRC.[4]In general terms, when a subject access request is made, Article 15(3) of the UK GDPR requires a data controller to provide a data subject with a copy of their personal data undergoing processing. HMRC now accepts that it breached its obligations under Article 15(3) in its handling of the SAR by reason of its failure between 5 December 2022 and 2 July 2024 to provide Mr Ashley with copies of his personal data. In particular, it accepts that the personal data that was disclosed by Schedules 1 – 3 ought to have been disclosed by 5 December 2022. HMRC also accepts that it acted unlawfully by failing to disclose the information required by Article 15(1)(a)-(f) as to its data processing until its letter of 14 March 2024 (the “14 March letter”).[5]However, a number of matters remain in dispute between the parties, including the scope of the SAR, the extent of the search that the Defendant was required to undertake and whether copies of all of Mr Ashley’s personal data that it processed have been provided to him. The latter dispute involves the Court considering the meaning of “personal data”, as defined in Article 4(1) of the UK GDPR. Mr Cornwell maintains that the Defendant’s obligation to provide copies of Mr Ashley’s personal data was satisfied by the provision of Schedules 1 – 4, with Schedule 5 being disclosed on a gratuitous basis; whereas Ms Proops KC submits that Mr Ashley’s personal data extends to the Enquiry’s assessment of his tax liability, so that (subject to any applicable exemptions) HMRC is obliged to provide full copies of the investigation and assessment documentation that it holds.[6]The parties prepared a helpful List of Common Ground and Issues (the “List of Issues”). During the hearing it underwent some amendment. By the time that submissions concluded, the agreed issues for the Court to resolve were as follows:
“Issue 1 – Was the SAR limited to the Claimant’s personal data pertaining to the Enquiry as processed within the WMBC, or did it also include such data where it was being processed more widely by HMRC, including by the VOA? Issue 2 - Application of Article 4(1) UK GDPR: Does data that relates to the Defendant’s assessment of the Claimant’s tax liability in the context of the Enquiry amount to the Claimant’s ‘personal data’, as defined in Article 4(1) UK GDPR? If not, in what circumstances does that data amount to the Claimant’s personal data? Issue 3 - Reasonable and proportionate searches: Was HMRC obliged to search for the Claimant’s personal data pertaining to the Enquiry as processed by the VOA? Issue 4 - Provision of copies of the Claimant’s personal data under Article 15(3) UK GDPR: Issue 4(a) - Having breached its obligation under Article 15(3) UK GDPR in its handling of the SAR between the period 5 December 2022 and 2 July 2024 by failing to provide the Claimant with copies of his personal data during that period, did the Defendant remain in breach of those obligations after 2 July 2024 (in particular after it had provided the Claimant with Schedule 2 on 28 February 2024), whether as a result of: (i) its having applied the concept of ‘personal data’ provided for in Article 4(1) unduly narrowly (as addressed in Issue 2 above) and/or (ii) its having failed to conduct reasonable and proportionate searches to identify the personal data of the Claimant falling within the scope of the SAR (as addressed in Issue 3 above); and/or (iii) its having wrongfully treated the Claimant’s personal data (as comprised within documents 5 and 115 of Schedule 1) as falling within the scope of the First Tax Exemption. In particular, would disclosure of that data to the Claimant under Article 15 UK GDPR both: 1. ‘provide an insight into HMRC’s position with regard to settlement of the tax due at the time’ (as claimed by the Defendant) and 2. as a result, amount to a disclosure likely to prejudice the assessment or collection of a tax or duty or an imposition of a similar nature? Issue 4(b) - Is the Defendant in breach of its obligations under Article 15(3) UK GDPR (read with Article 12(1)) by failing to provide the Claimant with his personal data in Schedules 1-4 in a concise, transparent and intelligible manner?” (i) its having applied the concept of ‘personal data’ provided for in Article 4(1) unduly narrowly (as addressed in Issue 2 above) and/or (ii) its having failed to conduct reasonable and proportionate searches to identify the personal data of the Claimant falling within the scope of the SAR (as addressed in Issue 3 above); and/or (iii) its having wrongfully treated the Claimant’s personal data (as comprised within documents 5 and 115 of Schedule 1) as falling within the scope of the First Tax Exemption. In particular, would disclosure of that data to the Claimant under Article 15 UK GDPR both: 1. ‘provide an insight into HMRC’s position with regard to settlement of the tax due at the time’ (as claimed by the Defendant) and 2. as a result, amount to a disclosure likely to prejudice the assessment or collection of a tax or duty or an imposition of a similar nature? Issue 4(b) - Is the Defendant in breach of its obligations under Article 15(3) UK GDPR (read with Article 12(1)) by failing to provide the Claimant with his personal data in Schedules 1-4 in a concise, transparent and intelligible manner?”
[7]It was agreed that Issue 3 only arose if I decided Issue 1 in the Claimant’s favour.[8]The reference in Issue 4(a)(iii) to the “First Tax Exemption” was the parties’ shorthand (which I will also use) for the Defendant’s reliance upon para 2 of Schedule 2 to the Data Protection Act 2018 (“DPA 2018”) in respect of a small passage of text appearing in two of the Schedule 1 documents. The parties were agreed that a closed procedure was required for the Court to be able to decide this issue. Accordingly, the two documents were made available to the Court (along with a further document that Mr Ashley had asked to be included), but not to the Claimant. After both parties had made open submissions on the applicable legal principles and the context, I heard brief submissions from Mr Cornwell in a closed session. These submissions lasted less than 10 minutes and in so far as counsel had raised matters that could properly be raised publicly, I relayed them once the hearing in open Court had resumed. No evidence was given in the closed session. In the circumstances, I was satisfied that this short, closed session was necessary for me to decide whether the Defendant was right to rely on the First Tax Exemption and that it was a proportionate interference with the fundamental principle of open justice. As will be apparent when I come to address it, having seen the documents, I am able to address Issue 4(a)(iii) in this open judgment (and, for the avoidance of doubt, there is no separate closed judgment).[9]Until the second day of the hearing, the list also included an Issue 5. By the start of the hearing this was focused upon whether the Defendant was required to identify the recipients of Mr Ashley’s personal data at an individual level (rather than simply by category), where it had been disclosed to individuals external to HMRC. However, upon Mr Cornwell confirming that Mr Ashley’s personal data had not been disclosed outside of HMRC, it was agreed that this issue fell away. The original List of Issues also contained Issues 6 and 7 relating to remedies (the terms of declaratory relief and whether the Court should make a compliance order under section 167 of the DPA 2018). However, I indicated at the outset of the hearing that I would consider remedies and other consequential matters after I had handed down judgment on the issues relating to liability. Both parties were content with this course.[10]A further potential issue was footnoted by the Claimant to Issue 3. This concerns whether HMRC’s search for the personal data of Mr Ashley that it processed should have extended to individual email accounts of HMRC employees working in the WMBC, including in particular Mr Garside who was responsible for the Enquiry from July 2022. Mr Garside subsequently left HMRC and it is understood that his email account has been deleted. The Defendant’s position is that searches of individual email accounts were unnecessary as employees would have stored all of the documentation, including emails, on the WMBC folder (described at paras 35 and 36 below). Ms Proops preferred to reserve Mr Ashley’s rights in respect of this, as his current concerns may be allayed by further personal data disclosed as a result of this Court’s determination of the current issues. Mr Cornwell did not object to this course.[11]The Claimant relied upon witness statements from:(i) himself dated 11 January 2024 (“Ashley 1”);(ii) Rupert Cowper-Coles, a partner at Reynolds Porter Chamberlain LLP (“RPC”), the Claimant’s solicitors, dated 12 January 2024 (“Cowper-Coles 1”); and(iii) Robert Waterson, dated 5 April 2024, also a partner at RPC at the time of his statement (“Waterson 1”). The Defendant relied upon: (i) two statements from Alexander Kempell, a Customer Compliance Manager at HMRC, dated 28 February 2024 and 15 October 2024 (“Kempell 1” and “Kempell 2”); (ii) a statement from Nishat Choudhury, a lawyer at HMRC, dated 3 July 2024 (“Choudhury 1”); (iii) a statement from Rebecca Pitt, employed within the Land Portfolio Valuation Unit (“LPVU”) of the VOA’s District Valuer Services, dated 3 October 2024 (“Pitt 1”); and(iv) a statement from Alison Jayne Fox, employed within the Information Rights and Ministerial Correspondence Team at the VOA, dated 1 October 2024 (“Fox 1”).[12]The structure of this judgment is as follows: The factual circumstances: paras 13 – 56: The “common ground”: paras 15 – 25 The Enquiry: paras 26 – 32 The SAR and HMRC’s response: paras 33 – 45 The VOA: paras 46 – 52 The exemptions: paras 53 – 56 The legal framework: paras 57 – 134: The UK GDPR and the DPA 2018 provisions: paras 58 – 73 Personal data: paras 74 – 124 Responding to a subject access request: paras 125 – 132 The First Tax Exemption: paras 133 – 134 Issue 1: scope of the SAR: paras 135 – 146: Summary of the submissions: paras 135 – 138 Analysis and conclusions: paras 139 – 146 Issue 2: the Claimant’s personal data: paras 147 – 184: Summary of the submissions: paras 147 – 152 Analysis and conclusions: paras 153 – 184 Issue 3: extent of the Defendant’s search for personal data: paras 185 – 194: Summary of the submissions: paras 185 – 188 Analysis and conclusions: paras 189 – 194 Issue 4(a): the First Tax Exemption: paras 195 – 200: Summary of the submissions: paras 196 – 197 Analysis and conclusions: paras 198 – 200 Issue 4(b): provision of personal data in a concise, transparent and intelligible manner: paras 201 – 210: Summary of the submissions: paras 201 – 203 Analysis and conclusions: paras 204 – 210 Outcome and consequential matters: paras 211 – 213

The factual circumstances

[13]I will begin by reproducing the parties’ account of their common ground as set out in the List of Issues (omitting passages that I have already covered in my Introduction). I will then summarise additional uncontentious material from the witness statements.[14]When counsel sought to address me orally on disputed factual issues relating to the quality of the Enquiry and the conclusions that it arrived at, I made clear that I would not be addressing those matters in this judgment. As the parties had agreed to adopt the Part 8 procedure and no live evidence had been called, I am not in a position to form a view on such matters and do not do so. Moreover, I do not need to do so in order to determine the issues that are properly before the Court at this stage. However, to give a brief flavour, the Claimant says that he exercised his right of subject access “in the hope that this would enable me to get to the bottom of how it had come about that HMRC had, over a period of years, made such clearly wrong and unfair decisions concerning my tax liabilities” (para 1, Ashley 1); whereas, Mr Kempell does not accept any error or wrongdoing on the part of HMRC.

The “common ground”

[15]The Claimant is an individual and a data subject within the meaning of Article 4 of the UK GDPR.[16]Between February 2014 and October 2016, the Defendant undertook the Enquiry into the Claimant’s tax return for the year ending on 5 April 2012. In October 2016, the Defendant issued a closure notice under s.28A of the Taxes Management Act 1970 (the “Closure Notice”)in which it concluded that the properties had been sold by the Claimant at an overvalue, meaning he had obtained a taxable benefit, giving rise to a tax liability of c.£13.6 million.. On 23 November 2016, the Claimant appealed against the Closure Notice. On 8 December 2016, the appeal against the Closure Notice was acknowledged and the tax due was postponed. The parties then entered into discussion, and the Closure Notice was withdrawn on 21 October 2022 (the “Notice Withdrawal”).[17]In the course of the Enquiry and the subsequent dispute between the parties regarding the Closure Notice, the Defendant processed the Claimant’s personal data. Following the Notice Withdrawal, the Defendant continued to process the Claimant’s personal data. The Defendant is a data controller, within the meaning of Article 4 of the UK GDPR, in respect of such personal data.[18]On 13 September 2022, the Claimant (acting through his solicitors) made the SAR under Article 15 of the UK GDPR in the following terms:
“Please take this email as notification of a Subject Access Request on behalf of our client pursuant to Article 15 of the UK General Data Protection Regulation. Please provide a copy of all information held in relation to our client since the inception of HMRC's enquiry into our client's 2011/12 SATR, to date. For the avoidance of doubt, we require a copy of any and all data held in relation to HMRC's enquiry that pertains to our client.” (Emphasis in original.)
[19]The Defendant provided its substantive response to that request on 5 December 2022. It refused to disclose any copies of any of the Claimant’s personal data that it held, save that it offered to provide the Claimant with copies of inter-partes correspondence between his representatives and the Defendant (the “First SAR Decision”). With respect to the personal data it had withheld, the Defendant claimed that it was lawfully entitled to withhold those data on an application of the exemptions provided for in paras 2 and 3 of Schedule 2 to the DPA 2018.[20]The Defendant conducted an independent review into the First SAR Decision (the “Review”). The Defendant informed the Claimant of the result of the Review on 12 January 2023. The Review maintained the First SAR Decision, and explained that no further information could be provided to the Claimant pursuant to his SAR. The Defendant also relied, at that stage, on exemptions provided pursuant to paragraph 19 of Schedule 2 to the DPA 2018 in respect of legal professional privilege in relation to a “handful of documents” (the “LPP Exemption”).[21]In response to a letter before claim from the Claimant dated 17 February 2023, the Defendant maintained the position in its pre-action response letter dated 13 April 2023. The Claimant again wrote to the Defendant on 15 November 2023 intimating an intention to commence proceedings to which the Defendant responded on 27 November 2023 expressing an intention to respond by 22 December 2023. On 22 December 2023 the Defendant wrote again stating, inter alia, that it was not yet in a position to provide a full response, but it had revised its position and was further reviewing the information that it held to identify non-exempt personal data that could be disclosed and would provide another update to the Claimant “early in the New Year” as to the anticipated timescale. The Claimant issued the present claim on 12 January 2024.[22]The Defendant asserted in respect of Schedules 1 and 2 that it is entitled to withhold personal data in 53 documents under the LPP Exemption, and in two documents under the First Tax Exemption. The Claimant does not take issue with the withholding of his data pursuant to the LPP Exemption.[23]On 14 March 2024, the Defendant wrote to the Claimant stating, inter alia that the purpose of its processing of the Claimant’s personal data was to “comply with a legal obligation and [as] necessary for the performance of a task carried out in the public interest or in the exercise of [its]official authority as a government department”, and that it was now also processing his personal data in connection with the legal proceedings that he had initiated. The letter also provided certain information as to the categories of recipients of the Claimant’s personal data.[24]On 2 July 2024, the Defendant wrote to the Claimant stating, inter alia, that one of the schedules provided on 28 February 2024 was “missing a number of entries”, providing Schedule 3 and profusely apologising for the error.[25]On 15 October 2024, the Defendant served supplemental evidence on the Claimant, in the form of Kempell 2, Pitt 1 and Fox 1. Through this evidence, the Defendant: i) confirmed that, in June 2024, it had instructed its VOA to assess the extent to which it was processing personal data relating to the Claimant concerning the Enquiry; ii) provided further personal data pertaining to the Claimant, as derived from the VOA’s records, such data being comprised within Schedule 5; and iii) made clear that it was proceeding on the basis that it had not at any point been obliged under Article 15 to search for/disclose the Claimant’s personal data pertaining to the Enquiry as processed by the VOA because(i) the SAR fell to be construed as pertaining only to such of the Claimant’s personal data as processed within the WMBC, and(ii) it had in any event been entitled not to search the VOA records on the basis that this would have exceeded what was required by way of reasonable and proportionate searches in response to the SAR.

