Dale Vince wins GDPR fair processing appeal against Daily Mail publisher

In a landmark ruling, the Court of Appeal has overturned a High Court decision that had dismissed a data protection claim against Associated Newspapers Limited (ANL). The judgment marks the first successful damages claim based on unfair processing under 5(1)(a) of the UK General Data Protection Regulation (GDPR).

The case involves photographs of the green energy entrepreneur and Labour donor Dale Vince, which were published in the Daily Mail and on the Mail+ app alongside a headline about a "sex harassment" donor. Although the digital images were changed with photos of another labour donor, Davide Serra, 47 minutes after publication, the print edition still featured Vince.

Vince argued the publication unfairly used his personal data and could mislead readers into believing he was accused of harassment. ANL disputed the claim, arguing that the full article context clarified the subject and that the lawsuit was an attempt to resurrect a previously dismissed 2024 libel action.

However, Sir Geoffrey Vos, writing for the three appeal judges, ruled that ANL failed to take care to avoid publishing misleading images, violating the editors' code of practice. He noted the layout would have misled casual readers and concluded that ANL has no realistic prospect of defending the damages claim.

Credit to a LinkedIn post by Jon Baines for highlighting this excellent summary of the ruling by Sean Sutherland, pupil barrister at Doughty Street Chambers. While discussing the merits of the decision, Sutherland notes that it "remains to be seen" whether claimants can be awarded eputational damages for article deemed unfair, as "this would complete the circumvention of the law of defamation by the law of data protection." 

He goes on to warn of the implications for freedom of expression should publishers become liable for a "new ground of liability for distress, personal injury and financial damages." 

Both Sutherland and Baines are of the opinion that this "important and surprising" decision will likely be subject to appeal. 

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.