Aven & Ors v Orbis Business Intelligence Ltd

Reference: [2020] EWHC 1812 (QB)

Court: High Court

Judge: Warby J

Date of judgment: 8 Jul 2020

Summary: Data Protection Act 1998 – s.35 exemption (legal purposes) – s.28 exemption (national security) – remedies

Download: Download this judgment

Facts

The claimants, Mr Petr Aven, Mr Mikhail Fridman and Mr German Khan, were businessmen of Russian or Ukrainian origin. They were among the owners of the Alfa Group Consortium (“Alfa Group”), a Russian investment conglomerate which included Alfa Bank JSC (“Alfa Bank”).

The defendant was an English company, established by two British former public officials. It held itself out as providing strategic insight, intelligence and investigative services to clients around the world.

In May 2016, a Washington DC consultancy, Fusion GPS (“Fusion”), engaged the defendant to investigate alleged links between then-presumptive Republican US Presidential candidate Donald Trump, Russia, and Russian President Vladimir Putin. Fusion had been instructed by a US law firm, Perkins Coie, which in turn was acting on the instructions of one or more persons or bodies at the top of the Democratic Party (“the Ultimate Client”).

The defendant subsequently produced the so-called “Steele Dossier”, a set of memoranda authored by Mr Christopher Steele, director of the defendant. One of the memoranda, “Memorandum 112”, focused on Alfa Group and President Putin, and made reference to the claimants.

The defendant delivered Memorandum 112 to Fusion in September 2016, and gave a copy to the FBI. In November 2016, the defendant disclosed Memorandum 112 and other memoranda to three further parties: a former US Deputy Secretary of State; a UK national security official; and Mr David Kramer, a former US Assistant Secretary of State. Mr Kramer gave an American news website, BuzzFeed News, access to the Steele Dossier.

In January 2017, BuzzFeed News published an online article bearing the headline “These Reports Allege Trump Has Deep Ties to Russia”. The article provided a link to the Steele Dossier, thereby alerting the claimants to the existence of Memorandum 112.

In May 2018, the claimants instituted proceedings under the Data Protection Act 1998 (“DPA”). They argued that because Memorandum 112 contained inaccurate personal data relating to them (some of which was sensitive personal data), the defendant had failed to comply with the fourth data protection principle when processing their data. They also accused the defendant of non-compliance with the first data protection principle, contending that the processing of their data had been unfair and unlawful. The claimants sought several remedies, including compensation.

The defendant denied liability. It argued that not all of the information in Memorandum 112 was personal data; that none of it related to the third claimant; that the personal data processed did not include any sensitive personal data; and that the data were not inaccurate. Further and alternatively, the defendant sought to rely on the DPA’s legal purposes exemption at s.35(2), and the national security exemption at s.28(1). Finally, the defendant contended that even if liability were established, the claimants were not entitled to compensation or any other remedy, as they had not suffered any damage or distress.

Warby J heard evidence and argument over four days in mid-March 2020.

Issue

1.  The scope and nature of the personal data relating to the claimants contained in Memorandum 112.

2.  The extent, if at all, to which the defendant’s processing of those data was protected by the legal purposes exemption.

3.  The extent, if at all, to which the defendant’s processing of those data was protected by the national security exemption.

4.  Whether the defendant had processed any of the data in contravention of the first data protection principle.

5.  Whether the defendant had processed any of the data in contravention of the fourth data protection principle.

Held

1. (a) The claimants argued that Memorandum 112 contained five propositions amounting to “personal data of which [they] [were] the data subjects”. Two were in dispute:

(i) The first proposition formulated by the claimants, that “significant favours are done by President Putin for the claimants and for President Putin by the claimants”, was derived from Memorandum 112 passages which did not themselves name the claimants. In support of their argument that the memorandum nevertheless contained the personal data set out in that proposition, the claimants contended that their formulation reflected the natural meaning which the ordinary reader of Memorandum 112 would understand the relevant passages, in their overall context, to bear. The defendant argued that this holistic approach was, in a DPA rather than a defamation action, wrong in principle, and that the court should focus on the individual items of information i.e. the individual passages, not the document in the round; assessed in this way, the defendant contended, the relevant passages did not refer to any of the claimants, and therefore did not contain any personal data about them. Warby J agreed with the claimants, holding that the holistic approach was consistent with principle and authority, namely NT1 v Google LLC [2018] EWHC 799 (QB); that it was the right approach to the facts of the instant case; and that Memorandum 112 contained the information about all three claimants set out in the first proposition.

