Energy companies operate under licence conditions set by Parliament.^[5] These aren't optional. They aren't guidelines. They are conditions of being allowed to supply energy in the UK.

One of those conditions — Standard Licence Condition 21BA — says your supplier must not bill you for energy consumed more than 12 months ago, unless the delay was your fault (for example, you blocked meter access or refused to give readings).^[1]

This rule covers both gas and electricity. It has been in force since 2018. Every energy company knows about it.

Despite this, many suppliers have continued sending these prohibited bills. Some have gone further: instead of writing off the debt, they sold it to debt collection agencies. The collector then chases you for payment, often without knowing the debt was unlawful in the first place.^[2]

Citizens Advice received over 52,000 billing complaints in the first nine months of 2024, with nearly a quarter involving catch-up bills averaging £2,525.

The Statutory Authority

SLC 21BA is not "a regulation" in the loose sense. It is delegated legislation, made under express statutory authority conferred by Parliament.

The chain of authority: Parliament enacted the Electricity Act 1989. Section 7 provides for the grant of licences. Section 7A empowers the Secretary of State and GEMA (operating as Ofgem) to determine standard conditions applicable to all supply licences.^[5] The Gas Act 1986 provides equivalent powers.^[6]

GEMA exercised this power to impose SLC 21BA on all domestic supply licences, effective 1 May 2018 (electricity) and 1 November 2018 (gas).^[1]

SLC 21BA is not Ofgem policy. It is not regulatory guidance. It is a condition of licence, imposed under powers conferred by primary legislation. Breach is unlawful in the same sense that breach of any statutory instrument is unlawful. Ofgem itself characterised seeking to recover backbilled debt as enforcement of "an unlawful contract."^[2]

This matters because the entire GDPR analysis depends on whether the supplier's conduct was unlawful, not merely inadvisable. Delegated legislation settles that question.

SLC 21BA contains three prohibitions, and their hierarchy matters.^[1]

The primary prohibition is "seek to recover" — any attempt to get payment. Billing, chasing, selling the debt. The verb is "seeks," not "recovers." The attempt is prohibited, not just success.

The second is "otherwise take advantage of." The word "otherwise" signals a separate category.^[2] It catches any commercial benefit: selling for value, keeping it on the books, using as security.

The third is "enforce" — suing you, getting a court order. But enforcement is downstream of recovery: you cannot enforce a debt without first seeking to recover it, which is already banned. This makes "enforce" structurally moot. The industry reads SLC 21BA as if it works like statute-barred debt, where enforcement is blocked but chasing and selling are still allowed. It doesn't. "Seeks to recover" and "otherwise take advantage of" close every route that remains open for statute-barred debt.^[5]

There's also a basic legal principle: you cannot give what you do not have.^[9] If your supplier had no right to collect or take advantage of the debt, they had no right to sell it. The collector has purchased nothing.

The data protection angle

Every act of pursuing this debt involved processing your personal data. Under the GDPR, processing requires a lawful basis.^[6] "Chasing a debt we're banned from collecting" is not a lawful basis. The ICO confirms: anything unlawful is not a legitimate interest.^[7]

Each breach entitles you to compensation for distress under GDPR Article 82.^[12] The longer they chased you, the bigger the potential claim.

The Regulatory Framework

SLC 21BA operates through three prohibitions from two provisions. Their hierarchy matters, and the energy industry appears to have understood only the least important one.

SLC 21BA.1 — "seeks to recover"^[1]

This is the primary prohibition. The licensee must only take "charge recovery actions" in respect of consumption within the preceding 12 months. The operative concept is "charge recovery action", defined to include billing, collection, and recovery activity. The prohibition regulates actions, not debts. This distinction is fundamental and frequently misunderstood by defendants.

Crucially, the verb is "seeks," not "recovers." The prohibition captures the attempt, not merely success. Issuing a bill is seeking to recover. Sending a demand letter is seeking to recover. Instructing a collection agent is seeking to recover. Selling the debt for collection is seeking to recover by proxy.

