Good Law Project Ltd v Reform UK Party Ltd [2026] EWHC 1458 (KB)

[2026] EWHC 1458 (KB)Case No KB-2025-001120
IN THE HIGH COURT OF JUSTICE
KING’S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Venue Royal Courts of Justice, Strand, London, WC2A 2LLDate Date: 19 June 2026
Before
THE HONOURABLE MR JUSTICE MURRAY
Between
GOOD LAW PROJECT LIMITEDRespondentREFORM UK PARTY LIMITEDApplicantGOOD LAW PROJECT LIMITED Respondent/Claimant- and -REFORM UK PARTY LIMITED Applicant/Defendant
Andrew Sharland KC and George Molyneaux (instructed by Pallas Partners LLP) for Respondent/ClaimantPhilip Coppel KC (instructed by Griffin Law Limited) for Applicant/DefendantHearing Hearing date: 4 February 2026
Approved JudgmentThis judgment was handed down remotely at 10.30am on 19 June 2026 by circulation to the parties or their representatives by e-mail and by release to the National Archives..............................
[1]The defendant, Reform UK Party Limited (“Reform”), made an application on 30 June 2025 to strike out, or for summary judgment in its favour on, the claim brought against it by the claimant, Good Law Project Limited (“GLP”), on 28 March 2025 (“the Application”).[2]At this hearing, the applicant/defendant is represented by Mr Philip Coppel KC, and the respondent/claimant is represented by Mr Andrew Sharland KC and Mr George Molyneaux.[3]The claim concerns Reform’s alleged failure to comply with its obligations under the UK General Data Protection Regulation (“the UK GDPR”). The UK GDPR is the version of the European Union’s Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (generally known as “the General Data Protection Regulation” or “the GDPR”), which was assimilated into English law following the departure of the United Kingdom from the European Union. The processing and protection of personal data in the UK is governed by the UK GDPR as supplemented by the Data Protection Act 2018 (“the DPA 2018”).[4]GLP states in its Particulars of Claim that it brings the claim in its capacity as a representative mandated by a group of 51 individuals (“the Relevant Individuals”) to pursue proceedings on their behalf under Article 80 of the UK GDPR. Reform disputes that GLP has standing to act in that capacity.[5]The names of the Relevant Individuals are set out in a Confidential Appendix to the Particulars of Claim, a revised version of which, correcting some editing errors, was filed by GLP on 27 January 2026. GLP states in the Particulars of Claim that the Relevant Individuals are a group of data subjects, who are all individuals resident in the UK and are all registered voters.[6]The core allegations of the claim are that Reform failed to respond to data subject access requests (“DSARs”) sent by the Relevant Individuals within the relevant statutory time limit and that the late responses provided by Reform were substantively deficient, causing non-material damage to the Relevant Individuals, including, without limitation, concern, worry, uncertainty, and distress caused to the Relevant Individuals by Reform’s failure to respond within the relevant time limit and the substantive deficiency of its late responses.