The Enquiry

[26]On 20 April 2012, a number of Special Purpose Vehicle companies (the “SPVs”), which were owned by Sports Direct International Plc (“SDI”), purchased 32 properties owned by Mr Ashley. Ashley 1 explains that although the Claimant founded the Sports Direct business, he was not involved in any SDI Board discussions on these transactions.[27]On 23 April 2013, HMRC received the Claimant’s Self Assessment for the tax year ending on 5 April 2012. This return reported that he had disposed of the 32 properties on 6 September 2011. In February 2014 HMRC opened an enquiry into Mr Ashley’s return for this year under section 9A of the Taxes Management Act 1970.[28]Following investigation, HMRC asserted that the amount which SDI had paid for the properties (£86.8 million) was an overvalue, as they were collectively worth only £60 million and that, accordingly, a benefit had been conferred on the Claimant under sections 201 – 203 of the Income Tax (Earnings and Pensions) Act 2003. As part of its investigation, HMRC instructed the VOA to provide independent valuations of the properties. Ms Pitt explains that individual valuations were prepared on each of the 32 properties and that after she had reviewed and collated the valuations to arrive at a total value for the portfolio, negotiations took place to see if these could be agreed with Mr Ashley. Grant Thornton (his then accountants) were provided with a summary of each of the valuations. Subsequently, additional details were provided in relation to seven of the properties. As agreement could not be reached, in August 2016, the VOA provided the WMBC with a “Defendable on Appeal” report which concluded that the appropriate valuation of the properties was £60 million. Ms Pitt says that this report is a confidential document provided for HMRC’s internal use only, to assist HMRC in considering whether to pursue a valuation to litigation. Ms Pitt subsequently provided Grant Thornton with a table setting out all the figures that had been used in the valuations and an explanation of the methodology that the VOA had employed to value the properties occupied by SDI and those let to third-party tenants.[29]Upon receipt of the report from the VOA, HMRC issued the Closure Notice that I have referred to at para 16 above. The Claimant disputed the Closure Notice on the basis that the properties were purchased for a fair price in an arm’s length transaction. Between November 2016 and April 2022, the Claimant’s solicitors (who wereDentons and then subsequently RPC), were in discussions with various individuals at HMRC and a number of meetings took place.[30]In April 2022 Mr Ashley was offered the opportunity to have the matter reviewed by a HMRC officer not previously involved in the case. This was accepted and Robert Martindale, a HMRC Customer Compliance Officer, undertook the review. Mr Garside took over from him in July 2022 upon Mr Martindale’s retirement. Both of these officers were line managed by Martyn Pattinson.[31]Ashley 1 says that on 29 June 2022 the Claimant’s solicitors met with Mr Martindale, who said that HMRC accepted that the basis of the Closure Notice was incorrect and that the matter could be closed via the issue of a further notice. Kempell 1 explains this view was arrived at because Mr Martindale accepted RPC’s contention that as Mr Ashley was not an employee of the SPVs which had acquired the properties, no tax charge could arise. However, after Mr Garside took over, he indicated that the matter could not be formally closed until HMRC’s Dispute Resolution Board had met (in October 2022) to confirm Mr Martindale’s conclusion. Kempell 1 explains that Mr Garside then came to the view that a third-party benefit still applied, given Mr Ashley’s ultimate employment with SDI Property Ltd, the parent company of the SPVs. This was communicated to RPC during a phone call on 9 September 2022, where Mr Garside stated that HMRC would be maintaining their position that the properties were sold at an overvalue. The SAR was made a few days later.[32]On 20 September 2022, RPC submitted a further ground of appeal, indicating that although the sale of the properties had begun during the year ending on 5 April 2012, the purchases were not completed until 20 April 2012. Accordingly, the relevant year of assessment was the tax year ending on 5 April 2013. Kempell 1 says that HMRC did not have an open enquiry into this later year and were out of time to raise an assessment in respect of it and this was what led to the Notice Withdrawal.

The SAR and HMRC’s response

[33]The SAR was contained in an email sent by Mr Waterson on 13 September 2022 to Mr Pattinson, copying in Mr Garside. The majority of the email took issue with the changed position that Mr Garside had communicated during the 9 September 2022 phone call, complaining that it was “unacceptable” in light of the recent history. Mr Pattinson was asked to confirm that the matter was still going before the Dispute Resolution Board on 13 October 2022 and asked to provide details of the most recent advice that HMRC had obtained. The last substantive paragraph of the letter was headed “Subject Access Request” and then contained the text quoted at para 18 above. The paragraph concluded by saying that the information must be provided within one month of the date of the email, namely by 12 October 2022.[34]HMRC replied indicating that it required the additional two months that the legislation permitted for complex requests. Mr Kempell says that when the SAR was received, Mr Garside undertook a review of all the documents that the WMBC held in relation to the Enquiry. HMRC does not have a central team that deals with responses to subject access requests and the standard process is for the response to be undertaken by the relevant business area. In this instance the relevant business area was the WMBC, as it had dealt with the Enquiry.[35]Kempell 2 describes how the Enquiry material was held by HMRC. The WMBC previously had a Controlled Access Folder (“CAF”) for each person it was considering. A CAF contained multiple folders, each representing an individual tax year. Accordingly, there was a particular folder for this Enquiry into Mr Ashley’s tax return for the year ending on 5 April 2012. CAFs were electronic files, and prior to their use, documents were generally held within paper files. In September 2021, all of the CAFs held by the WMBC were migrated over to SharePoint and the system remained that there would be a separate folder for each tax year. The documentation held in the folder would include copies of all correspondence (external and internal), case reviews, requests for and responses to advice from internal stakeholders within HMRC and other procedural documentation. Mr Kempell considers that these are the documents that Mr Garside would have reviewed in responses to the SAR. The Claimant’s folder for the 2011/12 tax year contains seven subfolders and comprises over 1,000 documents. At this stage, the search did not extend beyond the folder held by the WMBC.[36]Mr Kempell says that all of the documents held by the WMBC relevant to the Claimant’s 2011/12 tax return would have been saved in this folder. It is a requirement and standard practice within the WMBC to do this in respect of all emails sent and received and all other documents generated or received. This would include any emails or other documents received from the VOA. He indicates that he has seen nothing to suggest that this standard approach was not followed in the present case.[37]Mr Garside listed the documents in a disclosure log, catalogued according to whether they contained any personal data, were previous correspondence and whether any of the exemptions in Schedule 2 of the DPA 2018 applied. The disclosure log was also used by Owen Jones in conducting the Review.[38]In response to the First SAR Decision, RPC indicated that it did not seek copies of the correspondence between the parties.[39]The letter of 13 April 2023 indicated that HMRC was treating the SAR request as “a request for a copy of any and all data held in relation to HMRC’s enquiry into your client’s 2011/12 SATR that pertains to your client”. RPC was asked to indicate if the SAR was wider than this. This does not seem to have received a response in RPC’s subsequent correspondence. However, I do not regard this as significant, since it appears that RPC was proceeding on the assumption that references to “HMRC” included the VOA, whereas the Defendant was proceeding on the basis that the search request only related to the data that was processed by the WMBC and that “HMRC” did not include the VOA for these purposes.[40]RPC’s letter before claim of 15 November 2023 asserted that HMRC had taken too narrow an approach to “personal data” and that its earlier correspondence disclosed an erroneous approach focusing on which “documents” were disclosable or exempt, rather than asking whether and to what extent Mr Ashley’s personal data was contained within documents held by HMRC and should be provided. In its response of 22 December 2023, HMRC accepted that it had erred in its approach to “documents”, particularly when considering whether any of the exemptions applied. HMRC indicated that it would undertake a further review.[41]The further review is described in Kempell 1 and Kempell 2. The first step was a review of all the documentation containing personal data that had previously been categorised as covered by the Schedule 2, para 2 or para 3 DPA 2018 exemptions. Personal data was extracted from the documents and recorded on a separate schedule before consideration was then given to whether the exemptions applied to this data. This led to the compilation and disclosure of Schedule 1. Given the incorrect “document-based” approach that HMRC had taken earlier, a further review was also conducted of all documents that were previously identified as containing no personal data. This process led to the compilation and disclosure of Schedule 2.[42]The 14 March letter said that the personal data processed in respect of the 2011/12 tax return related to Mr Ashley’s “income, capital disposals, business activities, business properties, National Insurance Number, name, address, contact details and employment information”. The letter also indicated that: the only recipients of the Claimant’s personal data were the listed departments within HMRC, the VOA and his tax agents and legal representatives; the standard default period for retention of HMRC records was 6 years plus the current year; and the personal data had predominantly been collected from Mr Ashley or his respective agents, although some personal data had been generated within HMRC for the purposes of the Enquiry. An electronic link was provided to HMRC’s Privacy Notice.[43]Choudhury 1 explains that Schedule 3 was prepared in July 2024 because Mr Kempell noticed that the schedule served in February 2024 was an earlier draft of the document, rather than the finalised version, and had some items missing.[44]Kempell 2 also addresses the nature of the additional personal data that was disclosed on 15 October 2024 in Schedule 4. Mr Kempell reviewed the documentation in light of points made in Waterson 1 and this resulted in him identifying the further material that he describes.[45]Mr Kempell says that the WMBC spent over 150 hours in identifying and extracting Mr Ashley’s personal data across the various reviews that were undertaken.

The VOA

[46]The Defendant accepts that HMRC is the data controller of personal data that is processed by the VOA. However, Mr Kempell says that the VOA has its own team who deal with subject access requests, so that it is not normal practice for HMRC to liaise with the VOA when a subject access request is received by them, or vice versa. In this instance the SAR was sent directly to the WMBC, who did not consider that the VOA was intended to be within its scope.[47]Kempell 2 and Fox 1 explain that the VOA was approached by HMRC in June 2024 to conduct an assessment of the personal data that it held in relation to the Claimant and the Enquiry, in case the Court decided that this material was within the scope of the SAR. From this it emerged that the VOA held a large amount of material and documents in relation to their valuations of the properties, some of which contained the Claimant’s personal data.[48]Ms Fox describes the documentation held by the VOA. There are 33 electronic main folders for the 32 properties that were the subject of the valuations (with one of the properties having two main folders). Each of these folders contains sub-folders, so that, in total, there are 65 folders for the 32 properties. There are approximately 7,347 pages in total, including duplicate documents. The folders include: instructions from, correspondence with and reports to the LPVU; valuation research and workings; internal VOA correspondence; and internal procedural documentation. She explains that there is also a master file comprising 1,785 pages. These were extracted from an out-housed storage facility and scanned onto the VOA’s system. This documentation includes: correspondence with HMRC; correspondence with the Claimant’s agents; correspondence with the local District Valuer who provided the individual property valuations; internal records of discussions about the valuations and technical advice; and copies of various valuation reports provided by the Claimant’s agents.[49]Ms Pitt clarifies that all of the valuations include the identification and analysis of comparable evidence, including details of property transactions by unconnected third parties who have no interest in or awareness of these valuations. The comparable information is derived from various sources including the VOA’s internal database.[50]Ms Fox explains that information relating to the internal operations of the VOA and that relating to third parties or their properties was not considered the Claimant’s personal data. She says that Schedule 5 also excludes data that the VOA were able to identify as duplicates of information already provided to the Claimant in the earlier WMBC schedules.[51]Ms Fox says that the exercise of searching for the Claimant’s personal data, extracting it and preparing Schedule 5 has taken her team 165.5 hours and that she has spent an additional 20 hours on the exercise herself.[52]I mention for completeness that Kempell 2 confirms that no search has been made of documents held by HMRC’s Large Business team. However, as no complaint has been made about this aspect, it is unnecessary for me to describe the material held by that team.

The exemptions

[53]By the time of the hearing, the Defendant no longer relied upon the exemption contained in para 3 of Schedule 2 to the DPA 2018.[54]Reliance on the First Tax Exemption was explained in HMRC’s letter of 13 April 2023 as follows:
“You have questioned how the provision of your client’s personal data could prejudice the collection of tax as no further tax can be collected in relation to this matter. As set out in our letter of 12 January 2023, prejudice in this regard does not relate solely to your client’s tax affairs but to HMRC’s wider function in the assessment and collection of tax. The prejudice here is disclosing information that could assist in artificially lowering any future liability, rather than prejudicing any current assessment or collection activities. If these documents are disclosed, this will give an indication as to what HMRC considers when looking to determine whether a benefit should be charged and therefore resulting in a prejudice to the assessment and collection of tax.”
[55]The First Tax Exemption was also addressed at para 37 of Kempell 1, as follows:
“…disclosure to Mr Ashley would be likely to prejudice the assessment or collection of tax. The prejudice in this regard does not have to solely relate to a customer’s tax affairs but can relate to HMRC’s wider functions in the assessment and collection of tax. In this case, the disclosure of personal data…would provide an insight into HMRC’s position with regard to settlement of the tax due at the time.”
[56]As clarified during the hearing, the First Tax Exemption is claimed in respect of the same short phrase that appears in two iterations of the VOA’s “Defendable on Appeal Report – Case Summary”.

The legal framework

[57]The GDPR (Regulation (EU) 2016/679) came into force on 25 May 2018 and remained the data protection regime in the United Kingdom until 31 December 2020 (the end of the transitional period that followed the United Kingdom leaving the EU). From that point onwards, a modified data protection regime, the UK GDPR, came into effect. I will focus on the UK GDPR as the regime in force during the time that I am concerned with, but counsel have not suggested that for present purposes there is any material distinction between the GDPR and the UK GDPR. The DPA 2018 also came into force on 25 May 2018. A number of the cases that I need to refer to were decided under the earlier Data Protection Act 1998 (“DPA 1998”) regime, which implemented EU Directive 95/46/EC (the “Directive”).

