Subject access requests and the scope of personal data

The High Court in Michael Ashley v Commissioners for His Majesty’s Revenue and Customs (HMRC) has recently found in favour of British retail entrepreneur Mike Ashley, after a 2 day trial concerning his claim against HMRC for a breach of Article 15 of the UK General Data Protection Regulations (GDPR) after they failed to provide Mr Ashley with all of the data he had requested, labelling the response to his Subject Access Request (SAR) “incomplete and inadequate”.

Article 15 of the GDPR concerns the rights of access by the data subject (in this case, Mr Ashley) and requires the data controller to provide a data subject with a copy of their personal data undergoing processing.

Background

Mr Ashley was engaged in a tax dispute with HMRC when he submitted a Subject Access Request (SAR) in September 2022. Mr Ashley requested access to his personal data processed by HMRC in connection with his tax return in the 2011/12 tax year. HMRC accepted that his data should have been disclosed by 5 December 2022 (instead, it was provided in 2024) and that they acted unlawfully by failing to disclose the information required by Article 15(1)(a)-(f) of the GDPR.

Mr Ashley claimed that HMRC failed to:

• Properly construe his SAR;
• Conduct adequate searches when responding to his SAR;
• Properly apply the concept of personal data and the tax exemption; and
• Provide him with copies of his personal data in a way that was clear and understandable.

Judgement

Mrs Justice Heather Williams agreed with Mr Ashley on all four points. She rejected HMRC’s claim that the key paragraph of Mr Ashley’s SAR did not contain the phrase “personal data” as the email which contained the SAR was headed “Subject Access Request” and “the contents that followed confirmed that it was a subject access request”.

HMRC proceeded to undertake the SAR in only applying it to the Wealthy Individuals and Mid-Sized Business Compliance department (WMBC), but the SAR stated that it was seeking “any and all data held in relation to HMRC’s enquiry that pertains to [Mr Ashley] for the relevant tax year”.  Mrs Justice Heather Williams concluded that the wording of the request was not “limited to particular departments or agencies of HMRC”. She concluded that the SAR was not limited to personal data processed within the WMBC department and should have been interpreted to include HMRC as a whole organisation.

Key take-aways

The judgement provides helpful guidance as to how:

• The concept of “personal data” is interpreted and applied by the courts in practice; and
• Data controllers need to approach SARs by conducting adequate searches for personal data pertaining to an individual and provide copies of personal data in a way that is clear and understandable to the data subject making the SAR.

If you require any assistance with any of the issues mentioned in this article, do not hesitate to contact the Employment team at Thomson Snell & Passmore.