Data law not always plain sailing

27 July 2026

A dispute between two former Greenwich Yacht Club committee members over mooring fees, which escalated into emails, WhatsApp messages, a dedicated campaign website and eventually four separate causes of action is, on its face, the sort of thing many would roll their eyes at and move on. But buried in a typically thorough Hill J judgment mostly concerned with striking out a disgruntled ex-Commodore’s claims is a useful worked example of how far the “purely personal activity” exemption in UK GDPR stretches, and where it snaps.

The claimant brought harassment, breach of confidence, misuse of private information, and UK GDPR claims arising from the defendant’s public campaign accusing him of receiving preferential mooring rates — an allegation an independent investigation had found unfounded. The defendant sought strike-out or summary judgment on all four. He got summary judgment on three, and a partial win on the fourth.

The harassment claim is the most conventional part of the judgment, and probably the least surprising in outcome. Hill J applied the familiar Article 10 balancing exercise, and found that even fifteen-odd communications, a website and some posters over several months didn’t cross the “quasi-criminal” threshold required — particularly given the claimant had “vociferously and repeatedly defended himself” throughout, and the defendant’s tone was largely “considered, careful, precise [and] lawyerly.” It’s perhaps not surprising that intemperate club politics falls some way short of harassment liability (and something of a relief that a lawyerly tone can be a partial defence to claims).

The breach of confidence and misuse of private information claims fell for essentially the same reason: the claimant’s own conduct. Having voluntarily disclosed an investigation’s exculpatory findings and the total mooring fees paid on a members’ forum months earlier, he couldn’t credibly argue the information remained confidential or private once it reappeared online. Information a claimant has broadcast to hundreds of people themselves is difficult to reclaim as private later, however aggrieved they are about who repeats it.

The real interest is the UK GDPR claim, where the outcome splits on a significant distinction. The defendant argued that everything he did fell within Article 2(2)(a)’s exemption for “purely personal or household activity,” relying on the Court of Appeal’s generous reading in Ittihadieh and distinguishing Harrison v Cameron, where sharing a recording with business contacts fell outside the exemption because of its commercial character. Hill J agreed as to WhatsApp and Facebook activity — a members-only chat about club business is about as paradigmatically personal as data processing gets.

But the website was different: relying on the CJEU’s reasoning in Lindqvist, the judge held the exemption only covers activity carried out in the course of private or family life, which is “clearly not the case” once data is published online to an indefinite audience. Publishing to the world, even amateurishly, on a self-funded WordPress site with a handful of visitors, takes an activity outside the personal-use shelter that would have protected the same content shared in a closed group chat. The medium, not just the content or the motive, is what matters. On this approach, the line isn’t really about how public-spirited or aggrieved the poster is; it’s about whether the data escapes into a space with an indefinite audience.

Finally, the obiter observations on Jameel abuse are worth flagging even though undecided: having narrowed the surviving claim to the GDPR point on the website alone, Hill J’s provisional view was that pursuing that single claim in isolation may itself be a Jameel abuse – in other words, not worth the candle once stripped of the harassment and confidence claims. As regular readers will know, Jameel abuse has been somewhat out of favour lately in the data context: this judgment suggests a degree of rehabilitation, which is interesting to note at the same time as (pending the Supreme Court’s decision in Farley) the de minimis principle has been cut down.

Phillips v Oloffs [2026] EWHC 1821 (KB)