James Watt
&
Second Best Beer
EFP Data
If you were previously an Equity for Punks (EFP) investor in BrewDog, you may well be aware of recent developments.
There are a couple of reasons why, but they all centre around the former CEO of BrewDog.
James Watt has decided to launch another beer company – Second Best Beer.
Initially, Watt launched his opening gambit via social media, which garnered a rumoured 9% response rate from out-of-pocket EFP shareholders.
So how else could you contact previous investors?
It appears that somehow Second Best Beer has managed to acquire the contact details of EFP shareholders. How is this possible?
BrewDog and EFP data
BrewDog have confirmed that they are concerned, and said in an email:
"To confirm, BrewDog has not authorised the use of investment data... We are diligently investigating how the information was obtained."
ComputerShare
Now, there will be a number of people who want to support James Watt and Second Best Beer. You only have to look at his LinkedIn post with over 100 comments, the majority being eager to support.
These people will say that EFP shareholders' data is publicly available from the registrar, ComputerShare.
It wasn't.
ComputerShare have confirmed that contact data for EFPs wasn't available to the public.
This website will do all the hard work for you and help you find out how Second Best obtained your data.
It will generate the email with your details, tap the [Open in my email app] button make sure you're happy with it and press SEND
I cannot stress this enough - THIS WEBSITE DOESN'T STORE YOUR EMAIL OR NAME, AND WE WON'T CONTACT YOU DIRECTLY IN THE FUTURE
Use the address you registered with BrewDog, or the one Second Best Beer contacted you on.
Optional, but including it can head off requests for identity verification.
Sending from your own account means the request comes from you, the data subject, which is the strongest position to be in. A request from a third party can be challenged on grounds of authority; one from you cannot. Keep a copy of the sent email and note the date, as the response deadline runs from the day they receive it.
Update
Second Best Brewing Update
On August 5th Second Best Brewing replied to my Subject Access Request (SAR)
"Hi Neil,
Thank you for your correspondence dated 9th July, 2026 relating to the email you received on behalf of Second Brewing Company (“we” “us” “our”) on 5th July 2026.
We have reviewed the matter and confirm that we processed your personal data, namely: i) your name and ii) your email address, solely for the purpose of sending the communication referred to in your correspondence dated 5th July 2026. Your personal data has not been used for any other purpose or shared with any third party.
If you requested that your personal data be removed from our records, we confirm that this has now been actioned. We may retain a minimal record of your request where necessary to ensure that we do not contact you again and to demonstrate compliance with our legal obligations.
Our Privacy Notice, which explains how we use personal data, is available here.
If you want to raise any concerns about our response to your data subject access request, please contact hello@secondbest.beer in the first instance. If you are not happy with our response, you have the right to make a complaint to the data protection supervisory authority in the United Kingdom, the Information Commissioner. For further information, see the data protection supervisory authority’s website at https://ico.org.uk/global/contact-us/contact-us-public/.
Yours sincerely,
Second Best Brewing Company"
Where Second Best Brewing are falling short
However, the response falls short in the following ways:
- No source disclosed. Under Article 15(1)(g) UK GDPR, individuals are entitled to information about the source of their data where it wasn't collected from them directly. Recipients who never signed up with Second Best Brewing, and had no relationship with the company, were not told where their data came from.
- No lawful basis evidenced. The company states the data was obtained and processed lawfully, but has not shown which Article 6 basis it relied upon, or how that basis applies to people it had no prior relationship with.
- Third-party data. Many recipients are former Equity for Punks investors in BrewDog, a separate and unrelated company. This points to the data having come from a third party, which the response does not address.
- Possible PECR breach. Beyond the SAR itself, the original unsolicited email appears to engage Regulation 22 of PECR, which prohibits unsolicited electronic marketing to individuals without consent or a valid soft opt-in.
Yet another Second Best Brewing Update
On September 1st Second Best Brewing replied to my email regarding their shortcomingsto my SAR
Thank you for your correspondence dated 05 August 2026.
We have reviewed your complaint and our view is that your personal data has been processed appropriately for the purposes explained in our previous correspondence. If you are not happy with our response, you have the right to make a complaint to the data protection supervisory authority in the United Kingdom, the Information Commissioner. For further information, see the data protection supervisory authority’s website at https://ico.org.uk/global/contact-us/contact-us-public/.
The ICO
On reciept of the previous communication from James Watts' Second Best Beer/Brewing, a complaint was opened with the Information Commissioner Office (ICO)
Second Best Beer Privacy Policy
On 5 July 2026, Second Best emailed former BrewDog Equity Punks, many of whom had never given the company their details. Yet the privacy policy live that day said data was only ever collected directly from you, via the landing page and form. There was no mention of obtaining data from third parties or public sources. This isn't guesswork: an Internet Archive capture from 5 July preserves that version, and the page's own Webflow publish stamp shows it went live on 22 June and stayed unchanged through the email.
Under Article 14 UK GDPR, when you obtain someone's data from a source other than them, you must tell them so, including where it came from, at the latest when you first contact them. The 5 July email was that first contact. The policy behind it disclosed none of this. It's also why recipients are entitled, under Article 15(1)(g), to ask Second Best directly where their data came from.
A rewritten policy dated 31 July is the first version to admit data "may" come "from publicly available sources or third parties." But that came weeks after the email, and a disclosure added later doesn't cure processing that had already happened. The timeline speaks for itself: policy published 22 June, archived 5 July, email sent 5 July, disclosure added 31 July.