The legal framework for data protection in the United Kingdom

[7]A DSAR, despite the use of the word “request”, is, in effect, a demand for information that may be made pursuant to Articles 12 and 15 of the UK GDPR by a natural person who is a “data subject” to a “controller”. The terms “data subject” and “controller” are each defined in Article 4 of the UK GDPR and, in similar terms, in sections 3 and 6 of the DPA 2018. For present purposes, it is sufficient to indicate that: i) a “data subject” is an identified or identifiable natural person or living individual; and ii) a “controller” is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the “processing” of personal data (subject to certain qualifications not relevant for present purposes in section 6 of the DPA 2018); and iii) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.[8]It is not in dispute that the Relevant Individuals are data subjects or that Reform is a controller of personal data within the relevant statutory meaning. It is a matter of dispute what personal data, if any, Reform has or had about each Relevant Individual at relevant times for purposes of this claim.[9]Under Article 15(1) of the UK GDPR, a data subject has the right to obtain from a person who may be a controller of the data subject’s personal data: i) confirmation as to whether personal data concerning him or her are being processed by the recipient of the DSAR; and ii) if so: a) access to that personal data; and b) various types of information as specified in Article 15(1), including the purposes of the processing, the categories of personal data concerned, and other matters.[10]Article 12 of the UK GDPR sets out certain rules applicable to communication between a data subject and a controller under various provisions of the UK GDPR, including Article 15.[11]Article 12(3) of the UK GDPR, as in effect at the relevant time, provides that a controller shall provide information on action taken on a request under Article 15 to the data subject without undue delay and in any event within one month of receipt of that request. It also provides that the period may be extended by two further months where necessary, taking into account the complexity and number of requests. The controller is required to inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject has made his or her request by electronic means, Article 12(3) requires the controller to provide the requested information by electronic means where possible, unless the data subject has requested that the information be provided by some other means.[12]Article 12(4) of the UK GDPR, as in effect at the relevant time, provides that if the controller does not take action on a request of the data subject made under Article 15, the controller is required to inform the data subject, without undue delay and at latest within one month of receipt of the request, of its reasons for not taking action and on the possibility of lodging a complaint with the Information Commissioner and seeking a judicial remedy.[13]Articles 79(1) of the UK GDPR reads in relevant part as follows:
“Without prejudice to any available administrative or non-judicial remedy, … each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.”
[14]Article 80(1) of the UK GDPR reads in relevant part as follows:
“The data subject shall have the right to mandate a body or other organisation which meets the conditions in section 187(3) and (4) of the [DPA 2018] to lodge the complaint on his or her behalf, to exercise the rights referred to in Article… 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf … .”
[15]Article 82 of the UK GDPR reads in relevant part as follows:
“1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. 2. Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. … 3. A controller … shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage. …”
[16]Section 187 of the DPA 2018 reads in relevant part as follows:
“(1) In relation to the processing of personal data to which the UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)— (a) enables a data subject to authorise a body or other organisation which meets the conditions set out in subsections (3) and (4) to exercise the data subject's rights under Article… 79 of the UK GDPR … on the data subject's behalf, and (b) also authorises such a body or organisation to exercise the data subject's rights under Article 82 of the UK GDPR … … (3) The first condition is that the body or organisation, by virtue of its constitution or an enactment— (a) is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes, (b) is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and (c) has objectives which are in the public interest. (4) The second condition is that the body or organisation is active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data. (5) In this Act, references to a ‘representative body’, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the UK GDPR or this section.” (a) enables a data subject to authorise a body or other organisation which meets the conditions set out in subsections (3) and (4) to exercise the data subject's rights under Article… 79 of the UK GDPR … on the data subject's behalf, and (b) also authorises such a body or organisation to exercise the data subject's rights under Article 82 of the UK GDPR … … (3) The first condition is that the body or organisation, by virtue of its constitution or an enactment— (a) is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes, (b) is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and (c) has objectives which are in the public interest. (4) The second condition is that the body or organisation is active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data. (5) In this Act, references to a ‘representative body’, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the UK GDPR or this section.”

The claim

[17]By this claim, GLP seeks: i) an order pursuant to section 167 of the DPA 2018 that Reform comply with the DSARs by disclosing to GLP all personal data concerning each of the Relevant Individuals processed by Reform and the information set out in Article 15(1)(a)-(h) of the UK GDPR; and ii) an order pursuant to Article 82 of the UK GDPR and section 168 of the DPA 2018 that Reform pay compensation for the non-material damage suffered by the Relevant Individuals as a result of Reform’s continued non-compliance with the DSARs, in an amount to be determined by the court and paid to the claimant in accordance with section 168(3) of the DPA 2018.

The Application

[18]By the Application, Reform seeks an order from the court: i) striking out the Claim Form and Particulars of Claim under CPR r 3.4(2)(a) (no reasonable grounds disclosed) and/or CPR r 3.4(2)(b) (abuse of process); and/or ii) entering summary judgment in favour of Reform under CPR r 24.2 on the basis that GLP has no real prospect of succeeding in its claim and there is no other compelling reason for the claim to be disposed of at trial.[19]As a threshold matter, Reform maintains that GLP does not meet the conditions in section 187(3)-(4) of the DPA 2018 necessary to enable it to act as a representative body for the Relevant Individuals under Article 80(1) of the UK GDPR in order to exercise on behalf of each of them his or her right to: i) an effective judicial remedy under Article 79(1) of the UK GDPR against Reform as a controller; and ii) the right to receive compensation referred to in Article 82 on his or her behalf.

The principal issues

[20]In my view, the principal issues raised by the Application are as follows: i) Does GLP have standing as a “representative body” (as defined in section 187(5) of the DPA 2018) to bring the claim? ii) Does GLP have a proper mandate to bring the claim on behalf of the Relevant Individuals? iii) Does GLP have reasonable grounds for bringing the claim? iv) Is the claim an abuse of process and/or a vexatious claim? v) Does GLP have a real prospect of succeeding on the claim and, if not, is there any other compelling reason why the case should be disposed of at trial?