SLC 21BA.5 — "must not enforce or otherwise take advantage of"^[1]

This provision adds two further prohibitions. The word "otherwise" does critical legal work: it establishes that "taking advantage of" is a different category from "seeking to recover" in 21BA.1. Under the canon against surplusage (verba cum effectu sunt accipienda), every word must be given independent meaning.^[2]

"Otherwise take advantage of" captures any commercial use of the debt beyond recovery attempts: selling for value, retaining on the books, using as security. A corporate entity takes advantage of an asset by profiting from it or reducing costs through it. Selling a debt portfolio for value is the paradigm case.

"Enforce" captures direct legal compulsion: litigation, court orders, enforcement agents. But enforcement is logically downstream: you cannot enforce a debt without first seeking to recover it. Since "seeks to recover" is already prohibited, enforcement is structurally moot. The industry has fixated on "enforce" because it maps onto statute-barred debt, but that comparison fails. Statute-barred debt can still be chased, sold, and retained. SLC 21BA-prohibited debt cannot. "Enforce" is the third and least important prohibition, not the first.

The combined effect is absolute. The licensee cannot:

What lawful action remains? Write it off. Delete it. Nothing else.

Why this matters: The industry has read SLC 21BA, seen "enforce," and assumed it works like statute-barred debt. It does not. Statute-barred debt cannot be enforced through the courts, but it can still be chased, sold, and retained. SLC 21BA-prohibited debt cannot be touched at all. More fundamentally, enforcement is downstream of recovery: you cannot enforce without first seeking to recover, which is already prohibited. "Enforce" is not an independent route the industry can use while avoiding the first two prohibitions. It is structurally unreachable. "Seeks to recover" and "otherwise take advantage of" close every route that remains open for statute-barred debt, making the enforceability question moot before it arises.

This construction is reinforced by the Supreme Court's approach in Uber BV v Aslam [2021] UKSC 5, which at [70] endorsed examining "the purpose of a particular provision" and interpreting language "in the way which best gives effect to that purpose."^[3] The purpose of SLC 21BA is consumer protection against stale billing. Permitting the supplier to sell the debt while prohibiting direct collection would defeat that purpose entirely.

Ofgem's May 2020 Open Letter confirmed this reading, stating that the backbilling requirement "remains applicable in the event that... the supplier's consumer debt is collected by a debt collection agency (DCA)" and that any party seeking to recover such debt "would be to enforce an unlawful contract."^[4]

Ofgem's December 2020 guidance further confirmed that the prohibition operates on the supplier's actions, not the consumer's: "Consumers must not be held responsible for failing to identify errors in their billing or that a debt balance is accruing."^[5]

The Data Protection Bridge

Every act of pursuing a SLC 21BA-prohibited debt necessarily involves processing the consumer's personal data. The data controller (supplier or debt purchaser) must identify a lawful basis under UK GDPR Article 6(1) for each processing operation.^[6]

The most commonly relied-upon basis for debt collection processing is Article 6(1)(f): legitimate interests. The three-part test requires: (1) the controller has a legitimate interest; (2) the processing is necessary for that interest; (3) the interest is not overridden by the data subject's rights.

The argument is that limb (1) fails at the threshold. There can be no "legitimate interest" in processing personal data for a purpose that is prohibited by law. The interest is, by definition, illegitimate. The ICO's own guidance confirms this: "Anything illegitimate, unethical or unlawful is not a legitimate interest" and "The other parts are not able to legitimise processing that is illegitimate from the outset."^[7]

This is not a proportionality argument (limb 3) or a necessity argument (limb 2). It is a threshold argument: the purpose itself is unlawful, so the analysis never reaches balancing.

If the lawful basis fails, every processing operation in connection with the prohibited debt is unlawful: generating bills, internal CRM entries, sharing data with purchasers or collectors, credit reference agency reporting, phone calls, letters, emails, SMS, and any automated processing.

Each is a separate instance of unlawful processing.

