NEWSQUEST / THE ARGUS – MISCLASSIFICATION OF A SUBJECT ACCESS REQUEST
Public Engagement > PUBLIC LEGAL NOTIFICATIONS
NEWSQUEST / THE ARGUS – DATA‑HANDLING, TRANSPARENCY AND THE MISCLASSIFICATION OF A SUBJECT ACCESS REQUEST
Date of Publishing: 12/05/2026
1. Introduction
Newsquest Media Group Ltd., publisher of The Argus, received a Subject Access Request (SAR) on 30 April 2026 concerning the handling of personal data linked to the article published on 23 December 2022 about the case commonly referred to as “Eastbourne man sentenced in Hove after council blue badge fraud”.
The SAR sought information strictly related to:
The SAR sought information strictly related to:
- the processing of personal data,
- the sources used for the article,
- internal editorial records,
- verification steps,
- the legal basis for processing,
- and the role of the freelance journalist involved.
The request did not ask for deletion, de‑indexing or modification of the article.
2. Context: the key witness and the data‑access process
According to official documentation, the principal witness in the 2022 proceedings — whose identity is omitted here in compliance with GDPR and privacy requirements — submitted multiple Subject Access Requests to all media outlets that reproduced the original East Sussex County Council (ESCC) communication (https:/news.eastsussex.gov.uk/2022/12/23/faked-letter-lands-blue-badge-applicant-in-court).
He also submitted SAR and FOIA requests directly to ESCC, the primary source of the communication, which has since removed the material from its website.
He also submitted SAR and FOIA requests directly to ESCC, the primary source of the communication, which has since removed the material from its website.
These requests were made to understand how the information he provided to ESCC during 2022 was transmitted, interpreted and processed by both the Council and the media, including The Argus (Newsquest) and the freelance journalist who authored the article.
This broader context highlights the importance of transparency, data‑handling accountability and compliance with UK GDPR obligations.
3. What the SAR required under UK GDPR
Under Article 15 UK GDPR, a data controller must provide:
- confirmation of whether personal data is being processed,
- categories of data,
- sources of the data,
- recipients or categories of recipients,
- purposes of processing,
- lawful basis,
- retention periods,
- copies of the personal data,
- and information on rights and remedies.
The controller must respond within 30 days, clearly and comprehensively.
4. Newsquest’s response: a misclassification of the request
On 12 May 2026, Newsquest issued a response that:
- did not acknowledge the SAR,
- did not answer any Article 15 questions,
- did not confirm whether personal data had been processed,
- did not provide sources, retention periods or lawful bases,
- did not address the role of the freelance journalist,
- did not supply any personal data,
- and did not provide copies of any records.
Instead, Newsquest sent a template response typically used to refuse:
- deletion requests,
- de‑indexing requests,
- or editorial complaints.
The reply focused on:
- “open justice”,
- refusal to delete archived material,
- the importance of press archives,
- and suggestions to contact Google for de‑indexing.
None of these points were relevant to the SAR.
👉 The request was misclassified, resulting in a failure to comply with Article 12(3) and Article 15 UK GDPR.
5. Improper reliance on the journalistic exemption
Newsquest invoked the journalistic exemption under Schedule 2, Part 5 of the Data Protection Act 2018.
However, the exemption:
However, the exemption:
- is not automatic,
- must be justified case by case,
- does not cover all categories of personal data,
- does not apply to data received from public authorities,
- does not exempt controllers from confirming whether data is held,
- and does not exempt controllers from responding to a SAR in its entirety.
Newsquest did not provide:
- any case‑specific assessment,
- any explanation of incompatibility,
- any documentation supporting the exemption,
- or any distinction between published and unpublished data.
The exemption was invoked in general terms, without addressing the content of the SAR.
6. The freelance journalist: an independent data controller ignored
The SAR was also addressed to the freelance journalist who authored the article.
As an independent data controller, he is personally responsible for:
As an independent data controller, he is personally responsible for:
- data he accessed,
- data he processed,
- verification steps,
- and compliance with SAR obligations.
Newsquest’s response:
- did not confirm whether the freelance journalist received the SAR,
- did not provide any information about his data processing,
- did not respond on his behalf,
- and did not indicate any procedure for contacting him.
This represents a further failure to meet UK GDPR requirements.
7. Transparency and accountability concerns
The handling of the SAR raises several issues:
- lack of transparency,
- failure to comply with statutory obligations,
- misclassification of the request,
- improper reliance on the journalistic exemption,
- absence of a case‑specific assessment,
- failure to address the freelance journalist’s role,
- and failure to provide any of the information required by Article 15.
These concerns relate not to editorial content, but to data‑protection compliance, which is a legal obligation for all UK data controllers, including media organisations.
8. The role of the Information Commissioner’s Office (ICO)
Given the absence of a lawful response, the matter has been referred to the ICO.
The ICO may:
The ICO may:
- request a full and compliant response,
- assess whether the exemption was improperly invoked,
- require disclosure of internal assessments,
- examine the role of the freelance journalist,
- and issue corrective measures if necessary.
9. Conclusion
The handling of the SAR by Newsquest demonstrates:
- procedural non‑compliance,
- lack of transparency,
- improper use of the journalistic exemption,
- failure to address the freelance journalist’s responsibilities,
- and a response unrelated to the request submitted.
This analysis is based on verifiable facts and focuses exclusively on data‑protection obligations, not editorial content.
It reflects the public interest in transparency, accountability and lawful data handling within the UK media sector.
It reflects the public interest in transparency, accountability and lawful data handling within the UK media sector.