Background

[21]GLP is a private company limited by guarantee without share capital, registered under the Companies Act 2006, the principal activity of which, according to its Directors’ Report for the year ended 31 January 2024, is to use “the law to address significant issues of disadvantage, discrimination, unfairness and wrongdoing”.[22]Given their relevance to one of the principal issues arising in relation to the Application, I note the following provisions of GLP’s current Articles of Association (“the GLP Articles”), which were adopted on 15 December 2021: i) Under Article 2, the objects of GLP are: “2.1 to promote the sound administration of the law and to challenge injustice and inequality; 2.2 to uphold democracy and promote changes to the law and public administration with the aim of improving social justice, equality and inclusion; 2.3 to uphold high standards in public administration in accordance with democratic principles; 2.4 to enable and promote access to justice and the law, particularly for those whose access is curtailed because of poverty, social or economic disadvantage or discrimination; 2.5 to protect and preserve the environment for the benefit of mankind now and in the future; 2.6 to advance education and research into good application and development of the law and of administrative practice; 2.7 to promote compliance with the law by public and private actors and to address imbalances of economic power in the application of the law; and 2.8 to further any other philanthropic or benevolent purpose ancillary to the above purposes. ” ii) Under Article 5.1, the income and property of GLP are to be applied solely towards the promotion of its objects. iii) Under Article 5.2, no part of the income and property of the company may be paid or transferred directly or indirectly by way of dividend, bonus, or otherwise by way of profit to any member of the company, subject to certain exceptions to which I will revert in due course. iv) Under Article 4.2, if the company is wound up under the Insolvency Act 1986 and all its liabilities have been satisfied, any residual assets shall be given or transferred to an asset-locked body such as a charity or community interest company.[23]Reform is a private company limited by guarantee without share capital, registered under the Companies Act 2006, and a political party included in the register of political parties maintained by the Electoral Commission under section 23 of the Political Parties, Elections and Referendums Act 2000 (“the PPERA 2000”). It is therefore a “registered party” within the meaning of section 160(1) of the PPERA 2000.[24]Reform is a “controller” within the meaning of Article 4(7) of the UK GDPR and section 3(6) of the DPA 2018 of personal data and therefore must comply with the provisions of the UK GDPR as supplemented by the DPA 2018 in relation to its processing of the personal data of data subjects. As it is required to have, Reform has a data protection policy, the version included in the bundle for the hearing of the Application being dated January 2022.[25]The lawfulness of the processing of personal data is governed, in the first instance, by Article 6 of the UK GDPR, subject to other provisions of the UK GDPR, related provisions of the DPA 2018, and relevant secondary legislation.[26]The processing of special categories of personal data (namely, personal data concerning an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and an individual’s genetic data, biometric data used for identification, health data, or data concerning their sex life or sexual orientation) is prohibited under Article 9(1) of the UK GDPR, subject to specific exceptions set out in Article 9(2) and related provisions of the DPA 2018. Article 9(2)(g) of the UK GDPR provides that the prohibition in Article 9(1) does not apply to the processing of special categories of personal data that is:
“… necessary for reasons of substantial public interest, on the basis of domestic law, or relevant international law, which shall be proportionate to the aim pursued … and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;”
[27]Section 10(3) of the DPA 2018 provides that the processing of special categories of personal data meets the requirement in Article 9(2)(g) of the UK GDPR only if it meets a condition set out in Part 2 (Substantial public interest conditions) of Schedule 1, which comprises paragraphs 5-28 of that Schedule.[28]In relation to the processing of special categories of personal data by a registered party such as Reform, the relevant condition is set out in paragraph 22 of Schedule 1 to the DPA 2018, which provides: “(1) This condition is met if the processing—(a) is of personal data revealing political opinions,(b) is carried out by a person or organisation included in the register maintained under section 23 of [PPERA 2000], and(c) is necessary for the purposes of the person’s or organisation’s political activities, subject to the exceptions in sub-paragraphs (2) and (3). (2) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to a person. (3) Processing does not meet the condition in sub-paragraph (1) if— (a) an individual who is the data subject (or one of the data subjects) has given notice in writing to the controller requiring the controller not to process personal data in respect of which the individual is the data subject (and has not given notice in writing withdrawing that requirement), (b) the notice gave the controller a reasonable period in which to stop processing such data, and (c) that period has ended. (4) In this paragraph, ‘political activities’ include campaigning, fund-raising, political surveys and case-work.” (a) is of personal data revealing political opinions, (b) is carried out by a person or organisation included in the register maintained under section 23 of [PPERA 2000], and (c) is necessary for the purposes of the person’s or organisation’s political activities, subject to the exceptions in sub-paragraphs (2) and (3). (a) an individual who is the data subject (or one of the data subjects) has given notice in writing to the controller requiring the controller not to process personal data in respect of which the individual is the data subject (and has not given notice in writing withdrawing that requirement), (b) the notice gave the controller a reasonable period in which to stop processing such data, and (c) that period has ended.[29]Paragraph 5 of Schedule 1, which applies generally to the other conditions in Part 2 of the Schedule (in paragraphs 6-28) provides:
“(1) Except as otherwise provided, a condition in this Part of this Schedule is met only if, when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule). (2) See also the additional safeguards in Part 4 of this Schedule.”
Although a question was raised by GLP in its pre-action letter of 8 October 2024 to Reform about whether Reform had in place an appropriate policy document at the relevant times, no issue is raised about this in the Particulars of Claim.[30]During the month prior to the general election held on 4 July 2024, GLP provided an online tool (“the Tool”) through which members of the public could send one or more of the five major political parties in the UK (including Reform) by email a notice (“a Notice”) containing: i) a request to cease processing the sender’s personal data (including special category data); ii) an objection to the recipient’s processing of the sender’s personal data and a request that the registered party cease processing it and delete, to the full extent possible, all of the sender’s personal data held by the recipient, pursuant to the sender’s rights under Articles 18 and 21 of the UK GDPR; iii) written notice under paragraph 22(3) of Schedule 1 to the DPA 2018 (see [28] above) requiring the recipient not to process personal data in respect of which the sender is the data subject; and iv) a DSAR, requesting that the recipient provide all of the sender’s personal data “processed by you”, and asking that the recipient respond to each request “as soon as possible and in any event within one month of receipt”, reserving all of the sender’s other rights.[31]Over 11,600 individuals used the Tool to send a Notice to one or more parties. 1,746 of those individuals, including the Relevant Individuals, chose to send a Notice to Reform. The Relevant Individuals sent their Notices between 5 June and 4 July 2024.[32]Reform failed to respond to the Notices within one month of receipt, either to provide a substantive response or to explain that it required further time to respond.[33]On 8 October 2024, GLP sent a pre-action letter to Reform.[34]Between 11 and 14 October 2024, Reform sent the following message to each of the Relevant Individuals and the other individuals who had sent a Notice to Reform using the Tool (each, a “Response Message”):
“Private and Confidential We have received and investigated your Data Subject Access Request. We have found no record of you in our systems, other than the original DSAR/cease and desist notice that you sent to us. During the general election you may have received a mailing from Reform UK by the Royal Mail, based on electoral roll data, which we are entitled to have by virtue of a statute and which is exempt from subject access. We hope this answers your questions. The Reform UK team”
The Reform UK team”[35]It appears that each of the Response Messages was sent via email by an officer of Reform addressed to himself with a large number of individuals blind-copied (bcc) on the email.[36]On 24 October and 3 December 2024, GLP wrote to Reform seeking a response to its pre-action letter of 8 October 2024. In its letter of 3 December 2024, GLP set out why it considered that the Response Messages were not sufficient to discharge Reform’s obligations under the UK GDPR.[37]GLP did not receive a reply to either of the letters sent on 24 October and 3 December 2024.