The Nemo Dat Problem for Debt Purchasers

Energy suppliers routinely sell aged debt portfolios to secondary market purchasers. When the sold debt includes SLC 21BA-prohibited accounts, a further problem arises.

What did the supplier sell?

Personal property falls into two categories: choses in possession (things you can hold) and choses in action (rights enforceable by legal action). There is no third category. A debt is ordinarily a chose in action — a right to recover money, enforceable by action (Torkington v Magee [1902] 2 KB 427).^[8]

But SLC 21BA prohibits the supplier from seeking to recover (any attempt to obtain payment), from otherwise taking advantage of (any commercial use, including retention), and from enforcing (legal compulsion). If a chose in action is a right enforceable by action, and the supplier is prohibited from any action, what remains? It is not a chose in action, because there is no action. It is not a chose in possession, because it cannot be touched. It is a number on a ledger with no legal character.

Property must admit lawful use beyond deletion to exist in law. "Taking advantage of" includes retention; the supplier was not even permitted to keep it on the books. Doing so would misrepresent asset value to investors.

This is not statute-barred debt. A creditor may retain, sell, or request voluntary payment of statute-barred debt. A supplier caught by SLC 21BA cannot even accept payment the consumer insists on making — acceptance would be "taking advantage of". Every route available for statute-barred debt is closed.

The test is simple. Can the owner claim damages for conversion of this "asset"? If someone stole or destroyed it, the supplier could not claim recovery value (prohibited from recovering), sale value (prohibited from selling), or book value (prohibited from retaining). The claim would be zero. If theft or destruction causes no loss, the thing is not property. It is nothing.

The insurance test confirms it. Try to insure this debt. What is the insurable interest? The right to seek recovery, which is prohibited. What is the covered peril? Non-payment, but non-payment is the mandated outcome, not a contingency. What is the loss? The face value assumes a right to collect, which does not exist. No insurable interest, no covered peril, no quantifiable loss. If it cannot be insured, it has no value as property.

The supplier sold a legal hallucination: a right it does not possess, to a purchaser who paid real money for it. Nemo dat quod non habet.^[9] The purchaser acquired nothing.

Section 136(1) of the Law of Property Act 1925 provides that legal assignment is "subject to equities having priority over the right of the assignee."^[10] Bibby Factors Northwest Ltd v HFD Ltd [2015] EWCA Civ 1908 confirmed that "the factor, as assignee, can be in no better position than his assignor."^[11]

Compensation Under Article 82

UK GDPR Article 82(1) provides: "Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor."^[12]

Following Vidal-Hall v Google Inc [2015] EWCA Civ 311, it is established that non-material damage (distress) is compensable without proof of financial loss.^[13] Lloyd v Google LLC [2021] UKSC 50 confirmed that individual claims for proven distress are recoverable.^[14]

Each processing operation is a separate infringement. Quantum is a function of volume and duration of unlawful processing, severity of distress, and consequential losses such as wrongful credit reporting.

Limitation

Claims under Article 82 are subject to a 6-year limitation period (Limitation Act 1980, s.2 or s.9).^[15] The clock runs from each individual processing event, not the date of the original bill. A consumer billed unlawfully in 2019 but still receiving collection letters in 2025 has claims for every letter within the 6-year window.

Fraud and s.32(1)(a): Section 32 of the Limitation Act 1980 postpones the start of the limitation period in cases of fraud.^[16] The limitation period does not begin until the claimant discovered, or could with reasonable diligence have discovered, the fraud.

Following Ivey v Genting Casinos [2017] UKSC 67, dishonesty is assessed objectively: would ordinary decent people consider the conduct dishonest, given the facts as the defendant knew them?^[17]

Apply that test here. SLC 21BA says "must not." A licensee is taken to know the conditions of its own licence; that is the basis on which it is permitted to operate. The energy company knew it was prohibited from recovering these charges. It pursued payment anyway. It did so to induce consumers to pay money the company was not entitled to collect. The language of "must not" leaves no room for honest mistake. It is not ambiguous, and there is no scope for innocent misinterpretation of a mandatory prohibition.

