Guidance on Responding to SARs and the Meaning of “Personal Data”

Ashley v Revenue and Customs Commissioners [2025] EWHC 134 (KB)

In a Judgment of 24 January 2025, the High Court (Heather Williams J) gave detailed guidance on the approach to Subject Access Requests (“SARs”) as well as the proper interpretation and application of “personal data” within Article 4(1) UK GDPR, in the context of a data claim against HMRC. 

Michael Ashley, a British retail entrepreneur and the founder and former chief executive of Frasers Group plc (formerly Sports Direct International), claimed that HMRC had breached his subject access rights under Article 15, UK GDPR, after he had made a SAR seeking access to his personal data processed during an HMRC enquiry (“the Enquiry”) into his tax return. After initially claiming that his personal data was exempt from disclosure, HMRC provided schedules of his data rather than copies, which, it subsequently accepted, failed to comply with Art.15(3). It also accepted failures to disclose information required by Art.15(1) as to its data processing. The Claim was brought under Part 8 CPR as the material facts were not in dispute.

The issues for the Court were:

1.     The scope of the SAR: was it limited to the Claimant’s personal data pertaining to the Enquiry or did it extend to data being processed more widely by the Defendant’s Valuation Office Agency (“VOA”) (an executive agency within HMRC)?

2.     Personal Data: the application of Art. 4(1): did data that related to the Defendant’s assessment of the Claimant’s tax liability in the context of the Enquiry amount to personal data within Art.4(1)? If not, in what circumstances would it?

3.     Reasonable and proportionate searches: was HMRC obliged to search for the Claimant’s personal data as processed by the VOA? (such issue only arising if the Court found in favour of the Claimant -that the SAR was wider than HMRC contended – on issue 1)

4.     Provision of copies of the Claimant’s personal data under Art.15(3). This encompassed various issues overlapping with issues 2 and 3, including the correct approach to the “first tax exemption” in the Data Protection Act 2018 (“DPA 2018”) Schedule 2 Part 1, paragraph 2 as well as the question of whether there was a failure to provide the Claimant with his personal data in a concise, transparent and intelligible manner.

The Judge, Heather Williams J, found generally in the Claimant’s favour as follows:

1. The SAR was not limited to the Claimant’s personal data processed within the Enquiry but included such data as was being processed by the VOA.
2. The authorities indicate that the meaning of personal data must be applied by looking at whether the information held (as opposed to the purpose/effect of the Enquiry), by reason of its content, purpose or effect, is linked to a particular person. The Court gave guidance on the scope of the word “linked”. The Judge did not consider that the data relating to the Defendant’s assessment of the Claimant’s tax liability in the context of the Enquiry amounted to “personal data” per se: such data will amount to “personal data” where it is information that by reason of its content, purpose or effect is linked to Mr Ashley. The Defendant was required to reconsider the SAR applying the approach identified by the Court together with “some additional observations designed to assist with the application of the test to the present circumstances”.
3. Given the finding on issue 1, as HMRC was a controller in respect of the VOA data, and as the Defendant had not established that it was disproportionate to search for the Claimant’s data being processed by the VOA, HMRC was obliged to search for the Claimant’s personal data pertaining to the Enquiry that was being processed by the VOA.
4. (a) There was no dispute that the personal data in question was being processed for one of the purposes specified in Schedule 2, paragraph 2 of the DPA  2018, namely “the assessment or collection of a tax or duty”. However, the Court did not consider that the Defendant had discharged the burden of proving that the application of the subject access provisions to the text in question would be likely to prejudice the assessment or collection of tax. As the Defendant failed to establish the existence of the alleged prejudice, the Court did not reach the subsequent proportionality stage of balancing the likely prejudice against the value of the subject access right.

   (b) Article 15(1) and 15(3), read with Article 12(1) and (2) of the UK GDPR, did require the Defendant to go beyond providing a copy of the Claimant’s personal data where contextual information was necessary for that personal data to be intelligible in the sense of enabling the data subject to exercise their rights conferred by the UK GDPR effectively. It followed that insofar as the Defendant did not adopt this approach, it was in breach of this duty.

Further reading: Michael Ashley v Commissioners for His Majesty’s Revenue and Customs [2025] EWHC 134 (KB)

---

Authors

Francesca Whitelaw KC

Call 2003 | Silk 2023

Other articles in this edition

Dealing with LPP Material under the EIR/ FOIA- Greenwich v ICO

---

When are Statistics ‘Held’ for the EIA/ FOIA? Roberts v ICO

---