Procedural history

[38]On 28 March 2025, the claim was issued.[39]On 2 April 2025, GLP served the Claim Form, together with the Particulars of Claim, on Reform.[40]On 24 April 2025, as Reform had not filed an Acknowledgement of Service within the relevant deadline, GLP filed and served an application for judgment in default.[41]On 28 April 2025, Reform filed and served its Acknowledgement of Service.[42]On 13 May 2025, Reform filed and served its Defence.[43]On 19 May 2025, the application for judgment by default was dismissed by consent, granting Reform relief from sanctions in relation to defending the claim, extending its deadline for filing and serving its Defence to 16:00 on 13 May 2025, and making a pro bono costs order against Reform.[44]On 20 June 2025, GLP made a CPR Part 18 request for further information.[45]On 30 June 2025, Reform made the Application and filed supporting evidence (see below).[46]On 4 July 2025, Reform provided a short response to the Part 18 request.[47]On 30 July 2025, Reform provided a more detailed response to the Part 18 request.

Evidence

[48]As its principal evidence in support of the Application, Reform filed witness statements from each of the following witnesses: i) Mr Dominic Burgess, a solicitor at the law firm Griffin Law Limited (“Griffin Law”), Reform’s solicitors, whose witness statement is dated 30 June 2025; and ii) Ms Keeley Parry, a solicitor and associate at Griffin Law, whose witness statement is dated 23 October 2025.[49]In response to the Application, GLP filed witness statements from each of the following witnesses: i) Mr Jolyon Maugham KC, Founder and Executive Director of GLP, whose first witness statement is dated 10 October 2025 and whose second witness statement is dated 16 December 2025; ii) Mr Duncan McCann, Head of Technology and Data at GLP, whose first witness statement is dated 10 October 2025 and whose second witness statement is dated 28 January 2026; and iii) Mr Matthew Getz, a solicitor and partner at the law firm Pallas Partners LLP (“Pallas Partners”), GLP’s solicitors, whose first witness statement is dated 10 October 2025 (his third witness statement in these proceedings) and whose second witness statement is dated 16 December 2025 (his fourth witness statement in these proceedings).[50]Apart from the second witness statement of Mr McCann and the fourth witness statement of Mr Getz, each witness statement has annexed to it an exhibit of relevant documents.[51]In addition to the foregoing evidence, on the morning of the hearing, I received a further witness statement dated 4 February 2026 from Mr Getz (his fifth witness statement in these proceedings). During the course of the hearing, I received a witness statement dated 4 February 2026 from Mr Terence Blaney, a solicitor at Griffin Law, which was handed up by Mr Coppel just before he began his submissions in reply to those of Mr Sharland.

