It starts with an unexpected email out of the blue: James Watt, the co-founder of BrewDog, is offering you a free stake in his new beer company. For many of the 200,000 former crowdfunding investors who lost everything when the craft brewer collapsed, the message raised a puzzling and worrying question: how did he get my details?
BrewDog was founded in 2007 by James Watt and Martin Dickie in Aberdeenshire. It grew rapidly, building four breweries and around 100 pubs worldwide, and at its peak was said to be worth more than $1bn. A key part of that growth was a pioneering crowdfunding scheme called "Equity for Punks", which allowed ordinary drinkers to buy shares and become "equity punks". Over the years, the company raised millions from about 200,000 small investors.
“Explains BrewDog's crowdfunding model and the data privacy complaints around James Watt's buy-back bid.”
But in March 2026, the debt-laden brewer went into administration with debts of more than £500m, leading to hundreds of job losses and the closure of 36 bars. The US cannabis and drinks firm Tilray bought BrewDog's brand, intellectual property, UK breweries and 11 bars for about £33m. The deal rendered the shares of those 200,000 crowdfunding investors completely worthless.
Just months later, in July 2026, Watt made a surprise bid to buy back BrewDog through his new firm, Second Best. He claimed 43,000 equity punks had joined forces for the bid, and offered them the "exact same stake in Second Best that you once held in BrewDog, for free". To do so, he contacted thousands of former shareholders by email.
Several recipients told the Guardian they did not understand how Watt had obtained their contact details, raising concerns about a potential breach of the General Data Protection Regulation (GDPR), the UK's strict data privacy rules overseen by the Information Commissioner's Office (ICO). The ICO confirmed it was "assessing" information following complaints. Watt denied any wrongdoing, saying the communication was sent "following legal advice, using lawfully obtained data, and in connection with their legitimate interests as shareholders". He did not explain how the data was obtained.
Tilray stressed it had not provided any data. A spokesperson said Tilray did not acquire the Equity for Punks shareholder data as part of the acquisition; that records system remains under the control of BrewDog plc (in administration). Tilray said it acquired only a customer CRM database of individuals who explicitly opted in to BrewDog communications, and did not authorise or participate in Watt's communications.
For UK readers who invested in BrewDog or any other crowdfunding scheme, this case highlights an important vulnerability: when a company fails, investors' personal data can end up in unexpected hands. Crowdfunding investors are often treated as shareholders, but their shares are usually unlisted and can become worthless in an insolvency. The question of who owns their data – and how it can be used – is less clear.
Q: What is Equity for Punks? Equity for Punks was BrewDog's name for its crowdfunding campaigns, which allowed the public to buy shares in the company. Over several rounds, about 200,000 people invested, becoming known as "equity punks". They were shareholders in the company, but when BrewDog went into administration and Tilray bought the brand and assets, their shares became worthless.
Q: Can James Watt legally contact former shareholders? That is what the ICO is assessing. Under GDPR, personal data can only be used for the purpose for which it was collected. The former shareholders' contact details were originally held by BrewDog plc, not by Watt personally. If he obtained them without proper authorisation, it could be a breach. Watt says he used lawfully obtained data, but has not explained how.
Q: What does this mean for people who invested in BrewDog? Former equity punks have lost their investment. Those who received Watt's email may have their personal data caught up in a legal dispute. They can complain to the ICO if they believe their data was misused. The outcome could affect how insolvent companies' shareholder data is handled in future crowdfunding schemes.
What happens next depends on the ICO. It said it is assessing the information provided. If it finds a GDPR breach, it has the power to impose fines or compel changes in practice. Meanwhile, Tilray has said BrewDog is not for sale and plans to reject Watt's takeover efforts. For the 200,000 former investors, the saga is a reminder that being an equity punk comes with risks – both financial and digital.