Councillor breached data protection rules after personal information was used in restaurant promotions and links to personal political social media accounts, regulator finds

Personal data collected by a Portsmouth councillor was used for restaurant promotions and Reform UK messaging without consent, according to the Information Commissioner’s Office.

After carrying out an investigation, the independent regulator concluded that George Madgwick did not comply with data protection obligations. But, the city and county councillor has pledged to clear his name.

The investigation was carried after Portsmouth resident Scott Alexander completed a survey in late 2024 run by the Portsmouth Independent Party (PIP) on the Council of Sanctuary pledge, providing his phone number and email address.

In May 2025, Mr Alexander began receiving unsolicited emails promoting the “Steak + Roast” restaurant, formerly run by Councillor Emily Strudwick, now leader of the Reform UK group on Portsmouth City Council.

Although Councillor Madgwick was not officially listed as part of the business, he is an experienced restaurateur, Cllr Strudwick’s partner and has often promoted the restaurant through his social media channels.

After Cllr Madgwick defected from PIP to Reform UK in July 2025, Mr Alexander also began receiving text messages sent through mass SMS software containing “breaking news” and links to the councillor’s political social media posts.

Mr Alexander said he had never given permission for his personal details to be used for political messaging or marketing.

He publicly challenged Cllr Madgwick on social media, saying he had not consented to receiving Reform UK updates.

“Within an hour, my post was deleted,” he said.

Mr Alexander then requested the privacy notice authorising the use of his personal information.

Cllr Madgwick supplied a copy of the survey disclaimer, which Mr Alexander said fell “woefully short of the requirements for collecting such information under the Data Protection Act”.

He said: “The survey received over 4,000 responses, which means that, de facto, Cllr Madgwick is misusing a dataset of over 4,000 Portsmouth residents to pursue his own political agenda.

“He thinks he can get away with not following the law – it will catch up with him.”

Mr Alexander later submitted two complaints under the councillor code of conduct. The first related to an Instagram livestream in which Cllr Madgwick published the confidential names of people who had made complaints against him.

In December 2025, the council’s monitoring officer found the code had been breached, saying publicly naming the complainants, otherwise referred to as doxxing, was “indicative of a bullying and or hectoring attitude”.

Mr Alexander then lodged a second complaint over the alleged misuse of data. In February 2026, the monitoring officer concluded the “evidence is such that the code had been breached”.

He added that sharing data from one source to the business without “legitimate consent” could breach the Data Protection Act.

While such a breach could be actionable “in a civil sense and potentially a criminal offence”, the monitoring officer said it was “beyond the scope of the Members Code of Conduct”.

He recommended Cllr Madgwick apologise to Mr Alexander and make a self-referral to the Information Commissioner’s Office (ICO) which is responsible for upholding information rights, enforcing major data privacy laws and regulating how organisations handle personal information.

In April 2026, Mr Alexander queried why no apology had been issued as suggested. But Cllr Madgwick replied: “no apology will be issued to you as it is not deserved nor needed”.

Now, after investigating for around 10 months, the ICO issued its findings on June 30, upholding both of Mr Alexander’s complaints. The ICO’s findings are not published on its website.

The regulator said it was “our view that Councillor George Madgwick has not complied with their data protection obligations” after disclosing a resident’s personal information during an Instagram livestream without a lawful basis.

It also said it “appears” Cllr Madgwick failed to keep personal data secure, as required under the General Data Protection Regulation (GDPR).

Regarding the emails and text messages, the ICO said it was its view that Cllr Madgwick “has not complied with their data protection obligations”.

It found that linking promotional messages to his Reform UK social media account breached Article 5(1)(b) of the GDPR, which prohibits personal data being used for purposes outside what it was originally collected for.

The ICO said it understood concerns that survey data belonging to other residents may also have been used without a clear or lawful purpose.

The watchdog said it would write to Cllr Madgwick with advice on improving his data protection practices to help prevent similar incidents.

Reacting to the decision, Mr Alexander said: “I am very pleased that all of my complaints have been upheld. The ‘punishment’ for such offences is rather light, particularly as the survey data set could very well have been used to inform Reform UK’s local campaigning and marketing spend for the local election, as well as the aggravating conduct of Councillor Madgwick himself.”

Responding, Cllr Madgwick said he believed he would clear his name and intends to provide more evidence to the ICO.

He said: “The ICO failed to contact me to respond to the complaint. I’ve written to the ICO to complain and ask for a review as the information submitted by Scott Alexander was inaccurate. I have clear evidence that no breach occurred and the ICO will go in my favour once they allow me to submit this evidence.”

A Portsmouth City Council spokesperson added: “The ICO’s findings do not relate to Portsmouth City Council’s collection, processing or use of personal data. The council was not involved in obtaining or using any of the information identified in the complaint.

“Subsequently we were unaware of this matter but glad it has been dealt with by the ICO. We will continue to remind all councillors of their responsibilities when handling data.”

Editorial update: The article originally published on July 5, 2026 was updated on August 6, 2026 to clarify two points: the Information Commissioner’s Office (ICO) found Coun Madgwick had breached his data protection obligations but did not rule that he personally used the survey data to promote his partner’s restaurant; the ICO ruled Coun Madgwick sent links to his social media accounts hosting political videos as a Reform UK councillor, but Coun Madgwick has said the data collected in the survey was not shared with Reform UK. This article has been amended to make these points clear.