The legal framework

[52]I deal with the legal framework of the data protection regime to the extent necessary for purposes of the Application elsewhere in this judgment.[53]The principles applicable to an application to strike out and to an application for summary judgment are well-known and are not in dispute in this case. CPR r 3.4(2) provides:
“The court may strike out a statement of case if it appears to the court— (a) that the statement of case discloses no reasonable grounds for bringing or defending the claim; (b) that the statement of case is an abuse of the court’s process or is otherwise likely to obstruct the just disposal of the proceedings; or (c) that there has been a failure to comply with a rule, practice direction or court order.”
[54]Reform relies on (a) and (b) of CPR r 3.4(2). In relation to CPR r 3.4(2)(a), the bar is higher than the “no reasonable prospect of success” test that applies in relation to summary judgment. The impugned statement of case (or relevant part of it) must state a case that is unwinnable on the merits, misconceived or, upon the facts or matters pleaded, bound to fail as a matter of law: Partco Group Ltd v Wragg [2002] EWCA Civ 594 at [46]-[48].[55]In relation to CPR r 3.4(2)(b), the term “abuse of the court’s process” is not defined in the rules or practice directions, but was explained by the Lord Chief Justice, Lord Bingham of Cornhill, sitting in the Divisional Court in relation to a family law matter in HM Attorney General v Barker [2000] 1 FLR 759 at [19] as:
“… a use of the court process for a purpose or in a way which is significantly different from the ordinary and proper use of the court process.”
[56]In Barker, the Divisional Court was dealing with a person who had instituted vexatious civil proceedings, a concept that Lord Bingham characterised in Barker at [19] as involving civil proceedings with little or no discernible basis in law that, whatever the intention of the proceedings might be, have the effect of subjecting the defendant to inconvenience, harassment, and expense out of all proportion to any gain likely to accrue to the claimant.[57]In Munícipio de Mariana v BHP Group (UK) Ltd [2022] EWCA Civ 951, [2022] 1 WLR 4691 (CA) at [170]-[178], the Court of Appeal reviewed the general principles applicable to the striking out of a claim under CPR r 3.4.(2)(b), noting at [172] that the categories of abuse of process “are varied and not closed”, although certain categories were now “well-established”. A number of examples of possible forms of abuse of process are given in the White Book at paragraphs 3.4.3-3.4.17. In Munícipio de Mariana at [178], the Court of Appeal emphasised the longstanding principle that a court should only strike out a case as an abuse of the court’s process in “clear and obvious” cases.[58]It is also well-established that a strike-out application should not be conducted as “a minute and protracted examination of the documents and facts of the case”, as to do this is to “usurp the position of the trial judge”: Wenlock v Moloney [1965] 1 WLR 1238 (CA) at 1244; see also Three Rivers District Council v Bank of England (No 3) [2001] UKHL 16, [2003] 2 AC 1 (HL(E)) at [96]-[97].[59]In relation to Reform’s application in the alternative for summary judgment in its favour under CPR r 24.3, that rule provides that:
“The court may give summary judgment against a claimant or defendant on the whole of a claim or on an issue if— (a) it considers that the party has no real prospect of succeeding on the claim, defence or issue; and (b) there is no other compelling reason why the case or issue should be disposed of at a trial.”
[60]Principles applicable to an application for summary judgment by a defendant, distilled from earlier authorities, were set out by Lewison J (as he then was) in Easyair Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch) at [15] and approved by the Court of Appeal in AC Ward & Sons Ltd v Catlin (Five) Ltd [2009] EWCA Civ 1098 at [24]. These principles include, among others, that: i) the claimant has a “realistic” as opposed to “fanciful” prospect of success; ii) a “realistic” claim is one that carries some degree of conviction or, in other words, is more than merely arguable; iii) the court in reaching its conclusion on the application for summary judgment must not conduct a “mini-trial”; and iv) it is not uncommon for an application for summary judgment under CPR Part 24 to give rise to a short point of law or construction, and where the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and the parties have had an adequate opportunity to address it in argument, the court should “grasp the nettle and decide it”.[61]Although I have not set out the full set of principles set down by Lewison J in the Easyair case, I have had regard to all of them. There is a more recent summary of the relevant principles in Amersi v Leslie [2023] EWHC 1368 (KB) at [142], to which I have also had regard to the extent applicable to the circumstances of this case.

Does GLP have standing to bring the claim?

