“7. The first request is addressed to the ‘data protection officer’ of LIO. It states, materially: “Please supply us with any and all information you hold constituting personal data of which our client is the data subject. This should include, but is not limited to: • All profiles or entries on any service or databases operated by you, whether current or archived, containing or in any way referring to our client's personal data. Note that this is not limited to profiles or entries where our client is the main subject, but includes any in which our client is named (for example as being 'linked' to the profile subject) as this would constitute their personal data. • All correspondence pertaining to decisions concerning current or superseded profiles or entries on or in any way referring to our client. This encompasses but is not limited to any electronically-generated documentation concerning decisions to amend or delete any profiles or entries on or referring to our client. • All data pertaining to any internal interaction by leather inside out or its agents, in respect of our client's personal data. • All documents and communications logs referring to or in any way connected with our client Antony Savva (or Savva, as he is commonly known) between June 2019 and September 2020. In particular we require the supply of: • Antony Savva's contract of employment or 'zero hours contract''. • Antony Savva's beneficiary case file, including but not limited to any notes concerning disciplinary hearings, formal and informal complaints, including witness statements and investigation reports. • All communication logs from and between LIO staff members and its trustees referencing Antony Savva (or Savva, Savor any similar reference to him by which he is commonly known) and in connection to communication referencing Antony Savva, particularly concerning complaints and allegations, including emails and text messages (including social media application platforms). • All minutes of meetings relating to Antony Savva, in particular relating to his dismissal; to appoint a law firm to contact Antony Savva and the decision to report Antony Savva to the probation service and police. • All communication between Leather Inside Out and the St Giles Trust referencing Antony Savva. • All communication between Leather Inside Out and, or its trustees or employees and any outside organisation referencing Mr Antony Savva. • All communication between LIO and staff at HMP Prison and Probation service referencing and in connection to communication referencing Antony Savva. • All communication with accountants in regards to PAYE, National Insurance contributions and Pension contributions, that references Antony Savva. • Any communication with HMRC in connection with or that references Antony Savva. • Any pay slips referencing Antony Savva, including Antony Savva's P45 and P60.” 8. The subsequent SARs put the requests in slightly different terms, but seek materially similar information.” “Please supply us with any and all information you hold constituting personal data of which our client is the data subject. This should include, but is not limited to: • All profiles or entries on any service or databases operated by you, whether current or archived, containing or in any way referring to our client's personal data. Note that this is not limited to profiles or entries where our client is the main subject, but includes any in which our client is named (for example as being 'linked' to the profile subject) as this would constitute their personal data. • All correspondence pertaining to decisions concerning current or superseded profiles or entries on or in any way referring to our client. This encompasses but is not limited to any electronically-generated documentation concerning decisions to amend or delete any profiles or entries on or referring to our client. • All data pertaining to any internal interaction by leather inside out or its agents, in respect of our client's personal data. • All documents and communications logs referring to or in any way connected with our client Antony Savva (or Savva, as he is commonly known) between June 2019 and September 2020. In particular we require the supply of: • Antony Savva's contract of employment or 'zero hours contract''. • Antony Savva's beneficiary case file, including but not limited to any notes concerning disciplinary hearings, formal and informal complaints, including witness statements and investigation reports. • All communication logs from and between LIO staff members and its trustees referencing Antony Savva (or Savva, Savor any similar reference to him by which he is commonly known) and in connection to communication referencing Antony Savva, particularly concerning complaints and allegations, including emails and text messages (including social media application platforms). • All minutes of meetings relating to Antony Savva, in particular relating to his dismissal; to appoint a law firm to contact Antony Savva and the decision to report Antony Savva to the probation service and police. • All communication between Leather Inside Out and the St Giles Trust referencing Antony Savva. • All communication between Leather Inside Out and, or its trustees or employees and any outside organisation referencing Mr Antony Savva. • All communication between LIO and staff at HMP Prison and Probation service referencing and in connection to communication referencing Antony Savva. • All communication with accountants in regards to PAYE, National Insurance contributions and Pension contributions, that references Antony Savva. • Any communication with HMRC in connection with or that references Antony Savva. • Any pay slips referencing Antony Savva, including Antony Savva's P45 and P60.”