The UK GDPR and the DPA 2018 provisions

[58]Article 4(1) defines “personal data” as follows: “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more of the factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.[59]Article 4(2) defines “processing”: “‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”.[60]Article 4(7) defines a controller:
“‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data…”
[61]Article 5 sets out the principles relating to the processing of personal data. In summary, they are that personal data shall be:(a) processed lawfully, fairly and transparently;(b) collected for specified, explicit and legitimate purposes;(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;(d) accurate and, where necessary, kept up to date;(e) kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed; and(f) processed in a manner that ensures appropriate security of the personal data. Article 5(2) states that the controller shall be responsible for and be able to demonstrate compliance with these principles. Article 6(1) provides that processing shall be lawful only if and to the extent that one of the purposes identified at (a) to (f) applies.[62]Article 12 is headed “Transparent information, communication and modalities for the exercise of the rights of the data subject”. As relevant, it provides:
“1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communications under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language… 2. The controller shall facilitate the exercise of data subject rights under Articles 15 to 22… 3. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. The period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay… ….. 5. …Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee for taking into account the administrative costs of providing the information or communication or taking the action required; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.”
[63]Articles 13 and 14 are concerned with information that is to be provided by the controller when personal data is obtained. Article 15 is at the heart of this case. It is headed “Right of access by the data subject” and (as relevant) states: “1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:a. the purpose of the processing;b. the categories of personal data concerned;c. the recipients or categories of recipients to whom the personal data has been or will be disclosed…d. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;e. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;f. the right to lodge a complaint with the Commissioner;g. where the personal data are not collected from the data subject, any available information as to their source;h. the existence of automated decision-making, including profiling referred to in Article 22(1) and (4)… ….. 3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.” a. the purpose of the processing; b. the categories of personal data concerned; c. the recipients or categories of recipients to whom the personal data has been or will be disclosed… d. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; f. the right to lodge a complaint with the Commissioner; g. where the personal data are not collected from the data subject, any available information as to their source; h. the existence of automated decision-making, including profiling referred to in Article 22(1) and (4)…[64]The UK GDPR does not prescribe any particular means or format by which a subject access request is to be made. A request can be made in a written or oral form and there are no specific requirements regarding the way that it is sent to the controller or the controller’s address that is to be used.[65]In The Information Commissioner v Experian Limited [2024] UKUT 105 (ACC), a case concerned with the obligations in Articles 5 and 14 of the GDPR, a Presidential Panel of the Upper Tribunal (Administrative Appeals Chamber) considered the GDPR transparency requirements. The Panel’s summary (at para 95) included:
“a. there is an overarching obligation to process personal data in a transparent manner in relation to the data subject; b. it is achieved, principally, by providing information to data subjects about how their personal data is being processed; c. it is a lynchpin of, or gateway to, the GDPR, because, without this information, data subjects cannot enforce the rights afforded them under the GDPR to have their personal data protected…”
[66]Rights to rectification, erasure, restriction of processing and data portability are contained in Articles 16 – 20 of the UK GDPR.[67]Article 23(1) provides that the Secretary of State may restrict the scope of the obligations and rights provided for in Articles 12 – 22 “when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard” one of a number of matters that are then listed, including “taxation matters”.[68]The exemptions are contained in Schedules to the DPA 2018. This statute defines “personal data” in a slightly different way to the UK GDPR, as:
“any information relating to an identified or identifiable living individual”
. Counsel did not suggest that anything turned on this. Section 15(1) and (2)(b) indicate that Schedule 2 makes provision restricting the application of the rules contained in Articles 13 – 21 of the UK GDPR in the circumstances described in Article 23(1).[69]Schedule 2, para 2 of the DPA 2018 is headed “Crime and taxation: general” and (as relevant) provides: “(1) The listed GDPR provisions…do not apply to personal data processed for any of the following purposes –(a) the prevention or detection of crime;(b) the apprehension or prosecution of offenders; or(c) the assessment or collection of a tax or duty or an imposition of a similar nature, to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) to (c).” (a) the prevention or detection of crime; (b) the apprehension or prosecution of offenders; or (c) the assessment or collection of a tax or duty or an imposition of a similar nature,[70]Schedule 2, para 1(1)(a)(iii) indicates that “The listed GDPR provisions” includes Article 15(1) and (3).[71]Where a Court is satisfied that there has been an infringement of the data subject’s rights, the court may make an order for the purposes of securing compliance with the data protection legislation (section 167 of the DPA 2018).[72]It is well established that the recitals to a directive or regulation are an aid to its interpretation. The recitals to the UK GDPR include the following:
“(1) The protection of natural persons in relation to the processing of personal data is a fundamental right… (2) The principles and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data…. (3) Directive 95/46/EC…seeks to harmonise the protection of fundamental rights and freedoms of natural persons in respect of processing activities… (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person…The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable… (63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing…Every data subject should therefore have the right to know and obtain communications in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing.”
[73]I add for completeness that section 18(1) of the Commissioners for Revenue and Customs Act 2005 provides that Revenue and Customs officials may not disclose information held by the Revenue and Customs in connection with a function of the Revenue and Customs. However, subsection (3) provides that this obligation is subject to any other enactment permitting disclosure.

Personal data

[74]The Article 4(1) definition of “personal data” (para 58 above) contains four cumulative elements, namely that there is “any information” “relating to” “an identified or indefinable” “natural person”. There is no dispute that the material in this case constitutes information and no dispute that (in so far as it does relate to him), the Claimant is identified or identifiable and a natural person. The key issue for present purposes is the scope and meaning of “relating to”.[75]A similar phrase was used in the earlier legislative provisions. The Directive defined personal data in Article 2(a) as: “…any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly by reference to an identification number or one or more factors specific to his physical, physiological, mental, economic, cultural or social identity”.[76]Section 1(1) of the DPA 1998 used the following definition: “‘personal data’ means data which relates to a living individual who can be identified –(a) from those data; or(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intention of the data controller or any other person in respect of the individual”. (a) from those data; or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intention of the data controller or any other person in respect of the individual”.[77]I will review the relevant domestic and EU caselaw in chronological order, not least because there is some difference in emphasis in the later authorities.

Durant v Financial Services Authority

[78]I begin with Durant v Financial Services Authority [2003] EWCA Civ 1746, [2004] FSR 28 (“Durant”) which Mr Cornwell relies upon as supporting the Defendant’s position. Durant was decided in 2003 under the DPA 1998. The appellant sought disclosure of information which he alleged was personal data relating to him held by the Financial Services Authority (“FSA”). He had sued Barclays Bank unsuccessfully and had subsequently attempted to obtain various records in connection with that dispute. He made subject access requests to the FSA, in its role as the regulator for the financial services sector. The FSA provided him with some material but declined to provide further data concerning his complaint about Barclays Bank and the FSA’s investigation of this complaint. I note the wide terms in which his case was argued on appeal. It was said that his entitlement under the DPA 1998 included any information retrieved as a result of a search under his name and anything on file which had his name on it or from which he could be identified. Further, his counsel submitted that the documentation generated by his letters of complaint to the FSA were his personal data because he was the source of the material.[79]Unsurprisingly, the Court of Appeal rejected these submissions, indicating that not all information received from a computer search against an individual’s name was their personal data; that the mere mention of a data subject in a document held by the data controller did not necessarily establish that it was his personal data; and just because the FSA’s investigation had emanated from his complaint did not mean, without more, that the information generated by the investigation was the claimant’s personal data (paras 28 and 30). Auld LJ (giving the leading judgment) also emphasised that a data subject’s entitlement under the DPA 1998 was to be provided with their personal data, not with original or copy documents as such (para 26).[80]In the course of setting out those conclusions, Auld LJ discussed the circumstances in which information would “relate to” the data subject. At para 27 of his judgment he observed that the purpose of the subject access right conferred (then) by section 7 of the DPA 1998 was to enable the data subject to check whether the controller’s processing unlawfully infringed his right to privacy and, if it did, to take steps to protect it; and that it was likely in most cases that only information that named or directly referred to the data subject would qualify. At para 29, Auld LJ considered that “personal data” was to be given a narrow meaning and that this approach was supported by the definition’s expressly stated inclusion of expressions of opinion and indications of intention (para 76 above), whereas, if the concept had the broader meaning that the appellant proposed, this wording would have been otiose.[81]I pause to foreshadow at this stage that, by contrast, more recent authorities have stressed the broad nature of “personal data”. In addition, subsequent caselaw has confirmed that expressions of opinion may amount to “personal data” within the meaning of the definition in the Directive and the GDPR (where the “expression of opinion” wording contained in the DPA 1998 definition does not appear) and it was not thought necessary to reproduce that wording in the DPA 2018 definition.[82]At para 28 of his judgment, Auld LJ provided some guidance as to the scope of “personal data”:
“…Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject’s involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or events in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person’s or body’s conduct that he may have instigated. In short, it is information that affects his privacy, whether in his personal or family life, business or professional capacity…”
[83]The general proposition that whether information “relates to” the data subject may be a question of degree on a continuum of relevance is not, as I understand it, contentious. Whilst Auld LJ’s two “notions” have been cited in a number of the later cases, looked at in context, it is apparent that he was not laying down an exhaustive list of the ways in which information may “relate to” a data subject, as opposed to providing suggested indicators that were at least partly prompted by the circumstances of the particular case before the court. By way of example, Auld LJ does not refer in terms to the impact of the information in question upon the data subject; albeit his reference to the “focus” of the information may be wide enough to accommodate this. As I will return to, Ms Proops also points out that it is now clear that the purpose of the exercise of data access rights extends beyond affording protection to a data subject’s right to privacy.[84]Buxton LJ gave a short concurring judgment, in which he observed that: the requirement that the information should “relate to” the data subject imposed a limitation on the “otherwise very wide” definition; the guiding principle was that the DPA 1998 gave rights to data subjects to protect their privacy; and the notions identified by Auld LJ at para 28 would provide a clear guide in borderline cases (paras 78 and 79).

The Article 29 Opinion

[85]Durant pre-dated the “Opinion 4/2007 on the concept of personal data” provided by the Article 29 Data Protection Working Party (a body instituted under Article 29 of the Directive). It is common ground that the Article 29 Working Party’s Opinion (“the Article 29 Opinion”) is not binding upon this Court. However, it appears to me to be of value in its emphasis upon the broad nature of “personal data”; in its suggested three indicators as to when information will “relate to” the data subject, which reflect that broad approach; and in a particular example that is included in respect of the value of a house (given that the VOA’s valuations of the 32 properties is one of the contentious areas in the present case). Moreover, the three indicators identified in this document are reflected in more recent decisions of the Court of Justice of the European Union (“CJEU”) in particular in Nowak v Data Protection Commissioner [2018] 1 WLR 3505 (“Nowak”) and FF v Ősterreichische Datenschutzbehörde [2023] 1 WLR 3674 (“FF”).[86]The Article 29 Opinion considers that the term “any information” signals the willingness of the legislator to design a broad concept of personal data. The concept of personal data includes “‘subjective’ information, opinions or assessments”, the latter making up a considerable share of personal data processing in sectors such as banking, insurance and employment (page 6). The Opinion observes that in general terms, information can be considered to “relate” to an individual “when it is about that individual” (emphasis in the original). The text notes that the information conveyed by the data may concern an object, rather than an individual, but that it may relate indirectly to an individual by virtue of the object belonging to them, or because it is subject to particular influence by or upon an individual or it has a physical or geographical vicinity to an individual (page 9). The text then gives the following example:
“The value of a particular house is information about an object. Data protection rules will clearly not apply when this information will be used solely to illustrate the level of real estate prices in a certain district. However, under certain circumstances such information should also be considered as personal data. Indeed, the house is the asset of an owner, which will hence be used to determine the extent of this person’s obligation to pay some taxes, for instance. In this context, it will be indisputable that such information should be considered as personal data.”
[87]The Article 29 Opinion proceeds to identify the following approach to whether information is “relating” to an identified or identifiable individual:
“… in order to consider that the data ‘relate’ to an individual, a ‘content’ element OR a ‘purpose’ element OR a ‘result’ element should be present. The ‘content’ element is present…where…information is given about a particular person…Information ‘relates’ to a person when it is ‘about’ that person, and this has to be assessed in the light of all circumstances surrounding the case… Also a ‘purpose’ element can be responsible for the fact that information ‘relates’ to a certain person. That ‘purpose’ element can be considered to exist when the data are used, or are likely to be used, taking into account all the circumstances surrounding the precise case, with the purpose to evaluate, treat in a certain way, or influence the status or behaviour of an individual. …. A third kind of ‘relating’ to specific persons arises when a ‘result’ element is present. Despite the absence of a ‘content’ or ‘purpose’ element, data can be considered to ‘relate’ to an individual because their use is likely to have an impact on a certain person’s rights and interests, taking into account all the circumstances surrounding the precise case…it is not necessary that the potential result will be a major impact. It is sufficient if the individual may be treated differently from other persons as a result of the processing of such data.” (Emphasis in the original.)

Edem v The Information Commissioner

[88]I can refer to Edem v The Information Commissioner [2014] EWCA Civ 92 relatively briefly. The Court of Appeal, unsurprisingly, agreed with the decision of the Upper Tribunal (Administrative Appeals Chamber) which had allowed an appeal from the First-tier Tribunal’s (“FtT”) determination that the names of three members of staff at the FSA did not constitute their personal data. The FtT had fallen into error in trying to apply the “notions” referred to at para 28 of Durant (para 82 above). As Moses LJ explained, the “notions” were Auld LJ’s “explanation as to why the information and documents in which Mr Durant’s name appeared were not personal data relating to him”; whereas in a case such as Edem where the narrow question was whether the individuals’ names were personal data, they had no relevance (para 20). Moses LJ endorsed the Information Commissioner’s Office Data Protection Technical Guidance as accurately setting out the effects of the statutory scheme in terms of what is personal data (para 21). I refer to the more recent iteration of this guidance at paras 119 – 121 below.