[62]In support of Reform’s argument that GLP does not have standing to bring the claim, Mr Coppel submitted that there was nothing in GLP’s Articles of Association (“the GLP Articles”) that demonstrates that GLP satisfies the three cumulative conditions in section 187(3), namely, that: i) in accordance with condition (a), GLP is required, after payment of outgoings, to apply the whole of its income and any capital it expends for charitable or public purposes; ii) in accordance with condition (b), GLP is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes); and iii) in accordance with condition (c), GLP has objectives that are in the public interest.[63]Mr Coppel submitted that there is no express requirement in the GLP Articles that satisfies condition (a) and that Articles 5.4.1, 5.4.4, 5.4.5, 5.4.6, 5.4.7, 5.4.8, 5.5, and 5.6 are all irreconcilable with that condition. He submitted that Articles 5.2.1, 5.2.2, 5.2.3, and 5.2.4 are all irreconcilable with condition (b). It was a necessary, but not sufficient, condition that GLP is a “non-profit”, as Mr Maugham said in his evidence. In relation to condition (c), he submitted that at least some of the objects of GLP were “sectional interests” rather than objectives in the public interest, for example, the object (Article 2.7) “to address imbalances of economic power in the application of the law”.[64]Furthermore, Mr Coppel submitted, GLP does not satisfy the condition in section 187(4) of the DPA 2018. First, he submitted, there is nothing in the GLP Articles identifying data protection as being of particular concern to GLP. The timing of the DSARs shows that GLP’s interest in data protection is simply a means to an end. He also submitted that there was no evidence that GLP is active in the field of data protection.[65]Mr Coppel submitted that a community interest company (“CIC”) established under and regulated in accordance with the Companies (Audit, Investigations and Community Enterprise) Act 2004 (the “2004 Act”) would, by virtue of the 2004 Act, relevant secondary legislation, and government guidance on CICs, satisfy the conditions set out in sections 187(3) and 187(4) of the DPA 2018. GLP, however, had chosen not to constitute itself as a CIC but instead as a company limited by guarantee without share capital, thus avoiding regulation as a CIC. This, he submitted, was “telling”.[66]Accordingly, he submitted, GLP fails to satisfy the conditions set out in sections 187(3) and 187(4) of the DPA 2018 to act as a representative body under Article 80(1) of the UK GDPR in relation to the rights of the Relevant Individuals under Articles 79 and 82 of the UK GDPR. For this reason alone, he submitted, the claim should be struck out or summary judgment granted in Reform’s favour.[67]In response, Mr Sharland submitted that GLP had a reasonable prospect of establishing at trial that the GLP Articles do satisfy the requirements of sections 187(3) and 187(4) of the DPA 2018. He noted, as a threshold matter, that section 187 does not require a representative body to be established as a CIC, as a charity, or in any other specific legal form.[68]In relation to section 187(3), Mr Sharland submitted that all of GLP’s objects set out in Article 2 of the GLP Articles fall within the broad definition of “charitable or public purposes”. Article5.1 requires the income and property of GLP to be applied solely to promotion of its objects. Article5.2 provides that no part of the income or property of the company may be paid or transferred directly or indirectly by way of dividend, bonus, or otherwise by way of profit to any member of the company. Article 4.2 requires that if GLP is wound up, any residual assets shall be given or transferred to an “asset-locked body”, which is defined to be a CIC or charity or equivalent foreign entity. All of the exceptions that Mr Coppel relies on as “irreconcilable” with conditions in section 187(3) are reasonable and narrow exceptions that permit GLP to operate effectively as a corporate body in pursuit of its objects. Mr Sharland submitted that GLP’s objects are plainly “in the public interest”. It was not relevant that some of GLP’s previous claims had not succeeded, as there is an important public interest in enabling the judicial determination of genuine legal disputes on matters of general public concern. Accordingly, GLP has a reasonable prospect of establishing at trial that it complies with the three-part condition in section 187(3).[69]In relation to section 187(4), Mr Sharland submitted that there was sufficient evidence, in particular from Mr Maugham and Mr McCann, to establish that GLP has a reasonable prospect of establishing that it is active in the field of data protection. Section 187 does not require activity in the field of data protection to be named specifically as an object of the representative body in its constitutional document.[70]For all these reasons, he submitted, GLP has a reasonable prospect of establishing at trial that it complies with the conditions in section 187 to act as a representative body under Article 80(1) of the UK GDPR on behalf of the Relevant Individuals. There is, therefore, he submitted, no basis on this ground to strike out the claim or grant summary judgment in favour of Reform.[71]I accept the submissions made by Mr Sharland on behalf of GLP in relation to section 187. The Articles provide a reasonable basis for arguing that all of GLP’s income and capital must be applied solely towards its objects, that all of its objects fall within the broad definition of “charitable or public purposes”, that those are in the public interest, and that the specific provisions relied on by Mr Coppel as demonstrating non-compliance with section 187(3) do not, properly analysed, do so. Mr Coppel appeared to accept that some of the exceptions in Article 5.4 are not irreconcilable with section 187(3)(a), namely, those at Articles 5.4.2 and 5.4.3. However, in my view, all of the other exceptions in Article 5.4 fall into the same conceptual category and are equally unexceptionable.