Portsmouth councillor breached GDPR to promote partner's restaurant and Reform UK

An Information Commissioner's Office (ICO) investigation has concluded that Portsmouth councillor George Madgwick breached its obligations under the UK General Data Protection Regulation (GDPR). The investigation followed complaints from a resident who completed a 2024 survey run by the Portsmouth Independent Party (PIP), only to later receive unsolicited marketing for a restaurant linked to Madgwick's partner and mass text messages promoting Reform UK, the party Madgwick defected to in 2025.

The ICO found that linking the survey data to promotional and political messaging violated Article 5(1)(b) of the GDPR by using personal details outside their original purpose. The ICO also concluded that Madgwick failed to keep personal data secure and lacked a lawful basis for disclosing complainants' names during an Instagram livestream.

The ICO said that it intends to write to Madgwick with advice to improve his data protection practices. While Portsmouth City Council confirmed it was not involved in the data breach, Madgwick has refused to apologise. He claims the ICO failed to contact him, maintains that the allegations are inaccurate, and pledges to clear his name by submitting new evidence for an ICO review.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.