YS v Minister voor Immigratie, Integratie en Aisel

[89]Mr Cornwell places particular reliance upon the CJEU’s decision in YS v Minister voor Immigratie, Integratie en Aisel [2015] 1 WLR 609 (“YS”), decided under the Directive. The three applicants, who were third-country nationals whose applications for residence permits had been dealt with by the Netherlands authorities, each requested copies of the “minute” relating to the decision made on their applications. The minute was an internal document drawn up by the case officer responsible for making the draft decision. In addition to personal information about the applicant, the minute contained material about the procedural history, the applicable legal provisions and an assessment of the relevant information in the light of the applicable law. The requests were rejected and the applicants appealed. The questions asked by the referring Court included whether a legal analysis, as set out in the respective minutes, could be regarded as personal data within the meaning of Article 2(a) of the Directive. The CJEU confirmed that the minutes contained personal data relating to (amongst other things) the applicants’ name, date of birth, nationality, gender, ethnicity, religion and language, but held that although the legal analysis might contain personal data, it was not in itself personal data (paras 38 – 39).[90]The core of the CJEU’s reasoning was as follows:
“40. As the Advocate General noted in essence in point 59 of her opinion…such a legal analysis is not information relating to the applicant for a residence permit, but at most, in so far as it is not limited to a purely abstract interpretation of law, is information about the assessment and application by the competent authority of that law to the applicant’s situation, that situation being established inter alia by means of the personal data relating to him which that authority has available to it.”
[91]The Advocate General’s reasoning at para 59, which the Court endorsed was as follows (with paras 57 – 58 also set out in order to give context):
“57. …I do not find it helpful to distinguish between ‘objective’ facts and ‘subjective’ analysis. Facts can be expressed in different forms…For example, a person’s weight might be expressed objectively in kilos or in subjective terms such as ‘underweight’ or ‘obese’. Thus, I do not exclude the possibility that assessment and opinions may sometimes fall to be classified as data. 58. However, the steps of reasoning by which the conclusion is reached that a person is ‘underweight’ or ‘obese’ are not facts, any more than legal analysis is. 59. Legal analysis is the reasoning underlying the resolution of a question of law. The resolution might be in the form of advice, an opinion or a decision (and thus may, or may not, be legally binding). Apart from the facts on which it is based (some of which might be personal data), that analysis contains the explanation for the resolution. The explanation itself is not information relating to an identified or identifiable person. At most, it can be categorised as information about the interpretation and application of the pertinent law with regard to which the legal position of any individual is assessed and (possibly) decided. Personal data and other elements of fact may very well be inputs in the process leading to answering that question but that does not make the legal analysis itself personal data.”
[92]It appears to me that this passage is of assistance in understanding what the Advocate General and, in turn, the Court had in mind when referring to “legal analysis”; in essence it appears to be the decision-maker’s reasoning process. I also note that at para 49 (which appears just before she proceeded to set out her reasoning and conclusions), the Advocate General said that she did not think it necessary to provide “an exhaustive definition of ‘personal data’, ‘legal analysis’ or any other form of analysis. It suffices to focus on whether the legal analysis included in the minute is personal data”.[93]The CJEU went on to observe that its approach was borne out by the objective and general scheme of the Directive:
“42. In accordance with article 1 of the Directive, its purpose is to protect the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data, and thus to permit the free flow of personal data between member states.”
[94]The Court observed that the data subject was given a right of access to the data in order to undertake the necessary checks and, in this context, referred to a data subject’s rights under the Directive to be informed that processing is taking place, to request corrections to the data and to object to the processing in certain circumstances; and referred to the right to respect for private life, meaning that the person may be certain that the personal data concerning them are correct and are being processed lawfully (paras 43 and 44). It was said that the right of access was necessary “inter alia, to enable the data subject to obtain, depending on the circumstances, the rectification, erasure or blocking of his data by the controller” (para 44). The Court then concluded:
“45. In contrast to the data relating to the applicant for a residence permit which is in the minute and which may constitute the factual basis of the legal analysis contained therein, such an analysis…is not in itself liable to be the subject of a check of its accuracy by that application and a rectification under… [the provisions of the Directive]. 46. In those circumstances, extending the right of access of the applicant for a residence permit to that legal analysis would not in fact serve the Directive’s purpose of guaranteeing the protection of the applicant’s right to privacy with regard to the processing of data relating to him, but would serve the purpose of guaranteeing him a right of access to administrative documents, which is not however covered by Direction 95/46.”
[95]In the latter context, reference was made to the distinction drawn in EU regulations between regulations concerning public access to European Parliament, Council and Commission documents, as distinct from regulations relating to the processing of personal data by the EU institutions (para 47).[96]Accordingly, the Court answered this aspect of the referred questions as follows:
“48. …article 2(a) of Direction 95/46 must be interpreted as meaning that the data relating to the applicant for a residence permit contained in the minute and, where relevant, the data in the legal analysis contained in the minute are ‘personal data’ within the meaning of that provision, whereas, by contrast, that analysis cannot in itself be so qualified.”
[97]Accordingly, the issue decided in YS was specific to the legal analysis contained in the minute. I return to the parties’ submission as to the wider significance of YS at paras 165 – 170 below.

Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd

[98]Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd [2017] EWCA Civ 121, [2018] QB 256 (“Ittihadieh”) concerned subject access requests made under section 7 of the DPA 1998. In terms of “personal data”, the direct issue before the Court of Appeal was a narrow one; the Court held that information was not disqualified from being “personal data” merely because it had been supplied to the data controller by the data subject. The Court acknowledged that the DPA 1998 was to be interpreted in conformity with the Directive (para 35). Further, that the purpose underlying the Directive, as set out in recital (2) was that data processing systems must respect natural persons’ “fundamental rights and freedoms, notably the right to privacy”. Giving the leading judgment, Lewison LJ noted that the emphasis on the right to privacy was repeated in recitals (7), (9), (10), (11) and (68) (para 36).[99]Lewison LJ accepted a submission that the definition of “personal data” in both the DPA 1998 and the Directive consisted of two limbs:(i) whether the data in question “relates to” a living individual; and(ii) whether that individual is identifiable from the data (para 61). Having referred to various pieces of information about an individual that would amount to “personal data”, Lewison LJ described the CJEU’s decision in YS in the following terms:
“62. …The same is true of the name, date of birth, nationality, gender, ethnicity, religion and language, relating to a natural person who is identified by name, although it does not apply to legal analysis: YS v Minister voor Immigratie, Integratie en Asiel…Mr Pitt-Payne submitted, and again I agree, that these cases are concerned with the ‘identifiability’ limb of the definition. ”
[100]Accordingly, whilst this observation was not part of the ratio of the case, it is of note that Lewison LJ considered that the CJEU’s decision in YS turned on the “identifiability” requirement, rather than on the “relate to” limb of the “personal data” definition.[101]Lewison LJ also observed that the Court of Appeal’s view in Durant corresponded closely with that expressed by the Advocate General at para 55 of YS, where she said that she was not convinced that the definition of “personal data” should be read “so widely as to cover all of the communicable content in which factual elements relating to a data subject are embedded”. He also cited a passage from para 46 of the judgment in YS, as supporting the proposition that it is necessary to consider whether the interpretation of “personal data” in any given case would serve the purpose of the Directive (para 68).[102]For completeness I note that Lewison LJ explained why there was no conflict between Durant and Edem: Mr Edem had wanted the names of officials, whereas Mr Durant had wanted the entirety of any document in which he was mentioned (para 66).[103]Before leaving Ittihadieh, I turn to a further aspect of Lewison LJ’s judgment; the form of a subject access request. This is of relevance to Issue 1. Under the DPA 1998 (unlike the UK GDPR) a subject access request had to be made in writing and payment of a fee (not exceeding the prescribed maximum) could be required by the data controller. Lewison LJ explained that beyond these aspects, the legislation did not lay down any prescribed form for making a subject access request (para 78). A request was to be interpreted by reference to the usual principles that the Court applies in interpreting any written communication; it must be read fairly and as a whole and, as a request may be made informally, exacting standards of precision would be inappropriate (para 80).

Nowak v Data Protection Commissioner

[104]The data subject in Nowak, a trainee accountant who had failed an accountancy examination, submitted a data subject access request seeking all of his personal data held by the professional body which had marked his paper. Some data was provided, but it refused to send him his examination script, on the basis that this was not “personal data”. The CJEU held that the written answers he had submitted in the examination and the comments of the examiner on the paper did constitute the applicant’s “personal data”. The information was linked to him as a person, as the content of his answers reflected the state of his knowledge and competence and the purpose of collecting his answers was to evaluate his professional abilities and suitability to practice as an accountant (paras 37 – 41). The examiner’s comments reflected and recorded their assessment of the candidate’s performance (paras 42 – 43).[105]Identifiability was not in issue. The CJEU said that the key issue for it to determine was whether the written answers provided by a candidate at a professional examination and any comments made by an examiner with regard to those answers constituted “information relating to” that candidate within the meaning of Article 2(a) of the Directive. Referring to its earlier case law, the Court noted that the scope of the Directive “is very wide and the personal data covered by that Directive is varied” (para 33). The judgment continued:
“34. The use of the expression ‘any information’ in the definition of ‘personal data’ within article 2(a) of Directive 95/46 reflects the aim of the EU legislature to assign a wide scope to that concept, which is not restricted to information that is sensitive or private, but potentially encompasses all kinds of information, not only objective, but also subjective, in the form of opinions and assessment, provided that it ‘relates’ to the data subject. 35. As regards the latter condition, it is satisfied where the information, by reason of its content, purpose or effect, is linked to a particular person.”
[106]Pausing there, I note that this passage reflects the approach of the Article 29 Opinion (paras 86 – 87 above), save that the third indicator is described as “effect” rather than “result”, but there does not appear to be a material distinction between the two. It also confirms that the Directive’s definition of “personal data” is wide enough to encompass subjective opinions and assessments, without the need for the additional wording that appeared in the DPA 1998 definition (paras 76 and 80 above).[107]During the course of identifying why the examination answers constituted “personal data”, the CJEU referred to the use that would be made of such information; it would be “liable to have an effect on his or her rights and interests, in that it may determine or influence, for example, the chance of entering the profession aspired to or of obtaining the post sought” (para 39). The key reason why the Court concluded that the examiner’s comments also amounted to the examinee’s “personal data” related to its impact: “the purpose of these comments is, moreover, precisely to record the evaluation by the examiner of the candidate’s performance, and those comments are liable to have effects for the candidate” (para 43). This was a little different to the reasoning of the Advocate General, who had considered that the examiner’s comments were personal data because they were “typically inseparable” from the script itself, such that there was a “close link” between the examination script and any corrections made on it” (paras 62 – 63).[108]The Court went on to conclude, at para 56, that giving a candidate the right of access to their answers and the examiner’s comments on their script would serve the purposes of the Directive “of guaranteeing the protection of that candidate’s right to privacy with regard to the processing of data relating to him (see, a contrario, YS v Minister voor Immigratie, Integratie en Asiel… paras 45 and 46)”. The reference to YS appears to do no more than note that a contrary conclusion was reached in the circumstances of YS, as to whether giving the applicants access to the data they sought would serve the Directive’s objective. In and of itself I do not agree with Ms Proops that this is an expression of disagreement with the Court’s reasoning in YS.[109]However, Ms Proops is on firmer ground in pointing out that the analysis that supported the conclusion in Nowak that the purposes of the Directive were served by regarding this information as “personal data”, did not rest on the rights of a data subject to rectification and erasure, but more broadly on the data subject being entitled to check the lawfulness of the processing of their data and, for example, raise objection in respect of the controller’s storage or retention of their data or its provision to third parties (paras 47 – 50).[110]The Advocate General’s opinion was to similar effect, in particular at paras 26, 34 and 38 – 41, which included the following:
“38. …rectification and the other rights set out under article 12(b) of the Data Protection Directive, namely blocking and erasure, are not the sole aims of the right of access. 39. Recital (41) does indeed describe the purpose of access as being that the data subject may verify in particular the accuracy of the data and the lawfulness of the proceedings. By using ‘in particular’ in most language versions, however, the legislature has indicated that the purpose goes further. For even irrespective of rectification, erasure or blocking, data subjects generally have a legitimate interest in finding out what information about them is processed by the controller. ….. 41. …In addition, there is greater uncertainty with the passing of time…about the script still being retained. In such circumstances the examination candidate must at least be able to find out whether his script is still being retained. That right, too, presupposes that the incorporation of the examination candidate’s personal data in the script is recognised.”
[111]The Advocate General also discussed the position of the examiner’s comments on the script, acknowledging that whilst it was hard to imagine a right of rectification, erasure or blocking of inaccurate data arising in respect of those comments, the “primary purpose of a right of access to the examiner’s corrections would be to inform the examination candidate about the evaluation of particular sections of his script” (paras 55 and 57).[112]As YS was cited by both the CJEU and the Advocate General (who acknowledged, at para 59, that “at first glance” the Court’s finding in YS could be transposed to the examiner’s comments), it is clear that neither regarded the reasoning or conclusion in that case as precluding the decision that the examination answers, including the examiner’s comments, were personal data.

Aven v Orbis Business Intelligence Limited

[113]The next in time case cited by counsel was Aven v Orbis Business Intelligence Limited [2020] EWHC 1812 (QB) (“Aven”). The claimants sought correction of the record and other remedies under the DPA 1998 in relation to one component of the “Steele Dossier”, an intelligence memorandum produced by the defendant that considered any links that might exist between Presidents Vladimir Putin and Donald Trump. The claimants were three businessmen of Russian or Ukrainian origin who were among the beneficial owners of the Alfa Group Consortium, which was referred to in the dossier. The claimants relied on five propositions that they said Memorandum 112 contained and which were their personal data. The defendant disputed that some the contentious information was the claimants’ personal data.[114]Warby J (as he then was) acknowledged that “personal data” was a broad term (para 14). He rejected the defendant’s submission that an individual could only show that information is his personal data if he is identifiable from the sentence in question, accepting the claimants’ approach that the contentious wording had to be approached holistically, in its context (paras 23 – 26). Ms Proops relies on this case as authority for the proposition that the question of whether or not information relates to the relevant individual is to be approached in a broad way, in the present case by reference to the nature and contents of the Enquiry.[115]Warby J rejected the defendant’s argument that the wording of the definition of “personal data” in the DPA 1998 indicated that “an item-by-item approach to the contents of that document must be adopted” (para 28). He cited the observation of

Judge Jacobs in Farrand v Information Commissioner [2014] UKUT 310 (ACC) at para 18 that:

“To ignore context would render the legislation ineffective in numerous circumstances to which it is clearly intended to apply, thereby reducing its effectiveness” (para 30). However, Warby J made clear that his decision was based upon the particular circumstances of the case before him: “31. There may be cases involving data sets of a more abstract or more granular kind, where the question of whether the set contains the claimant’s personal data calls for an individualised assessment of each constituent element, read in isolation from other components of the data set…it is always necessary to identify what is and is not the proper context for any given statement or item of data. At any rate, I am satisfied that what I have called the holistic approach should be applied to Memorandum 112. The document…is a coherent narrative…it would be artificial to read any individual sentence in isolation from the remainder of the document.”
[116]Warby J referred briefly to Durant and to Ittihadieh, noting that they were consistent with his conclusions and indicating that “whether information comprises personal data depends on where it falls in a continuum of relevance or proximity to the data subject”. He said that the propositions identified in Durant had been developed “to guide those confronted with claims based on the notion that all information in any document that makes mention of an individual is that individual’s personal data” and that they were of “scant relevance” to the issue that he had to decide (para 33).

FF v Ősterreichische Datenschutzbehörde

[117]I refer to FF in more detail from para 126 below. It was decided after the end of the implementation period (31 December 2020 at 23.00 hours) and thus it is not binding of this Court: section 6(1)(a) of the European Union (Withdrawal) Act 2018. However, section 6(2) provides that the Court may have regard to such a judgment. The parties were also agreed that the effect of section 6(3) and (4) is that earlier CJEU judgments were binding upon this Court (although not on the Court of Appeal or Supreme Court).[118]Unlike the earlier authorities that I have cited, FF was determined under the GDPR. The CJEU cited with approval the approach to “personal data” and to “relates to” that the Court had identified at paras 34 – 35 of Novak (para 105 above).

