Holyoake v Candy & Anor [2017] EWHC 52 (QB)

Case No HQ16X02638

[2017] EWHC 52 (QB)

IN THE HIGH COURT OF JUSTICE

QUEEN'S BENCH DIVISION

Venue Royal Courts of Justice, Strand, London, WC2A 2LL

Date 24/01/2017

Before

MR JUSTICE WARBY

Between

Mark Alan HolyoakeClaimant

(1) Nicholas Anthony Christopher CandyDefendants

(2) CPC Group LimitedDefendant

Anya Proops QC and Robin Hopkins (instructed by gunnercooke llp) for Claimant

Timothy Pitt-Payne QC and Christopher Knight (instructed by Grosvenor Law) for Defendant

Hearing Hearing dates: 12-14 December 2016

Judgment

Mr Justice Warby :

Introduction

[1]This is a case about the right of an individual to have access to personal data relating to that individual which is held by others. The right, generally known as the right to “subject access”, was first brought into domestic law by the Data Protection Act 1998 (“DPA”). The main operative provisions are contained in s 7 of the DPA. This requires an individual seeking subject access to make a written subject access request or SAR. Section 7 and certain provisions of Schedule 1 of the DPA are known as the “subject information provisions”. By s 37 and Schedule 7 paragraph 10 material protected by legal professional privilege is exempt from the subject information provisions (“the LPP Exemption”).

[2]This has been the trial of a Part 8 claim in which the claimant (“Mr Holyoake”) seeks orders to enforce his rights of subject access under s 7 DPA against the defendants, Nick Candy (“Mr Candy”) and a Guernsey-registered company (“CPC”). Mr Holyoake first made SARs on 15 April 2016. The SARs were later narrowed. The defendants responded to the narrowed SARs on 14 November 2016. They disclosed a limited amount of information. In relation to some of the information he identified as being under his control Mr Candy relied on the LPP Exemption. The trial has been principally concerned with the adequacy of the defendants’ responses.

[3]The main issues are:(1) Whether the defendants carried out adequate searches in response to the narrowed SARs (“the Search Issue”);

(2) The validity of Mr Candy’s reliance on the LPP Exemption (“the LPP Issue”).

[4]The arguments on the LPP Issue raise two main questions. The first is whether any LPP is abrogated by the rule against reliance on privilege to cloak iniquity. I shall call this the Iniquity Issue. The second question I shall call the Inspection Issue. It is whether the court should inspect the relevant data in order to test the validity of Mr Candy’s reliance on the LPP Exemption. It is common ground that s 15(2) of the DPA confers a power to inspect. The issue is whether that power should be exercised.

[5]I have also heard argument on the question of whether the SARs were and remained invalid on the grounds that they have been made and pursued for collateral and improper motives and therefore represent an abuse of the right of subject access (“the Abuse Issue”). That was an objection taken by the defendants in correspondence at the outset, and relied on in their evidence. They have not abandoned it. But it is not a ground on which they resisted the claim at the trial. That is clearly a matter that may be relevant to costs. So also might be the propriety of the defendants’ conduct in running this “defence”. But those issues have featured in argument at the trial for other reasons. Among those reasons is a contention by Mr Holyoake that the defendants’ reliance on abuse of process is itself abusive, and by that token casts doubt on the reliability of their stance, and their evidence, on the two main issues that I have identified above. Factual background

[6]Mr Holyoake and Mr Candy met at Reading University in the 1990s, when they became friends. Some twenty years later, both were involved in the property development business. In 2011 they had business dealings in connection with a property at Grosvenor Gardens House, SW1 (“the Property”). Those dealings have led to a serious falling out and litigation in the High Court, Chancery Division (“the Chancery Proceedings”), which is presently awaiting a 7-week trial commencing in February 2017. The Chancery Proceedings

[7]A brief and general summary of the issues in the Chancery Proceedings will be enough for present purposes. In 2011 Mr Holyoake’s company Hotblack Holdings Limited (“Hotblack”) was seeking to purchase the Property. It was in need of funds for that purpose. Mr Holyoake approached Mr Candy, seeking a loan of £12m. This led to a loan agreement dated 12 October 2011 between Mr Holyoake and CPC, a property company connected to Mr Candy’s brother Christian (“the Loan Agreement”). This involved an unsecured loan of £12m, advanced by CPC to Mr Holyoake personally. At the same time certain declarations of trust were made by Mr Holyoake. Further related agreements were made thereafter. Hotblack completed the purchase of the Property later in 2011.

[8]Subsequently, it was alleged against Mr Holyoake that one of the declarations of trust contained a false statement; that he was thereby in breach of warranties given under the Loan Agreement; and that net asset statements provided by him pursuant to the Loan Agreement were non-compliant with the requirements of that Agreement. On this basis CPC took various steps which, on its case, represented lawful enforcement measures to protect its legal rights. The case for Mr Holyoake and Hotblack is very different. In the Chancery Proceedings, which were issued on 12 August 2015, Mr Holyoake and Hotblack sue Mr Candy, Christian Candy, CPC and three other directors of CPC (“the Chancery Defendants”). The three directors include Steven Miles Smith (“Mr Smith”) and Timothy James Dean (“Mr Dean”). The claims are for unlawful means conspiracy, extortion, fraudulent misrepresentation and a variety of other causes of action. The Chancery Defendants vigorously deny the claims. Among their defences is reliance on a settlement agreement made by deed on 15 October 2013 (“the Settlement Deed”). The claims advanced in the Chancery Proceedings were first intimated in December 2014. The Chancery Defendants are represented by Gowling WLG. The Injunction Proceedings

[9]A separate High Court claim has been brought, in the Queen’s Bench Division, by Mr Candy against Mr Holyoake, his wife, and a Mr David Wells (“Mr Wells”). Mr Wells is Mr Holyoake’s Financial Director. This claim, issued on 16 December 2015, seeks injunctions against the defendants to restrain the disclosure of certain information recorded by Mrs Holyoake, which is alleged to be private and confidential to Mr Candy. The Injunction Proceedings are presently stayed. The claimant in the Injunction Proceedings, Mr Candy, is represented by Schlomo Rechtshaffen of Rechtshaffen Law (“Mr Rechtshaffen”). The SARs and this action

[10]The SARs which Mr Holyoake made to Mr Candy and CPC on 15 April 2016 stated that Mr Holyoake was “interested in obtaining all of the information to which I am entitled under section 7 of the Act in relation to my dealings and communications with you between the period from 2011 to the date of this request.” But the SARs acknowledged that both recipients had disclosure obligations in the Chancery Proceedings, in which standard disclosure was due to be given on 1 July 2016. Each of the SARs said “This request is not intended to overlap significantly with the same”, and that its scope was therefore limited. By letter of 6 May 2016 Mr Holyoake reiterated his willingness to consider proposals to minimise any duplication of disclosure.

[11]The SAR addressed to Mr Candy (“the Candy SAR”) illustrates the scope of the original requests. It sought data under the following five headings:(1) all personal data of mine relating to my personal assets and financial affairs in any format and media including, but not limited to, CCTV footage, sound recordings, correspondence and email communications;

(2) all personal data of mine created pursuant and/or in relation to the production of a net statement of my personal assets to CPC by Mr David Wells on my behalf on 20 October 2011 and any subsequent statements about and additional disclosures of my personal assets (ie, any file notes, emails or other information containing my personal data which relates to my personal net asset statement);

(3) all communications, documents or other information containing my personal data which are held by you and which have passed to or from any employee, agent or other representative of USG Security Limited (“USG”);

(4) all communications, documents or other information containing my personal data which are held by you and which have passed to or from any employee, agent or other representative of DPM Facilities Limited (“DPM”);

(5) all communications, documents or other information containing my personal data which are held by you and which have passed to or from any third party (other than USG or DPM) for the purposes of an investigation or surveillance of me or any of my family or colleagues.

