High Court highlights limits of the UK GDPR's personal activities exemption
The High Court's decision in Phillips v Oloffs [2026] EWHC 1821 (KB) highlights an important distinction between privacy claims and data protection obligations.
The dispute arose between members of a yacht club after allegations were made that the club's Commodore had received preferential treatment regarding mooring fees. Following an internal investigation which cleared him of wrongdoing, a former council member continued to raise concerns with club members and published information about the dispute on a dedicated website.
The claimant brought claims for harassment, breach of confidence, misuse of private information (MOPI) and unlawful processing of personal data under the UK GDPR. The High Court dismissed the majority of the claims but allowed part of the UK GDPR claim to proceed.
The court found that the claimant had already disclosed the key information to club members, meaning it was no longer confidential or private within the relevant audience. It also held that the defendant's actions formed part of a legitimate debate about club governance, engaging freedom of expression rights. As a result, the breach of confidence and misuse of private information claims failed.
However, the court reached a different conclusion in relation to data protection law. While posts within the club's private WhatsApp and Facebook groups were found to fall within the UK GDPR's "personal or household activities" exemption, publication of the same information on a publicly accessible website did not. The court held that information placed online is available to an indefinite number of people and therefore falls outside the exemption. The UK GDPR claim was therefore permitted to continue in respect of the website publication.
Get in touch
Key takeaways
The case highlights several practical lessons for organisations when handling personal information:
Data Protection claims are distinct
Information may cease to be confidential or private for the purposes of breach of confidence or MOPI claims, yet its publication may still constitute processing of personal data subject to the UK GDPR. A successful defence to a privacy claim is not necessarily a defence to a data protection claimThe personal and household exemption has limits
The UK GDPR's personal activities exemption can apply to communications within genuinely private groups or personal networks. However, publication on a publicly accessible website is likely to fall outside the exemption because the information becomes available to an unrestricted audience
Freedom of expression remains an important consideration
The judgment demonstrates the courts' willingness to balance privacy rights against freedom of expression, particularly where information is published as part of a discussion on matters of public or community interestPublic disclosure can influence protections
Where individuals themselves disclose information to a relevant audience, it may become more difficult to argue later that the same information remains confidential or private. However, this will not automatically remove all data protection obligations
Our views
For businesses, membership organisations and individuals publishing information online, the case underlines the continuing importance of assessing whether personal data is being processed lawfully under the UK GDPR, even where concerns about confidentiality or privacy may appear to have fallen away.
The content of this page is a summary of the law in force at the date of publication and is not exhaustive, nor does it contain definitive advice. Specialist legal advice should be sought in relation to any queries that may arise.
Related expertise
Contact us today
Whatever your legal needs, our wide ranging expertise is here to support you and your business, so let’s start your legal journey today and get you in touch with the right lawyer to get you started.
Get in touch
For general enquiries, please complete this form and we will direct your message to the most appropriate person.