[72]For example, in relation to Article 5.4.6, where a director or person connected to a director supplies goods or other property to GLP, the fact that the director or other person receives “reasonable and proper payment” for the supply is no more a failure to “apply the whole of its income and any capital it expends for charitable or public purposes” than is a “reasonable and proper payment” to a third party for goods or other property supplied to GLP.[73]To give another example, in relation to Article 5.4.1, if a director is also a beneficiary of the company (in particular, bearing in mind that the “benefits” intended to be conferred by GLP are primarily intangible), the fact that it is a director receiving the benefit rather than a third party does not mean that it has failed to comply with section 187(3)(a). Any benefit produced by GLP can only have resulted from the application of the income and property of GLP towards the promotion of its objects, as required by Article 5.1. The fact that such a benefit has been received by a director rather than a third party does not change that fact. Therefore, logically, Article 5.4.1 cannot be “irreconcilable” with section 187(3)(a).[74]In relation to Article 5.5, in furtherance of its objects, GLP may need to engage legal and professional services. The fact that it engages such services from a director or person connected to a director rather than a third party and it provides reasonable remuneration to the supplier of those services does not mean that it is not providing that reasonable remuneration in furtherance of its objects.[75]Similarly in relation to Article 5.6, it is normal for a company to purchase and maintain insurance for the benefit of its directors and officers in respect of relevant losses. It does so in order to operate effectively as a company, for example, by attracting directors and officers of the necessary calibre, who would normally expect to have such insurance in place, just as it might have to pay remuneration of a particular level to attract directors and officers of the necessary calibre. GLP would do this in support of its normal activity, which is limited by the Articles to pursuit of its objects. Therefore, expenditure of this nature by GLP would also be in furtherance of its objects.[76]In relation to Mr Coppel’s submissions in respect of section 187(b), similar considerations apply. The exceptions at Articles 5.2.1, 5.2.2, 5.2.3, and 5.2.4 are not sub rosa distributions of profit or capital to members. Those exceptions merely permit payments to a member of GLP that could be made to a third party. The payment must, under Article 5.1, still be made in pursuance of the objects of GLP.[77]I am also satisfied that GLP has a reasonable basis for arguing at trial that it has objectives that are each in the public interest. The term “public interest” is, of course, a broad one. The vast majority of the objects in Article 2 of the GLP Articles are uncontroversially in the public interest, in my view, but Mr Coppel submitted that some of the objects are “sectional interests” and either do not fall within “charitable and public purposes” or are not representative of the public interest. He gave, in particular, the example of the latter half of Article 2.7 (“… to address imbalances of economic power in the application of the law”).[78]There will inevitably be disagreement between reasonable individuals as to what is constitutive of “the public interest”. There was clearly a time when a significant body of individuals (primarily men) considered that it was not in the public interest for women to have the right to vote. Few would question now that the promotion of gender equality is in the public interest.[79]At any rate, on an application to strike out or for reverse summary judgment, it would not be right to strike out the claim because a couple of the objects are ones on which reasonable persons could differ as to whether the relevant object was “in the public interest”, given the breadth of that concept. GLP’s object of addressing imbalances of economic power in the application of the law would achieve some benefit, not necessarily material, “to a number of persons not organisationally bound together” (see Information Rights (6th edition) at paragraph 49-035, footnote 178). The same could be said of all of its objects in Article 2.[80]As far as relating the public interest to the law relating to data protection, as Mr Coppel submitted was required by section 187(3) (presumably by implication), Mr Sharland’s response was that it is in the public interest that the law should be complied with, including in relation to data protection. I agree.[81]Neither section 187(3) nor section 187(4) requires a representative body to have an express object concerning activity in data protection and/or an express object to promote compliance with the law relating to data protection. Section 187(4) simply requires that the representative body should be “active” in the field of protection of data. I am happy that there is sufficient evidence of activity of GLP in the field of protection of data from Mr Maugham and Mr McCann to show that there is a genuine factual dispute on this point, and therefore neither strike-out nor reverse summary judgment is appropriate on this point.[82]Accordingly, I conclude that GLP has a reasonable basis for arguing at trial that it has standing to bring the claim.[83]The question of GLP’s standing to bring the claim was, it seems to me, the primary focus of the written submissions of the parties and in oral argument. I can deal with remaining issues more briefly.