[12]The Candy SAR went on to make clear “for the avoidance of doubt” that parts (3), (4) and (5) of the requests were to include communications held by Mr Candy and containing Mr Holyoake’s personal data which had passed to or from Mr Candy, Christian Candy, Mr Smith, Mr Dean and 11 other named individuals.

[13]The SAR addressed to CPC (“the CPC SAR”) also contained 5 categories and was in similar terms to the Candy SAR. Categories(1) and

(2) were identical to the corresponding categories in the Candy SAR. The other categories were:

(3) all communications, documents or other information containing my personal data and passing between any director, employee or agent of CPC and any employee, agent or other representative of [USG]

(4) all communications, documents or other information containing my personal data and passing between any director, employee or agent of CPC and any employee, agent or other representative of [DPM]; and

(5) all communications, documents or other information containing my personal data and passing between any director, employee or agent of CPC and any third party (other than USG or DPM) for the purposes of an investigation or surveillance of me or any of my family or colleagues.

[14]Again, it was made clear that the SAR embraced communications to and from Mr Candy, his brother, and the 13 other named individuals.

[15]The references in categories(1) and

(2) to Mr Holyoake’s personal assets are easily explained, given the nature of the issues in the Chancery Proceedings.

[16]The requests in category (4) (“the DPM Requests”) are explained in the evidence of Mr Holyoake and his solicitor, Mr Savani of gunnercooke llp. They state that in November 2015 Mr Holyoake received some documents from an unidentified third party (the “November Documents”) which indicated that he had been subject to close surveillance and investigation at the behest of the defendants in 2013 and 2014. It is Mr Holyoake’s position that the November Documents show that in 2013 the defendants commissioned and received from DPM an “Investigation and Surveillance Report” on Mr Holyoake. He and Mr Savani devoted substantial parts of their evidence in this action to the November Documents. However, the November Documents have largely dropped out of the picture for present purposes. That is because since they were raised with the Chancery Defendants in February 2016, their authenticity has become a hotly contested point of dispute. It is accepted on behalf of Mr Holyoake that the dispute over authenticity cannot be resolved in this Part 8 claim. He therefore cannot rely, in support of the remedies he presently seeks, on the November Documents or any inferences that might be drawn from them if genuine.

[17]The requests in category (3) (“the USG Requests”) are also explained in the evidence filed on behalf of Mr Holyoake. Mr Holyoake says that the SARs make reference to USG (said to be “a military-based ‘security consultancy and security services provider’”):

“because I am reliably informed that USG has been engaged by the Defendants to investigate and surveil my family, my colleagues and I” (3rd witness statement para 17). The evidence does not say who “reliably informed”

Mr Holyoake. He says he is unwilling to disclose “the specific source” of the information, because it is linked with security arrangements for his personal security and that of his family “and could have consequences for the safety of my source if revealed”. These concerns are not further explained. Mr Holyoake does not say when he received the information. Evidence as to that comes from Mr Savani. He says (3rd witness statement paragraph 24) that Mr Holyoake has told him that he received this information “in around February 2016” and (5th witness statement paragraph 13) that he is instructed that Mr Holyoake has been concerned about USG’s involvement “since at least late 2015”.

[18]The requests in category (5) of the SARs, which I shall call the “Third Party Requests”, appear to have been based on an inference that, if the defendants had used DPM and/or USG to carry out surveillance and/or investigation of Mr Holyoake then they might be using or have used other organisations or individuals for the same or similar purposes.

[19]Section 7(8) of the DPA requires a data controller to comply with a SAR promptly and in any event within 40 days of receipt. It was Grosvenor Law who responded to the SARs on behalf of Mr Candy and CPC. They did so by letters dated 24 May 2016. The primary response was summarised in this way:

“... we do not consider that the SAR has been made for a reason which conforms with the purpose of the DPA. We consider that the SAR is an abuse of the rights conferred by section 7 of the DPA and that – if an application were made to the Court under DPA section 7(9) – the Court would refuse to grant any relief. As a result [Mr Candy and CPC] do not propose to comply with your request. .... the SAR has been made for one reason and one reason only, which is to seek early disclosure of evidence to support your clients’ claims in the litigation.”

[20]It was also said that even if the SARs were a proper use of the rights conferred by s 7 it would be disproportionate to carry out the extensive searches requested, and that substantial amounts of information would need to be withheld pursuant to the exemption for third party personal data (s7(4)-(6)) and “the various exemptions set out in DPA Part IV”. The latter include the LPP Exemption, though this was not mentioned.

[21]Following further correspondence, in which gunnercooke llp represented the interests of Mr Holyoake, this claim was issued on 25 July 2016.

[22]On 13 August 2016 disclosure was given in the Chancery Proceedings, in relation to documents within the period 1 September 2010 to 1 June 2014. The Chancery Defendants’ disclosure included some emails from 2012 which have come to be known as the “Knuckey Emails”. Inspection of the Knuckey Emails was not given until September 2016, but it is convenient to set out their contents at this point in the history. There are five of them. The fifth is of no materiality. The first four show that in early April 2012 Mr Smith on behalf of CPC commissioned Clifford Knuckey to carry out a criminal record check on Mr Holyoake and Mr Wells, and that Mr Knuckey did so, with negative results:-(1) “From: Steven Smith Sent: 02 April 2012 11:36 To: Cliff Knuckey Subject: Criminal checks Cliff Further to our conversation I set out below the two individuals that we need Criminal checks on. 1. Mark Alan Holyoake [details of date of birth and residential addresses followed] 2. David Wells [ditto] If you need anything else let me know SMS CPC Group Limited”

(2) “From: Cliff Knuckey Sent: 04 April 2012 10:38 To: Steven Smith Subject: RE: Criminal checks Steven, I have checked and neither individual has any criminal convictions for which they have received a term of imprisonment of in excess of 2 years and 6 months. If either man has received a prison sentence of less than 2 years 6 months, under the Rehabilitation of Offenders Act, such convictions are treated as ‘spent’ after ten years. Any fines, probation, etc, are treated as ‘spent’ after 5 years. We cannot get details of ‘spent’ convictions. Kind regards Cliff Knuckey Chief Executive Hermes Forensic Solutions Ltd”

(3) At 10.47 on 4 April 2012 Mr Smith forwarded this response to Chris Candy and Tim Dean, with copy to Mr Candy.

(4) Chris Candy replied immediately as follows:

“If he was in jail in the last 10 years, for under 2 years, it would have shown up, correct?”

No reply to that question has been disclosed.

[23]On 24 August 2016 Mr Candy and CPC filed their evidence in response to the present claim. It was contained in the first witness statement of Mr Morrison of Grosvenor Law. The defendants’ response to the claim, as set out in this statement, was that it should be dismissed for four reasons:(1) the SARs were an abuse of the rights conferred by s 7 DPA because their predominant purpose was or is “to assist [Mr Holyoake] to obtain early and/or additional disclosure in relation to the [Chancery Proceedings]”;

(2) the inference is that Mr Holyoake made the SARs to obtain documents he would obtain through the disclosure process, but without the restrictions on collateral use imposed by CPR 31.22; and/or

(3) the searches required would be of “astonishing scale and scope”, and disproportionate; and/or

(4) it was inevitable that a significant amount of the personal information held by the defendants would be subject to litigation privilege in the context of the Chancery Proceedings.

[24]Much of Mr Morrison’s statement was devoted to setting out the factual basis for the first three of these propositions. This included, in particular, an explanation of the defendants’ case as to overlap between the disclosure to be given in the Chancery Proceedings and the data requested by the SARs. In view of later developments in the case it is unnecessary to summarise that evidence here. It is relevant, however, to refer to what Mr Morrison said about the DPM, USG, and Third Party Requests. At paragraphs 54 and 55 he said this:

“54. It will be noted that the unexplained assertion in those letters as regards the alleged surveillance or investigation of him or those close to him is not expanded upon by Mr Shilpen Savani of gunnercooke, or by Mr Holyoake, in their witness statements in support of the claim. Extraordinarily, neither statement even mentions the matter. 55. Outside any investigation relating to legal proceedings, which would in any event be exempt from disclosure in response to the SARs under paragraph 10 of Schedule 7 to the DPA 1998, the Defendants have confirmed to me that neither USG nor DPM or any other third party have been instructed by them to investigate or carry out surveillance of Mr Holyoake, his family or colleagues.”

