Michael Ashley v The Commissioners for HMRC

The claimant brought a Part 8 claim that HMRC breached his subject access rights under Article 15 UK GDPR by failing to provide copies of his personal data in relation to HMRC's enquiry into his 2011/12 tax return. The court held that the SAR extended to personal data processed by the Valuation Office Agency as well as data held within HMRC's Wealthy and Mid-Size Business Compliance team, and that HMRC had adopted an unduly narrow approach to the Article 4(1) definition of "personal data".

Legal principles applied: the definition of personal data in Article 4(1) must be applied by asking whether the specific information, by reason of its content, purpose or effect, is linked to the data subject; the controller bears the burden of showing that searches beyond particular units are disproportionate (Dawson-Damer); Article 15(3) may require more than a bare extract where contextual material is necessary to make the data intelligible (CJEU in FF); Schedule 2 paragraph 2 DPA 2018 (the "First Tax Exemption") requires cogent evidence that disclosure would be likely to prejudice the assessment or collection of tax.

The court found HMRC in breach of its Article 15(3) and Article 12 obligations for the period in question, concluded that the First Tax Exemption did not apply to two short passages claimed as exempt, and ordered HMRC to revisit its searches and disclosures applying the Court's legal analysis. The court left remedies and any compliance order to subsequent submissions.

This is a first instance Part 8 claim for relief under Article 15 UK GDPR following a subject access request made on 13 September 2022 seeking all personal data held by HMRC in relation to an enquiry into the claimant's tax return for 2011/12. The enquiry was conducted by HMRC's Wealthy and Mid-Size Business Compliance team (WMBC) and involved valuations provided by the Valuation Office Agency (VOA). After litigation was commenced HMRC disclosed multiple schedules of extracted personal data but accepted some breaches of Article 15(3) while disputing other aspects of the SAR response.

Nature of the claim/applications (relief sought):

• The claimant sought copies of all personal data processed by HMRC in relation to the enquiry (Article 15 UK GDPR) and contended HMRC had failed to provide such copies.

Issues framed by the court:

• Issue 1: Whether the SAR was limited to data processed within the WMBC or extended to data processed more widely by HMRC, including the VOA.
• Issue 2: Whether material generated in the assessment of the claimant's tax liability constituted the claimant's personal data under Article 4(1) UK GDPR and in what circumstances.
• Issue 3: Whether HMRC was obliged to search VOA records (reasonable and proportionate searches).
• Issue 4(a): Whether HMRC remained in breach after partial disclosure and whether two short passages were correctly withheld under Schedule 2 para 2 DPA 2018 (the First Tax Exemption).
• Issue 4(b): Whether HMRC provided personal data in a concise, transparent and intelligible manner (Article 12 read with Article 15).

Court's reasoning (concise):

• Issue 1: The SAR, read objectively and in context, was broad and not confined to documents held solely within the WMBC; it encompassed HMRC's processing of the claimant's personal data by the VOA. The fact the request was sent to WMBC staff did not restrict the SAR's scope.
• Issue 2: The court adopted the content/purpose/effect test (as in Nowak and the Article 29 Opinion): information "relates to" a person where by reason of its content, purpose or effect it is linked to that person. That is a broad test, but not unlimited: there is a continuum of relevance and an atomised approach may be needed in some contexts. The court held that the VOA valuations of the claimant's properties were personal data because they related to assets owned by him and were used in assessing tax liability, but emphasised that not all underlying investigatory material or comparables automatically became the claimant's personal data; each item must be assessed by reference to the content, purpose or effect.
• Issue 3: HMRC, as controller of VOA data, was required to conduct reasonable and proportionate searches of the VOA material; its internal practice of bifurcating VOA and HMRC searches did not absolve it of that obligation. The defendant had not shown that searching VOA records would have been disproportionate.
• Issue 4(a): The court applied established statutory principles for Schedule 2 para 2 DPA 2018 and held HMRC had not discharged the burden of showing disclosure of the two short passages would be "likely" (in the required, weighty sense) to prejudice the assessment or collection of tax.
• Issue 4(b): Following the CJEU in FF, the court held Article 15(3), read with Article 12(1)–(2), can require disclosure of contextual passages or whole documents where necessary to make the personal data intelligible so the data subject can effectively exercise GDPR rights; HMRC had sometimes provided unduly decontextualised extracts (for example, only a name or initials) which would not satisfy intelligibility in many instances.

The result is that HMRC remained in breach in several respects and must re-consider its searches and disclosures applying the court's legal analysis; the court invited further submissions on remedies and any compliance order.

The claim was allowed in part. The Court held that (i) the SAR extended to personal data processed by both the WMBC and the VOA; (ii) the Article 4(1) concept of "personal data" is satisfied where the information, by reason of its content, purpose or effect, is linked to the data subject; (iii) HMRC had adopted an unduly narrow approach and was obliged to search VOA records; (iv) the First Tax Exemption did not justify withholding two short passages; and (v) Article 15(3) read with Article 12(1) may require contextual material where necessary to render personal data intelligible. HMRC must reconsider its searches and disclosures and the parties must address remedies.