Does GLP have a mandate to bring the claim on behalf of the Relevant Individuals?

[84]Whether GLP has a mandate to bring the claim is a factual matter that is appropriate for resolution at trial. There is sufficient evidence that the Relevant Individuals have given a mandate to GLP to assert their rights to a judicial remedy under the UK GDPR, the natural corollary of which is the right to receive compensation. The Application has highlighted some deficiencies in the formal confirmation and scope of the mandates, in particular in relation to Article 82. Those deficiencies can and should be addressed by the time of trial. They provide no basis for granting the Application.

Does GLP have reasonable grounds for bringing the claim?

[85]In summary, Mr Coppel submitted that the Particulars of Claim are speculative, lack particularity, and do not disclose a cause of action. He submitted that the six witness statements relied on by GLP in opposition to the Application failed to set out a factual or evidential foundation for the inferences that GLP alleges can be drawn.[86]I respectfully disagree. The specific allegation is encapsulated in paragraph 33 of the Particulars of Claim. That allegation is supported by the evidence filed by GLP. Matters such as whether the Relevant Individuals have suffered any non-material damage or even the scope of the term “non-material damage” are for resolution at trial. This aspect of the claim is sufficiently particular and not speculative.[87]Mr Coppel submitted that there are speculative inferences in the Particulars of Claim regarding alleged unlawful processing of special category personal data by Reform.[88]Mr Sharland submitted that GLP has not pleaded a claim that any processing of personal data by Reform was unlawful. It has merely indicated in the Particulars of Claim that GLP may seek to amend the claim to introduce such an allegation following disclosure. He submitted that this part of the Particulars of Claim should simply be viewed in the light of notice of a possible future amendment to the claim. Reform is not prejudiced because this part of the Particulars of Claim does not affect the scope of disclosure required at this stage. Any amendment to the claim would be determined on the ordinary principles and, if permitted, would give rise to additional disclosure obligations at that stage. Accordingly, there is no basis for this part of the Particulars of Claim to be struck out.[89]I accept Mr Sharland’s submissions on this.

Is the claim an abuse of process and/or a vexatious claim?

[90]Mr Coppel submitted that the claim is an abuse of process, being politically motivated. An abuse of process is the use of the court process for a purpose or in a way that is significantly different from the ordinary and proper use of the court process. In essence, he submitted, GLP is using the private law claim of third parties (namely, the Relevant Individuals) to advance a political objective of GLP. That, he submitted, is an abuse of process.[91]Mr Sharland submitted that the claim arises out of Reform’s conduct in response to a campaign in the public interest in which GLP assisted members of the public to send Notices to parties across the political spectrum. Reform was the only party, having failed fully to comply with the UK GDPR, that did not cooperatively address any shortcomings in response to communication from GLP. He noted that Reform did not respond to GLP’s pre-action letter.[92]In my view, having regard to the evidence filed by GLP, there are sufficient reasonable grounds for bringing the claim. The claim is not abusive, nor is it vexatious in the sense given to that term by Lord Bingham in Barker at [19]. The claim has been sufficiently articulated, as I have already discussed, such that there are genuine factual disputes appropriate for resolution at trial.[93]The fact that GLP has an underlying motive to bring the claim that is “political”, if true, does not mean that this claim is an abuse of process. (To that extent, therefore, how GLP chooses to portray the claim in its communications with its members or to the general public, for example, via its website, is not relevant to whether this claim, properly analysed, is an abuse of process or is vexatious.)[94]The essence of the claim is to seek to enforce the data rights of the Relevant Individuals. If their data rights have been breached as alleged and if, as a result of that breach, they have suffered non-material damage, then they have a right to appropriate relief. I have already given my reasons why the question of GLP’s standing to represent the Relevant Individuals is a matter for trial.[95]GLP has done enough in response to the Application to show that it has a claim that should be resolved at trial and not on an application to strike out or for reverse summary judgment.[96]For these reasons, I do not consider that the claim is an abuse of process, nor do I consider it to be a vexatious claim.

Does the claim have a real prospect of success?

[97]This claim raises triable issues of fact. It has a real prospect of success in the sense that it is arguable. That is sufficient.

Other issues

[98]Reform provided a list of issues prior to the hearing, which was not agreed by GLP. Reform’s list set out in tabular form each issue that Reform considered was raised by the Application, together with a summary of each party’s position set out side by side in adjacent columns. I am not sure why the list was not agreed by GLP. It may be that GLP did not agree with the way its position was summarised. It does not matter. I consider that in my reasons above I have dealt with the issues in the list provided by Reform, save for two, namely: i) whether Reform complied with the DSARs; and ii) whether there were any procedural deficiencies by GLP that justify granting the Application.[99]In relation to whether Reform complied with the DSARs, I am satisfied that GLP has sufficiently clearly alleged that Reform did not do so, principally by failing to adhere to the relevant time limit but also by failing to give adequate responses to the Relevant Individuals. That is a matter for trial.[100]The procedural deficiencies alleged by Reform against GLP are a failure to comply with the pre-action protocol and a failure in the letter before action properly to identify the Relevant Individuals as the relevant data subjects and a failure to substantiate damage caused to the Relevant Individuals. Those alleged procedural deficiencies are disputed by GLP and, in any event, do not in my view justify strike-out or reverse summary judgment in favour of Reform.

Conclusions

[101]For the reasons set out in this judgment, I consider that none of the grounds put forward by Reform in support of the Application is made out. The Application is therefore refused.