The distinction drawn in paragraph 55 between investigation and surveillance is to be noted.

[25]In a later section of his statement Mr Morrison dealt with “The Likely Availability of the Privilege Exemption”. He pointed out that disclosure in the Chancery Proceedings would cover the period up to 1 June 2014. He said that any data generated in the later period covered by the SARs, namely 2 June 2014 to 15 April 2016, “would be most likely to have been generated in the course of defending the Chancery Proceedings, or their earlier proposed variant, and would be covered by legal professional privilege.” He said that the reason the disclosure period in the Chancery Proceedings had been settled on was that it was the period in which the Chancery Defendants would have been generating documents relating to Mr Holyoake, his financial information and/or his net asset position. By 1 June 2014 some eight months had passed since the Settlement Deed and, it was said, the Chancery Defendants would not then have had any particular reason to consider or discuss such matters, other than in the context of seeking and obtaining legal advice on the claims.

[26]On 21 September 2016 Mr Holyoake served his reply evidence in this action, consisting of second statements from him and Mr Savani. The evidence made clear that in the light of Mr Morrison’s evidence, Mr Holyoake was “... now content to pursue only parts 3 to 5 of the Subject Access Requests in these proceedings.” These were said to be “unarguably distinct” and to deal with “a specific theme”. Following that change of approach matters progressed relatively swiftly.

[27]In October 2016 the Chancery Defendants agreed to the use of the Knuckey Emails in these proceedings. On 25 October the defendants offered to provide a substantive response to the narrowed SARs, without prejudice to their position that the SARs were abusive for the reasons given earlier. On 4 November 2016 I granted an application for an early hearing of this claim. By letters from dated 14 November 2016 Mr Candy and CPC provided their substantive responses to the narrowed SARs. A covering letter of the same date from Grosvenor Law explained the responses.(1) Mr Candy’s response to the narrowed SARs is as follows:

a. In relation to the USG Request, some of Mr. Holyoake’s data exists within this category. However, such data is exempt from s 7 by virtue of the LPP Exemption as the personal data processed was the subject of litigation privilege.

b. In relation to the DPM Request, no such data was processed by Nick Candy at the time of the request.

c. In relation to the Third Party Request, no data was processed by Mr Candy at the time of the request which amounted to personal data of Mr Holyoake which had been passed between him and any third party for the purposes of surveillance of Mr. Holyoake. In respect of data which amounted to personal data of Mr Holyoake which had passed between CPC and any third party for the purposes of investigations of Mr Holyoake Mr Candy disclosed the four Knuckey Emails set out above.

(2) CPC’s response is this: a. In relation to the USG request, no such data was processed by CPC at the time of the request. b. Similarly, in relation to the DPM request: no such data was processed by CPC at the time of the request. c. In relation to the Third Party Request, CPC’s response was materially identical to that of Mr Candy: it disclosed the four Knuckey Emails.

[28]These responses are further explained in evidence from Mr Morrison (3rd statement), Michelle Quinn of Grosvenor Law, and Mr Rechtshaffen. Ms Quinn explains the nature and extent of the searches undertaken. Mr Morrison explains the basis for the claim to the LPP Exemption. Mr Morrison sets out the principles he has applied in determining whether that exemption applies. He says that he is “satisfied, based upon my own knowledge of the Chancery and Injunction Proceedings along with instructions sought and obtained from the Defendants and their legal representatives in those proceedings, that the data within the scope of the Amended SARs is litigation privileged.” Later, he makes clear that the basis for the exemption is “litigation privilege arising out of the Injunction Proceedings.” Mr Rechtshaffen supports him in this.

[29]This represents what Mr Candy and CPC describe as voluntary compliance with the SARs, provided without prejudice to their view that the SARs were not valid as a matter of law. Mr Holyoake stands by his position that the SARs are and were valid. The responses are not accepted by Mr Holyoake. On 16 November 2016 gunnercooke wrote a letter raising concerns. These concerns have been amplified and supported by a fifth witness statement from Mr Savani, made on 1 December 2016 and a statement of Neil Davies, a solicitor, of 2 December 2016. The defendants have responded via statements of Mr Morrison (his fourth) and Christopher Daw QC, dated 7 December 2016. The Legal Context

[30]The DPA gives effect in domestic law to Directive 95/46/EC (“the Directive”). The right of subject access is provided for in Article 12 of the Directive and implemented in English law via ss 7 and 8 of the DPA. Section 7 provides as follows:

“(1) Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled – (a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller, (b) if that is the case, to be given by the data controller a description of – (i) the personal data of which that individual is the data subject, (ii) the purposes for which they are being or are to be processed, and (iii) the recipients or classes of recipients to whom they are or may be disclosed. (c) to have communicated to him in an intelligible form – (i) the information constituting any personal data of which that individual is the data subject, and (ii) any information available to the data controller as to the source of those data …” (a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller, (b) if that is the case, to be given by the data controller a description of – (i) the personal data of which that individual is the data subject, (ii) the purposes for which they are being or are to be processed, and (iii) the recipients or classes of recipients to whom they are or may be disclosed. (c) to have communicated to him in an intelligible form – (i) the information constituting any personal data of which that individual is the data subject, and (ii) any information available to the data controller as to the source of those data …”

[31]Section 8(2) provides that “The obligation imposed by section 7(1)(c)(i) must be complied with by supplying the data subject with a copy of the information in permanent form unless – (a) the supply of such a copy is not possible or would involve disproportionate effort …”

[32]Article 13(1)(g) of the Directive permits Member States to restrict the scope of the subject access obligations, where such a restriction constitutes a necessary measure to safeguard the rights and freedoms of others. Part IV of the DPA provides for such exemptions. Some of the exemptions are contained in Schedule 7, which confers “miscellaneous exemptions”. Schedule 7 paragraph 10 contains the LPP Exemption:

“Personal data are exempt from the subject information provisions if the data consist of information in respect of which a claim to legal professional privilege …could be maintained in legal proceedings.”

[33]Section 7(9) of the DPA provides for a remedy:

“If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.”

[34]In order to decide whether a claim under s 7(9) should be upheld the court may inspect the information constituting the personal data in question. Section 15(2) reads, so far as relevant:

“For the purpose of determining any question whether an applicant under subsection (9) of section 7 is entitled to the information which he seeks (including any question whether any relevant data are exempt from that section by virtue of Part IV) a court may require the information constituting any data processed by or on behalf of the data controller … to be made available for its own inspection but shall not, pending the determination of that question in the applicant’s favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery … or otherwise.”

[35]Section 55 of the DPA creates criminal offences. It provides so far as relevant as follows:- “55.— Unlawful obtaining etc. of personal data.(1) A person must not knowingly or recklessly, without the consent of the data controller— (a) obtain or disclose personal data or the information contained in personal data, or (b) procure the disclosure to another person of the information contained in personal data.

(2) Subsection (1) does not apply to a person who shows— (a) that the obtaining, disclosing or procuring— (i) was necessary for the purpose of preventing or detecting crime, or (ii) was required or authorised by or under any enactment, by any rule of law or by the order of a court, (b) that he acted in the reasonable belief that he had in law the right to obtain or disclose the data or information or, as the case may be, to procure the disclosure of the information to the other person, (c) that he acted in the reasonable belief that he would have had the consent of the data controller if the data controller had known of the obtaining, disclosing or procuring and the circumstances of it, or (d) that in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest.

