1. (a) The claimants argued that Memorandum 112 contained five propositions amounting to “personal data of which [they] [were] the data subjects”. Two were in dispute:
(i) The first proposition formulated by the claimants, that “significant favours are done by President Putin for the claimants and for President Putin by the claimants”, was derived from Memorandum 112 passages which did not themselves name the claimants. In support of their argument that the memorandum nevertheless contained the personal data set out in that proposition, the claimants contended that their formulation reflected the natural meaning which the ordinary reader of Memorandum 112 would understand the relevant passages, in their overall context, to bear. The defendant argued that this holistic approach was, in a DPA rather than a defamation action, wrong in principle, and that the court should focus on the individual items of information i.e. the individual passages, not the document in the round; assessed in this way, the defendant contended, the relevant passages did not refer to any of the claimants, and therefore did not contain any personal data about them. Warby J agreed with the claimants, holding that the holistic approach was consistent with principle and authority, namely NT1 v Google LLC  EWHC 799 (QB); that it was the right approach to the facts of the instant case; and that Memorandum 112 contained the information about all three claimants set out in the first proposition.
(ii) Whether the information in the fourth proposition, that “the first and second claimants used Mr Oleg Govorun as a ‘driver’ and ‘bag carrier’ to deliver large amounts of illicit cash to President Putin when he was Deputy Mayor of St Petersburg”, consisted of sensitive personal data. The claimants argued that this information, especially the memorandum’s two-fold use of the term “illicit cash”, contained an allegation of criminal behaviour, such as to fall under the “sensitive personal data” definition at s.2(g), DPA. Warby J agreed, and rejected the defendant’s contention that the “illicit” reference merely implied furtiveness, secrecy or immorality.
2. (a) The compilation and inclusion in Memorandum 112 of the disputed information, and its delivery to Fusion, was necessary for the purposes of obtaining legal advice and establishing legal rights (the latter being a broad concept). The Ultimate Client had instructed Perkins Coie to obtain information on Trump-Russia issues and on interference in the US Presidential campaign for the purpose of taking legal advice on any legal implications, and on any legal steps which could be taken as a result. The Judge accepted that the defendant’s purpose – collecting and reporting back on that information – was, in a narrow sense, different to the Ultimate Client’s, but held that for s.35(2) to apply it was not just the data controller’s purpose which mattered. Similarly, the fact that the Ultimate Client clearly had other (political) purposes in mind when commissioning the Steele Dossier did not mean that the legal exemption could not apply. Though nothing in Memorandum 112 went directly to the question of links between Mr Trump and President Putin, the relevance of the document had to be considered in the context of the overall project: in light of suspicions of server links between Trump Tower in New York and Alfa Bank, it was well within the margin of appreciation to conclude that, for the Ultimate Client to obtain legal advice on possible Russian interference in the Presidential election, it was reasonably necessary and proportionate for the defendant to obtain and pass on information regarding links between Alfa Group and President Putin.
(b) Warby J also accepted that compliance by the defendant with “the Notice Requirements” governing the interpretation of “fairness” in the first data protection principle, in paragraphs 2(1)(b) and (3) of Schedule 1, Part II of the DPA – which would have included notifying the claimants of the inclusion of their data in Memorandum 112 – would have been inconsistent with the purposes of the exercise. However, he refused to disapply the fourth (accuracy) principle or ss.14(1)-(3) in respect of the disclosure to Fusion. While it might be in some cases appropriate to disapply those provisions, here, while the defendant was not subject to an absolute duty of accuracy, it was not inconsistent to apply the fourth principle to require the defendant to take reasonable steps to ensure data obtained from third parties were accurate.
3. The national security exemption in s.28(1) can disapply any of the provisions of the data protection principles if “required for the purposes of safeguarding national security”. Warby J held that “required” imposed a more exacting test than “necessary”, limiting the exemption to cases judged indispensable to the safety and well-being of the UK. Applying that test to each of the defendant’s four (non-Fusion) disclosures of Memorandum 112 in autumn 2016, the Judge concluded that the claimants’ personal data was exempt only from “the Notice Requirements” accompanying the first data protection principle: the disclosures still needed to be lawful under that principle (and satisfy a condition in Schedule 2 and/or Schedule 3), and meet the accuracy requirement imposed by the fourth principle. Warby J also signalled that his conclusions would have been the same if a less demanding “reasonably necessary” test had been applied.