The ICO Guidance

[119]The ICO has published guidance on the concept of “personal data” under the GDPR, entitled “What is personal data?” (the “ICO Guidance”). The meaning of “relates to” is addressed at pages 22 - 26. The thrust is similar to the Article 29 Opinion in that the text explains that data may be “personal data” by virtue of its content, its purpose or its impact. Having referred to data that is obviously about a particular individual or their activities, the text continues:
“Alternatively, data may be personal data because it is clearly ‘linked’ to an individual as it is about his or her activities and you are processing it for the purpose of determining or influencing the way in which that individual is treated. Data may also be personal data if it is biographically significant or has a particular individual as the focus.”
[120]Pausing there, I note that the “notions” identified in Durant are included as some of the ways that data may constitute personal data, but the text also highlights that information may amount to personal data because it is used to make a decision about the individual or it otherwise affects the way that the individual is treated.[121]The ICO Guidance recognises that data may be personal data where the content is about their activities, rather than about the individual themselves; and where the data is not in itself personal data but will become so in certain circumstances “where it can be linked to an individual to provide particular information about that individual”. The text goes on to say that if the data is used, or is likely to be used “to learn, evaluate, treat in a certain way, make a decision about, or influence the status or behaviour of an individual”, then it is personal data. A number of examples are then given, some of which are of potential relevance to the present situation:
“…data about a house is not, by itself, personal data. Context is important here. Information about a house is often linked to an owner or resident and consequently the data about the house will be personal data about that individual. Example Information about the market value of a particular house may be used for statistical purposes to identify trends in the house values in a geographical area. The house is not selected because the data controller wishes to know anything about the occupants, but because it is a four bedroom detached house in a medium-sized town. As soon as the data about a house is either: • linked to a particular individual, for example, to provide particular information about that individual (for example, his address); or • used in deliberations and decisions concerning an individual (even without a link to the individual’s name, for example, the amount of electricity used at the house is used to determine the bill the individual household is required to pay), then that will be personal data. ….. Example The value of a house is used to determine an individual’s liability for Council Tax, or to determine their assets or in proceedings following divorce. This is then personal data because the data about the house is clearly linked to the individual or individuals concerned.” (Emphasis in original)
Example • linked to a particular individual, for example, to provide particular information about that individual (for example, his address); or • used in deliberations and decisions concerning an individual (even without a link to the individual’s name, for example, the amount of electricity used at the house is used to determine the bill the individual household is required to pay), Example

Surrey Searches Limited v Northumbrian Water Limited

[122]I was taken to Surrey Searches Limited v Northumbrian Water Limited [2024] EWHC 1643 (Ch) (“Surrey Searches”) as a recent example of the application of the “personal data” concept. One of the issues before the Court was whether the defendants were obliged to make certain information available to the claimant personal search companies for free or for no more than a reasonable charge. The claimant companies compiled personal search reports on particular properties for sale to clients, such as solicitors’ firms acting for property purchasers. They argued that the information in question was “environmental information” within the meaning of the Environmental Information Regulations 2004 (“EIR”). The defendants were water and sewerage companies and commercial providers of water and drainage information search reports. The Court had to determine whether information responsive to questions about buildover agreements and about internal flooding constituted “personal data”, so that, pursuant to regulation 13 of the EIR it was not disclosable (paras 724 – 725). The reports did not identify any specific individual but each report related to a specific property, identifying it by its address and postcode (para 729).[123]Richard Smith J referred to the judgments in Durant, Edem, Ittihadieh and Aven. He also quoted from the ICO Guidance, including the examples regarding information relating to a particular house which I have set out at para 121 above, describing it as useful. The Judge found that the buildover information was not personal data, whereas information about internal flooding was personal data (paras 736 and 738). Richard Smith J said that the buildover information did not say anything meaningful about the lives of the owner or occupier; it did not indicate what, if any, steps had been taken after the approval was given, nor who had sought the approval; it was unlikely that the information would be used by property developers to make decisions relating to the owners and occupiers; and it was unlikely that the information would be used by third parties to make valuation decisions. He contrasted this with the responsive information in respect of internal flooding which concerned a current risk to the property which had the potential to seriously impact on the owners and occupiers’ domestic or working lives and conditions; and carried with it potentially serious financial consequences, in terms of decisions made by others relating to mitigation measures, sale, value, security and insurance.[124]Accordingly, both the content of the respective data in terms of the extent to which it was linked to the particular owners and occupiers and its potential impact, including in terms of financial consequences, were material to the Court’s assessment. Responding to a subject access request The extent of the search for data

Responding to a subject access request

[125]Section 8(2)(a) of the DPA 1998 provided that the controller was not obliged to supply the data subject with a copy of their personal data where to do so would involve “disproportionate effort”. In Dawson-Damer v Taylor Wessing LLP [2017] EWCA Civ 74, [2017] 1 WLR 3255 (“Dawson-Damer”) the Court of Appeal found that the defendant solicitor’s firm had not shown that complying with the subject access request would involve “disproportionate effort” in the circumstances (para 23). Both parties accepted that the guidance provided by the Court of Appeal in this case was applicable to the response of the controller that is required under the UK GDPR. Giving the leading judgment Arden LJ (as she then was) made the following points: i) It falls to the data controller to show that the supply of a copy of the information would involve disproportionate effort (para 75); ii) Difficulties that would render the effort disproportionate are not limited to those that arise in the process of producing a copy of the document, “but include difficulties which occur in the process of complying with the Request” (para 76); iii) It was a question for evaluation in each case as to whether disproportionate effort would be involved in finding and supplying the information as against the benefit that it might bring to the data subject (para 77); and iv) As shown by the recitals to the Directive, there are substantial public policy reasons for giving people control over data maintained about them, meaning that, so far as possible, subject access requests should be enforced. Data controllers can be expected to know of their obligations and to have designed their systems accordingly, to enable them to make most searches for subject access request purposes (para 79).

The obligation to provide a “copy”

[126]The Article 15(3) GDPR requirement to provide “a copy of the personal data undergoing processing” was considered by the CJEU in FF, including the extent to which this obligation required the controller to provide the data subject with information that was additional to the personal data in order to render that data intelligible. As I have already noted, FF is not binding on this Court (para 117 above). I will set out the main planks of the Court’s reasoning at this juncture and then consider whether I should follow it when I come to Issue 4(b).[127]The data subject in FF applied to a business consulting agency who supplied information on creditworthiness to third parties, seeking copies of any documents, such as emails and database extracts, containing his personal data which the agency had processed. The agency responded by sending him a summary list of his personal data that was undergoing processing, but it did not provide the documents or extracts from the documents containing his personal data. The CJEU held that the “copy” that was to be provided pursuant to Article 15(3) had to be a faithful reproduction of all of the data subject’s personal data that was undergoing processing (paras 28 and 32). Relevantly for present purposes, the Court then went on to consider whether Article 15(3) entitled the data subject to obtain not only a copy of their personal data undergoing processing, but also a copy of wider extracts from the documents containing that data or the entire documents (para 29).[128]The Court explained that Article 15(3) of the GDPR set out the practical arrangements for the fulfilment of the controller’s Article 15(1) obligations, rather than establishing a separate right (paras 31 – 32). The objective of Article 15, as identified in recital (11), is to strengthen and detail the rights of data subjects; and recital (63) provides that a data subject’s right of access is in order that they are aware of and can verify the lawfulness of the processing. Thus, the right of access provided by Article 15 “must enable the data subject to ensure that the personal data relating to him or her are correct and that they are processed in a lawful manner” (para 34). The Court observed that the right of access is necessary to enable the data subject to exercise their rights to rectification, erasure and restriction of processing, their right to object to their personal data being processed and the right of action when they suffered damage (para 35). The Court then discussed the importance of transparency at paras 36 – 39, expressing agreement with the Advocate General’s statement (at paras 54 – 55 of his opinion) that the controller is obliged to provide the data subject with all the information referred to in Article 15 in a “concise, transparent, intelligible and easily accessible form, using plain and clear language…The purpose of that provision, which is an expression of the principle of transparency, is to ensure that the data subject is fully able to understand the information sent to him or her” (para 38). Accordingly, reasoned the Court, the copy of the personal data undergoing processing that is provided “must have all the characteristics necessary for the data subject effectively to exercise his or her rights under the Regulation” (para 39). This meant that:
“41. In order to ensure that the information thus provided is easy to understand, as required by article 12(1) of the GDPR…the reproduction of extracts from documents or even entire documents or extracts from databases which contain, inter alia, the personal data underdoing processing may prove to be essential, as Advocate General Pitruzella observed in points 57 and 58 of his opinion, where the contextualisation of the data processed is necessary in order to ensure the data are intelligible.” (Emphasis added.)
[129]In setting out its conclusion at para 45, the CJEU repeated that:
“45. …the right to obtain from the controller a copy of the personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all documents or even documents or extracts from databases which contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by the Regulation..” (Emphasis added.)
[130]I do not accept Mr Cornwell’s submission that the CJEU in FF went no further than determining that the controller was required to provide a reproduction (“a copy”) of the individual’s personal data that was being processed, so that a summary was insufficient. Question 3 from the referring Court asked whether the Article 15 right was “only to an exact reproduction of the personal data” or, whether, depending on the nature of the data processed and the transparency requirement in Article 12(1), “it may nevertheless be necessary in individual cases to make text passages or entire documents available to the data subject?” (emphasis added). The CJEU’s judgment first addressed the obligation to provide a copy (as opposed to a summary) and then proceeded to consider whether more might be required. It is apparent from its reasoning, particularly the terms of the passages in paras 41 and 45 which I have already set out, that the CJEU considered that in certain circumstances the need for intelligibility required the provision of documents or document extracts which “contain” (that is to say, are not limited to) the personal data.[131]This is further reinforced by the terms of the passages in the Advocate General’s opinion that the Court endorsed in its para 41:
“56. The need for the data to be communicated intelligibly so that the data subject can fully become aware of the data and check that they are accurate and processed in compliance with EU law was, moreover, already emphasised by the court in its case law concerning Direction 95/46 (see YS…paras 57 and 60). 57. The above-mentioned need for the data and the information set out in points (a) to (h) of article 15(1) of the GDPR to be intelligible means that it is not ruled out that in some cases in order to ensure the full intelligibility of the information sent to the data subject, it might be necessary to provide the latter with passages of documents or even entire documents or extracts from databases. The need to provide documents or extracts in order to ensure the intelligibility of the information must, however, inevitably be analysed on a case-by-case basis depending on the type of data being requested and the request itself. 58. …it is certainly necessary in some cases, in order to have a full understanding of the personal data in question, to be aware of the context in which those data are processed. However, that does not mean that the data subject should, on the basis of the provision in question, be given a generalised right to access to copies of documents or extracts from databases.”
[132]Accordingly, it is apparent that both the Advocate General and the CJEU envisaged that in certain circumstances where intelligibility considerations require this, Article 15 does oblige the controller to do more than provide a reproduction of the individual’s personal data. However, it was also indicated that the need to do this would arise in particular circumstances, rather than in every case. The Advocate General opined at para 68 that this was only where it was “indispensable” for the purpose of ensuring that the personal data was fully intelligible. To similar effect, the CJEU said that this would apply where it was “necessary” in order to ensure that the data was intelligible (para 41) or where it was “essential” to enable the data subject to exercise the rights conferred by the GDPR effectively (para 45). Both the Court and the Advocate General acknowledged that in some circumstances a balance would need to be struck between the rights in question and the rights and freedoms of others (paras 44 and 59 – 61, respectively).

The First Tax Exemption

[133]I have set out the legislative provisions at paras 68 - 70 above. The parties were agreed as to the relevant principles and agreed that they remained applicable although identified in cases decided under the equivalent exemptions in section 29 of the DPA 1998. The following authorities were cited to me on this aspect of the case: R (Lord) v Secretary of State for the Home Department [2003] EWHC 2073 (Admin) (“Lord”); Zaw Lin v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) (“Zaw Lin”); and Guriev v Community Safety Development(UK) Limited [2016] EWHC 643 (QB) (“Guriev”).[134]In summary, the applicable principles are as follows: i) The controller bears the burden of proving the applicability of the exemption and thus its entitlement to refuse access: Lord at para 99, Zaw Lin at paras 84 – 85 and 101 and Guriev at para 37. The ordinary civil standard of proof applies: Guriev at para 37; ii) The starting point is that the data subject is entitled to the data unless the exemption is established and the presumption in favour of disclosure should be viewed as a strong and weighty factor: Zaw Lin at para 101; iii) The statutory wording requires the Court to be satisfied of two things:(i) that the personal data in question were being processed for one of the specified purposes; and(ii) that the application of the subject access provisions would be “likely to prejudice one or more of those specified matters”: Guriev at para 35; iv) “Likely” in this context does not mean more probable than not, but it connotes a significantly greater degree of probability than merely more than fanciful. “Likely” connotes that there is a very significant and weighty chance of prejudice to the identified public interests, the degree of risk must be such that there “may very well” be prejudice to those interests: Lord at paras 99 – 100 and Guriev at para 43; v) The question of whether disclosure is likely to prejudice the specified purpose(s) may include consideration of the consequential impact that disclosure in this particular case may have upon other cases and/or prejudice that would be caused to the activities and aims set out in the statutory provision more generally: Lord at para 122, Zaw Lin at paras 102, 105 and 106 and Guriev at para 49; vi) A structured and fact-specific approach is required; it is necessary to identify the prejudice, show how disclosure would cause the prejudice and show that a failure to apply the exemption would likely cause that prejudice: Guriev at para 43; vii) Restrictions upon a data subject’s right of access may only be imposed where this is a necessary measure to safeguard the specified purpose. This is a strict test and those seeking to rely on the exemption must do so convincingly by evidence that establishes this, not by mere assertion: Lord at para 99 and Guriev at paras 38, 45 and 49; and viii) The necessity test requires that any interference with the subject’s rights is proportionate to the gravity of the threat to the public interest; and in making the proportionality assessment the Court will have to take into account the value of the access right: Lord at para 99, Zaw Lin at para 78 and Guriev at para 45. The proportionality assessment must be applied to each item of personal data that is in issue: Zaw Lin at paras 110 and 115. Issue 1: scope of the SAR Summary of the submissions

Issue 1: scope of the SAR

[135]The List of Issues asks whether the SAR was limited to the Claimant’s personal data pertaining to the Enquiry processed by the WMBC or extended to such data as was processed more widely by HMRC “including by the VOA”. However, the parties’ oral submissions were focused entirely upon the VOA; it was not suggested that the Defendant’s approach to the SAR was too narrow in other respects. Accordingly, in addressing Issue 1, I will also focus on the position of the data processed by the VOA.[136]The Claimant contends that his personal data processed by the VOA in connection with the Enquiry was within the scope of the SAR. Ms Proops submitted that this was the only reasonable construction of the terms of the SAR, in that it was a wide request for copies of all of the Claimant’s personal data processed by HMRC in relation to the Enquiry and there was no legal or factual basis for distinguishing between the WMBC and the VOA for these purposes, not least because the Defendant accepts that it is a controller of the data held by the VOA. Moreover, the VOA’s role was “centre stage” in the dispute over the assessment of Mr Ashley’s tax liabilities, given it had undertaken the valuations of the 32 properties and concluded that they had been bought at an overvalue. She said it would “drive a coach and horses” through the legislative protection afforded to data subjects if a controller could unilaterally decide to demarcate a subject access request as limited to a particular department. She also pointed out that if there was any ambiguity in the SAR (which she disputed), the Defendant could have sought clarification of the same, pursuant to the Article 12(2) duty to “facilitate” the exercise of the data subject’s rights (para 62 above).[137]The Defendant, on the other hand, contends that Mr Ashley’s personal data processed by the VOA in connection with the Enquiry was not within the scope of his SAR. Mr Cornwell emphasised the arrangements operated by HMRC under which the VOA and central HMRC handle subject access requests separately; and that the VOA is a separate entity with its own separate functions, as recognised by statute. He also relied on the terms of HMRC’s Privacy Notice, which states that a person wishing to request access to their personal information should follow “HMRC’s subject access request guidance” or “Valuation Office Agency’s guidance” with links provided to both documents.[138]Mr Cornwell noted that the SAR was not made to the Defendant’s postal address or via its online form for subject access requests; it was directed to two members of the WMBC team and was made in the context of a longer email raising concerns about the recent change of position adopted by the WMBC (para 31 above). Whilst the role of the VOA was important, the WMBC was the decision-maker, with the VOA acting as a valuation provider. Furthermore, the Claimant’s lawyers did not say in the pre-action correspondence or in the Part 8 claim form that the SAR was intended to extend to the VOA, in circumstances where they were well aware of the role that it had played in the valuation of the properties. Whilst the Defendant’s pre-action correspondence did refer to searches of data held by “HMRC”, this was intended by the Defendant to refer to the data held by the WMBC.

