James Watt
&
Second Best Beer
EFP Data
If you were previously an Equity for Punks (EFP) investor in BrewDog, you may well be aware of recent developments.
There are a couple of reasons why, but they all centre around the former CEO of BrewDog.
James Watt has decided to launch another beer company – Second Best Beer.
Initially, Watt launched his opening gambit via social media, which garnered a rumoured 9% response rate from out-of-pocket EFP shareholders.
So how else could you contact previous investors?
It appears that somehow Second Best Beer has managed to acquire the contact details of EFP shareholders. How is this possible?
BrewDog and EFP data
BrewDog have confirmed that they are concerned, and said in an email:
"To confirm, BrewDog has not authorised the use of investment data... We are diligently investigating how the information was obtained."
ComputerShare
Now, there will be a number of people who want to support James Watt and Second Best Beer. You only have to look at his LinkedIn post with over 100 comments, the majority being eager to support.
These people will say that EFP shareholders' data is publicly available from the registrar, ComputerShare.
It wasn't.
ComputerShare have confirmed that contact data for EFPs wasn't available to the public.
This website will do all the hard work for you and help you find out how Second Best obtained your data.
It will generate the email with your details, tap the [Open in my email app] button make sure you're happy with it and press SEND
I cannot stress this enough - THIS WEBSITE DOESN'T STORE YOUR EMAIL OR NAME, AND WE WON'T CONTACT YOU DIRECTLY IN THE FUTURE
Use the address you registered with BrewDog, or the one Second Best Beer contacted you on.
Optional, but including it can head off requests for identity verification.
Sending from your own account means the request comes from you, the data subject, which is the strongest position to be in. A request from a third party can be challenged on grounds of authority; one from you cannot. Keep a copy of the sent email and note the date, as the response deadline runs from the day they receive it.
Update
Second Best Brewing Update
On August 5th Second Best Brewing replied to my Subject Access Request (SAR)
"Hi Neil,
Thank you for your correspondence dated 9th July, 2026 relating to the email you received on behalf of Second Brewing Company (“we” “us” “our”) on 5th July 2026.
We have reviewed the matter and confirm that we processed your personal data, namely: i) your name and ii) your email address, solely for the purpose of sending the communication referred to in your correspondence dated 5th July 2026. Your personal data has not been used for any other purpose or shared with any third party.
If you requested that your personal data be removed from our records, we confirm that this has now been actioned. We may retain a minimal record of your request where necessary to ensure that we do not contact you again and to demonstrate compliance with our legal obligations.
Our Privacy Notice, which explains how we use personal data, is available here.
If you want to raise any concerns about our response to your data subject access request, please contact hello@secondbest.beer in the first instance. If you are not happy with our response, you have the right to make a complaint to the data protection supervisory authority in the United Kingdom, the Information Commissioner. For further information, see the data protection supervisory authority’s website at https://ico.org.uk/global/contact-us/contact-us-public/.
Yours sincerely,
Second Best Brewing Company"
Where Second Best Brewing are falling short
However, the response falls short in the following ways:
- No source disclosed. Under Article 15(1)(g) UK GDPR, individuals are entitled to information about the source of their data where it wasn't collected from them directly. Recipients who never signed up with Second Best Brewing, and had no relationship with the company, were not told where their data came from.
- No lawful basis evidenced. The company states the data was obtained and processed lawfully, but has not shown which Article 6 basis it relied upon, or how that basis applies to people it had no prior relationship with.
- Third-party data. Many recipients are former Equity for Punks investors in BrewDog, a separate and unrelated company. This points to the data having come from a third party, which the response does not address.
- Possible PECR breach. Beyond the SAR itself, the original unsolicited email appears to engage Regulation 22 of PECR, which prohibits unsolicited electronic marketing to individuals without consent or a valid soft opt-in.
Yet another Second Best Brewing Update
On September 1st Second Best Brewing replied to my email regarding their shortcomingsto my SAR
Thank you for your correspondence dated 05 August 2026.
We have reviewed your complaint and our view is that your personal data has been processed appropriately for the purposes explained in our previous correspondence. If you are not happy with our response, you have the right to make a complaint to the data protection supervisory authority in the United Kingdom, the Information Commissioner. For further information, see the data protection supervisory authority’s website at https://ico.org.uk/global/contact-us/contact-us-public/.
The ICO
On reciept of the previous communication from James Watts' Second Best Beer/Brewing, a complaint was opened with the Information Commissioner Office (ICO)
Second Best Beer Privacy Policy
On 5 July 2026, Second Best emailed former BrewDog Equity Punks, many of whom had never given the company their details. Yet the privacy policy live that day said data was only ever collected directly from you, via the landing page and form. There was no mention of obtaining data from third parties or public sources. This isn't guesswork: an Internet Archive capture from 5 July preserves that version, and the page's own Webflow publish stamp shows it went live on 22 June and stayed unchanged through the email.
Under Article 14 UK GDPR, when you obtain someone's data from a source other than them, you must tell them so, including where it came from, at the latest when you first contact them. The 5 July email was that first contact. The policy behind it disclosed none of this. It's also why recipients are entitled, under Article 15(1)(g), to ask Second Best directly where their data came from.
A rewritten policy dated 31 July is the first version to admit data "may" come "from publicly available sources or third parties." But that came weeks after the email, and a disclosure added later doesn't cure processing that had already happened. The timeline speaks for itself: policy published 22 June, archived 5 July, email sent 5 July, disclosure added 31 July.
Update
ICO Update
Second Best Brewing Update After ICO Intervention
On October 22nd the ICO replied to my complaint of non-compliance by Second Best Brewing
"Dear Neil
Thank you for contacting the Information Commission's Office (ICO) about the way Second Best Brewing Company Ltd obtained, used, or responded to requests concerning your personal information.
They then go on to explain their role etc
What is the outcome of my complaint?
We have carefully considered the information available to us regarding your complaint.
As part of our consideration of your concerns, we have reviewed the information available to us about your complaint and the way Second Best Brewing Company Ltd obtained, used and responded to requests concerning personal information. We have written to the company setting out our concerns and asking it to revisit your complaint and provide you with a substantive response. We have asked the company to respond directly to you and to provide us with a copy of its response by 20 November 2026.
Based on the information available to us, we have concluded that Second Best Brewing Company Ltd has not demonstrated compliance with the relevant requirements of data protection law in relation to the concerns you told us about. We have therefore recorded an infringement in your case based on the specific issues you raised and the legal provisions relevant to those circumstances.
We have also asked the company to review the way it obtains and uses personal information, how information rights requests are identified and handled, and the steps it takes to comply with its obligations under data protection law.
If Second Best Brewing Company Ltd considers that it has complied with data protection law, we expect it to explain its position and the evidence it relies upon. If something has gone wrong, we expect it to explain what action it has taken to put matters right and prevent a recurrence.
The James Watt / Second Best Brewing Defence
James Watt has apparently said in a closed forum, that:
However, the flaw in this excuse, even if true, is that shareholder's contact details aren't on Companies House, which is the whole point, as this would breach any number of data protection legislations
The next update will be when/if James Watt & Second best brewing choose to comply with the ICO by the deadline of November 20th