4. (a) Warby J’s findings on issues (2) and (3) above meant that the production and delivery to Fusion of Memorandum 112, and the defendant’s four other disclosures of the document, were all exempt from the Notice Requirements. The Judge therefore rejected the claimants’ case that the defendant, by failing to notify them of Memorandum 112, or enable them to comment on its accuracy, had breached those requirements, and thus contravened the first data protection principle’s requirements of fairness.
(b) The Judge also rejected the submission that the defendant’s processing did not comply with any of the conditions in Schedules 2 or 3, and was therefore in breach of the first principle. The defendant’s provision of the memorandum to Fusion was reasonably necessary for its legitimate interest of fulfilling its contractual duties to the latter, while the related interests of Fusion, Perkins Coie and the Ultimate Client were also legitimate. The interference with the claimants’ own legitimate interests, and their Article 8 rights, were limited and proportionate. The relevant processing therefore had a lawful basis in condition 6(1) of Schedule 2, while the factors triggering the application of the legal purposes exemption meant that it also satisfied conditions 6(b) and (c) of Schedule 3. Regarding the other disclosures, Warby J accepted the defendant’s submission that they were reasonably necessary for the exercise of each institution or body’s enactment functions, and thus satisfied conditions 5(b) of Schedule 2 and 7(b) of Schedule 3.
5. (a) Applying well-established defamation law principles, Warby J rejected the defendant’s submission that two of the propositions in Memorandum 112 were expressions of opinion, and therefore fell outside the DPA’s “supplementary definition” of inaccuracy at s.70(2) (“incorrect or misleading as to any matter of fact”). He held that all five propositions were factual in nature, and went on to find, on the limited evidence available, that the claimants had proved that each of them was inaccurate or misleading.
(b) The defendant also sought to rely on paragraph 7 of Schedule 1, Part II, which provides that the fourth data protection principle will not be contravened by reason of inaccuracy where the data controller has accurately recorded the information obtained from their source(s), and taken reasonable steps to ensure its accuracy. Warby J accepted that Memorandum 112 accurately recorded what Mr Steele had been told by the relevant source, and, in respect of four of the propositions, that Mr Steele had taken reasonable steps to ensure their accuracy. But given the gravity of the fourth proposition, that “the first and second claimants used Mr Oleg Govorun as a ‘driver’ and ‘bag carrier’ to deliver large amounts of illicit cash to President Putin when he was Deputy Mayor of St Petersburg”, the steps taken to verify it fell short of reasonable. The defendant’s disclosure of that allegation to Fusion and the four other recipients in autumn 2016 thus involved a contravention of the fourth data protection principle.
The claimants sought an order pursuant to ss.14(1)-(3) for the blocking, erasure, destruction and rectification of their personal data, and for the defendant to inform those to whom it had disclosed Memorandum 12 of the inaccuracies; a declaration that the personal data were inaccurate; and compensation.
The remedies under ss.14(1)-(3) were, in principle, available in respect of all of the inaccurate or misleading data. Warby J was prepared to direct, if necessary, that the copy of Memorandum 112 held by the defendant for legal purposes be marked up or otherwise rectified so as to make any reader aware of the court’s judgment, the inaccurate or misleading data, and the formal order which was made. But given the limited disclosures by the defendant of the memorandum, and the fact that the recipients would surely become aware of his decision, he declined to grant any additional remedies under s.14.
Similarly, Warby J declined to make the declaration sought. Assuming, though without deciding, that such a remedy was available in principle, he felt that this was not necessary or appropriate: the judgment and resultant order were a sufficient statement of the position, and compensation would afford some real vindication for the first and second claimants.
In this regard, and pursuant to s.13, DPA, Messrs Aven and Fridman were entitled to compensation for any damage suffered by the defendant’s disclosure of the “illicit cash” allegation. “Damage” was not confined to material loss: compensation could be awarded for distress and interference with the data subject’s control over their data. The Judge also held, albeit cautiously, that where the inaccurate information was seriously defamatory, compensation could be awarded for reputational harm. Applying established defamation law principles on the assessment and mitigation of damages, as set out in Barron v Vines  EWHC 1226 and Sloutsker v Romanova  EWHC 2053 (QB), Warby J awarded the first and second claimants £18,000 each.