(3) A person who contravenes subsection (1) is guilty of an offence.” (a) obtain or disclose personal data or the information contained in personal data, or (b) procure the disclosure to another person of the information contained in personal data. (a) that the obtaining, disclosing or procuring— (i) was necessary for the purpose of preventing or detecting crime, or (ii) was required or authorised by or under any enactment, by any rule of law or by the order of a court, (b) that he acted in the reasonable belief that he had in law the right to obtain or disclose the data or information or, as the case may be, to procure the disclosure of the information to the other person, (c) that he acted in the reasonable belief that he would have had the consent of the data controller if the data controller had known of the obtaining, disclosing or procuring and the circumstances of it, or (d) that in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest. (3) A person who contravenes subsection (1) is guilty of an offence.” The Abuse Issue

[36]The defendants’ decision to answer the SARs means that this issue is now relevant only to costs. Nonetheless, Ms Proops has devoted a significant part of her submissions to the issue. She points out that the defendants have not abandoned what was their primary defence. She identifies this as one of three good reasons why Mr Holyoake could not be expected to abandon the claim after 14 November 2016. I am not sure I see the force of that argument. It is said that if the defendants’ reliance on the abuse argument was ill-conceived then Mr Holyoake may be entitled to compensation for the failure to comply with the s 7 obligation. But no compensatable harm to Mr Holyoake has so far been identified, and the present claim remains confined to one made under s 7(9).

[37]Another problem that confronts Ms Proops is that the relevant law is in a state of uncertainty at present. In obiter passages in Guriev v Community Safety Development (UK) Limited

[2016] EWHC 643

[67-72] I reviewed the authorities as they then stood. In summary, there were two main views. According to one view, the subject access regime is “purpose blind” and there is nothing wrong with exploiting subject access rights to obtain early disclosure of documents for the purposes of present or contemplated legal proceedings: see, eg, Dunn v Durham County Council

[2012] EWCA Civ 1654

[2013] 1 WLR 1305

[16] (Maurice Kay LJ). The other view was that subject access rights are not conferred in order to facilitate such disclosure, and that reliance on s 7 for such a purpose is or may be an abuse: see, eg, Durant v. Financial Services Authority

[2003] EWCA Civ 176

[2004] FSR 28

[27] (Auld LJ), Dawson-Damerv Taylor-Wessing LLP

[2015] EWHC 2366 (Ch)

[2016] 1 WLR 28

[38] (HHJ Behrens). The Court of Appeal has recently heard appeals touching on the issue: in Dawson-Damer itself and in Deer v University of Oxford and Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd. Judgment on these appeals has been reserved.

[38]Ms Proops submits however that the unresolved state of the law need not concern me, because it is clear on the evidence that her client’s SARs were in fact made for a purpose which is legitimate on any view of the law, namely to vindicate privacy rights. She invites me to find as a fact that this was Mr Holyoake’s purpose.

[39]I was initially attracted by Mr Pitt-Payne’s argument that I should defer consideration of this issue to the stage of argument on costs, but the matter has been fully argued and I have concluded that it is best to make findings of fact at this stage.

[40]I am satisfied, and find as a fact, that when he made the SARs Mr Holyoake wished to find out whether he had been placed or kept under surveillance or investigation by or on behalf of the defendants and, if so, to learn details of what had been done. Obtaining such data was a purpose of the SARs for data in categories (3), (4) and (5). To that extent, Mr Holyoake’s purpose was to exercise and to vindicate privacy rights. But beyond that, I am not sure the matter is quite as simple or straightforward as Ms Proops suggests. That is for two main reasons.

[41]First, the SARs as they originally stood were not limited in that way, and did in my view involve or at least risk a substantial overlap with disclosure in the Chancery Proceedings. Data in categories(1) and

(2) would certainly appear to be disclosable in that context in any event. So it may be that there is or was room for a finding that the SARs were abusive to that extent.

[42]Secondly, it is not clear to me that the reduced SARs are on any possible view of the law immune from attack as abusive. I find as a fact that Mr Holyoake had it in mind from the outset that if subject access revealed that he had been kept under surveillance or investigation, he might well seek to rely on that fact in the Chancery Proceedings.

[43]In his first statement, dated 22 July 2016, Mr Holyoake said that the SARs were “not made … with a view to obtaining any additional disclosures which may assist me in the [Chancery Proceedings] … [or] to pursue other legal proceedings unconnected with my data protection and privacy rights”. On 26 October 2016, however, he said:

“I do not deny that I may in due course wish to deploy the information or data disclosed to me in these proceedings … in [the Chancery Proceedings] as is my right. However, this is only because I believe that: (a) they will show conclusively that I have been subject to grossly unlawful and indeed criminal interferences with my right to privacy and (b) that such evidential matters are highly relevant to my claims in the Chancery Proceedings, including my claim that I have been the victim of an unlawful means conspiracy and my new claims relating to the breach of my privacy and data protection rights.”

[44]By the time this later statement was made draft amendments to the Particulars of Claim in the Chancery Proceedings had been prepared. The amendments were evidently prepared when Mr Candy and CPC were maintaining their primary position, that the SARs were an abuse, and before they changed their approach and offered a substantive response. The draft amendments propose the addition of claims to the following effect:(1) that the unlawful means employed in the conspiracy already alleged in the Chancery Proceedings included “unlawful processing of [Mr Holyoake’s] personal data .. misuse of [his] private information contrary to the common law and the criminal obtaining of personal data or information in personal data relating to [Mr Holyoake and Mr Wells] … contrary to s 55 DPA (such conduct amounting to an offence under section 55(3) therein)”;

(2) further and alternatively, relief under ss 13 and 14 of the DPA and/or damages at common law for the misuse of Mr Holyoake’s private information.

[45]The factual allegations added in support of these intended claims include the following:-(1) Reliance on the Knuckey Emails (paragraph 116A ff). These are said to show that in 2012 Mr Smith, acting on his own behalf and other “conspirators”, instructed Mr Knuckey to obtain and did obtain criminal record information which he then passed on to Mr Candy, Christian Candy, and Mr Dean.

(2) Allegations of covert investigation and surveillance of Mr Holyoake by the Chancery Defendants (paragraphs 150A – 150D). Reliance is placed on the November Documents in support of allegations that DPM were engaged to carry out such activities between August and October 2013. It is further alleged that one Vladimir Tarasov was engaged for similar purposes in 2014.

(3) There is also a complaint (at paragraph 150E) that the “unlawful failure” of Mr Candy and CPC to provide Mr Holyoake with the data requested by his SARs has “necessarily substantially inhibited his ability to plead fully his allegations of breach of the DPA and misuse of his private information.”

[46]I have concluded that the best interpretation of the evidence, read as a whole, is that Mr Holyoake foresaw and intended from the outset that if his SARs led to confirmation and/or revelations that he had been investigated or surveilled by the defendants he might sue them for infringing his privacy and/or data protection rights. He had in mind that such claims might be joined with the claims already made in the Chancery Proceedings, which would obviously make sense. It is less obvious that Mr Holyoake foresaw at the outset that infringement of privacy by surveillance and/or investigation might be relied on as unlawful means to support his conspiracy claims. But I think it likely that he saw that as a possibility.

[47]On these findings, one purpose of the SARs was to obtain disclosures which might be deployed in the Chancery Proceedings. I would not conclude that it was the dominant purpose but in my view it was a significant purpose. Whether that means that the SARS were or may have been an abuse of the s 7 right is an issue on which it is not necessary to rule pending the judgments of the Court of Appeal in the cases to which I have referred. It is better not to rule on the issue before those judgments are available. The Search Issue

[48]Plainly, a data controller confronted by a SAR will need to carry out a search to ascertain whether it is processing personal data relating to the data subject and, if so, to identify the data and determine whether they are to any extent exempt from subject access. As Mr Pitt-Payne puts it, an obligation to search is by necessary implication an aspect of the data controller’s duty under DPA s 7(1). As is common ground, however, this implied obligation is not absolute. It is not a duty to find all personal data. A data controller’s implied obligation to carry out a search is limited to what is reasonable and proportionate: see e.g. Ezsias v Welsh Ministers

[2007] All ER (D) 65

, [96-97]. This limitation may be viewed as deriving from DPA s 8(2)(a) (see Dawson-Damer [36]) or as a limit imposed by the principle of proportionality, a fundamental principle of EU law which must be applied in construing national legislation which implements the Directive: Criminal proceedings against Lindqvist (

Case C-101/01

)

[2004] QB 1014

[87-89].