(ii) Whether the information in the fourth proposition, that “the first and second claimants used Mr Oleg Govorun as a ‘driver’ and ‘bag carrier’ to deliver large amounts of illicit cash to President Putin when he was Deputy Mayor of St Petersburg”, consisted of sensitive personal data. The claimants argued that this information, especially the memorandum’s two-fold use of the term “illicit cash”, contained an allegation of criminal behaviour, such as to fall under the “sensitive personal data” definition at s.2(g), DPA. Warby J agreed, and rejected the defendant’s contention that the “illicit” reference merely implied furtiveness, secrecy or immorality.

2. (a) The compilation and inclusion in Memorandum 112 of the disputed information, and its delivery to Fusion, was necessary for the purposes of obtaining legal advice and establishing legal rights (the latter being a broad concept). The Ultimate Client had instructed Perkins Coie to obtain information on Trump-Russia issues and on interference in the US Presidential campaign for the purpose of taking legal advice on any legal implications, and on any legal steps which could be taken as a result. The Judge accepted that the defendant’s purpose – collecting and reporting back on that information – was, in a narrow sense, different to the Ultimate Client’s, but held that for s.35(2) to apply it was not just the data controller’s purpose which mattered. Similarly, the fact that the Ultimate Client clearly had other (political) purposes in mind when commissioning the Steele Dossier did not mean that the legal exemption could not apply. Though nothing in Memorandum 112 went directly to the question of links between Mr Trump and President Putin, the relevance of the document had to be considered in the context of the overall project: in light of suspicions of server links between Trump Tower in New York and Alfa Bank, it was well within the margin of appreciation to conclude that, for the Ultimate Client to obtain legal advice on possible Russian interference in the Presidential election, it was reasonably necessary and proportionate for the defendant to obtain and pass on information regarding links between Alfa Group and President Putin.

(b) Warby J also accepted that compliance by the defendant with “the Notice Requirements” governing the interpretation of “fairness” in the first data protection principle, in paragraphs 2(1)(b) and (3) of Schedule 1, Part II of the DPA – which would have included notifying the claimants of the inclusion of their data in Memorandum 112 – would have been inconsistent with the purposes of the exercise. However, he refused to disapply the fourth (accuracy) principle or ss.14(1)-(3) in respect of the disclosure to Fusion. While it might be in some cases appropriate to disapply those provisions, here, while the defendant was not subject to an absolute duty of accuracy, it was not inconsistent to apply the fourth principle to require the defendant to take reasonable steps to ensure data obtained from third parties were accurate.

3.  The national security exemption in s.28(1) can disapply any of the provisions of the data protection principles if “required for the purposes of safeguarding national security”. Warby J held that “required” imposed a more exacting test than “necessary”, limiting the exemption to cases judged indispensable to the safety and well-being of the UK. Applying that test to each of the defendant’s four (non-Fusion) disclosures of Memorandum 112 in autumn 2016, the Judge concluded that the claimants’ personal data was exempt only from “the Notice Requirements” accompanying the first data protection principle: the disclosures still needed to be lawful under that principle (and satisfy a condition in Schedule 2 and/or Schedule 3), and meet the accuracy requirement imposed by the fourth principle. Warby J also signalled that his conclusions would have been the same if a less demanding “reasonably necessary” test had been applied.

4. (a) Warby J’s findings on issues (2) and (3) above meant that the production and delivery to Fusion of Memorandum 112, and the defendant’s four other disclosures of the document, were all exempt from the Notice Requirements. The Judge therefore rejected the claimants’ case that the defendant, by failing to notify them of Memorandum 112, or enable them to comment on its accuracy, had breached those requirements, and thus contravened the first data protection principle’s requirements of fairness.

