Energy companies must follow rules made by Parliament.^[2] These are not guidelines. They are the law.

One of those rules says: if your energy company bills you more than 12 months after you used the energy, and the late bill was not your fault, they cannot chase you for it.^[1] They cannot sell it to a debt collector either.^[3] This rule has been in place since 2018. Every energy company knows about it.

There is also a data protection law called the GDPR. It says companies can only use your details if they have a good reason.^[4] Chasing a debt they are banned from collecting is not a good reason. Passing your name and address to a debt collector is not a good reason either.

If you have been sent a late energy bill, been threatened with court, been chased by a debt collector, or even paid a bill you should not have owed, this likely applies to you.

Every letter, every phone call, every time they shared your details: none of it had a proper legal basis. Each one may mean you are owed money.^[5]

This is currently being tested in court, but no judge has ruled on it yet. The law behind it has been in force since 2018. The energy regulator, Ofgem, has not stepped in. You cannot sue under the rule itself. So energy companies have carried on: billing, selling, and taking money the law says they cannot take. This tool exists because no one else stopped them.

The SLC 21BA / GDPR Private Enforcement Route

This is a detailed explanation of the legal theory underpinning this tool. It's based on arguments currently being tested in active County Court proceedings against a Big Six energy supplier (2025). This is novel law. No court has ruled on this specific intersection yet. What follows is a legal argument, not settled precedent.

The Statutory Authority

SLC 21BA is not "a regulation" in the loose sense the word is often used. It is delegated legislation, made under express statutory authority conferred by Parliament.

The chain of authority runs as follows:

Parliament enacted the Electricity Act 1989 ("EA 1989"). Section 7 provides for the grant of licences to supply electricity. Section 7A empowers the Secretary of State and the Gas and Electricity Markets Authority ("GEMA," operating as Ofgem) to determine standard conditions applicable to all supply licences.^[1] The Gas Act 1986 provides equivalent powers for gas supply via ss.7A and 7AB.^[2]

GEMA exercised this power to impose Standard Licence Condition 21BA on all domestic supply licences, effective from 1 May 2018 (electricity) and 1 November 2018 (gas).^[3]

The legal significance is this: SLC 21BA is not Ofgem policy. It is not regulatory guidance. It is not a code of practice. It is a condition of licence, imposed under powers conferred by primary legislation, and breach is unlawful in the same sense that breach of any statutory instrument is unlawful. Ofgem itself characterised seeking to recover backbilled debt as enforcement of "an unlawful contract."^[4]

This matters because the entire GDPR analysis depends on whether the supplier's conduct was unlawful, not merely inadvisable. Delegated legislation settles that question.

The Regulatory Framework

SLC 21BA operates through three prohibitions from two provisions. Their hierarchy matters, and the energy industry appears to have understood only the least important one.

SLC 21BA.1 — "seeks to recover"^[3]

This is the primary prohibition. The licensee must only take "charge recovery actions" in respect of consumption within the preceding 12 months. The operative concept is "charge recovery action", defined to include billing, collection, and recovery activity. The prohibition regulates actions, not debts. This distinction is fundamental and frequently misunderstood by defendants.

Crucially, the verb is "seeks," not "recovers." The prohibition captures the attempt, not merely success. Issuing a bill is seeking to recover. Sending a demand letter is seeking to recover. Instructing a collection agent is seeking to recover. Selling the debt for collection is seeking to recover by proxy.

SLC 21BA.5 — "must not enforce or otherwise take advantage of"^[3]

This provision adds two further prohibitions. The word "otherwise" does critical legal work: it establishes that "taking advantage of" is a different category from "seeking to recover" in 21BA.1. Under the canon against surplusage (verba cum effectu sunt accipienda), every word must be given independent meaning.^[5]

"Otherwise take advantage of" captures any commercial use of the debt beyond recovery attempts: selling for value, retaining on the books, using as security. A corporate entity takes advantage of an asset by profiting from it or reducing costs through it. Selling a debt portfolio for value is the paradigm case.

"Enforce" captures direct legal compulsion: litigation, court orders, enforcement agents. This is the least important of the three prohibitions, but it is the only one the energy industry appears to have understood, because it maps onto statute-barred debt. Enforcement is the third prohibition, not the first.

The combined effect is absolute. The licensee cannot:

— Issue a bill (seeking to recover)

— Send a demand letter (seeking to recover)

— Instruct a collection agent (seeking to recover)

— Sell the debt (seeking to recover and taking advantage)

— Use the debt as security (taking advantage)

— Enforce through litigation (enforce)

What lawful action remains? Write it off. Delete it. Nothing else.