[49]The evidence of Ms Quinn provides a very detailed account of the processes undertaken. It is unnecessary to set this out. It is worth mentioning some aspects, however. The work involved the review of over 17,000 individual documents and included the following steps. Searches were carried out as part of the disclosure exercise in the Chancery Proceedings. These searches were outsourced to an organisation called Altlaw Litigation Support (“Altlaw”). Altlaw collected electronic documents created, sent, stored or received by Mr Candy, Christian Candy, Mr Smith, Mr Dean, and three other individuals (known as the “Relevant Custodians”). The documents were collected from(i) servers belonging to CPC and another company, Candy & Candy Ltd, from which Mr Candy sent and received emails at the material times;

(ii) PCs and laptops of Relevant Custodians and

(iii) mobile phones and other handheld devices still in the Relevant Custodians’ possession, which were used at the relevant times. The collection exercise was carried out in and between March and July 2016. Servers belonging to Candy Capital were also searched. Altlaw also retained a US agent to collect and/or image documents created, sent, stored or received by Mr Candy on or from his personal computer in Los Angeles. Searches were carried out using lists of key words, which were then expanded in the light of the evidence filed by Mr Holyoake in this action. The work generated time charges in excess of £37,000 (leaving aside the charges of the service providers).

[50]As Mr Holyoake concedes, these are “ostensibly impressively thorough” efforts. But Mr Holyoake alleges two flaws in the searches. One “major and inexcusable deficiency” is said to be that “it does not appear from the evidence that [Grosvenor Law] asked the defendants in terms whether they commissioned any investigations/surveillance of Mr Holyoake”. Secondly, Mr Holyoake complains that individuals do not seem to have been asked to search their private email accounts for information within the scope of the narrowed SARs. (There was a third criticism, that the abrupt conclusion to the Knuckey Emails implies the existence of more than has been disclosed; but that criticism has not been pursued). Failure to state that clients were questioned

[51]I am unimpressed by this complaint. The defendants themselves have made their position clear in their SAR responses. As pointed out on the defendants’ behalf, one would not expect the detail of privileged communications between solicitors and clients to be disclosed in evidence responding to a claim under s 7(9). Nor is any basis put forward for setting aside the privilege. Reliance on privilege cannot of itself be a basis for drawing an adverse inference. Whatever may be said about the adverse inferences to be drawn against the defendants on the basis of the Knuckey Emails (and much has been said), that does not afford any basis on which to infer that Grosvenor Law did not ask the obvious questions. I see no other basis for drawing such an inference. Rather the contrary.

[52]The claimant’s criticisms of the search were first put forward in correspondence and in the evidence of Mr Savani. Grosvenor Law responded in correspondence and in a 4th witness statement of Mr Morrison. In a letter dated 18 November 2016 the firm said that they had “taken instructions from our clients and have approached the matter in the light of those instructions and in accordance with our duties.” Mr Morrison has repeated that in his witness statement, and he adds that “Mr Savani’s purported concerns are factually unjustified.”

[53]On behalf Mr Holyoake a number of reasons have been put forward as to why the Court should not accept this at face value. There is an overarching submission, to the effect that neither the defendants nor Grosvenor Law are to be trusted. In support of this a number of distinct points are advanced, which it is convenient to address at this stage of the discussion. None of them have persuaded me that I should view Grosvenor Law’s correspondence or Mr Morrison’s evidence with suspicion.

[54]First, it is suggested that the defendants’ stout resistance of the SAR over many months on the basis of collateral motive was disingenuous, amounting to a campaign to avoid providing any substantive response. Alternatively, and in any event, the defendants’ reliance on the abuse argument is said to leave Mr Holyoake with a justified suspicion that there is bad faith here, and that the defendants have something to hide. Ms Proops was careful to base her submissions on Mr Holyoake’s perceptions. I am not sure that she has gone so far as to invite the inference that Grosvenor Law have acted in bad faith. In any event I am not prepared to draw that inference.

[55]Secondly, Mr Holyoake advances a critique of paragraph 55 of Mr Morrison’s first witness statement (see 24 above). The Knuckey Emails are said to show that this evidence was inaccurate. I agree. Those emails do not contradict Mr Morrison’s evidence that there had been no surveillance. But they do appear to be evidence of an “investigation” which was not protected by litigation privilege. However, by the time Mr Morrison made his first statement in this action the Knuckey Emails had already been disclosed by the Chancery Defendants. Mr Morrison was not acting in the Chancery Proceedings. He swiftly corrected the position in his second statement. I decline to infer that in paragraph 55 of his first statement he was seeking to misrepresent the position.

[56]Thirdly, Mr Holyoake’s team highlight the change in the defendants’ basis for asserting LPP (see 25 and 28 above). This is a point with some superficial attraction. However, it is important to recall that Morrison 1 was dealing with the SARs as originally framed, which overlapped considerably with disclosure in the Chancery Proceedings. This makes it understandable for Mr Morrison to have focussed at that time on litigation privilege in the context of those proceedings. I do not by any means discount the change of position. To my mind it supports the view that the Court should in general be wary of blanket assertions that data that have not been searched for are likely to be protected by LPP, so that no search should be required (cf Guriev, above). But the defendants’ present claim to LPP appears on its face to be a considered assessment of the application of LPP to specific data, produced and inspected following a diligent search. The change of position provides no basis for rejecting what Mr Morrison says in his 4th statement about his approach to taking instructions.

[57]Mr Holyoake’s fourth argument is that reliance on LPP in answer to the USG Request is at odds with the disclosure of the Knuckey Emails in the Chancery Proceedings. This is a weak point. The Knuckey Emails were sent in April 2012, long before the first intimation of the claims that were eventually made in the Chancery Proceedings, and over three years before the events which prompted the Injunction Proceedings. The evidence of Mr Morrison is that the USG data date from 4 February 2015 to 11 April 2016. These therefore are two quite different episodes, involving different organisations, at different times, in different contexts. Again, the difference in approach does not help to undermine what is said by Mr Morrison in his 4th statement.

[58]Fifthly, it is pointed out that there has been no disclosure of the instructions given to third parties in relation to the matters for which LPP is asserted. I see no merit in this point. As a matter of general principle, where third parties are instructed to conduct investigations for the purposes of litigation, the instructions will be protected by LPP.

[59]Ms Proops further submits that it is unsatisfactory for the defendants to rely on LPP in the present context, and thus to avoid scrutiny of their approach to compliance with the SARs. She points out that the defendants could have carried out the search exercise without employing lawyers, and thus without the cloak of legal advice or litigation privilege on the relevant communications. That is true, but it does not provide a basis for questioning the reliability of what a solicitor says about the way in which he has performed his retainer. It is not and could not be suggested that the defendants are not entitled to engage lawyers to assist them with the necessary searches. Having done so, they are entitled to rely on the privilege which the law confers on communications between client and lawyer. Failure to search private email accounts

[60]There is no dispute of fact here. The evidence is that Mr Candy’s corporate email account and his personal gmail account have both been searched. Otherwise, the searches carried out were limited to corporate email accounts. Ms Quinn explains that “personal email accounts are not processed by CPC as the data controller”. She further maintains that such searches would be disproportionate. The argument for Mr Holyoake is that the first point is legally misconceived. The right conferred by s 7 of the DPA extends to personal data which are being processed “on behalf of” the data controller. Accordingly, if directors of CPC used private email accounts to process data relating to Mr Holyoake on behalf of CPC the company would be obliged to afford subject access. Ms Proops submits that there is no evidence that the solicitors even asked the question of whether there might be any such data, and points out that it is far from unknown for private accounts to be used for “nefarious activity”.

