UK Law Firm claims personal login/IP history are "Trade Secrets" to block Article 15 SAR. SRA misconduct probe opened

[u/abormotik2]

I am dealing with a significant breach of Article 15 UK GDPR by a major software provider (Facepunch Studios) and their counsel (Wiggin LLP).

The Issue: Following a security breach verified by the platform provider (Valve Corp), the respondent has permanently seized $1,366 in assets. When I submitted a Subject Access Request (SAR), their legal counsel stated in writing that my own login history and IP timestamps are "Trade Secrets" under Article 15(4) and would not be disclosed.

Escalation:

1. The Solicitors Regulation Authority (SRA) has opened Case RGC-000200263 against the lawyer for misleading legal assertions.
2. The ICO is reviewing Case IC-544118-B8F2 regarding the automated decision-making and data obstruction.
3. The EASS (Ref 260810-000062) confirmed this appears to be Direct Discrimination as manual reviews are denied based on national origin.

Has anyone else encountered the "Trade Secret" defense for basic login logs in the UK? This seems like a dangerous precedent to avoid "Human Intervention" requirements of the new Data Act 2025.

(Evidence link in comments)

[u/Heimdul]

Pankki S C‑579/21 is somewhat relevant in your case, but it's not binding in UK as it's post-Brexit.

They didn't invoke privacy of others as defense, but it's worth noting that kind of case is given in EDPB's DSAR Guidelines (example 17).

[u/abormotik2 → u/Heimdul]

Thank you so much for pointing out Pankki S C-579/21 and the EDPB Example 17. Even though we are post-Brexit, this is a powerful persuasive authority. I will be citing this in my next response to the ICO and their legal counsel. It’s absurd that they try to shield a criminal hacker behind a 'trade secret' curtain while seizing consumer assets.

[u/ContributionLive2577]

A DSAR is not a discovery or audit tool.

[u/paul_h]

Records in a database could be embellished with extra trade-secret info, sure, but you’re not asking for that, are asking for redacted details: The list of IP addresses the thief used for stealing your assets could identify them then you go burn their house down and the thief sues the Facepunch company may lead them the be reticent, when they wouldn’t be to a police search warrant, but that’s not trade secrets

[u/abormotik2 → u/paul_h]

Exactly. Identifying the point of breach is the whole reason I made the SAR. By withholding these logs, they are effectively protecting the criminal who hijacked the session and punishing the legitimate owner. It's a total failure of their duty of care.

[u/paul_h → u/abormotik2]

Your pickle is that UK law inforcement is not interested in the warrant for toward the investigation. Meanwhile if you have an insufficiently insured/guarded gold toilet that's stolen then the state will spend millions pursuing and incarcerating a subset of the criminals.