seek damages arising from the use of their personal data by the organisation. With regard to, "would creative works or derived works count as 'data'?" You have to ask two questions "what is a work" and "what is data". The definition of data used by technical personel is most definatly not the same as courts use. Likwise a "work" is not regarded in the same way as you would think. On the Internet you will see an argument such as "a file of data is just a binary number, and you cannot copyright a number". Any legal person would laugh them selves silly over that argument. However you then get a more subtal argument coming from the techs "If I have two files neither contains the data of the work, therfore neither is copyrighted" again the legal person would have fits of laughter, simply because using both and an apropriate transform the original work can be recovered. However this last point is an area of great concern. If I send you by Email a file of data that is encrypted via a one time pad (OTP) (that I previously sent you in the post). And it is sufficiently large, and we both carry out the proper procedure with OTPs which is to securly destroy the key file after use we have a problem. A third party could argue that any file that is less than the size of the Email file (or in some cases larger) was what was sent