In Vince v Associated Newspapers [2026] EWCA Civ 899, the Court of Appeal held that an unfair processing compensation claim under data protection law provided redress against the seriously misleading publication of a juxtaposed headline and captioned photographs, even though this claim had not been raised in initial proceedings and redress was ruled out in defamation law. As with earlier cases, its facts confine it to the data protection/defamation interface whereas data protection law’s true potential will only be revealed when it is used with potent effect against journalistic privacy invasion/intrusion in the ordinary courts. Nevertheless, Vince’s clear focus on both the far-reaching and autonomous nature of data protection standards and the limits of its journalistic defence may help mainstream data protection law within journalistic proceedings and catalyse the recognition of new rights and remedies for the contemporary online media environment.
The Facts & Procedural Chronology
Late on 8 June 2023, Associated Newspapers (Associated) published a Mail+ online article with the headline “Labour repays £100,000 to sex pest donor” featuring prominent, identified photographs of Dale Vince, a substantial donor to the Labour Party, at a Just Stop Oil protest. The same article and photographs, again identified by caption, were published in the Daily Mail on 9 June 2023 under the headline “Labour repays £100,000 to ‘sex harassment’ donor” (at [16])). However, Vince was not the donor who had been found liable for sex harassment (or considered a sex pest), a fact which was only made clear in the article’s main text. Although the photographs of Vince were removed from the Mail+ article within an hour of publication, the Daily Mail article was not changed and remained available online through the (licensed) PressReader platform until October 2023 (at [18]). Not unreasonably, Vince argued that many readers would not have looked past such headlines and captioned photographs, that they would thereby have been misled and he had suffered damage as a result.
Later in June, Vince explored redress possibilities through a complaint lodged with the self-regulatory Independent Press Standards Organisation (ISPO) (Ibid at [28]) and a letter before legal action intimating claim for both libel (under defamation) and unfair processing (under the UK General Data Protection Regulation (UK GDPR)) (at [30]). IPSO summarily rejected his complaint holding that it disclosed no ground to investigate a possible breach of the accuracy provision (Clause 1) of the Editors’ Code of Practice (at [29]). In early October 2023, Vince issued a claim but only in libel, which Associated then applied to strike out based on the long-standing principle from Charleston v News Group Newspapers ([1995] 2 AC 65) that meaning within libel must be determined by reference to an article in its entirety, rather than only parts or a headline (see [31]). HHJ Lewis in the High Court granted strike out in July 2024 and permission for appeal was refused in October. Nevertheless, a month before strike out, Vince had provided Associated with an unsealed copy of a claim form alleging unfair processing and compensatable damage (under articles 5(1)(a) and 82UK GDPR, and in September 2024 he had issued such proceedings (at [32]). Associated then applied to strike these out as an abuse of process and/or to obtain summary judgment on the grounds that the Charleston principle also applied in a data protection law context (at [32]). On 9 June 2025 Mr Justice Swift in the High Court issued both strike out and summary judgment in favour of Associated (at [6]). However, on 15 July 2026 the Court of Appeal – in a judgment written by Sir Geoffrey Vos MR (with Lord Justice Warby and Lady Justice Whipple concurring) – dramatically overruled both holdings and instead upheld Vince’s claim for summary judgment, with damages to be assessed (at [78]).
Strike Out Rejected: No Abuse of Process
Associated’s abuse of process submission rested on the claim that, since these arose out of the same event, the unfair processing and libel proceedings should have been launched at the same time: the precedent enunciated in Henderson v. Henderson ((1843) 3 Hare 100) was determinative here. Although Mr Justice Swift had held that Henderson was inapplicable as Vince had issued his unfair processing proceedings before the libel judgment had been handed down, he agreed with Associated’s overall submission on the grounds that neither claim was legal or factually complex and there was therefore no sufficient reason for holding the unfair processing claim in reserve (at [34]). In contrast, the Court of Appeal accepted that Henderson was applicable but argued that it called for “a broad merits-based judgment” (at [52], citing Johnson v Gore-Wood & Co [2002] 2 AC 1) which came down in Vince’s favour due especially to the following factors:
- Vince had advanced the unfair processing claim from his first contact with Associated but its response had been inappropriately dismissive;
- Vince followed legal advice in not initially advancing this claim but, without undue delay, switched to focus on data protection law based on fresh legal advice from new counsel; and
- The unfair processing claim was legally novel and, as a seasoned litigant, Associated was not oppressed by the need to defend itself in consecutive proceedings (at [54]).