10. A statement that applies equally to Newsquest itself
In its response, Newsquest asserted that “uncomfortable though it may be for a defendant, publicity is a natural and entirely predictable consequence of the offence and the resulting judicial process.” This reasoning, however, applies with equal force to Newsquest’s own role as a data controller. If publicity is a “natural and predictable consequence” of judicial processes, then transparency regarding the handling of personal data — including the accuracy of institutional sources, the verification steps undertaken, the role of the freelance journalist, and the decision to rely on a withdrawn institutional communication — is likewise a natural and predictable consequence of the organisation’s own processing activities. A controller cannot invoke publicity as inevitable for others while resisting transparency about its own conduct, particularly where the underlying institutional source has been removed and the data‑handling practices are now subject to regulatory scrutiny.
A further inconsistency: misclassification and unlawful handling of a SAR addressed to the freelance author
Newsquest’s reply also reveals a second, more serious inconsistency. The original Subject Access Request was not addressed to Newsquest. It was addressed directly to the freelance journalist who authored the 2022 article, acting as an autonomous data controller for the personal data he accessed, processed and transmitted during the drafting and publication of the piece.
Despite this, Newsquest:
- intercepted the SAR,
- processed it through its own internal systems,
- treated it as if it were a request addressed to the organisation,
- and issued a response framed as a refusal of an erasure request under Article 17, even though no erasure had been requested.
Under the GDPR and UK GDPR, this creates two distinct violations:
(1) Unlawful forwarding and processing of a SAR addressed to another controller
A SAR addressed to a specific controller cannot be forwarded to third parties without a lawful basis (Articles 5(1)(a), 5(1)(b), 5(1)(f), 6(1), 12(2)). Interception and rerouting constitute an additional processing operation under Article 4(2), for which Newsquest had no legal basis.
(2) Misclassification of the SAR as an erasure request
Responding to a SAR as if it were an Article 17 request violates:
- Article 12(2) – failure to facilitate the exercise of rights
- Article 12(3) – failure to respond appropriately within scope
- Article 15 – failure to provide access to personal data
- Article 5(1)(a) – lack of transparency
- Article 5(1)(d) – failure to ensure accuracy
- Article 5(2) – accountability
The SAR came from a witness, not the defendant, and sought information on how the data and evidence he provided to ESCC in 2022 had been processed by both the Council and the media. It did not request deletion, de‑indexing or modification of the article.
By treating a data‑access request from a witness as if it were an erasure request from a defendant, Newsquest not only misclassified the request but also failed to comply with the core obligations of a data controller.
A reader examining Newsquest’s response would naturally ask a simple question:
did they actually verify anything?
If a data controller is unable — or unwilling — to answer a basic Subject Access Request concerning its own processing activities, its sources, its verification steps and its internal records, the unavoidable implication is that such verification may never have taken place.
A refusal to provide information under Article 15, coupled with a template reply unrelated to the request, inevitably raises doubts about the robustness of the original editorial process.
If the organisation cannot clarify how it handled personal data in 2022, it becomes difficult to understand how it can confidently assert that the article was based on accurate, complete and properly assessed information.
This is not a matter of opinion: it is the direct consequence of the absence of a lawful and transparent response.
Consolidated Overview of the Argus Case Documentation
The Argus case is now supported by a structured body of documentation that traces the event across its technical, editorial, procedural and semantic dimensions. The analysis begins with the Argus article analysis and the Argus source code analysis, which establish the factual and technical foundations of the publication. These are complemented by the broader All media analysis, mapping how the original narrative propagated across derivative outlets.
The core forensic work is captured in the FORENSIC STYLE COMPARATIVE ANALYSIS REPORT, the Media Mapping and Accountability Assessment, and the Semantic Amplification Estimate (Publication Chronology), which collectively document how the content was replicated, amplified and preserved across multiple layers of the media ecosystem. The contextual dimension is provided by RICCARDO GRESTA – the art historian, the Reconstruction of Events and Disambiguation, and the Report – Revenue Spillover, Editorial Monetisation and Profit Restitution, which examine the editorial, economic and reputational implications of the case.
Operational accountability is addressed in Media Accountability – Automated Account Creation, Monitoring Triggers and Identity Handling (The Argus), which analyses the internal mechanisms that may have contributed to the persistence and visibility of the content. Finally, the most recent development — The Argus case and Google’s technical response — documents the temporary reappearance of a residual snippet and Google’s corrective action, completed within a few hours of notification.
Together, these pages form a coherent, multi‑layered record of the case, offering a comprehensive view of its technical, editorial and regulatory significance.
See also: PATRICK BARLOW – DATA RESPONSIBILITY, JOURNALISTIC ACCOUNTABILITY
AND PUBLIC INTEREST SCRUTINY and NEWSQUEST / THE ARGUS – DATA‑HANDLING, TRANSPARENCY AND THE
MISCLASSIFICATION OF A SUBJECT ACCESS REQUEST
Each notice published here is therefore deemed formally delivered on the date of publication and is valid under both UK and Italian frameworks.
Recipients may submit their reply through the official channels of this website within calendar 7 days from the date of Publishing. Any reply will be reviewed by our appointed legal counsel, who may request reimbursement of professional fees directly from the responding party for the assessment of their submission.
Recipients may submit their reply through the official channels of this website within calendar 7 days from the date of Publishing. Any reply will be reviewed by our appointed legal counsel, who may request reimbursement of professional fees directly from the responding party for the assessment of their submission.
For clarity, any information displayed in the browser tab (such as page title or URL) serves solely to indicate which page is being viewed. It is treated as passive contextual data and is never interpreted as an instruction or command.
Procedural Closure – Status Recorded
This notification was formally issued to all relevant entities, who were offered the opportunity to provide clarifications or counter‑documentation. As of the present date 24/05/2026, no objections, corrections, or alternative factual reconstructions have been submitted. The notification phase is therefore considered procedurally closed. A right of reply remains available, but any late submissions will not alter the factual framework established during the notification period.