[61]I would accept these broad propositions. But the general proposition that something might be so does not mean that there is any reason to believe it was so in an individual case. A company director who has used a personal email account for corporate business may owe the company a duty to allow access to that account, if that is needed to enable the company to comply with a SAR. But I do not believe the company is bound to ask the question unless there is some sufficient reason to do so. Nor does it seem to me that the company has a general right of access in order to check the position. To search a private email account would be an intrusion requiring justification. The Court must ask itself whether enquiry and/or search in relation to a director’s private email account is a requirement of a reasonable and proportionate search by a corporate data controller. Its approach must be tailored to the facts before it.

[62]The difficulty with Ms Proops’ submission lies in its contingent nature, and the evidence in the case. Here, there is no evidence that any of the Relevant Custodians at any stage used personal email accounts to communicate about Mr Holyoake on behalf of CPC, or at all. On the contrary.(1) The Knuckey Emails were corporate communications sent to and from corporate email accounts.

(2) The evidence is that Mr Candy’s private gmail account, which was searched, contained no personal data of Mr Holyoake whatever.

(3) It follows that the USG data that are held by Mr Candy were not found in any private email of his.

[63]I note, further, that(a) the draft amendments in the Chancery Proceedings allege that the investigations evidenced by the November Documents were carried out on the instructions of the Chancery Defendants and

(b) that the documents concerning DPM refer to the “commissioning client” as Mr Candy “c/o Candy & Candy/CPC Group”. The authenticity of the November Documents is of course in dispute, but my point is that even assuming them to be genuine they contain nothing to suggest that private email addresses were used for the purposes alleged.

[64]Under these circumstances, I do not regard the failure to search private email addresses of the remaining Relevant Custodians as evidencing a breach of duty by the defendants. For these reasons I decline to make any order under s 7(9) on the basis that the defendants’ searches were inadequate. On the evidence before me I find that the searches undertaken were reasonable and proportionate and compliant with the defendants’ obligations under s 7 of the DPA. I see no sufficient basis in any event on which to exercise the discretion conferred on the court by s 7(9). The LPP Issue

[65]It is convenient to recall the background: the only person claiming the benefit of the LPP Exemption is Mr Candy; the claim relates solely to personal data responsive to the USG Request, which came into existence in the period 4 February 2015 to 11 April 2016; the claim is to litigation privilege in respect of the Injunction Proceedings only; and that claim is supported by evidence from Mr Morrison and from Mr Rechtshaffen, who is acting for Mr Candy in the Injunction Proceedings.

[66]The burden of proving that an exemption applies is on the data controller: Roberts v Nottinghamshire Health NHS Trust

[2008] EWHC 1934

[2009] PTSR 415

[12].

[67]In his third witness statement Mr Morrison sets out a summary of the principles he applied, in terms which are not controversial. He says this:(1) Litigation privilege arises where a document has been brought into existence for the sole or dominant purpose of use for litigation.

(2) Litigation need not have begun for the privilege to apply. It must, objectively assessed, reasonably be in prospect.

(3) The contemplated litigation need not be the litigation in which the claim to privilege is asserted.

(4) For the privilege to apply, communication must be either between client and advisor, or advisor and third party. Communications between client and third party are not of themselves protected.

(5) However, where the third party is acting as the advisor’s agent, communications between the client and the third party are protected. Indeed, where the client engages in communication with a third party with the intention of providing the fruits of any enquiry to his advisor, the client may himself be the agent of his advisor, and the privilege applies.

(6) Litigation privilege arises where a client obtains advice or assistance for litigation purposes from a non-lawyer acting in his professional capacity, whatever that capacity might be.

(7) Litigation privilege may be lost by waiver, or disapplied where it [is] designed to act as a cloak for crime or fraud.

(8) The claim to privilege must be correctly made and this is the question I have applied my mind to answer.

[68]With one qualification, there is nothing controversial about this summary, which is consistent with the law as declared by the House of Lords in Three Rivers District Council v Governor and Co of the Bank of England (No 6)

[2004] UKHL 48

[2005] 1 AC 610

[102]. As will appear, the qualification relates to the exception identified in paragraph (7).

[69]The evidence of Mr Morrison describes the data which are the subject of the claim to LPP. It comprises four files of documents and 18 specific documents. The four files consist of what Mr Morrison describes as “a category of correspondence which might be deemed litigation privilege par excellence”, namely “all the email traffic between client, solicitor and counsel in the contemplation and course of the Injunction Proceedings”. These documents only falls within the Amended SARs, says Mr Morrison, because other people within the litigation strategy team were also copied into the correspondence. The 18 specific documents fall into two categories. They are either(1) correspondence between (a) Mr Candy or others on his behalf and (b) Mr Rechtshaffen “in the litigation context” or

(2) documents or parts of documents passing between Mr Candy and individuals acting on behalf of Mr Rechtshaffen in relation to the contemplated and actual litigation. Mr Morrison explains that these 18 documents were selected for separate consideration because he and his colleagues “applying the legal principles carefully and cautiously” recognised that they had content which was entitled to more specific consideration.

[70]Because of the Inspection Issue, copies of all the data which is alleged to be subject to the LPP Exemption have been put before me in what, as compiled for the court, are three lever arch files.

[71]On the face of things, it might appear somewhat puzzling that that documents dating from as early as February 2015 are said to be protected by litigation privilege in respect of the Injunction Proceedings, when those proceedings did not begin until December 2015. Mr Morrison’s evidence is however that from November 2014 Mr Candy was particularly concerned to explore the possibility of taking legal action against Mr Holyoake; that he took advice from solicitors on the subject matter of the Injunction Proceedings in November and December 2014; and that civil or criminal litigation against Mr Holyoake in relation to the underlying matters was reasonably in contemplation from November 2014. He says he has seen emails from Mr Candy which confirm this. Mr Rechtshaffen was approached in relation to these matters on 4 February 2015. I have also been referred to the Confidential Schedule to the Particulars of Claim in the Injunction Proceedings, which in my judgment does support what Mr Morrison says. A reporting restriction order is in place in respect of the Confidential Schedule. But it is possible to record without breaching confidence that this is a long-running story. The earliest of the events which led to the Injunction Proceedings dates back to August 2010, and there was related correspondence between Mr Holyoake and Mr Candy in May 2014 and on 1 November 2014. It is clear to see why there is no challenge to Mr Candy’s claim to the LPP Exemption on the basis of the dates of the documentation.

[72]In my judgment the evidence sufficiently and plainly makes out the case for Mr Candy that LPP applies to the data in question, subject only to Mr Holyoake’s arguments on the Iniquity and Inspection Issues.

[73]The argument for Mr Holyoake is, in summary, that there is reason to believe that Mr Candy’s claim to the LPP Exemption is unfounded for one or both of two reasons:(a) because the relevant underlying surveillance/investigation activities are tainted by criminal conduct and/or

(b) because those activities resulted in an unjustified interference with Mr Holyoake’s fundamental right to privacy. In order to determine whether the LPP Exemption has been properly applied the Court should inspect the data pursuant to s 15(2) of the DPA.

[74]For the reasons that follow, I have concluded that the evidence before me discloses no sufficient basis for concluding that the iniquity exception applies or may apply to the USG data, nor any adequate basis for inspecting the data myself pursuant to s 15(2) to check whether it might do so. The Iniquity Issue

[75]The existence of a principle that LPP cannot be used as a basis for withholding material that is evidence of iniquity is not in dispute. I shall call this the iniquity principle. The parties are at odds about the scope of the iniquity principle, that is to say to what forms of iniquity it extends. They are also at odds about the threshold test for the iniquity principle, that is, what standard must be met before the court will refuse to uphold privilege on this ground. Thirdly, there is dispute about what inferences may be drawn from the evidence before the court.

