Reform UK Party Limited – Court Ruling (United Kingdom, 2026)

Good Law Project Limited, a representative body, was mandated by 51 individuals to bring proceedings on their behalf under Article 80 UK GDPR. Reform UK Party Limited, the controller, is a registered political party and processed personal data in the context of its political activities. In the month before the UK general election of 4 July 2024, the representative body provided an online tool through which members of the public could send notices to major political parties. These notices included a request to stop processing personal data, an objection to processing under Articles 18 and 21 UK GDPR, a written notice under Schedule 1 DPA 2018 requiring the recipient not to process the sender’s personal data and a DSAR under Article 15 UK GDPR. More than 11,600 individuals used the tool. Of these, 1,746 individuals, including the data subjects represented in the claim, sent a notice to the controller between 5 June and 4 July 2024. The controller did not respond within one month. It neither provided a substantive response nor explained that it required additional time to respond. On 8 October 2024, the representative body sent a pre-action letter to the controller. Between 11 and 14 October 2024, the controller sent response emails stating that it had found no record of the recipients in its systems, except for the DSAR and cease-and-desist notice. The controller also stated that any election mailing may have been based on electoral roll data, which it claimed it was entitled to use and which was exempt from subject access. The representative body considered these responses insufficient. It wrote again to the controller on 24 October and 3 December 2024, but the controller did not reply. On 28 March 2025, the representative body issued a claim seeking compliance with the DSARs and compensation for non-material damage under Article 82 UK GDPR and Section 168 DPA 2018. The controller applied to strike out the claim or, alternatively, for summary judgement. The controller argued that the representative body did not have standing under Article 80 UK GDPR and Section 187 DPA 2018, that the claim had no real prospect of success and that it was abusive or vexatious. The Court refused the controller’s application. First, the Court held that the representative body had a real prospect of establishing at trial that it satisfied the requirements of Section 187 DPA 2018. The Court rejected the argument that a body must be incorporated in a specific legal form, such as a charity or community interest company, to qualify as a representative body under Article 80 UK GDPR. It was sufficient, at this stage, that there was evidence that the representative body’s constitution pursued public-interest objectives and that it was active in the protection of data subjects’ rights. Second, the Court found that the claim had been sufficiently pleaded. The representative body had alleged that the controller failed to comply with the DSARs, primarily because it did not respond within the statutory time limit and because its later responses were allegedly inadequate. Whether the controller had in fact complied with the DSARs was a matter for trial. Third, the Court rejected the controller’s argument that the claim was an abuse of process or vexatious. The Court held that even if the representative body had a political motive, this did not make the claim abusive. The essence of the claim was the enforcement of data protection rights. If those rights had been infringed and the data subjects suffered non-material damage, they were entitled to seek appropriate relief. The Court also held that any alleged procedural deficiencies, including alleged failures in the pre-action correspondence, did not justify striking out the claim or granting summary judgement. Accordingly, the Court held that the claim raised triable issues of fact and had a real prospect of success. The application to strike out the claim or grant summary judgement was refused. No fine was imposed.