James Combes – Court Ruling (United Kingdom, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A UK council refused to share test scores and birth dates of students, claiming it would violate privacy laws. This is important because it shows how organizations must protect personal information, even when requests are made for transparency. People should understand that privacy laws can limit access to certain data.
What happened
The council denied a request for student test scores and birth dates, citing privacy concerns.
Who was affected
Students who took the Kent Test and their families were affected by this decision.
What the authority found
The authority upheld its refusal, stating that disclosing the information could lead to the identification of individuals, violating privacy principles.
Why this matters
This case illustrates the balance between transparency and privacy. Organizations should be aware of how personal data can be protected under privacy laws, especially when handling sensitive information.
Source checks
Secondary-source text retrieved.
Automated check recorded — 9 June 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On November 2024, a person (the requestee) made a request under the Freedom of Information Act 2000 to Kent County Council, the controller, concerning candidates who sat the Kent Test in September 2024. The requestee requested, for each candidate, the raw scores and standardised scores in English, Maths and Reasoning, together with the candidate’s date of birth. The request included anonymisation safeguards. In particular, the requestee asked the controller to exclude any results where fewer than five children shared the same date of birth and to remove candidates outside the normal cohort age range. The controller refused the request. It relied on section 40(2) FOIA, arguing that disclosure would involve the unlawful processing of third-party personal data. In particular, the controller considered that the combination of scores and dates of birth could allow the data subjects to be identified, including by parents or children who already knew some information about a candidate’s score or date of birth. The apellant requested an internal review. The controller upheld its refusal, stating that many combinations of raw scores, standardised scores and dates of birth were unique or occurred very infrequently. It concluded that disclosure would breach the principle of lawfulness, fairness and transparency under Article 5(1)(a) UK GDPR. The apellant then complained to the Information Commissioner, the DPA. The DPA found that the controller was entitled to rely on section 40(2) FOIA. The DPA considered that the requested information could constitute personal data because, when combined with existing knowledge held by certain individuals, it could allow individual children to be identified. The DPA further found that, although there was a legitimate interest in transparency and oversight of the Kent Test, disclosure would be an unwarranted interference with the rights and freedoms of the data subjects. It therefore concluded that Article 6(1)(f) UK GDPR could not be relied
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for James Combes in UK
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. James Combes - United Kingdom (2026). Retrieved from cookiefines.eu
Last updated: