A data protection claim brought against Mill Media has been dismissed by a County Court judge in what is thought to be the first court test of the journalism exemption in relation to a Subject Access Request for personal data.

The exemption, which allows journalists to process personal data in the public interest, was relied upon by Mill Media to protect confidential sources from disclosure in a case brought by TV historian Laurence Westgaph.

The case ruling, which left Mill Media incurring more than £75,000 in costs, could strengthen publishers’ ability to resist attempts to obtain source information through SARs.

An Subject Access Request is a statutory right that allows anyone to find out if an organisation is processing their personal data and to request a copy of that data if they are, and stems from EU legislation called the General Data Protection Regulation (GDPR).

The Mill’s solicitor Anne Mannion, senior associate at Lewis Silkin LLP, said the case was very “specialised” with it centring on data protection law.

“There’s hardly anything on applying the journalism exemption in Subject Access Requests, particularly where they’re being weaponised. This one was to obtain information about sources, so that’s why it was a really important case, and of interest to other media organisations and data protection practitioners.”

Mannion said the case “allows other practitioners to refer to the case in claims like this and say that the exemption was appropriately applied in the Westgaph-Mill Media case”.

“It will certainly be of help to other media organisations who are looking to apply the journalism exemption,” she said.

Westgaph sought information about sources for Mill investigation

Westgaph’s claim against The Mill was made in relation to reporting by Abi Whistance, an editor for Mill Media’s Liverpool title The Post.

Whistance covered National Museums Liverpool’s hiring of Westgaph despite allegations of improper conduct. The Post included interviews with more than a dozen sources including women who had previously been in relationships with Westgaph.

Her reporting was shortlisted for local journalism for the British Journalism Awards last year.

After a third story was published on the subject in March 2025, Westgaph submitted a Subject Access Request demanding The Mill send him “all the personal data you hold about me” plus information regarding the sources of the allegations published about him.

Before The Mill refused the request the under journalism exemption, Westgaph had filed a County Court lawsuit against the publisher, seeking “full compliance”.

He claimed damages for emotional distress, reputational harm and two other forms of harm, “aggravated damages” as well as his legal costs. 

He filed six Subject Access Requests in total, with The Mill breaching GDPR law on one occasion by responding 22 days late, a breach recognised by the Court and the Information Commissioner’s Office (ICO).

The judge called this delay “trivial”, and ruled that Westgaph’s argument that he was not seeking to identify sources was not supported, but it was “clear he wanted the identities” of the women interviewed, and his case had “changed dramatically” since it was first filed.

Westgaph told Press Gazette the proceedings “raised a number of distinct issues under the UK GDPR concerning Mill Media’s handling of that request” and that the ICO said that it “expected Mill Media to improve its information rights practices”.

“Whilst I did not succeed on every aspect of my claim, the proceedings resulted in a formal declaration that Mill Media had breached Article 12(3) UK GDPR,” he added.

“The Court also made no order as to costs. I also note that Mill Media’s own reporting of these proceedings does not inform readers that the Court declared it had breached Article 12(3) UK GDPR…

“I would also note that, although Mill Media may state that it follows the Editors’ Code of Practice, it is not subject to independent statutory regulation… It raises the question of why adherence to the Editors’ Code is cited at all if there is no effective regulatory mechanism through which breaches can be challenged.”

‘Onerous’ and ‘time-consuming’

The Mill’s costs of more than £75,000 are unusually high for a County Court case, which Mill Media founder Joshi Herrmann told Press Gazette is a result of the case being “complicated” and the hours spent putting together documentation in defence of the case.

“It took up a massive amount of my time, and it took a massive amount of Abby’s time, and then it took up a huge amount of lawyers’ time. So, put them all together, it’s been onerous… It would have created the precedent that people can use SARs to get sources, so we took [defending] it very seriously … and it was extremely time consuming.”

The case was also stretched across two days, when a County Court claim usually concludes within an afternoon to complete.

Herrmann added he was “surprised” the publisher didn’t recover any costs, but if they appealed for a costs order they would get it “because the case went overwhelmingly in our favour”.

“We weren’t expecting all of our costs, because frankly, it’s a County Court… but the problem with us now appealing the cost order and then trying to enforce it is both of those things are really expensive.”

He added: “A lot of readers pay us money, and we take contingencies for these kinds of situations, so it’s not like existential for us, but it’s a big cost. We’ve spent a lot of money to establish an important principle in the UK courts, which is that the journalism exemption can be enforced under GDPR, and I think that’s important, but it’s been expensive.”

Herrmann added that he hopes the ruling shows that claimants can’t get source information from media companies due to the journalism exemption, a firmer fact now it’s been tested in court.

“My advice would be that you’ve got to set principles – we don’t take stories down when people threaten us, we don’t give in to threats, we don’t give into bullies, we spend money when we need to go to court, and I don’t want to have loads of these battles, but I think it’s great that we’ve won a couple of them in the past couple of months, it’s a big tribute to our lawyers as well.”

[Read more: Mill Media libel claim thrown out as Lammy promises SLAPPs action]

Email pged@pressgazette.co.uk to point out mistakes, provide story tips or send in a letter for publication on our “Letters Page” blog