Reform UK faces legal challenge over data failures

Party ignored GDPR requirements

Image:
Of the 1,800 people who contacted Reform UK about the data it held on them, 96% were ignored

Reform UK is facing a lawsuit after allegedly ignoring its legal obligations under data protection laws.

The Good Law Project has launched legal action against Nigel Farage’s Reform UK on behalf of 51 individuals, claiming the party failed to comply with data protection laws by ignoring data subject access requests (DSARs) and subsequent legal letters.

The case, believed to be the first of its kind under Article 80(1) of the UK General Data Protection Regulation (UK GDPR), will be heard in the High Court.

The dispute originates from a Good Law Project initiative ahead of the UK general election last July, which provided voters with a tool to submit DSARs to political parties.

Users could request information held about them by each party and demand that their data not be used for further political purposes.

Of the approximately 1,800 people who contacted Reform UK through this platform, 96% reported that the party failed to respond adequately, making Reform UK the worst performer among all major political parties.

In response to the flood of unanswered requests, the Good Law Project instructed law firm Pallas Partners LLP (Pallas) to formally challenge Reform UK's failure to meet its legal obligations.

Despite repeated legal letters from Pallas, Reform UK allegedly responded with generic bulk emails that appeared to be copied and pasted, stating it held no data on any of the claimants.

Crucially, the party failed to address the request to stop using individuals' data, which is a clear requirement under data protection laws.

Good Law Project has now taken the unprecedented step of invoking Article 80(1) of UK GDPR, which allows representative bodies to take action on behalf of victims of data protection infringements.

Article 80(1) says: "The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law."

This is the first known instance where such a mechanism is being used in a UK court.

Duncan McCann, data and technology programme lead at Good Law Project, said, "Good Law Project is excited to be pioneering the use of a new collective redress mechanism that enables people along with representative bodies, like us, to hold political parties, organisations and companies to account for their use of our data."

Matt Getz, a partner at Pallas, criticised Reform's "token effort" of bulk emails and its subsequent disregard for requests to explain data processing and cease its use.

"Political parties, more than anyone, should understand the importance of respecting the rule of law. Incidents like this, where political parties wilfully ignore lawful, polite and reasonable requests from individuals to respect their personal data, are deeply concerning and necessitate legal action."

An anonymous claimant, with a background in data protection, shared their concerns. They said, "I thought it was a good idea to ask the main political parties to tell me what info they have about me. I am concerned that while the others acknowledged my requests, I did not hear anything from the Reform Party.

"I personally believe that the party, and its leader, issue statements that come close to breaking human rights laws - so I am particularly upset that they have not complied with my request. I want to be sure that my data is not being used to benefit the party in any way."