Analysis and conclusions

[139]The chronology of events suggests that the Defendant proceeded on the basis that the SAR only applied to the WMBC without giving specific consideration until much later on as to whether it extended to the data processed by the VOA. Be that as it may, the question for me is an objective one that is not dependent upon how the SAR was interpreted at the time. In order to determine the scope of the SAR, I have considered the terms of the request, read in its context. In accordance with the guidance given by Lewison LJ in Ittihadieh, I have considered the whole of the email containing the SAR, doing so without applying exacting standards of precision (para 103 above).[140]Mr Cornwell drew attention to the fact that the key paragraph of the SAR did not use the phrase “personal data”. I do not consider that there is anything in this point. This section of the email was headed “Subject Access Request”, the contents that followed confirmed that it was a subject access request and it was understood and actioned as such by both parties.[141]The SAR was expressed in very broad terms. It sought “any and all data held in relation to HMRC’s enquiry that pertains to our client” for the relevant tax year (emphasis included in the original). The wording of the request was not qualified in any material way and nor was it limited to particular departments or agencies of HMRC. I have taken into account the contextual points made by Mr Cornwell, but I do not accept that they narrowed the scope of what was, in its terms, a wide request for all of the personal data processed by HMRC. Whilst the earlier paragraphs of the email were about the Enquiry and the position that had now been reached in that regard, I do not consider that this impliedly limited the terms of the subject access request that followed, as the VOA had played a substantial role in this in valuing the properties (as both parties were aware).[142]I have also had regard to the addressees of the email. However, it is accepted that HMRC was a data controller for the VOA; and that the Defendant has no centralised team for dealing with subject access requests (para 34 above). In any event, I do not consider that sending the request to the particular individuals at the WMBC impliedly restricted its scope in the way that Mr Cornwell suggested. It was unsurprising that the request was sent to Mr Pattinson, given the role of the WMBC, the role of Mr Garside in particular and the stage that events had reached. I am unable to regard this as confining to this particular department a request that was expressly made in wider terms. The absence of prescribed formalities in the UK GDPR provisions (para 64 above), shows that subject access requests can be made in a relatively informal way, indeed the Defendant (rightly) does not suggest that it was mandatory to use its online form.[143]As the scope of the request was broad enough to encompass Mr Ashley’s personal data in respect of the Enquiry that was processed by the VOA, it followed that the Defendant, as a controller of the data, was subject to the obligations that were imposed by Article 12(1) - (3) and Article 15(1) and (3) of the UK GDPR. This position could not then be unilaterally altered by the Defendant’s own internal practice of treating the main part of HMRC and the VOA as separate entities for the purposes of subject access requests.[144]Equally, the contents of the Privacy Notice do not alter this position. Whilst I record that Ms Proops took issue with the references to HMRC’s subject access request guidance (as the document had not been provided to the Court as part of the Defendant’s evidence), this aspect does not avail the Defendant in any event, given Mr Cornwell accepted that the guidance indicated subject access requests could be made to the VOA, rather than that they must be made to the VOA, in respect of personal data it had processed.[145]As the terms of the SAR were not ambiguous, the question of whether the Article 12(2) duty to “facilitate”, obliged the Defendant to seek clarification from the Claimant does not arise. However, for the avoidance of doubt, I indicate that I do not regard either the Defendant’s references in party and party correspondence to conducting searches of data held by “HMRC” or to the Claimant’s non-response to the question posed in the 13 April 2023 letter (para 39 above) as significant. Both were simply the product of the parties proceeding under different understandings as to whether “HMRC” extended to the VOA for the purposes of the SAR.[146]Accordingly, I conclude that the SAR was not limited to the Claimant’s personal data pertaining to the Enquiry as processed within the WMBC and included such data as was being processed by the VOA. Issue 2: the Claimant’s personal data Summary of the submissions

Issue 2: the Claimant’s personal data

[147]The parties were far apart in their approaches to what amounted to information “relating to” Mr Ashley for the purposes of the definition of “personal data” in Article 4(1) of the UK GDPR.[148]The first part of the parties’ revised formulation of Issue 2 asks whether data that relates to the Defendant’s assessment of his tax liability in the context of the Enquiry amounts to the Claimant’s “personal data”. The question was reformulated in this way because Ms Proops contended that this data as a whole constituted Mr Ashley’s personal data. Mr Cornwell, on the other hand, submitted that the question should be answered in the negative and that the Defendant had already adopted the correct approach to identifying the Claimant’s personal data in the extracts that had been provided to him in the Schedules. That approach was summarised in Kempell 1 as “any information from which Mr Ashley can be identified, or he is identifiable from, and information that is sufficiently proximate to Mr Ashley that it relates to him”.[149]Ms Proops submitted that, consistent with the objectives of the legislation, the concept of “personal data” must be construed broadly, so as to achieve a suitably high level of protection for natural persons, particularly in respect of their fundamental rights and freedoms. She said that the content, purpose and effect of the data processing were central to the question of whether information relates to the individual. In this case, the entire data processing was exclusively targeted at determining Mr Ashley’s legal liability to pay tax and was centrally concerned with him. Ms Proops emphasised that a tax liability engages fundamental rights to property and that, given the sum involved, the determination of that liability had serious life consequences for the Claimant. She maintained that in the circumstances, Mr Ashley was entitled to the provision of copies of the entire documentation held by HMRC in relation to the Enquiry, including the material from the investigation and assessment process (subject to any applicable exemptions). She said that insofar as the CJEU’s decision in YS drew a distinction between data about an individual and administrative decision-making in the same documentation, it was wrongly decided. Furthermore, a holistic, rather than an atomised, approach should be taken when considering whether data processed by the Defendant amounted to Mr Ashley’s personal data and that this reinforced the Claimant’s entitlement to all of the data, given that his liability to pay tax was the entire focus of the processing that was undertaken.[150]Ms Proops accorded particular prominence to the valuations of the 32 properties, submitting that the data relating to these assessments, including the material concerning the comparable properties, were all Mr Ashley’s personal data, as this material was central to the Defendant’s investigations and decision-making, so that, in turn, this material was inextricably intertwined with Mr Ashley’s personal tax liability.[151]Mr Cornwell submitted that there was an important distinction between the processing of personal data, to which subject access rights applied, and decision-making, albeit there would sometimes be an overlap. Moreover, the question was whether the “information” related to the identified or identifiable individual, not whether the overall processing exercise did so, or whether the information was processed as part of an exercise that related to the data subject. He said that the Defendant had rightly applied the approach identified in Durant, YS and Ittihadieh in deciding whether information was “sufficiently proximate” to the Claimant, including using the “notions” identified by Auld LJ in Durant. He accepted that in determining whether data was “information relating to” the individual in question, its content, purpose and effect could all be relevant, but he suggested that the presence of one of these elements was not determinative, as, if it was, then the legal analysis in YS would have been regarded as personal data by virtue of its impact on the applicants. Mr Cornwell reminded the Court that the data protection legislation gave a wide range of rights to data subjects, not simply the right to access their data, so that if too broad an approach was taken to the concept of “personal data” this would have substantial implications for the responsibilities upon data controllers. Similarly, freedom of information rights would be affected, as section 40 of the Freedom of Information Act 2000 confers an exception in respect of “personal data”.[152]Mr Cornwell pointed out that the valuations in respect of the 32 properties had already been disclosed before receipt of the SAR. He said that not all information relating to how those valuations were arrived at amounted to the Claimant’s “personal data”, in particular data regarding the comparables and HMRC’s process of investigation and assessment. Analysis and conclusions The Court’s approach[153]The parties were agreed as to the approach that I should take to determining Issue 2. If I answered the question posed by the first sentence of the parties’ agreed text in the affirmative (as the Claimant sought), then the Defendant would be obliged to provide copies of a very considerable volume of additional data that it had processed (save where relevant exemptions applied). Whereas, if I accepted Mr Cornwell’s submissions in full, it would follow that (subject to Issue 4 points) the Defendant had already provided copies of the requisite data. The parties recognised that a third possible outcome was one where I concluded that the Defendant’s approach was too narrow, but the Claimant’s approach was too broad. This eventuality was reflected in the second sentence of the text of Issue 2, which contemplated the Court providing guidance as to the circumstances in which the data processed by the Defendant in respect of the Enquiry would amount to the Claimant’s personal data. The parties acknowledged that if this scenario eventuated, the Defendant would require an opportunity to undertake a further review of the data that it held, applying the guidance given by the Court in this judgment, with a view to then providing the Claimant with copies of additional personal data. Accordingly, save in respect of those relating to Issue 4(a)(iii), I was not provided with the extensive documentation held by the Defendant and I was not asked by the parties to myself conduct the exercise of deciding where the personal data line should be drawn in respect of any particular material. Does all the data that relates to the Defendant’s assessment of his tax liability in respect of the Enquiry amount to the Claimant’s “personal data”?[154]I will firstly address the broadest way that the Claimant’s case is put, namely the proposition that all of the data processed by HMRC in the context of its assessment of his tax liability in respect of the Enquiry amounted to his “personal data”, because of the nature and potential effect upon him of that exercise.[155]My starting point is the wording of the definition of “personal data” in Article 4(1) of the UK GDPR. As Mr Cornwell pointed out, the question is whether the “information” meets the criteria of “relating to an identified or identifiable natural person”, not whether the over-arching processing that is taking place or the reason for that processing is “relating to” an identified or identifiable individual. Accordingly, the question of whether data processed by HMRC relates to Mr Ashley, falls to be answered by focusing on the particular pieces of information that HMRC hold, rather than by reference to the overall nature of the exercise that HMRC were engaged in, namely determining Mr Ashley’s tax liability for the 2011/12 tax year.[156]If Ms Proops was correct that the “relating to” question should be approached from the perspective of the purpose and/or effect of the Enquiry itself, it is evident that this would represent a very significant extension of the concept of “personal data”. As I have already noted, this approach is not supported by the legislative wording. Furthermore, none of the cases that I have reviewed supports such an approach, including those that are the most favourable to the Claimant’s position. Whilst, as I have acknowledged, more recent decisions have emphasised the broad scope of the concept of “personal data” and that “information” is a wide word, the approach adopted by the CJEU in Novak and subsequently endorsed in FF (paras 105 and 118 above) nonetheless looks to whether “the information, by reason of its content, purpose or effect, is linked to a particular person” (emphasis added). This clearly accords with the GDPR definition.[157]Mr Cornwell rightly accepted that the data protection legislation is intended to respect the fundamental rights and freedoms of natural persons, as the recitals make clear; and that this is not confined to rights of privacy. He also rightly accepted that the determination of Mr Ashley’s tax liability involved fundamental rights regarding possession of property. However, this does not assist Ms Proops’ argument, given the clear wording of Article 4(1), the way the test has been articulated by the CJEU in Nowak and in FF and the absence of any caselaw that directly supports the approach she invites the Court to take.[158]Ms Proops also placed reliance upon Aven, which she said established that the question of whether data amounted to “personal data” was to be approached in a holistic, rather than an atomised, way. However, it is clear from the reasoning of Warby J (as he then was) that his decision was based upon the particular circumstances of that case (para 115 above). Furthermore, the circumstances in Aven were very different from the present situation. As I have explained, Warby J was concerned with a single document (Memorandum 112) and a submission that each of the passages relied upon by the claimants had to be considered individually when deciding whether the relevant individual was identifiable in that text (para 114 above). Unsurprisingly, Warby J rejected that submission for the reasons I have already summarised. Aven is not authority for the proposition that the question of whether data relates to the individual in question is to be decided by reference to the purpose or effect of the overall data processing exercise that the controller is engaged in, rather than by reference to “information”.