[76]Threshold The authorities show that a speculative case that the documents in question might involve or evidence iniquity will not suffice to displace LPP, where it would otherwise apply. The test of whether there is a “strong prima facie case” of iniquity has been adopted: BGBP Managing Global Partner Ltd v Babcock & Brown Global Partners

[2010] EWHC 2176 (Ch)

[2011] Ch 296

[68] (Norris J). Where fraud is one of the issues in the action the view has been expressed that a “very strong” prima facie case will be required: Kuwait Airways [42](2) (Longmore LJ). The lowest it has been put in the authorities before me is that where fraud is not one of the issues in the action a “prima facie case” of fraud may be enough: Kuwait Airways v Iraqi Airways

[2005] EWCA Civ 286

[2005] 1 WLR 2734

[42](3) (obiter). It is to be borne in mind that the court will not too readily find a prima facie case of fraud, or wrongdoing of comparable gravity.

[77]Crime It is clear law that LPP cannot be maintained in respect of documents or data which are evidence of criminal conduct or fraud. Hence, “… criminal or fraudulent conduct for the purposes of acquiring evidence in or for litigation cannot properly escape the consequence that any documents generated by or reporting on such conduct and which are relevant to the issues in the case are discoverable and fall outside the legitimate area of legal professional privilege.” Dubai Aluminium v Al-Alawi

[1999] 1 WLR 1964

, 1969F (Rix J). There, the allegation was that the defendants had instructed inquiry agents to engage in conduct that involved a criminal offence contrary to s 5(6) of the Data Protection Act 1984. See also Kuwait Airways [34] (Longmore LJ), approving Rix J’s decision.

[78]There is no question of fraud here. I am concerned only with crime. In her Skeleton Argument Ms Proops suggested there was a possibility of a breach of the Regulation of Investigatory Powers Act 2000, but she has not pursued that in oral argument. The criminal conduct that has been suggested as a possibility is breach of s 55 of the DPA. That is a provision which, speaking broadly, can be regarded as the modern equivalent of s 5(6) of the 1984 Act. The argument that the data that has been withheld may disclose such offending has been advanced in this action on the basis of two matters:(a) the Knuckey Emails, and

(b) the fact that Mr Candy holds material responsive to the USG Request.

[79]Contravention of s 55 is one of the allegations made in the draft Amended Particulars of Claim with reference to the Knuckey Emails. The application for permission to amend is not before me, and it may be thought undesirable to pre-empt decisions that have yet to be made in the Chancery Proceedings. I do not believe that I need to do that. I can decide this issue on the basis that whatever the Knuckey Emails might be said to reveal, they do not assist in showing that the USG data may contain evidence of criminality. There is no connection in subject-matter or timing between the two. But I would have decided the issue against Mr Holyoake in any event, on the additional footing that there is no real basis in the evidence before me for believing that the events evidenced by the Knuckey Emails involved a s 55 offence. This is a matter in issue before me, and one which has in my judgment been sufficiently explored in evidence and argument to allow a safe conclusion.

[80]The argument for Mr Holyoake starts from the premise that seeking personal data in the form of criminal records and not getting any involves “obtaining” or “disclosing” personal data within the meaning of s 55. That is a proposition that has not been explored in the submissions. It may deserve examination if it arises on a future occasion. It seems to me at least debatable. But I would reject the argument for Mr Holyoake on a different ground: it rests on the contention that Mr Knuckey must or at least may have gained access to the Police National Computer (“PNC”) for which I can see no satisfactory basis.

[81]There is nothing in the Knuckey Emails themselves which supports this proposition. The emails contain no direct information about the source or sources of information on which Mr Knuckey relied. His report to Mr Smith does, however indicate that such sources were not able to provide him with details of spent convictions. That is a point of importance because of the inferences that may be drawn.

[82]The witness evidence does not help a great deal on this point. The statement of Mr Davies, on which Mr Holyoake relies, is in my judgment almost entirely inadmissible. It mainly consists of assertions about English law, or speculation or opinion about what Mr Knuckey did. The only admissible aspect of the statement is a passage which contains some evidence of what Mr Davies knows about the means by which information about criminal records can be obtained from public sources. What he does not say is what information is or is not available on the PNC. The evidence of Mr Daw QC, relied on by Mr Candy, does not help on that issue either, and is also largely inadmissible. But it does state that criminal convictions are public information and that there are and were in 2012 public websites from which criminal records can be obtained. In the end the speculative case for Mr Holyoake is undermined by(i) this evidence of Mr Daw QC in combination with

(ii) the inherent probabilities,

(iii) information to be derived from authority and

(iv) Mr Morrison’s evidence that he has considered the crime/fraud exception. Of these points, (ii) and (iii) that seem to me most significant. Point (iii) is also corroborated by judicial experience.

[83]It is inherently unlikely, for obvious practical reasons, that records on the PNC would be confined to unspent convictions. A decision of the Court of Appeal to which Mr Pitt-Payne has referred me confirms that this is not the position. In Chief Constable of Humberside Police v Information Commissioner

[2009] EWCA Civ 1079

[2010] 1 WLR 1136

the Court considered a challenge by the Chief Constable to a decision of the Information Tribunal, upholding a determination of the Commissioner that it was unlawful to retain records of certain minor convictions on the PNC.The Court allowed the Chief Constable’s appeal, holding that the retention of the data was justified because (among other things) the Crown Prosecution Service, courts and Criminal Records Bureau require a complete record of convictions, spent or otherwise. This is consistent, and Mr Holyoake’s case is inconsistent, with the ordinary experience of those of us who hear criminal trials and appeals, in which PNC records are routinely relied on. In short, the Knuckey Emails do not suggest that Mr Knuckey gained direct or indirect access to the PNC; they suggest the opposite. Hearsay evidence of bad character in the form of newspaper cuttings about other alleged conduct of Mr Knuckey is relied on by Mr Holyoake, but cannot alter these facts.

[84]Turning to the fact that Mr Candy holds the USG data, I note that the draft Amended Particulars of Claim do not allege any criminality in relation to these data, though I acknowledge that the draft amendments were first prepared before the defendants’ SAR response of 14 November 2016. Again, the criminality that is suggested as a possibility in this action is a breach of s 55. Here, the problems faced by Mr Holyoake are different. His own evidence about what USG did is very weak indeed. It is entirely vague and general, the “reliable” source is unidentified for reasons which are also vague, and there are inconsistencies in the accounts of the relevant timings. Mr Holyoake provides no detail whatever of what it is that USG are supposed to have done. Mr Morrison’s evidence is clear: there was no surveillance. There is nothing of any substance to contradict that evidence. The conclusion I draw is that USG were instructed to investigate and only to investigate. It cannot be said that the instruction of private investigators necessarily involves a breach of s 55, or even that it is inherently suspicious. That is clearly not the case. See, for instance, Masriv Consolidated Contractors International

[2011] EWCA Civ 21

[44], [47] (and, in the European context, IPI v Englebert (

Case C-473/12

)

[2014] 2 CMLR 9

). For the reasons already given, the Knuckey Emails do not assist the claimant. For these reasons I see no basis for supposing that LPP in respect of the USG data is or may be abrogated by criminality. Indeed, in her reply submissions Ms Proops submitted that the case for Mr Holyoake had never been advanced on the basis that he was able to establish a prima facie case of illegality in respect of the USG data.

[85]Fundamental rights Ms Proops’ alternative submission, that Mr Candy’s reliance on the LPP Exemption should not be allowed to prevail on the basis that the data for which exemption is claimed may reveal breaches of fundamental human rights, is more legally ambitious.

