Associated Newspapers Limited – Court Ruling (United Kingdom, 2026)

Associated Newspapers Limited, the controller, published print and online articles in the Daily Mail and Mail+ on 8 and 9 June 2023 concerning a data subject. The articles were published under the headline "Labour repays £100,000 to 'sex harassment' donor" and featured two photographs of the data subject immediately beneath the headline. The article explained that the Labour donor accused of sexual harassment was another person, not the data subject. However, the data subject argued that the juxtaposition of the headline and his photographs created the misleading impression that he was the person referred to in the headline. The photographs were later removed from the online version of the article, but remained in the print edition. The data subject first brought defamation proceedings against the controller. The High Court struck out the claim, holding that a libel claim must be assessed by reference to the publication as a whole and that the article made clear that the allegations concerned another person. The data subject also complained to the Independent Press Standards Organisation, which rejected the complaint. The data subject subsequently brought a claim under Article 5(1)(a) and Article 82 UK GDPR, alleging that the controller had processed his personal data unfairly by juxtaposing his photographs with the headline. The High Court struck out the claim as an abuse of process and, in any event, granted summary judgement in favour of the controller, holding that the personal data had been processed fairly when the publication was considered as a whole. The data subject appealed both findings. The Court allowed the appeal. It held that the High Court had erred in striking out the claim as an abuse of process and in granting summary judgement in favour of the controller. Instead, it dismissed the application to strike out the claim and granted summary judgement to the data subject on liability, with damages to be assessed. The Court held that the controller had processed the data subject's personal data unfairly in breach of Article 5(1)(a) UK GDPR. It found that the juxtaposition of the headline referring to a "sex harassment donor" with photographs of the data subject was misleading and likely to lead readers to believe that the headline referred to him. Although the body of the article clarified that another individual was the subject of the allegations, many readers would only see the headline and photographs. The Court rejected the controller's argument that the fairness of the processing should be assessed by applying the common law principle that publications must be read as a whole. It held that this principle did not determine whether processing was fair under Article 5(1)(a) UK GDPR. Instead, fairness had to be assessed in light of the context of the processing. In reaching its conclusion, the Court relied on the Editors' Code of Practice, which requires newspapers to take care not to publish misleading information or images, including headlines not supported by the text. It found that the controller had failed to take adequate care to avoid publishing misleading information and could not rely on the journalism exemption under the Data Protection Act 2018. Finally, the Court held that, as the controller had accepted that the data subject had suffered material damage, the data subject was entitled to summary judgement under Article 82 UK GDPR, with damages to be assessed.