Reform UK Loses High Court Bid to Block Voter Data Claim

Reform UK tried to block The Good Law Project’s data-rights claim ahead of the trial. The High Court wouldn’t do that. So, the claim goes on. And the basic question is, to a voter, a simple enough one: What data did Reform have on people? How did it look for data? And why did it take so long to reply?

There’s an older, more familiar, old school way of doing politics. Doorstep leaflets. Town hall meetings. A candidate standing in a rosette in front of a mic telling you something that sounds better on a wet Tuesday evening than it does on Friday.

Then there’s modern politics.

Modern politics is all about databases. Voter profiling. Electoral roll data. Commercial data. “Data vendors”. Targeting software. Email lists. Facebook and social media. Algorithms. And somewhere, tucked away in a hidden little folder, there’s a thing that knows perhaps more about your politics than the guy next door does.

And that’s why the High Court claim between Good Law Project and Reform UK matters.

This is more than a bit of London legal business for lawyers and the press. It’s about what should matter to millions of people: when a political party has data on you, what happens if you ask, and must it tell you the truth?

The High Court has ruled against Reform’s attempt to have the Good Law Project claim struck out or dismissed by way of summary judgement. It doesn’t mean Reform has been found liable. It doesn’t mean Good Law Project has won the case. It means there is an issue to be tried.

In plain English: Reform tried to close the door early, and the judge didn’t let them.

The claim arose at the tail-end of the 2024 election campaign, when Good Law Project set up a digital tool that would enable anyone to write to all the main political parties, inquiring what personal data they held. The legal mechanism in the good law project tool was the data subject access request, or DSAR. Sounds like the kind of piece of paper invented to put people to sleep, isn’t it?

But the DSAR is an effective tool. It’s a bit like being able to say, on the law: Show me what you know about me.

Mr Justice Murray expressed it more forcibly: A DSAR, he said, “despite the use of the word ‘request’, is, in effect, a demand for information”.

That matters.

Under the UK GDPR, a person has the right to ask any controller of personal data whether it’s processing their personal data, and if so, can then ask to see it and to be given information about how that data’s being used. And a political party is a data controller. Reform conceded that, in this case, it qualifies as a controller of personal data.

Good Law Project clarified that 51 people were the “Relevant Individuals” in the claim because they resided in the UK, were registered to vote, and had instructed Good Law Project to act on their behalf. This case, however, was just one slice of a much larger political campaign. The amended evidence revealed that more than 11,600 people used the service to submit almost 16,000 requests to at least one of the political parties involved.

Of these, a total of 1,746 people sent their requests specifically to Reform UK. Those requests served two main purposes. The first was to request that Reform UK refrain from processing their data and, as far as possible, delete it. The second was to request that they be supplied with copies of all of their personal data processed by Reform UK.

These emails asked for a response “as soon as possible and in any event within one month of receipt.” Reform UK did not send responses to anyone within that timeframe. The judgment found that Reform UK had not made a “substantive response” or communicated its inability to respond because it needed more time. This part is easy to understand. If the law mandates a deadline, it doesn’t exist for decoration.

It’s put there for a purpose. Following the dispatch of the pre-action letter in October 2024, Reform UK provided messages to those who had contacted it.

What it wrote in those messages is significant, because this is where we get away from “dry data laws” and move into the “problem of political trust.” Reform UK sent this response: “We have found no record of you in our systems, other than the original DSAR/cease and desist notice that you sent to us.”

It further added: “During the general election you may have received a mailing from Reform UK by Royal Mail, based on electoral roll data, which we are entitled to have by virtue of a statute and which is exempt from subject access.”

This response is doing a lot of heavy lifting here.

Good Law Project argues that it did not pass the test. The position of Good Law Project is that Reform UK’s response did not adequately confirm if and to what extent personal data was processed by Reform UK at the time of the requests made. Good Law Project also says that Reform UK did not disclose access to any personal data being processed by it.

Regarding the “electoral-roll data” that Reform UK said was “exempt from subject access,” Good Law Project’s skeleton argument states that this is incorrect: “The data may be lawfully processed in the circumstances which exist, but that is not the same thing as removing a right of subject access.” That is a crucial distinction. Legally processed data is not the same as inaccessible data.

Just because a political party has the right to use electoral-roll data in the way it sees fit, does that mean an individual is prevented from asking what information they are holding and using about them? Yes, Reform was allowed to hold some of your data in some way or another.

But the crux of the case is simply whether it has answered your questions about its use of your data, and whether those answers were true. But there is also the little matter of Reform’s own privacy policy.

The documents in question say Reform’s January 2022 policy stated that the Reform Party UK “aims to create and maintain a profile for each registered voter in the UK”, and that would be done by “merging the Electoral Register(s) with other data that may be lawfully available to us” . For the average voter, that is the bit that should stop the kettle in mid-stream.

Each registered voter in the UK, meaning not activists, not donors, not members, and not people who’d written in asking to be contacted. Each registered voter. The Good Law Project’s claim also points to Reform’s use of NationBuilder, described in the court papers as voter data software. Reform denied in its Defence it used software called NationBuilder but in its Part 18 response, Good Law Project’s skeleton argued Reform later retracted that denial.