By the Ivey standard, it is strongly arguable that ordinary decent people would consider that dishonest. If so, it constitutes fraud for the purposes of s.32(1)(a), and limitation is postponed until the consumer discovers the breach.

Debt purchasers and fraud: Where an energy company sold the debt to a third party, the fraud dimension cuts both ways. The energy company sold a debt it knew it was prohibited from recovering. The purchaser paid real money for it. That means the debt purchaser may itself have a fraud claim against the energy company, because it bought something the seller knew was worthless under its own licence conditions. This does not help the purchaser's claim against the consumer; if anything, it reinforces that the entire chain of recovery was tainted from the start.

SLC 21BA is enforced by Ofgem under the Electricity Act 1989 and Gas Act 1986.^[1] But there is no private right of action — you cannot take your supplier to court for breaching a licence condition.

This creates a gap: consumers are protected by the rule but cannot enforce it themselves. Ofgem's enforcement has been, in practice, negligible. The Energy Ombudsman can make individual redress awards but has no power to address systemic breach.

The ICO regulates data protection but has shown no interest in the intersection between SLC 21BA and GDPR. Despite the clear unlawful processing argument, no action has been taken.

Energy companies have treated SLC 21BA as a dead letter. They continue billing years late. They sell the prohibited debt to collectors for profit. The collectors chase consumers who don't know the law protects them. The companies know all of this. They do it anyway.

The Enforcement Gap

SLC 21BA is imposed under the EA 1989 / Gas Act 1986. Enforcement lies with Ofgem under ss.25-28.^[1] There is no private right of action for breach of a licence condition, unlike breach of a statutory duty.

Ofgem could use its enforcement powers — including fines of up to 10% of a company's turnover — but has not done so for systematic SLC 21BA breach.

The Energy Ombudsman operates as alternative dispute resolution. It can award redress in individual cases, but its decisions do not set precedent and it has no power to investigate industry-wide patterns. It does not engage with the GDPR dimension.

Why the Industry Carries On

There is a critical difference between SLC 21BA-prohibited debt and statute-barred debt that the industry appears to have missed — or chosen to ignore.

Statute-barred debt (over 6 years old with no payment) cannot be enforced through the courts. But it can still be chased, sold, retained on the books, and the consumer can voluntarily pay. The entire secondary debt market depends on this.

SLC 21BA-prohibited debt is different. "Seeks to recover" and "otherwise take advantage of" close every route available for statute-barred debt. You cannot chase it, sell it, retain it, or accept voluntary payment. The only lawful option is deletion.

More fundamentally, enforcement is downstream of recovery. You cannot enforce a debt without first seeking to recover it, and seeking to recover is already prohibited. The enforceability question is moot before it arises. The industry has read SLC 21BA, seen "enforce," and assumed it works like statute-barred debt. It does not. "Enforce" is the third and least important prohibition, not the first — and it is structurally unreachable while the first prohibition stands.

The Defendant's Likely Arguments

"The debt exists contractually." — Irrelevant. SLC 21BA prohibits recovery actions regardless.

"SLC 21BA only applies to the supplier, not to us." — The supplier breached 21BA.5 by selling. The purchaser's processing has no independent lawful basis. Nemo dat applies.

"Limitation bars the claim." — Only for events more than 6 years old. Recent processing is within time. Where recovery was pursued knowingly in breach of "must not," s.32(1)(a) Limitation Act 1980 may postpone limitation.^[2]

"The consumer suffered no damage." — Distress is compensable per Vidal-Hall.

"Article 6(1)(b) (contractual necessity) provides an alternative lawful basis." — A contract term incompatible with SLC 21BA is unenforceable per SLC 21BA.5. You cannot rely on a term you are prohibited from enforcing.

Current Status

This legal theory is being tested in active County Court proceedings (2025). No court has yet ruled on whether SLC 21BA breach defeats Article 6(1)(f) legitimate interests. This is novel law. The argument is available for any affected consumer to advance.