The correct approach to the “information relating to” element

[159]Having rejected the broadest way in which the Claimant puts the position, I turn to consider how the “information relating to” element of the “personal data” definition is to be understood and approached. Whilst I began my review of the caselaw by noting that there was some difference of emphasis in the authorities (para 77 above), I do not accept that there is the level of conflict between some of these decisions that the parties suggested.[160]Nowak was decided by the CJEU on 20 December 2017; unlike FF, this was prior to the end of the implementation period and thus it is potentially binding on this Court (para 118 above). However, as I am concerned with the UK GDPR, rather than the Directive, it may be that Nowak is not technically binding upon me for present purposes (although I note that the Defendant submitted that YS – which I will return to - was binding authority upon this Court). Nonetheless, as the definitions of “personal data” in the Directive, the GDPR and the UK GDPR are not in materially different terms (paras 58 and 75 above) it would be surprising if this Court was to adopt a different approach to the meaning of “relating to”. In any event, for the reasons that I identify at para 162 below, I consider that the CJEU’s approach to “relating to” in Nowak was correct and I will follow it. As I explain at paras 163 - 170 below, the earlier authorities do not preclude this course.[161]Accordingly, the “relating to” requirement is satisfied where “the information, by reason of its content, purpose or effect, is linked to a particular person” (para 105 above). As the CJEU’s test in Nowak indicates, the “content”, “purpose” and “effect” of the information are disjunctive ways in which it may be linked to the individual in question. However, in many instances these features are likely to overlap and I accept that the position will be strengthened where a link exists in more than one of these senses. Consistent with the wording of the definition and the purpose of the legislative provisions, the concept of the information being “linked” to the data subject is to be construed in a broad way. However, this concept must have some limitations and I respectfully agree with the view expressed in Durant and in Aven that for these purposes there is a continuum of relevance to the data subject. Accordingly, an indirect or tenuous link at several removes is unlikely to suffice. On the other hand, information that would not, when viewed in isolation meet the definition of “personal data”, may do so where it is interlinked with or connected to material that is itself the “personal data” of the relevant individual. In Nowak the applicant’s script was plainly his personal data and the examiner’s comments appeared in the same document, were heavily interlinked with it and had a direct impact on the applicant. In cases of difficulty or ambiguity, it will be appropriate to consider whether affording rights of access to the individual will serve the legislative purposes, as the CJEU did in relation to the Directive in both YS and Nowak (paras 93 – 94 and 108 above).[162]I consider that the CJEU’s approach in Nowak accords with the relatively broad wording used in defining “personal data” in the Directive, the GDPR and the UK GDPR. I also note that recital (26) of the UK GDPR refers to the principles of data protection applying to “any information concerning an identified or identifiable natural person” (emphasis added); this choice of wording chimes with and reinforces the potentially wide nature of “relating to” in the Article 4(1) definition. The Nowak approach was endorsed by the CJEU in FF (para 118 above); and whilst FF is not binding on me, it is the only authority cited to the Court that was concerned with the GDPR. In addition, as I have already shown, the CJEU’s approach reflected the contents of the earlier Article 29 Opinion, which persuasively explained why it accorded with the wording of the definition of “personal data” (paras 85 - 87 above). The current ICO Guidance takes a similar approach (paras 119 – 121 above). I am also satisfied that this accords with a central objective of the UK GDPR (as well as that of the Directive), that the subject access request should enable the data subject to be aware of and able to verify the lawfulness of the processing: see in particular recital (63) of the UK GDPR (para 72 above) and my discussion of the CJEU’s reasoning in Nowak at paras 109 – 110 above.[163]I will next explain why this approach is not precluded by the earlier authorities that the Defendant relied upon.[164]Durant is not binding upon me as it was decided in respect of a differently worded definition of “personal data” and in circumstances where the Court of Appeal considered that the wording which does not appear in the current definition of “personal data” indicated that the legislature intended a narrow approach to be taken to the concept (paras 76 and 80 – 81 above). As I have observed when undertaking my chronological review of the authorities, Durant was clearly a correct decision on its facts and the indicators or “notions” identified by Auld LJ as to when information would “relate to” a data subject stemmed from the circumstances of that case and were not advanced as or intended to be an exhaustive account of how the statutory test could be met (paras 82 – 83 and 88 above). In any event the second of Auld LJ’s notions – whether the data subject is the “focus” of the information – is not necessarily out of step with the later authorities, if it is applied in a manner that reflects the broad way in which the concept of “personal data” has subsequently been interpreted in those authorities, including that this focus may come not only from the content of the information, but from its purpose or effect.[165]As I have noted, YS was decided by the CJEU in respect of the Directive’s definition of “personal data” and has the same precedent status as the CJEU’s later decision in Nowak (para 160 above). I have already highlighted that the decision in YS was specific to the legal analysis section of the relevant minute (paras 89 – 92, 94 and 96 – 97 above). The CJEU expressed its reasoning and its conclusion at paras 40, 45, 46 and 48 of its judgment in these narrow terms, reflecting the questions referred to the Court. Similarly, the Advocate General (whose reasoning the Court endorsed), expressly confined her assessment to whether the legal analysis included in the minute was personal data. Unlike the Court’s subsequent judgment in Nowak (also concerning the definition of “personal data” in the Directive), the CJEU in YS did not identify a general test or general indicators as to when the “relating to” element of the definition would be met. Insofar as the Court in YS indicated that it was appropriate to consider whether provision of the information in question to the data subject would accord with the objective and general scheme of the Directive, this was also consistent with the approach taken by the CJEU in Nowak (paras 93 – 94 and 107 – 108 above).[166]In the circumstances, YS does not preclude this Court adopting the approach to “relating to” identified by the CJEU in Nowak.[167]Furthermore, there is, with respect, force in Lewison LJ’s observation in Ittihadieh that the decision in YS turned on – or was at least heavily influenced by - the identifiability element of the definition (paras 99 – 100 above), which the Defendant accepts is not in issue in the present case. As the Advocate General said of the relevant section of the minute at para 59 of her Opinion (in a passage explicitly endorsed by the CJEU): “…that analysis contains the explanation for the resolution. The explanation itself is not information relating to an identified or identifiable person. At most it can be categorised as information about the interpretation and application of the pertinent law with regard to which the legal position of any individual is assessed and (possibly) decided”.[168]Accordingly, whilst YS underscores the point that I have already addressed, namely that the question is whether the information relates to the data subject, not whether the controller’s over-arching determination did so, I reject Mr Cornwell’s suggestion that YS is authority for the proposition that the impact or effect of the information in question upon the data subject cannot in itself provide the basis upon which the “relating to” criterion is satisfied. I also do not accept his proposition that in YS the CJEU was drawing a clear demarcation of more general application between personal data and administrative decision-making; that is not what the Court said. Indeed, in some circumstances there will likely be an overlap between the two; each situation will depend upon the content of the information in question, its purpose and effect and the context in which it appears. Nonetheless, as I observed at para 92 above, the decision in YS highlights that (depending on the circumstances) the reasoning or assessment process of the decision-maker may not itself amount to the “personal data” of the subject of the decision. Whether it does or not is likely to depend on the degree to which it is inter-linked with information that more specifically relates to the individual in question.[169]Mr Cornwell also relied upon the Court of Appeal’s decision in Ittihadieh as endorsing his interpretation of the CJEU’s approach in YS. However, I do not consider that Lewison LJ’s judgment supports that suggestion. As I have explained, Lewison LJ considered that YS was concerned with the “identifiability” limb of the definition. Furthermore, the observation that he made regarding the correspondence between YS and Durant was expressly related to the general point that the definition of “personal data” should not be read so widely as to necessarily cover all of the communicable content in which factual elements relating to a data subject are embedded (paras 100 – 101 above), a proposition that is plainly correct.[170]As I have concluded that the case does not have the significance that Mr Cornwell sought to attribute to it, Ms Proops’ submission that YS was wrongly decided is of less importance than the prominence that she gave to this contention during oral argument. However, for the avoidance of doubt, I do not consider that there is any basis upon which I could find that the case was wrongly decided. As I have explained, the decision turned on the contents of the legal analysis section of a particular minute, a document that I have not had the benefit of seeing. I have also rejected the proposition that the terms of the CJEU’s judgment in Nowak indicates that it was expressing disagreement with the Court’s conclusion or reasoning in that earlier case (para 108 above).

The approach taken by the Defendant

[171]Having addressed the test that is to be applied in determining whether information held by the Defendant in respect of the Enquiry is the Claimant’s “personal data”, I will next consider whether the Defendant has applied the correct approach thus far.[172]The criteria that were used by the Defendant in the searches for the Claimant’s personal data that were undertaken in response to the SAR could have been set out more clearly than they have been. The Court can only proceed on the basis of the information that the Defendant has provided. As I have noted, Mr Kempell identifies the Claimant’s personal data as being data in which Mr Ashley was identified or identifiable and that was “sufficiently proximate” to him (para 148 above). This appears to be a reference to the Court of Appeal’s approach in Durant. Although para 56 of the Defendant’s skeleton argument referred to HMRC having applied Durant, YS, Ittihadieh and Nowak, it was apparent from the oral submissions (summarised at para 151 above) that the Defendant’s position was that it was right to have approached the SAR by application of the Durant “notions” and the interpretation of YS that Mr Cornwell advanced. For the reasons I have just identified, this was too narrow a way of identifying when information constituted “personal data”. Furthermore, it does not appear that the Defendant used the Nowak approach that I have identified as applicable at paras 160 - 161 above in determining what amounted to the Claimant’s “personal data”. Accordingly, it is highly likely that the Defendant has taken an unduly restrictive approach to the personal data that it has provided in response to the SAR.[173]This impression is reinforced by a number of features, in particular:(i) the Defendant’s description of the Claimant’s personal data held by HMRC that was set out in the 14 March letter (para 42 above);(ii) that the Defendant has only identified the Claimant’s personal data as present in 329 of the over 1,000 documents that the WMBC holds in respect of the Enquiry;(iii) Ms Fox says that the VOA reviewed 9,132 documents, but Schedule 5 only contains extracts of personal data from 311 of these;(iv) in numerous instances the data disclosed by HMRC is limited to Mr Ashley’s name or initials (I was provided with a list of 21 examples of this); and(v) the VOA has been significantly more forthcoming in the extent of the extracts of data that it has disclosed than the WMBC, where this comes from documents that they both hold.[174]It therefore follows that the Defendant will need to reconsider the SAR applying the approach that I have identified. I will next set out some additional observations designed to assist with the application of the test to the present circumstances.

Application of the test to the present circumstances

[175]The basis upon which particular information satisfies the Article 4(1) definition is likely, in turn, to afford some guidance as to the scope of the data that amounts to the data subject’s “personal data”. If, for example, information in a document relates to Mr Ashley and thus is his “personal data” because its purpose is to evaluate or treat him in a particular way, or because of its impact on his rights or interests, then it is highly unlikely that it is only the Claimant’s name or initials from that document that will constitute his “personal data” and more likely that surrounding text which refers to or reflects this purpose or effect will also be his “personal data”. Similarly, if information meets the Article 4(1) definition because of its content, then it is highly likely that this content, rather than a smaller portion of it, will be the Claimant’s “personal data”.[176]I will consider specifically the valuations of the 32 properties, as this aspect loomed large in the parties’ submissions. During the Enquiry Mr Ashley had been provided with the valuation figures and a summary of how they were arrived at for each of the 32 properties, with further details given in respect of seven of them (para 28 above). Firstly, I will address the valuations themselves and then, secondly, the underlying material relating to how the valuations were arrived at, including the documentation regarding comparable properties. It is necessary to begin by considering the valuations, as Mr Cornwell did not concede that they constituted the Claimant’s “personal data”.[177]I conclude that the valuations were Mr Ashley’s personal data, essentially for the reasons explained in the Article 29 Opinion and the ICO Guidance (paras 86 and 121 above). The 32 properties were owned by Mr Ashley and the valuations that HMRC attributed to each of them were directly relevant to its assessment of his potential liability to pay tax for the period covered by the Enquiry.[178]As the Article 29 Opinion recognises, information conveyed by the data may directly concern an object, rather than an individual, but may relate indirectly to an individual by virtue of it belonging to them. The pertinent example given is that of the value of a house constituting personal data where that information is used to determine the extent of the owner’s obligation to pay tax. Mr Cornwell suggested that there is a distinction of principle to be drawn between a situation where the property is the data subject’s home and a situation where it is an asset in which the individual does not reside, in light of the particular rights associated with and the importance attached to a person’s home. I reject that submission as I do not consider that the aspect of residence provides a meaningful dividing line for these purposes (albeit, when present, it may reinforce the proposition that the information is personal data). In the example given, the value of the house is “personal data” because of the purposes that this data is to be put to and the impact that this is likely to have upon the individual’s interests (their liability to tax), both this purpose and this effect exist whether or not the person lives in the house in question. The same approach is reflected in the passage in the ICO’s Guidance that I have set out at para 121 above.[179]This approach is also consistent with the test identified in Nowak, which I have already discussed, and with the CJEU’s recognition at para 34 in Nowak that subjective opinions and assessments can be “personal data” provided they meet the requirement of “relating to” the data subject (para 105 above). Furthermore, there is nothing in YS that undermines this. I have already identified the limited nature of the CJEU’s conclusion in that case (paras 89 – 92 and 96 - 97 above). In any event, the question for the Court in YS was focused upon the decision-maker’s reasoning process, as set out in the legal analysis, as opposed to the decision that was reached by that process (paras 89 and 92 above).[180]Although I conclude that the valuations of the 32 properties constitute information relating to Mr Ashley and thus his personal data, it does not follow, as Ms Proops suggests, that all of the data generated by the investigations and assessments undertaken by HMRC in arriving at those valuations are also his personal data. As I have highlighted, the “relating to” test is to be applied to the particular information, rather than to the overarching purpose of the investigation (paras 155 – 158 above). Accordingly, whilst I have not heard submissions in respect of particular documents, which will need to be reviewed by the Defendant in light of this judgment, in general terms, it is difficult to see how details about a comparable property that Mr Ashley did not own and had no link to, or the value that HMRC attributed to that comparable property, or the basis upon which it was thought by HMRC to be a valid comparable, would constitute information “relating to” Mr Ashley. Similarly, it is difficult to see how information relating to HMRC’s processes would be information “relating to” Mr Ashley. On the other hand, data relating to the 32 properties themselves that was used in the assessment of their value, is likely to be the Claimant’s “personal data”.[181]Ms Proops observed in her oral submissions:
“we have the valuations but they don’t tell us how HMRC got there”
(emphasis added). However, the UK GDPR does not create a right, as such, to be given copies of the decision-maker’s reasoning. Not only would such an approach go much wider than the wording of the Article 4(1) definition of “personal data”, it is not one that is supported by the authorities that the Claimant relies upon. The Courts’ decisions in Nowak and Surrey Searches concerned, respectively, the examiner’s comments on the data subject’s script and answers provided to questions about internal flooding at the relevant properties; neither case supports the proposition that (if it existed), data indicating the underlying reasoning that led to these comments or answers was itself also the “personal data” of the relevant individual. Equally, although Ms Proops placed reliance upon the examples in the Article 29 Opinion and the ICO Guidance as supporting her case, these examples are, at best, neutral on the point (and, arguably, against her), as the personal data referred to in these examples is expressed to be the value of the data subject’s house, not the underlying material that led to the valuation figure.[182]For the avoidance of doubt, it may still be the case that some of the data concerning how the valuation figures were reached by the VOA and some of the data contained in its communications with the WMBC and/or others in relation to this, will amount to the Claimant’s personal data. However, this will depend on the application of the approach that I have identified earlier (see para 161 above in particular).[183]Turning to a different aspect of the material held by HMRC, given the approach that I have identified, it is very unlikely that the contents of internal policy documents or material relating to HMRC’s interpretation of its statutory powers and duties will be “information relating to” the Claimant. Conclusion[184]I return to the formulation of Issue 2. For the reasons I have identified, I do not consider that the data relating to the Defendant’s assessment of the Claimant’s tax liability in the context of the Enquiry amounts to the Claimant’s “personal data” per se. Such data will amount to “personal data” where it is information that by reason of its content, purpose or effect is linked to Mr Ashley. I have given as much guidance as I can at this stage as to the application of this test to the circumstances of this case at paras 161 and 175 - 183 above. Issue 3: extent of the Defendant’s search for personal data Summary of the submissions

Issue 3: extent of the Defendant’s search for personal data

[185]Issue 3 concerns whether it was reasonable and proportionate for the Defendant to respond to the SAR by searching for the Claimant’s personal data that was being processed by the VOA as part of the Enquiry. The Claimant contends that HMRC was obliged to take this step pursuant to its duties under Article 12 UK GDPR. The Defendant, on the other hand, maintains that the search of the data processed by the WMBC was sufficiently extensive and fully discharged the obligation to conduct a reasonable and proportionate search, so that the subsequent search of data held by the VOA was done on a purely voluntary basis.[186]Ms Proops emphasised that the SAR extended to data processed by the VOA, that HMRC was a data controller for the VOA and that it was under the duty imposed by Article 12(2) to “facilitate” the Claimant’s exercise of his data protection rights. She said that in the circumstances there was no legitimate basis for the arbitrary distinction that was unilaterally drawn by the Defendant between data processed by the main part of HMRC and data processed by the VOA. She emphasised the important role played by the VOA in valuing the 32 properties and the importance to the Claimant of understanding how the valuations were arrived at, given the potential impact on his tax position. The figure of 150 hours that was given by Mr Kempell (para 45 above) did not represent the time spent by the WMBC on a legitimate response to the SAR, as it included the hours spent on the erroneous way that the exercise was first conducted (para 40 above) and the mistakes that resulted in the provision of Schedule 3 (para 43 above); and it involved an unduly restrictive approach to what constituted “personal data”.[187]Mr Cornwell emphasised the substantial number of hours that the WMBC had spent in responding to the SAR, the large volume of documentation involved and the fact that much of this covered the same documentation as was also held by the VOA. He said that the legislation did not require HMRC to go further than this, as to do so would involve disproportionate effort, as was illustrated by the very substantial number of hours that the VOA had subsequently spent in (voluntarily) preparing Schedule 5 (para 51 above). He also noted that Article 12(3) did not envisage the response to a subject access request taking longer than three months.[188]At one stage of his oral submissions, Mr Cornwell sought to argue that searching the data processed by the VOA did not materially add to the data that was held by the WMBC. However, when I queried how I would be able to determine this point without sight of the material in question, he indicated that he was content not to pursue this proposition.