Good Law Project’s skeleton also noted the Defence, signed off with a statement of truth by Richard Tice MP, denied some statements made in the policy, before also later retracted that position. None of that proves the final claim. But it does go some way towards explaining the judge’s refusal to throw it out before it even reached the trial stage. Reform’s solicitors challenged the claim from many directions.

They said Good Law Project did not have the standing as a representative body, within Article 80 of the UK GDPR, or as a section 187 body under the Data Protection Act 2018. That Good Law Project was neither the right body, nor an active enough one in terms of data protection. That it did not have valid mandates from the individuals in question.

And that the claim was speculative, badly pleaded, abusive and motivated by politics. In short language, they said the case shouldn’t proceed. The judge disagreed. The Good Law Project’s status and that the court found he accepted he had a ‘reasonable prospect of establishing at the trial’ it could meet the statutory requirements to act as a representative body.

He didn’t decide the point one way or the other at this stage, but he found enough to allow the case to continue. Addressing the mandates issued by the 51 claimants, the judge acknowledged some shortcomings regarding the specific scope and official confirmation of those mandates, especially concerning the remedy of compensation, but noted those gaps should properly be resolved at the trial stage. This wasn’t a license to ignore procedural flaws.

Rather it was a directive to shore them up. It wasn’t justification to terminate the proceedings.

The judge also rebuffed Reform’s contention that the claim was speculative and rejected its assertion that, for want of proof, the claim should be struck out. He ruled the claims had substance, with evidence presented by the Good Law Project supporting them, and said the question of whether the individuals incurred non-material damage and what that actually means, should be determined at the trial. The concept of non-material damage also required definition. It isn’t physical injury or loss of property, but includes distress and worry.

In its grounds for a claim, the Good Law Project contended the individuals had experienced non-material damage in the sense of distress and worry due to Reform’s delay in response, in the form of non-substantial or partial compliance with requests, and in the absence of any substantive response to its request, and in terms of uncertainty as to whether Reform holds special category data, which, according to a claimant, is highly sensitive data.

Special category data, as defined by law, are the types of sensitive data that a person isn’t just supposed to handle without consent, which, in this claim includes information relating to the data subjects’ political opinions, data concerning their racial or ethnic origin, data concerning their religious beliefs or philosophical beliefs, membership of trade unions, data concerning the data subjects’ health, and data concerning their sexuality.

The information isn’t normally the sort you’d hand over to a bloke at a pub. It seems reasonable to expect that, if a party’s privacy policy promises the creation of individual voter profiles, voters are entitled to understand what that means in practical terms.

It wasn’t only a finding that the claim was properly argued, but that it wasn’t an abuse of process, a claim Reform had tried to make that it should be struck out for that reason. And in making that finding, Murray had again had to take account of the fact that a lawsuit can be politically embarrassing and it doesn’t amount to an abuse of the process.

The court shouldn’t ask a party is a claim embarrassing to that party, it should ask is it a legal argument?

Mr Justice Murray said: “The essence of the claim is to seek to enforce the data rights of the Relevant Individuals”.

He said that “if those rights were breached and, as alleged, the Relevant Individuals suffered non-material damage as a result, then they have a right to appropriate relief”.

And he added: “This claim raises triable issues of fact. It has a real prospect of success in the sense that it is arguable. That is sufficient”.

He dismissed Reform’s application, stating “The Application is therefore refused”. Reform’s application to strike out the claim and its request for summary judgment were both dismissed.

Good Law Project, in an update of its own, declared “each and every one of the arguments put forward by Reform UK Party Limited was rejected”, and added that Reform must pay costs, including £40,000 to Good Law Project and £140,000 to the Access to Justice Foundation for pro bono representation. The Canary, in its usually more strident tone, took the decision as Reform having “bad day” in the courts.

But beyond the snark, the underlying legal question is sobering, and more important. The case continues. The court is now going to have to address the facts directly. What data did Reform have on these people, if any? Which systems did it run through them?

Did it have electoral-roll data, did it have profiling data, vendor data, NationBuilder, anything that came to it via a third party, and when, and what did it delete if at all? Was that response late, was that response deficient? If so, does that give rise to compensable distress, worry, uncertainty? Can Good Law Project show that it is mandated, and has standing, to bring the claim? Those are not side issues.

That is the case. Beyond the facts, there is a larger democratic point here. Political parties are not just seeking votes anymore. They study voters; they segment voters; they model voters; they send different messages to different people. One household might get a promise about tax, another something about migration, another one about crime and another one about the NHS. The voter receives a message that’s addressed to them, not necessarily to the general public.

This is why the right of data access is now part of democracy. If parties can build a public profile, then the public can and should demand to know what’s in those profiles. Otherwise politics is just a one-way mirror where they can see us, but we can’t see what they’re up to. This decision doesn’t give any answers to these questions.

It doesn’t say Reform breached data protection law, or that compensation is payable, or that Good Law Project will win the day. It does, however, say that the claim isn’t without foundation and shouldn’t be strangled before trial. That’s still a significant moment.

A political party claims it intends to build a profile on every voter registered on the electoral roll but when those individuals ask for their data, they’re told that there’s no record beyond their original request. Someone needs to be able to ask what happened to all that data, and that question is now set to be asked at trial. It’s not just about legal technicalities.

For voters, it’s about whether they’re treated as citizens or targets.

The Shepway Vox Team

Not Owned By Hedgefunds or Barons