Summary Judgment: Indefensible Unfair Processing causing Damage
Turning to the core and substantive issue of unfair processing, Mr Justice Swift had largely accepted Associated’s arguments here also by holding that, in cases of publication allegedly creating a misleading impression and where the primary harm was said to be reputational damage, it was necessary to determine a data protection claim by reference to the entirety of a publication as in the libel rule in Charleston (at [40]). The Court of Appeal noted existing indications in case law (notably, NT1 v Google LLC [2018] EWHC 799 (QB) and Aven v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB)) that Charleston was applicable to a data protection inaccuracy claim (at [67]). However, it firmly distinguished this from an unfairness claim (at [68]) and likewise held that the IPSO determination was “irrelevant” as it had “only dealt with the allegation of inaccuracy” (at [71]).
Drawing in part on the Data Protection Act 2018’s Section 124 Data Protection and Journalism Code of Practice (which must be taken into account when relevant in any proceedings – see section 127(3)), the Court was clear that fairness under article 5(1)(a) UK GDPR was an autonomous concept: that it obviously implied a balance and that “[t]he data subject’s reasonable expectations will be relevant at least when they have a relationship with the data controller” (at [65]). At the same time, it held that the meaning of fairness “may be significantly affected by the context” (at [64]) which, in this case, included provision in the Editors’ Code – a document which the Court was bound to have regard to under s. 12(4)(b) of the Human Rights Act 1998 – stating that newspapers must “take care not publish inaccurate, misleading or distorted information or images, including headlines not supported by the text” (quoted at [69]). Associated had failed to take such care and so had not processed in accordance with the UK GDPR’s fairness standard.
In principle, this standard (like all the other substantive data protection provisions) is subject in journalistic cases to a special yet qualified defence (see Data Protection Act 2018, Sch. 2, Pt. V, para. 26). The Court therefore went on to consider this, noting that this “so-called ‘journalistic exemption’” requires a controller such as Associated to reasonably believe that:
- application of the provision would be incompatible with the purposes of journalism, and
- that publication would be in the public interest, having regard here to the Editors’ Code of Practice (at [73]-[74]).
Drawing similarly on the Editors’ Code (and its accompanying Notes), it held that Associated would “never be able to show” that it reasonably believed that publication of the headline juxtaposed with the captioned photographs was in the public interest. It additionally found no evidence of any belief that application of the fairness provision to the processing would be incompatible with the purposes of journalism. Since it was accepted even by Associated that Vince had clearly suffered some damage from this processing, it followed that he was entitled to summary judgment with damages to be assessed (at [75]-[76]).
Discussion and Importance
Covering essentially all information related to individuals who are at least identifiable, data protection has a notoriously broad scope: far wider than that of related torts such as defamation and misuse of private information. Moreover, not only are its default standards autonomous and far-reaching but its journalistic defence is far from absolute. Nevertheless, data protection claims have historically been dismissed and sidelined in final court actions involving the journalistic media. Despite Lord Justice Leveson’s cogently critiquing such sidelining in his famous 2012 Inquiry Report, this persists and was reflected in the initial proceedings in Vince which avoided all such claims. The Court of Appeal was right to recognise this background and adopt a liberal approach to court process, which enabled Vince’s unfair processing claim to proceed. Meanwhile, its substantive ruling in favour of the claim via summary judgment vindicates the autonomous and far-reaching nature of data protection standards and the way in which these can still bite even after the public interest and incompatibility limbs of the journalistic defence have been accounted for. The Court’s strong use of self-regulatory standards set out in the Editors’ Code – something first attempted in Campbell v Mirror Group Newspapers ([2002] EWCA Civ 1373)) – is particularly noteworthy, as is the novel (albeit much more limited) judicial recognition of the Data Protection and Journalism Code of Practice.
