Q&A: Sports Direct’s founder wins data dispute in the High Court

In Ashley v HMRC [2025] EWHC 134 (KB), Mike Ashley brought a claim against HMRC arising from an alleged breach of his data protection rights following the making of a tax closure notice. His claim succeeded, but how did he get there?

What is data?

Data is any information relating to an individual and can include a wide variety of information, including obvious categories of data such as blood type or eye colour, but can also extend to descriptors, including, for a broader example, the colour of one’s clothing.

The data in this case likely included details of Mr Ashley’s assets and the basis for the assessment of tax that HMRC rendered.

What are data protection rights?

The Data Protection Act 2018 and General Data Protection Regulation (GDPR) document the data protection regime in the UK. They ensure that ‘personal data’, namely information which relates to individuals (or ‘data subjects’ (Article 4 of the GDPR)) is properly processed by ‘data controllers’ (usually companies or public bodies, although it can also include sole traders). A data controller must be registered with the Information Commissioner’s Office (ICO).

In the event that there is a data breach, a complaint can be made by the data subject to the ICO or a civil claim can be issued to be heard in court at a trial.

How can I know what data is being processed?

Pursuant to Article 15 of the GDPR, a data subject may make a request to a data controller for the personal data that it is processing about the data subject. The process is known as a data subject access request or SAR/DSAR.

How long do I have to wait for a response to a DSAR?

There are strict rules for responding to a DSAR including that the data controller must respond ‘without undue delay and in any event within one month of receipt of the request’. If the request is complex, the response time can be extended by a further two months.

What should the response include?

The response must include all of the personal data that is being processed, how and why it is being processed. That is often misunderstood to mean that all documents and information about the data subject must be provided further to a request.

There are many ways that a compliant response can be prepared, including to provide a simple list of the personal data that is being processed. While it is also possible to provide copies of entire documents or to redact information as appropriate – in doing so the data controller must ensure that the response to the DSAR is not incomplete.

An important requirement in responding to a DSAR is that another data subjects’ data right(s) is/are not breached in the process.

Why did Mike Ashley bring a claim against HMRC?

The underlying tax dispute related to a 2012 transaction in which about £86.8m of properties were sold to special purpose vehicles owned by Sports Direct International plc. HMRC argued that the amount paid was an overvalue, with the properties only worth £60m. On that basis, a benefit had been conferred on Mr Ashley under ITEPA 2003, s 201 to s 203.

HMRC issued a closure notice under TMA 1970, s 28A in which it concluded that properties which had been sold by Mr Ashley were at an overvalue, meaning he had obtained a taxable benefit, giving rise to a tax liability of about £13.6m. Mr Ashley appealed and the tax due was postponed. The parties then entered into discussion and the closure notice was subsequently withdrawn.

Mr Ashley brought a claim against HMRC regarding its handling of a DSAR which he had made. As Mr Ashley is a data subject and HMRC is a data controller, he was entitled to make that request. HMRC initially argued that all of Mr Ashley’s personal data were exempt and therefore not disclosable. When HMRC eventually responded, Mr Ashley argued that the response was deficient.

What was the outcome?

The judge found in favour of Mr Ashley that HMRC had taken ‘too narrow an approach’ in response to his DSAR. However, the Court rejected the more expansive argument that all data relating to the underlying tax assessment amounted to personal data.

HMRC must now reconsider its response to Mr Ashley’s DSAR.

What does this mean for the future?

Although this case related to a taxpayer trying to understand what personal information HMRC was holding, there has been a recent uptick in cases relating to almost the opposite – taxpayers trying to stop their personal information (ie their identity) being identified by the tax tribunal to the public.

A good example is the recent unsuccessful attempt by the jockey, Frankie Dettori, to keep his tax dispute confidential; which, while not falling at the first hurdle, did not do enough to convince the Upper Tribunal to maintain his anonymity.

This shows a trend and growing overlap between tax disputes and data protection law. 

If you have any questions or concerns about the topics raised in this blog, please contact Waqar Shah or Ben Atkin. 

First published in Taxation on 24^th February. 

About the authors 

Waqar Shah is a Partner in the Dispute Resolution department, focusing on the resolution of complex tax matters. He acts for high net worth individuals and corporate clients across all sectors in respect of HMRC disputes and investigations across the full range of taxes.

Ben Atkin is a senior litigation lawyer and solicitor advocate in the Dispute Resolution team. He advises clients on a wide variety of matters including corporate/commercial disputes, contentious intellectual property, and media related litigation including in relation to defamation, libel and privacy matters, many of which have a high profile in the national press.