Analysis and conclusions

[189]As I concluded when deciding Issue 1 that the scope of the SAR extended to the Claimant’s personal data pertaining to the Enquiry that was being processed by the VOA, Issue 3 remains a live issue. Moreover, its resolution will be of continuing significance given that the conclusions I have reached in respect of Issue 2 will require the Defendant to reconsider its response to the SAR.[190]I have summarised the legal principles identified in Dawson-Damer at para 125 above. As Arden LJ (as she then was) indicated, the question of whether disproportionate effort is involved in responding to a subject access request is not limited to a consideration of the time spent in searching documentation for the data subject’s personal data; it may also encompass difficulties which occur in the process of complying with the request. It appears to be that this would include, for example, time spent addressing whether exemptions applied to any of the personal data identified and addressing the extent to which the data should be redacted.[191]The question is an objective one, judged by reference to the fact-sensitive circumstances of the case. However, if the controller made a cogent and reasoned assessment at the time that a particular search was disproportionate, then that is likely to support the proposition that undertaking the additional steps would have been unreasonable.[192]I have found that the SAR extended to the data being processed by the VOA in relation to the Enquiry. The HMRC was a controller in respect of that data. If, objectively viewed, it was not disproportionate for the Defendant to search for the Claimant’s personal data being processed by the VOA, then there was no legal basis for HMRC to differentiate the position of the VOA simply because that accorded with its past practice.[193]As I have indicated when setting out the legal principles, the onus is on the controller to show that supplying a copy of the information would involve disproportionate effort. I do not consider that the Defendant has established that it was disproportionate to search for the Claimant’s personal data pertaining to the Enquiry that was being processed by the VOA. Firstly, the VOA was within the wide terms of the SAR. Secondly, whilst I have not accepted the broad way in which the Claimant’s case was put in respect of his “personal data”, it is nonetheless apparent that the VOA had played an important role in the Enquiry and were likely to have processed a substantial amount of his “personal data”. Thirdly, whilst I am not in a position to evaluate the overall degree of duplication between the WMBC and the VOA or the extent to which additional personal data will need to be provided as a result of this judgment, it is apparent from the extent of Schedule 5 that the VOA did indeed hold a substantial amount of the Claimant’s “personal data”, even on the Defendant’s restricted approach to that concept. Fourthly, as Ms Proops pointed out, a significant portion of the 150 hours that were undertaken by the WMBC were spent on erroneously responding to the SAR. Fifthly, in so far as the Defendant relies upon practical difficulties said to arise in light of the distinction that had been applied between the main part of HMRC and the VOA in responding to subject access requests, as Arden LJ observed in Dawson-Damer, data controllers can be expected to know of their obligations and to design their systems accordingly (para 125(iv) above). This also provides an answer to the “three months” submission (para 187 above). Sixthly, it does not appear that the Defendant arrived at a considered, contemporaneous assessment that a search of the data processed by the VOA would be disproportionate, it simply applied its usual bifurcated approach.[194]Accordingly, I conclude that HMRC was obliged to search for the Claimant’s personal data pertaining to the Enquiry that was being processed by the VOA.

Issue 4(a): the First Tax Exemption

(a) : the First Tax Exemption

[195]As formulated, Issue 4(a) raises three points regarding whether the Defendant remained in breach of its obligation under Article 15(3) after 2 July 2024 (when Schedule 3 was provided). The answers to the questions posed at 4(a)(i) and (ii) now follow from the conclusions that I have already expressed. As I have set out in relation to Issue 2, the Defendant has adopted an unduly narrow concept of “personal data”. Accordingly, the Defendant has remained in breach of its obligations in this regard, in relation to data processed by the WMBC and that processed by the VOA. Further, it follows from my conclusion on Issue 3, that until the provision of Schedule 5 on 15 October 2024, the Defendant was also in breach of its obligations, in that it has failed to conduct a search to identify the Claimant’s personal data falling within the scope of the SAR that was held by the VOA. The outstanding issue relates to whether the Defendant has wrongfully treated the Claimant’s personal data comprised in a short passage within documents 5 and 115 of Schedule 1 as falling within the scope of the First Tax Exemption.

Summary of the submissions

[196]Ms Proops emphasised the strict criteria that the Defendant had to meet for the First Tax Exemption to apply, in particular the controller had to show by cogent evidence that there was a very significant and weighty chance of prejudice to the identified public interests. As HMRC had accepted that Mr Ashley had no further tax liability in relation to the 2011/12 tax year, the alleged future prejudice could only relate to other investigations and in this regard the explanations given in the Defendant’s letter of 13 April 2023 and in Kempell 1 (at paras 54 – 55 above) were brief, vague and did not come close to establishing a basis for the First Tax Exemption to apply.[197]Mr Cornwell submitted that Kempell 1 provided a perfectly adequate explanation that supported the applicability of the First Tax Exemption, namely that the text in question provided an insight into HMRC’s approach to a tax settlement so that, if this was disclosed, it could be used to the advantage of Mr Ashley or other taxpayers in future disputes and/or litigation with HMRC. He emphasised that the limited amount of data involved (less than a sentence in both instances) was relevant to the proportionality analysis. Analysis and

Conclusion

[198]I have set out the applicable approach at para 134 above. I will express my decision in terms that do not reveal the specifics of the information in question, in case there is an appeal by the Defendant from this conclusion.[199]There is no dispute that the personal data in question was being processed for one of the purposes specified in Schedule 2, para 2 of the DPA 2018, namely “the assessment or collection of a tax or duty” (para 69 above). However, I do not consider that the Defendant has discharged the burden of proving that the application of the subject access provisions to the text in question would be likely to prejudice the assessment or collection of tax. In arriving at this conclusion I bear in mind that “likely” connotes there being a very significant and weighty chance of prejudice to this public interest, which must be established convincingly by evidence, rather than through mere assertion.[200]The Defendant did not adduce any additional evidence in the Court’s closed session and thus the supporting material does not go beyond that which I have summarised at paras 54 – 55 above. The suggestion that the text in question would provide an insight into HMRC’s position with regard to the settlement of tax liabilities in the future is, at best, speculative. The text in question refers to HMRC’s position in respect of the specific dispute that was then live as to Mr Ashley’s tax liability for the tax year 2011/12; a dispute that was subsequently resolved. As such, I cannot see how its disclosure would provide an insight into HMRC’s settlement strategy more generally or somehow give Mr Ashley or other taxpayers an advantage in respect of the Defendant in future tax disputes that did not involve the same issues and same sum of money. When I put this concern to Mr Cornwell during the closed session, he responded that “any insight is of some use”. This entirely vague proposition falls far short of establishing that application of the subject access provisions to the text in question would be “likely to prejudice” the assessment or collection of tax. As the Defendant has failed to establish the existence of the alleged prejudice, the Court does not get to the subsequent proportionality stage of balancing the likely prejudice against the value of the subject access right. Issue 4(b): provision of personal data in a concise, transparent and intelligible manner Summary of the submissions

Issue 4(b): provision of personal data in a concise, transparent and intelligible manner

[201]As Ms Proops indicated, Issue 4(b) is only a live issue if I do not agree under Issue 2 that all of the data relating to the Defendant’s assessment of his tax liability in the context of the Enquiry amounted to the Claimant’s “personal data”. As I have not accepted that contention, the question raised by Issue 4(b) does arise from my determination.[202]This issue arises because the Claimant contends that a considerable amount of the extracts of his personal data that were provided on the Defendant’s Schedules were deracinated data that did not meet the Article 12(1) obligation to comply with the Article 15 duties in a “concise, transparent, intelligible and easily accessible form”. Ms Proopssaid that extracts that simply set out the Claimant’s name or his initials were particularly strong examples of this. Relying on the CJEU’s decision in FF, Ms Proops emphasised that the subject access regime was intended to assist data subjects in discovering the nature and implications of a controller’s processing of their personal data and that transparency and intelligibility were core objectives of the regime. In turn, this meant that where the data subject was likely to struggle to discern the full meaning and implications of the processing of the data in question if it was provided in a decontextualised form, then the controller was obliged to provide relevant contextual information, which might comprise additional passages from the document containing the individual’s personal data or even the entire document. She said that in this instance the Claimant could not begin to assess the legality of the underlying processing of his data on the basis of what had been provided; and it was not enough to simply say that Mr Ashley understood the nature of the Enquiry in a more general sense.[203]Mr Cornwell emphasised the wording of Article 15(3), which limited the controller’s obligation to providing “a copy” of the personal data, rather than any additional material. He submitted that FF did not decide that more was required of a controller than this and that the crux of the CJEU’s decision concerned the failure to supply a “copy” of the applicant’s personal data in that instance. Alternatively, in so far as FF went further than that, Mr Cornwell submitted that I should not follow its approach, which was not binding on this Court and was inconsistent with the indication in the domestic authorities from Durant onwards, that subject access provisions confer access rights to data, rather than to documents. He maintained that the provision of an extract that only contained the Claimant’s name or his initials did meet the UK GDPR requirement of intelligibility; and that insofar as the VOA had chosen to provide a greater degree of contextual information on Schedule 5 than had been given on the earlier Schedules, this did not undermine the Defendant’s contention that it was not bound to do so.

Analysis and conclusions

[204]I have already explained at paras 130 – 132 above, why I reject Mr Cornwell’s submission that in FF the CJEU went no further than confirming that the controller was required to provide a copy of the data subject’s personal data that was being processed, as opposed to a summary of this data. The Court decided that where intelligibility required it, Article 15 obliged the controller to go beyond providing a reproduction of the individual’s personal data.[205]As I noted at para 126 above, FF is not binding upon this Court. However, I consider that the CJEU’s reasoning (which I have discussed at paras 128 - 132 above) is persuasive and that this Court should follow it. The CJEU’s approach properly reflects and is consistent with the UK GDPR Article 12(1) requirement to take appropriate measures to provide the data subject with communications under Article 15 in a “concise, transparent, intelligible and easily accessible form” and the Article 12(2) duty on the controller to “facilitate” the exercise of data subject rights under (amongst others) Article 15. It is also in keeping with the entitlements conferred by Article 15(1), which gives the data subject the right to access their personal data that is being processed, in order to (amongst other things) assess whether to exercise rights regarding rectification or erasure or to object to the processing. If the data subject is only provided with a decontextualised snippet of data, such as their name, they may well not be able to assess the lawfulness of the processing or exercise their rights in a meaningful way (depending on the particular circumstances). This is reinforced by recital (63) of the UK GDPR, which acknowledges that data subjects’ rights of access are to enable them to be aware of and to verify the lawfulness of the processing of their personal data (para 72 above). It is also in keeping with the over-arching importance placed on transparency, which stems from the understanding that, without transparent information as to how their personal data is being processed, data subjects cannot enforce the rights afforded to them to have their personal data protected (para 65 above).[206]As the CJEU explained in FF, the data subject’s right to access their personal data that is being processed is to be found in Article 15(1), rather than Article 15(3) (para 128 above). Article 15(3) sets out the practical arrangements for the fulfilment of the controller’s Article 15(1) obligations and the reference to the provision of a “copy” in Article 15(3) must be understood in the light of the duty itself, interpreted in a manner consistent with Article 12, the recitals and the objectives of the UK GDPR.[207]Furthermore, the Defendant has not identified any good reason why I should not follow the CJEU’s approach in FF. I do not consider that the domestic authorities are inconsistent with or preclude this approach. The point addressed by the CJEU in FF did not arise for the Court’s consideration in the earlier domestic authorities. Furthermore, the fact that in certain circumstances the right to access personal data may require the provision of some additional contextual text in order to achieve an appropriate level of intelligibility, does not undermine the established position that the subject’s right is a right to access data, rather than a right to access documents.[208]As the CJEU did in FF, I emphasise that the obligation to supply additional contextual data will only apply where this is “necessary” to ensure that the provision of the data subject’s personal data is intelligible so that they are able to exercise the rights conferred by the UK GDPR effectively. The strict nature of this criterion is reinforced by the fact that the Court also used the alternative epithet “essential” and by the Advocate General’s reference to this requirement arising when it was “indispensable” (para 132 above). I also note, as the CJEU did, that in some circumstances a balance will need to be struck between the rights in question and the rights and freedoms of others, although this has not been advanced thus far by the Defendant as a specific basis for declining to provide fuller extracts in its Schedules.[209]In many instances, providing the data subject’s personal data will be likely in itself to meet intelligibility requirements. As I have addressed earlier, the Defendant has currently adopted too narrow an approach to what amounts to the Claimant’s “personal data” and it is likely that a proper application of this concept will minimise the circumstances in which additional contextual information will need to be provided.[210]The Court is not in a position to provide a precise answer to the question posed at Issue 4(b) in terms of particular material held by the Defendant, as I have not had sight of the relevant documentation that contains the data and, as I have noted, a greater amount of the data is likely to now be disclosable in any event on the basis that it constitutes “personal data”. However, I express my conclusions in the following way. Article 15(1) and 15(3), read with Article 12(1) and (2) of the UK GDPR, did require the Defendant to go beyond providing a copy of the Claimant’s personal data where contextual information was necessary for that personal data to be intelligible in the sense of enabling the data subject to exercise their rights conferred by the UK GDPR effectively. It follows that insofar as the Defendant did not adopt this approach, it was in breach of this duty.[211]I also indicate, by way of guidance, that it is unlikely that providing an extract that simply comprises the Claimant’s name or his initials or other entirely decontextualised personal data of that sort, will amount to compliance with this obligation (unless there is a proper basis, such as the application of a prescribed exemption or overriding third party rights, for withholding the additional data). Whilst Mr Cornwell maintained that provision of these snippets of data from the documentation held by the Defendant was sufficient compliance with any such duty, he was unable to explain why this was the case. The sheer fact that the Claimant understood the nature of the Enquiry and the issues that it was directed to, does not mean that a particular extract of his personal data, denuded of its proper context was intelligible to him in the sense that I have discussed.

Outcome and consequential matters

[212]The issues that the Court had to resolve at this stage are listed at para 7 above. I have addressed Issue 1 concerning the scope of the SAR at paras 139 - 146 above and my answer to the question posed by the parties is set out at para 146. Issue 2 regarding the correct approach to the concept of “personal data” in Article 4(1) of the UK GDPR is discussed at paras 153 – 184 above and my conclusions in relation to the questions posed by the parties appear at paras 155 – 158, 161, 172 – 174, 177, 180 – 181 and 184 in particular. I have addressed Issue 3 concerning the extent of the Defendant’s search at paras 189 – 194 above and my answer to the question posed by the parties is at para 194. The answers to the questions posed at Issue 4(a)(i) and (ii) follow from my conclusions in respect of Issues 2 and 3, as I have identified at para 195 above. Issue 4(a)(iii) regarding the First Tax Exemption is discussed at paras 198 – 200 above, with my conclusion set out at para 199. Issue 4(b) concerning the duty to provide the Claimant’s personal data in a concise, transparent and intelligible manner is discussed at paras 204 – 210 above, with my conclusion appearing at para 210.[213]As I foreshadowed earlier, in light of my conclusions regarding Issues 2, 4(a) and 4(b), the Defendant will need to reconsider its response to the SAR. In addition, both parties will want to address the Court in relation to remedies, including the terms in which declaratory relief should be granted and whether the Court should make a compliance order.[214]I will invite submissions from the parties as to how these consequential matters should be addressed.

Cited in 5 later judgments