Nevertheless, it cannot be said that Vince will itself bring data protection centre-stage and enable its journalism provisions to come of age. In the first place, the mainstreaming of data protection in journalism cases has been going on for some time, and this has already borne significant fruit in cases such as Moulay v Elaph Publishing ([2017] EWCA Civ 29) and Pacini v Dow Jones ([2024] EWHC 1709 (KB)). Moreover, subsequent judicial scrutiny – which, if Vince had not settled, would have been addressed in the assessment of damages in this very case (see [72]) – must shortly resolve the issue of whether compensation for reputational harm is recoverable in data protection (which is strangely contested despite the UK GDPR’s specific reference to reputational damage in Recitals 75 and 85).
Secondly, although the parties to Vince have now settled, its holding could ultimately be challenged in the Supreme Court. In that regard, it is right to acknowledge that Vince’s reasoning is not only quite limited but is, in part, questionable. Notably, the distinction drawn between inaccurate and misleading processing is far from watertight. Indeed, clause 1 of the Editors’ Code, which was given great emphasis by the Court, has a (not wholly misleading) heading of ‘[a]ccuracy’; the Data Protection Act 2018 (although not the UK GDPR) provides that “[i]naccurate, in relation to personal data means incorrect or misleading as to any matter of fact” (see s. 205(1)); and the Data Protection and Journalism Code similarly states that “[a]ccurate means correct or not misleading as to any matter of fact”. It would have been preferable to have acknowledged these facts (which, as an aside, show that IPSO was not as careful as it should have been when dealing with, and summarily dismissing, Vince’s complaint) and then taken issue with suggestions in existing case law that Charleston should apply in data protection inaccuracy claims. Nevertheless, the Court’s argument that fairness sits above this and itself requires a balanced and contextual analysis remains a convincing one.
Thirdly, Moulay, Pacini and now Vince all relate to claims concerning inaccurate or misleading data processing and, therefore, directly relate only to data protection’s interface with defamation law. In contrast, no significant journalistic data protection judgment has been handed down by the ordinary courts in the equally significant sphere of privacy invasion or other intrusion involving journalism. Instead, this area remains dominated by the misuse of private information (despite the successful Tribunal case of True Vision Productions v Information Commission (EA/2019/0170 (2021)) which was in this area). However, Vince’s focus on data protection’s broad scope, autonomous and far-reaching default standards and the qualified nature of the journalistic defence does highlight a powerful approach which could also be applied in the privacy/intrusion context. Moreover, in areas such as surveillance by journalists and around the right to be forgotten, there is considerable potential for novel rights and remedies to be recognised through data protection. Therefore, notwithstanding the formidable cost barriers to such actions (including the inability to claim after-the-event insurance premiums if successful in a pure data protection case), Vince could well catalyse developments which would finally make data protection mainstream in journalistic cases challenging privacy invasion/intrusion.
Conclusion
Vince is an important case which demonstrates that, even as regards journalistic processing which benefits from public interest and incompatibility defences, data protection’s far-reaching and autonomous standards can provide redress against severely misleading publication which is not otherwise legally available. Despite not being brought in the initial proceedings against Associated (limited to libel and which failed due to the rule in Charleston only permitting action in respect of entire publications), the Court of Appeal was right to allow this novel and important claim to be heard. Its summary judgment in Vince’s favour has certain limitations, notably relating to the questionable dichotomy it draws between claims of inaccurate and claims of misleading content. Nevertheless, its central claim that data protection’s far-reaching and autonomous standards are violated by a failure to take care even in journalism to avoid severely misleading content involving personal data remains convincing, as does its holding that the rule in Charleston should not be imported to override this. Whilst following a line of cases, notably Moulay and Pacini, which have positively applied data protection law in the area of inaccurate or misleading content, Vince did not itself address the (at least) equally important issue of journalistic privacy invasion/intrusion. In ordinary court cases, data protection law has yet to bite there. Unless and until this happens, its journalism provisions cannot be said to have come of age. Nevertheless, Vince undoubtedly constitutes a landmark judgment and its reasoning could pave the way for data protection to finally exert a wider strong effect including in privacy/intrusion cases involving journalism.
David Erdos is Professor of Law and the Open Society in the Faculty of Law and WYNG Fellow at Trinity Hall, University of Cambridge. He is also a Fixed Term Member of Matrix Chambers.
(Suggested citation: D. Erdos, ‘Vince v Associated Newspapers: Have UK Data Protection’s Journalism Provisions Come of Age?’, U.K. Const. L. Blog (22nd September 2026) (available at https://ukconstitutionallaw.org/))
Leave a Reply