[2025] UKUT 319 (AAC)

Ms Proops emphasised the broad and weighty nature of the data protection scheme under the GDPRs, highlighting the potentially serious consequences of a breach of their provisions, including mass data protection claims in the civil courts, criminal sanctions for non-compliance(see sections 144, 148 and 173 of the DPA 2018), and the imposition by regulators of large fines and orders to stop processing data. These sanctions could cause significant disruption to a controller’s business and might, ultimately, prevent it from operating at all. Ms Proops submitted that the “significant, particularly weighty nature” of the data protection scheme should be a factor that is taken into account when deciding how broadly or narrowly the provisions in issue in this appeal should be construed and applied.

Against that backdrop, Ms Proops argued, construction of the GDPR engages four principles of statutory interpretation:

We agree that these principles are relevant, and we have borne them in mind in interpreting these provisions. Counsel for the parties took us to various domestic and EU law authorities to assist us in our task of construction.