Why this matters: The distinction between SLC 21BA-prohibited debt and statute-barred debt is the critical point. Statute-barred debt cannot be enforced through the courts, but it can still be chased, sold, and retained. SLC 21BA-prohibited debt cannot be touched at all. "Seeks to recover" and "otherwise take advantage of" close every route the industry uses for statute-barred debt. This is what separates the legal theory from anything the energy industry has encountered before.

This construction is reinforced by the Supreme Court's approach in Uber BV v Aslam [2021] UKSC 5, which at [70] endorsed examining "the purpose of a particular provision" and interpreting language "in the way which best gives effect to that purpose."^[6] The purpose of SLC 21BA is consumer protection against stale billing. Permitting the supplier to sell the debt while prohibiting direct collection would defeat that purpose entirely.

Ofgem's May 2020 Open Letter confirmed this reading, stating that the backbilling requirement "remains applicable in the event that... the supplier's consumer debt is collected by a debt collection agency (DCA)" and that any party seeking to recover such debt "would be to enforce an unlawful contract."^[4]

Ofgem's December 2020 guidance further confirmed that the prohibition operates on the supplier's actions, not the consumer's: "Consumers must not be held responsible for failing to identify errors in their billing or that a debt balance is accruing."^[7]

The Enforcement Gap

SLC 21BA is imposed under the Electricity Act 1989 / Gas Act 1986. Enforcement lies with Ofgem under ss.25-28 of those Acts.^[8] There is no private right of action for breach of a licence condition, unlike breach of a statutory duty, which can in some circumstances ground a civil claim.

This creates a regulatory gap: consumers are protected by the rule but cannot enforce it themselves. Ofgem's enforcement has been, in practice, negligible. The Energy Ombudsman can make individual redress awards but has no power to address systemic breach and does not engage with the GDPR dimension.

The Data Protection Bridge

The solution lies in recognising that every act of pursuing a SLC 21BA-prohibited debt necessarily involves processing the consumer's personal data. The data controller (supplier or debt purchaser) must identify a lawful basis under UK GDPR Article 6(1) for each processing operation.^[9]

The most commonly relied-upon basis for debt collection processing is Article 6(1)(f): legitimate interests. The three-part test requires: (1) the controller has a legitimate interest; (2) the processing is necessary for that interest; (3) the interest is not overridden by the data subject's rights.

The argument is that limb (1) fails at the threshold. There can be no "legitimate interest" in processing personal data for a purpose that is prohibited by law. The interest is, by definition, illegitimate. The ICO's own guidance confirms this: "Anything illegitimate, unethical or unlawful is not a legitimate interest" and "The other parts are not able to legitimise processing that is illegitimate from the outset."^[10]

This is not a proportionality argument (limb 3) or a necessity argument (limb 2). It is a threshold argument: the purpose itself is unlawful, so the analysis never reaches balancing.

If the lawful basis fails, every processing operation in connection with the prohibited debt is unlawful: generating bills, internal CRM entries, sharing data with purchasers or collectors, credit reference agency reporting, phone calls, letters, emails, SMS, and any automated processing.

Each is a separate instance of unlawful processing.

The Nemo Dat Problem for Debt Purchasers

Energy suppliers routinely sell aged debt portfolios to secondary market purchasers. When the sold debt includes SLC 21BA-prohibited accounts, a further problem arises.

What did the supplier sell?

Personal property falls into two categories: choses in possession (things you can hold) and choses in action (rights enforceable by legal action). There is no third category. A debt is ordinarily a chose in action — a right to recover money, enforceable by action (Torkington v Magee [1902] 2 KB 427).^[20]

But SLC 21BA prohibits the supplier from seeking to recover (any attempt to obtain payment), from otherwise taking advantage of (any commercial use, including retention), and from enforcing (legal compulsion). If a chose in action is a right enforceable by action, and the supplier is prohibited from any action, what remains? It is not a chose in action, because there is no action. It is not a chose in possession, because it cannot be touched. It is a number on a ledger with no legal character.

Property must admit lawful use beyond deletion to exist in law. "Taking advantage of" includes retention; the supplier was not even permitted to keep it on the books. Doing so would misrepresent asset value to investors.

This is not statute-barred debt. A creditor may retain, sell, or request voluntary payment of statute-barred debt. A supplier caught by SLC 21BA cannot even accept payment the consumer insists on making — acceptance would be "taking advantage of". Every route available for statute-barred debt is closed.

The test is simple. Can the owner claim damages for conversion of this "asset"? If someone stole or destroyed it, the supplier could not claim recovery value (prohibited from recovering), sale value (prohibited from selling), or book value (prohibited from retaining). The claim would be zero. If theft or destruction causes no loss, the thing is not property. It is nothing.

