Michael Ashley v The Commissioners for HMRC

Article 4(1) of the UK GDPR requires particular information to be linked to an identified or identifiable person by its content, purpose or effect. It does not make all information generated during an investigation into that person’s personal data. The link is construed broadly, but an indirect or tenuous link may be insufficient. Information about an asset may be personal data where it is used to assess the owner’s tax liability. Controllers must search all data within the objective scope of a request unless the additional search would involve disproportionate effort. Article 15 may require contextual extracts where necessary to make personal data intelligible. A taxation exemption requires convincing evidence of a very significant and weighty chance of prejudice.

The claimant made a subject access request under Article 15 of the UK GDPR for information held by HMRC concerning its enquiry into his 2011/12 tax return. HMRC accepted breaches arising from delay and incomplete provision of personal data, but disputes remained about the request’s scope, the meaning of personal data, the extent of searches, a taxation exemption under Schedule 2 to the Data Protection Act 2018, and whether the disclosed extracts were intelligible.

The request was addressed to HMRC officers in the Wealthy and Mid-Size Business Compliance department. The enquiry had also involved valuations by the Valuation Office Agency, which HMRC accepted was within its data-controller responsibilities. The central questions were whether the request included data processed by the VOA, whether assessment and valuation material constituted the claimant’s personal data, and what further steps Article 15 required.

1. Scope. The SAR was expressed in broad terms and was not limited to data processed within the WMBC. It included the claimant’s personal data relating to the enquiry processed by the VOA. HMRC’s internal practice of handling WMBC and VOA requests separately could not narrow the request. [2025] EWHC 134 (KB) [139]–[146].
2. Personal data. The Article 4(1) question concerns particular information, not merely the overall processing exercise. Following Nowak, information is linked to a person by its content, purpose or effect. The concept is broad, but an indirect or tenuous link at several removes may be insufficient. Information may become personal data when interlinked with material that is plainly personal data. [2025] EWHC 134 (KB) [155]–[162].
3. The valuations of the 32 properties were the claimant’s personal data because the properties belonged to him and the valuations were used to assess his potential tax liability. This did not automatically extend to comparable-property data, HMRC’s investigative processes, or the decision-maker’s reasoning. Those matters required separate assessment. [2025] EWHC 134 (KB) [175]–[184]. The defendant had adopted an unduly restrictive approach and had to reconsider its response.
4. Searches. The controller bore the burden of showing that an additional search would involve disproportionate effort. The assessment was objective and fact-sensitive and included difficulties beyond locating the data. HMRC had not shown that searching the VOA’s records was disproportionate. HMRC was required to search the VOA data. [2025] EWHC 134 (KB) [189]–[194].
5. Taxation exemption. The defendant failed to prove that disclosure of the disputed passage was likely to prejudice the assessment or collection of tax under paragraph 2 of Schedule 2 to the Data Protection Act 2018. The asserted insight into future settlement strategy was speculative and vague. [2025] EWHC 134 (KB) [198]–[200].
6. Intelligibility. Articles 15(1) and (3), read with Article 12(1) and (2), could require contextual information beyond a bare reproduction where necessary or essential to enable effective exercise of UK GDPR rights. A wholly decontextualised extract, such as a name or initials alone, was unlikely to comply absent a valid exemption or overriding third-party rights. [2025] EWHC 134 (KB) [204]–[211]. Remedies and consequential matters were reserved for further submissions.