(b) The Judge also rejected the submission that the defendant’s processing did not comply with any of the conditions in Schedules 2 or 3, and was therefore in breach of the first principle. The defendant’s provision of the memorandum to Fusion was reasonably necessary for its legitimate interest of fulfilling its contractual duties to the latter, while the related interests of Fusion, Perkins Coie and the Ultimate Client were also legitimate. The interference with the claimants’ own legitimate interests, and their Article 8 rights, were limited and proportionate. The relevant processing therefore had a lawful basis in condition 6(1) of Schedule 2, while the factors triggering the application of the legal purposes exemption meant that it also satisfied conditions 6(b) and (c) of Schedule 3. Regarding the other disclosures, Warby J accepted the defendant’s submission that they were reasonably necessary for the exercise of each institution or body’s enactment functions, and thus satisfied conditions 5(b) of Schedule 2 and 7(b) of Schedule 3.

5. (a) Applying well-established defamation law principles, Warby J rejected the defendant’s submission that two of the propositions in Memorandum 112 were expressions of opinion, and therefore fell outside the DPA’s “supplementary definition” of inaccuracy at s.70(2) (“incorrect or misleading as to any matter of fact”). He held that all five propositions were factual in nature, and went on to find, on the limited evidence available, that the claimants had proved that each of them was inaccurate or misleading.

(b) The defendant also sought to rely on paragraph 7 of Schedule 1, Part II, which provides that the fourth data protection principle will not be contravened by reason of inaccuracy where the data controller has accurately recorded the information obtained from their source(s), and taken reasonable steps to ensure its accuracy. Warby J accepted that Memorandum 112 accurately recorded what Mr Steele had been told by the relevant source, and, in respect of four of the propositions, that Mr Steele had taken reasonable steps to ensure their accuracy. But given the gravity of the fourth proposition, that “the first and second claimants used Mr Oleg Govorun as a ‘driver’ and ‘bag carrier’ to deliver large amounts of illicit cash to President Putin when he was Deputy Mayor of St Petersburg”, the steps taken to verify it fell short of reasonable. The defendant’s disclosure of that allegation to Fusion and the four other recipients in autumn 2016 thus involved a contravention of the fourth data protection principle.

Remedies

The claimants sought an order pursuant to ss.14(1)-(3) for the blocking, erasure, destruction and rectification of their personal data, and for the defendant to inform those to whom it had disclosed Memorandum 12 of the inaccuracies; a declaration that the personal data were inaccurate; and compensation.

The remedies under ss.14(1)-(3) were, in principle, available in respect of all of the inaccurate or misleading data. Warby J was prepared to direct, if necessary, that the copy of Memorandum 112 held by the defendant for legal purposes be marked up or otherwise rectified so as to make any reader aware of the court’s judgment, the inaccurate or misleading data, and the formal order which was made. But given the limited disclosures by the defendant of the memorandum, and the fact that the recipients would surely become aware of his decision, he declined to grant any additional remedies under s.14.

Similarly, Warby J declined to make the declaration sought. Assuming, though without deciding, that such a remedy was available in principle, he felt that this was not necessary or appropriate: the judgment and resultant order were a sufficient statement of the position, and compensation would afford some real vindication for the first and second claimants.

In this regard, and pursuant to s.13, DPA, Messrs Aven and Fridman were entitled to compensation for any damage suffered by the defendant’s disclosure of the “illicit cash” allegation. “Damage” was not confined to material loss: compensation could be awarded for distress and interference with the data subject’s control over their data. The Judge also held, albeit cautiously, that where the inaccurate information was seriously defamatory, compensation could be awarded for reputational harm. Applying established defamation law principles on the assessment and mitigation of damages, as set out in Barron v Vines [2016] EWHC 1226 and Sloutsker v Romanova [2015] EWHC 2053 (QB), Warby J awarded the first and second claimants £18,000 each.

Comment

This is a rare example of a case which could have been brought (in theory) in defamation law, but was advanced solely in data protection law, to some (albeit limited) success. It is an important judgment on the similarities and differences between data protection and defamation law. The Judge reached into the latter for guidance in determining whether a statement was one of fact or opinion, and, having accepted that compensation could be awarded under the DPA for reputational harm, for the appropriate approach to damages.

Warby J’s forthcoming judgment in Gubarev & Anor v Orbis Business Intelligence Ltd & Anor, an action over the Steele Dossier in libel, should offer an interesting opportunity to compare and contrast the court’s approach under defamation and data protection law respectively.