The insurance test confirms it. Try to insure this debt. What is the insurable interest? The right to seek recovery, which is prohibited. What is the covered peril? Non-payment, but non-payment is the mandated outcome, not a contingency. What is the loss? The face value assumes a right to collect, which does not exist. No insurable interest, no covered peril, no quantifiable loss. If it cannot be insured, it has no value as property.

The supplier sold a legal hallucination: a right it does not possess, to a purchaser who paid real money for it. Nemo dat quod non habet.^[11] The purchaser acquired nothing.

Section 136(1) of the Law of Property Act 1925 provides that legal assignment is "subject to equities having priority over the right of the assignee."^[12] Bibby Factors Northwest Ltd v HFD Ltd [2015] EWCA Civ 1908 confirmed that "the factor, as assignee, can be in no better position than his assignor."^[13]

Compensation Under Article 82

UK GDPR Article 82(1) provides: "Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor."^[14]

Following Vidal-Hall v Google Inc [2015] EWCA Civ 311, it is established that non-material damage (distress) is compensable without proof of financial loss.^[15] Lloyd v Google LLC [2021] UKSC 50 confirmed that individual claims for proven distress are recoverable.^[16]

Each processing operation is a separate infringement. Quantum is a function of volume and duration of unlawful processing, severity of distress, and consequential losses such as wrongful credit reporting.

Limitation

Claims under Article 82 are subject to a 6-year limitation period (Limitation Act 1980, s.2 or s.9).^[17] The clock runs from each individual processing event, not the date of the original bill. A consumer billed unlawfully in 2019 but still receiving collection letters in 2025 has claims for every letter within the 6-year window.

Fraud and s.32(1)(a): Section 32 of the Limitation Act 1980 postpones the start of the limitation period in cases of fraud.^[18] The limitation period does not begin until the claimant discovered, or could with reasonable diligence have discovered, the fraud.

Following Ivey v Genting Casinos [2017] UKSC 67, dishonesty is assessed objectively: would ordinary decent people consider the conduct dishonest, given the facts as the defendant knew them?^[19]

Apply that test here. SLC 21BA says "must not." A licensee is taken to know the conditions of its own licence; that is the basis on which it is permitted to operate. The energy company knew it was prohibited from recovering these charges. It pursued payment anyway. It did so to induce consumers to pay money the company was not entitled to collect. The language of "must not" leaves no room for honest mistake. It is not ambiguous, and there is no scope for innocent misinterpretation of a mandatory prohibition.

By the Ivey standard, it is strongly arguable that ordinary decent people would consider that dishonest. If so, it constitutes fraud for the purposes of s.32(1)(a), and limitation is postponed until the consumer discovers the breach.

Debt purchasers and fraud: Where an energy company sold the debt to a third party, the fraud dimension cuts both ways. The energy company sold a debt it knew it was prohibited from recovering. The purchaser paid real money for it. That means the debt purchaser may itself have a fraud claim against the energy company, because it bought something the seller knew was worthless under its own licence conditions. This does not help the purchaser's claim against the consumer; if anything, it reinforces that the entire chain of recovery was tainted from the start.

The Defendant's Likely Arguments (and Why They Fail)

1. "The debt exists contractually." — Irrelevant. SLC 21BA prohibits recovery actions regardless of underlying contractual validity. The processing is unlawful because the pursuit is prohibited, not because the debt doesn't exist.

2. "SLC 21BA only applies to the supplier, not to us as debt purchaser." — The supplier breached SLC 21BA.5 by selling. The purchaser's processing has no independent lawful basis. Nemo dat applies.

3. "Limitation bars the claim." — Only for processing events more than 6 years old. Recent processing is within time regardless of when the original bill was issued. And where recovery was pursued knowingly in breach of "must not," there is a strong argument that s.32(1)(a) of the Limitation Act 1980 postpones limitation (see above).

4. "The consumer suffered no damage." — Vidal-Hall establishes distress is compensable. Being pursued for years for a debt that cannot lawfully be collected is inherently distressing.

5. "Article 6(1)(b) (contractual necessity) provides an alternative lawful basis." — A contract term incompatible with SLC 21BA is unenforceable per SLC 21BA.5. You cannot rely on a term you are prohibited from enforcing.

Current Status

This legal theory is being tested in active County Court proceedings (2025). The defendant's filed defence does not engage with the GDPR/SLC 21BA intersection, does not identify a lawful basis for processing, and does not address the nemo dat argument on debt sales. The case is proceeding to mediation and, if necessary, hearing.

No court has yet ruled on whether SLC 21BA breach defeats Article 6(1)(f) legitimate interests. This is novel law. The argument is available for any affected consumer to advance in their own claim.