“1. I am an ex-employee of the respondents charity, Leather Inside Out (LIO). LIO provides employment and training to ex-offenders such as myself. The charity was founded and is managed by Ms Victoria Johns, who is also an ex-offender; convicted for money laundering and fraud. I was also a beneficiary of the charity because of my status as an ex-offender subject to a license, and I performed my duties for LIO’s subsidiary company S & K Camden Ltd. 2. During my employment I uncovered several malpractices, failed obligations and serious criminal conduct (invoice fraud and potentially money laundering). After I raised these concerns, I was dismissed and victimized. The respondents wrote to me through their legal representation and made false accusations against me (AS1). Their letter made implicit threats to file a false report against me, knowing and highlighting that I was serving the remainder of my sentence in the community subject to a written license. They demanded that I sign ‘prepared statements’ and to never repeat my allegation of money laundering and fraud. 3. When I refused to comply the respondents indeed filed a false report to the probation service to ensure that my license to remain in the community was revoked…/… 6. Victoria Johns’ shadow controls the charity which is illegal. She claims to take directions from the Trustees, Anat McKenzie and Nicole Riedweg, who are legally responsible for the charity and any important decisions that the charity takes. This would invariably include the decision to file a report to the probation service because of the ‘safeguarding’ implications arising from its consequence.”
“8. The first sentence of paragraph 3 is admitted, save that it is denied the report to the Probation Service was a false one. The Claimant is required to prove the matters set out in the second sentence of paragraph 3, which are outside of the Defendants’ knowledge. 9. Paragraph 4 is admitted, save that it is denied that a false report was filed or that the Claimant was entitled to such information under the DPA 2018…/… 11. Paragraph 6 is denied to the extent that it is alleged that Victoria Johns has acted illegally in the manner pleaded. The matters pleaded are in any event irrelevant to these proceedings…/… 16. Paragraph 11 is denied. A report was made to the north London branch of the Community Rehabilitation Company (CRC) on behalf of First Defendant in December 2019 and two referrals were made to the Metropolitan police. The processing of the Claimant’s personal data for these purposes was related to the prevention or detection of crime and/or the apprehension or prosecution of offenders.”
“I described my experience of matters relevant to the Application [to Forsters LLP]” and “…I am advised by my lawyers that I am not a controller of this personal data (in any legal sense)…”
“Chapter I General Provisions Article 4 (Definitions) Article 4 (Definitions) 4(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data … 4(8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; …/… Chapter III Rights of the data subject Section 2 Information and access to personal data Article 15 (Right of access by the data subject) 15(1) The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;…”
“(2) The court may strike out a statement of case if it appears to the court — (a) that the statement of case discloses no reasonable grounds for bringing or defending the claim;” (a) that the statement of case discloses no reasonable grounds for bringing or defending the claim;”
“24.3 The court may give summary judgment against a claimant or defendant on the whole of a claim or on an issue if— (a) it considers that the party has no real prospect of succeeding on the claim, defence or issue; and (b) there is no other compelling reason why the case or issue should be disposed of at a trial.” (a) it considers that the party has no real prospect of succeeding on the claim, defence or issue; and (b) there is no other compelling reason why the case or issue should be disposed of at a trial.”
