Data, Privacy and Digital Disputes: GDPR, Nuisance, Social Media and SaaS

Data protection breaches and SARs. Under UK GDPR Article 15, the data subject has a right to access their personal data held by a controller. The controller must respond within one month (extendable to three months for complex requests). No fee for a first request. Where the controller fails to respond, misses the deadline, or provides incomplete data, the consumer can complain to the controller, then the ICO. Civil claims for compensation under Article 82 run through court.

Nuisance marketing. PECR 2003 governs marketing by phone, text, email, and post. Unsolicited live marketing calls to consumers registered with the Telephone Preference Service are unlawful. Unsolicited email and text marketing without prior consent is unlawful. Cookie consent must be specific, informed and freely given (the "soft opt-in" exception is narrow). The ICO enforces; consumers report nuisance and can also claim civil damages under PECR 30.

Online platform disputes (content moderation, account closures). Largely contractual under the platform's terms. Most platforms have substantial latitude to remove content and close accounts. The Online Safety Act 2023 imposes user empowerment, content-moderation, and complaints duties on user-to-user services, but the operative rules for many duties were still being phased in through 2024-2026 codes of practice. Where the platform's decision was procedurally unfair or breached its own published terms, the consumer's claim is contractual; small claims is the residual route.

Social media defamation. Defamation Act 2013 framework. Section 1 requires the consumer to show serious harm; for trading entities, serious financial loss. Section 5 provides a defence for operators of websites where they identify the poster or comply with a removal request, subject to the conditions in the Defamation (Operators of Websites) Regulations 2013. Civil claims run through court; one-year limitation under s.4A of the Limitation Act 1980, extendable by the court under s.32A.

AI services. A developing area. Where the AI service makes incorrect statements (hallucinations) that cause loss, the route depends on the supplier's terms and the underlying claim. Consumer contracts under CRA 2015 cover supply of digital content (ss.33 to 47): digital content must be of satisfactory quality (s.34), fit for purpose (s.35), and as described (s.36). The AI provider's broad disclaimers are subject to fairness review under s.62. The Government has published policy proposals for cross-economy AI regulation, but as at May 2026 no consolidated AI Act is in force.

SaaS and app subscriptions. CCR 2013 (14-day cooling-off for new online subscriptions), CRA 2015 (digital content quality and fairness of terms), DMCCA 2024 Part 4 (subscription-trap provisions, phased commencement). Subscription auto-renewals without clear pre-contract disclosure are at risk under s.62 of the CRA 2015.

Cloud storage and lost data. Where a cloud storage provider has lost the consumer's data through its own fault, the consumer's claim is contractual under the provider's terms and supported by CRA 2015 s.34 (satisfactory quality of digital content) and s.42 (consumer's right to refund where the digital content does not conform). Substantial limitation-of-liability terms are subject to s.62.