“As Ms Anderson QC rightly reminded me, the court must be careful before giving summary judgment on a claim. The correct approach on applications by defendants is, in my judgment, as follows: i) The court must consider whether the claimant has a “realistic” as opposed to a “fanciful” prospect of success: Swain v Hillman[2001] 2 All ER 91 ; ii) A “realistic” claim is one that carries some degree of conviction. This means a claim that is more than merely arguable: ED & F Man Liquid Products v Patel[2003] EWCA Civ 472 at [8]; iii) In reaching its conclusion the court must not conduct a “mini-trial”: Swain v Hillman; iv) This does not mean that the court must take at face value and without analysis everything that a claimant says in his statements before the court. In some cases it may be clear that there is no real substance in factual assertions made, particularly if contradicted by contemporaneous documents: ED & F Man Liquid Products v Patel at [10]; v) However, in reaching its conclusion the court must take into account not only the evidence actually placed before it on the application for summary judgment, but also the evidence that can reasonably be expected to be available at trial: Royal Brompton Hospital NHS Trust v Hammond (No 5)[2001] EWCA Civ 550 ; vi) Although a case may turn out at trial not to be really complicated, it does not follow that it should be decided without the fuller investigation into the facts at trial than is possible or permissible on summary judgment. Thus the court should hesitate about making a final decision without a trial, even where there is no obvious conflict of fact at the time of the application, where reasonable grounds exist for believing that a fuller investigation into the facts of the case would add to or alter the evidence available to a trial judge and so affect the outcome of the case: Doncaster Pharmaceuticals Group Ltd v Bolton Pharmaceutical Co 100 Ltd[2007] FSR 63 ; vii) On the other hand it is not uncommon for an application under Part 24 to give rise to a short point of law or construction and, if the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and that the parties have had an adequate opportunity to address it in argument, it should grasp the nettle and decide it. The reason is quite simple: if the respondent's case is bad in law, he will in truth have no real prospect of succeeding on his claim or successfully defending the claim against him, as the case may be. Similarly, if the applicant's case is bad in law, the sooner that is determined, the better. If it is possible to show by evidence that although material in the form of documents or oral evidence that would put the documents in another light is not currently before the court, such material is likely to exist and can be expected to be available at trial, it would be wrong to give summary judgment because there would be a real, as opposed to a fanciful, prospect of success. However, it is not enough simply to argue that the case should be allowed to go to trial because something may turn up which would have a bearing on the question of construction: ICI Chemicals & Polymers Ltd v TTE Training Ltd[2007] EWCA Civ 725 .”
“(a) It is only the CIO, the First Defendant, that is the data controller, to whom a SAR can be made, and against whom any obligation to respond arises. (b) There is no basis to contend that either of the Second or Fourth Defendants were acting as data controllers, in respect of any of the personal data sought. As above, the requests quite clearly relate to the course of the Claimant’s employment with a subsidiary of the First Defendant. Data gathered and processed in the course of that employment is at the direction and control of the CIO and not by the CEO or a trustee (save as agents of the CIO). (c) The Particulars of Claim does not set out any basis pursuant to whichit could be said that the Second or Fourth Defendant were data controllers.”
“(c) Insofar as the Second and Fourth Defendants were involved at all, they were acting as agents for the CIO, and the CIO is the data controller. The position is made clear by Mr Justice Richards in Southern Pacific Loans Ltd[2013] EWHC 2485 (Ch) (see the Statement of Case at §§17-18) (d) That is uncontroversial as a matter of law and, accordingly, the court should grant strike out (or summary judgment) on the claims against the Second and Fourth Defendant. The Court should, of its own motion, make the same Order in respect of the Third Defendant.”
“10. The defendants cite paragraph 17 of Southern Pacific Loans Limited[2013] EWHC 2485 (Ch) in paragraph 3(c) of their skeleton argument and present a hypothetical scenario suggesting that SARs should only ever be directed to the company, not its directors. In doing so, they suggest this proves that only a company or charity can be a controller. 11. However, this only supports the notion that companies are the ‘primary’ data controllers. The law is clear: individuals responsible for processing and determining how data is processed also become controllers, as referenced in 4 (a)-(d) above. Again arguing otherwise renders these provisions meaningless. 12. In WM Morrisons Supermarkets plc v Various Claimants[2020] UKSC 12 (at paragraph 55), the Supreme Court explicitly identified an employee as a data controller. It said - “since the DPA neither expressly nor impliedly indicates otherwise, the principle of vicarious liability applies to the breach of the obligations which it imposes, and to the breach of obligations arising at common law or in equity, committed by an employeewho is a data controller in the course of his employment, as explained in Dubai Aluminium. 13. The defendants referenced paragraph 19 of Southern Pacific Loans Limited during the previous hearing to make a similar argument. However, their point is contradicted by the very paragraph they cite. It merely clarifies that natural persons and senior officers do not automatically become controllers based solely on their senior roles - it does not suggest they cannot become controllers…”
“Given the definition of “data controller” as a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed, it might be argued that the directors as persons who in fact determine the purposes for which any personal data are to be processed on behalf of their company are within the definition.”