[86]The argument describes privacy rights, including subject access, as “fundamental rights” for several reasons. Reliance is, naturally, placed on

Article 8 of the Convention

. Ms Proops acknowledges of course that Article 8 is not directly applicable between private citizens, but points out that the positive obligations of the state pursuant to Article 8 have led to the creation of the common law tort of misuse of private information. She also contends that subject access is an aspect of the right to respect for private life protected by Article 8. Personal data rights are also protected by Article 8 of the EU Charter of Fundamental Rights, which protects subject access as a freestanding right. Article 8 of the Charter provides, relevantly, that:- ‘Protection of personal data Everyone has the right to the protection of personal data concerning him or her. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.’

[87]Acknowledging that there is no authority that breach of a human right is to be equated with crime or fraud for the purposes of the iniquity principle, Ms Proops submits that this extension of the existing law is required by principle and that the authorities “create an environment that is highly conducive to accepting the claimant’s case.”

[88]As to principle, the following submissions are made. The fundamental right to privacy is interfered with by covert surveillance or investigation of an individual, even in a public place. Such interference requires a justification which is prescribed by law, pursues a legitimate aim, and is necessary for and proportionate to the pursuit of that aim. The court must construe and apply the law compatibly with these principles pursuant to s 6 of the Human Rights Act 1998. It is also bound to construe and apply domestic law compatibly with the Charter. It must in particular ensure that a remedy for breach of fundamental rights is available, in accordance with Article 47 of the EU Charter: Vidal-Hall v Google Inc

[2015] EWCA Civ 311

[2015] 3 WLR 409

. The court would not be acting in accordance with these obligations if it allowed LPP to protect unlawful activity in breach of these rights. LPP should not be allowed to trump or be paramount over privacy rights. There is no human right to conceal evidence of one’s own violation of another human right.

[89]As to authority, Ms Proops relies on some general observations as to the scope of the iniquity principle by Rix J in Dubai Aluminium at 1969C-D, Colman J in The David Agmeshenebeli [2001] CLC 942, 947E-H, and Norris J in BBGP [61]. She points out that in R (Morgan Grenfell) v Special Commissioner of Income Tax

[2002] UKHL 21

[2003] 1 AC 563

[43] Lord Hobhouse suggested that some at least of the basic premises that underlie LPP “would benefit from further examination.” And she refers me to R v Brown (Edward)

[2015] EWCA Crim 1328

[2016] 1 WLR 1141

where it was held that in exceptional circumstances the usually inviolable privilege attaching to legal advice was capable of qualification at common law, even outside the situation where a meeting with lawyers was being misused in order to commit a crime.

[90]This is a novel, but ingenious argument, which has been skilfully developed at the hearing. But in my judgment it cannot prevail. First and foremost, the argument founders on the facts, for substantially the same reasons as set out above. The court will not set aside a claim to LPP on the basis of the iniquity principle unless there is at least a prima facie case of wrongdoing. There is no such case. There has been much talk in the course of submissions about the evils of surveillance, but the evidence does not support the conclusion that USG engaged in any surveillance. There is no worthwhile evidence that the firm did more than carry out investigation. It is not the case that every investigation into an individual is necessarily an interference with private life. Nor is it the case that any investigation which does involve an interference must necessarily involve an unjustified interference. There is no direct evidence as to the nature of the investigation undertaken by USG. The Knuckey Emails of 2012 do not help Mr Holyoake to make out an inferential case that USG’s investigation of 2015 was unlawful.

[91]Having reached those conclusions I can deal relatively shortly with the points of law. The authorities relied on are of no real assistance to the argument. The words of Lord Hobhouse in Morgan Grenfell are of no help to Ms Proops, representing no more than a minority obiter comment in a case which faithfully applied established principles, as to which see below. The three cases relied on as indicating that “iniquity” has a broader meaning than just crime or fraud are first instance authority on facts far removed from the present, and do nothing to support the broad submissions advanced. Brown was concerned with legal advice privilege not litigation privilege, and establishes a qualification of narrow scope based on quite exceptional facts (the point at issue was whether staff should be allowed to attend a conference between a convicted murderer and his lawyers to prevent the applicant committing suicide). It is true that the exception was rooted in a Convention right – the right to life. But I think it would be going much too far to treat this decision as a springboard for the much broader submission that the court is duty bound to allow an incursion into LPP whenever the documents for which protection is sought may evidence a breach of any human right.

[92]That, on analysis, has to be the logic of Ms Proops’ position. However much she may emphasise the “fundamental” nature of the privacy rights at issue in this case she cannot submit that they fall into any special or separate category from other fundamental human rights. If the argument is sound, it must apply to other human rights such as (for instance) the right to freedom of expression protected by Article 10, or the right to peaceful enjoyment of possessions protected by Article 1 of Protocol 1. It seems to me therefore that Mr Pitt-Payne is right to submit that this argument seeks a substantial expansion of the iniquity principle which would, on the face of it, significantly erode the right to LPP. I also see a great deal of force in Mr Pitt-Payne’s submission that the argument for Mr Holyoake fails properly to recognise that the right to LPP is itself a fundamental human right. Authority establishes that LPP is an aspect of the rights protected by

Article 8 ECHR

(see Campbell v United Kingdom

(1992) 15 EHRR 137

). Those same rights are also protected by Article 7 of the Charter. Recognition of the need in the public interest to protect communications between client and lawyer is a common feature of European legal systems so that the protection of LPP is, to some extent at least, a principle of EU law: A M & S Europe Ltd v Commission of the European Communities (Case 155/79)

[1983] QB 878

[21-22].

[93]Bearing these points in mind it might be thought, and Ms Proops has argued in the alternative, that the court should adopt a balancing approach, weighing one competing right against another. Such an approach would limit the extent to which this human rights argument would involve an incursion into LPP. But it would create a new exception of uncertain ambit. It would also appear to be inconsistent with House of Lords authority. In R vDerby Magistrates Court, ex parte B

[1996] 1 AC 487

the House rejected the notion that the availability of legal advice privilege might admit of exceptions, to be identified using a balancing approach. Lord Taylor CJ said at 508D-E that “if a balancing exercise was ever required in the case of legal professional privilege, it was performed once and for all in the 16th century, and since then has applied across the board in every case, irrespective of the client’s individual merits.” The reference was to the decisions in Berd v Lovelace (1577) Cary 62 and Dennis v Codrington (1579) Cary 100 (see

[1996] 1 AC 504

B-D). Lords Keith, Mustill and Lloyd agreed. Lord Nicholls at 511G-512E adopted the same approach. This rejection of a balancing approach is one of the fundamentals referred to by Lord Hobhouse in Morgan Grenfell, but as already observed, his views were obiter.

[94]Of course, the court is familiar with the process of striking a balance between competing fundamental rights. There is no inherent difficulty in the process, which has become a regular feature of judicial decision-making over the 16 years that have passed since the passage of the HRA. But the HRA has not abrogated the doctrine of precedent, which continues to apply subject to certain exceptions: Kay v Lambeth LBC

[2006] UKHL 10

[2006] 2 AC 465

, R (RJM) v Secretary of State for Work and Pensions

[2008] UKHL 63

[2009] 1 AC 311

. It is not submitted that the exceptions apply here.

[95]If the law is to be developed in the way contended for it will have to be done by another court on another occasion. For my part, I am not persuaded that the quite radical extension of the iniquity principle that is advocated on behalf of Mr Holyoake is required by the HRA or the Charter. The Inspection Issue

[96]I was invited on behalf of Mr Holyoake to read the material filed by Mr Candy in advance of the hearing. This was opposed by Mr Candy and I did not consider it appropriate to inspect before hearing oral argument. I have not inspected the material after hearing argument either.

[97]The established approach of the court to the issue of whether it should inspect material said to be protected by LPP is to do so only as a last resort: West London Pipeline and Storage Limited and Another v Total UK Ltd and Others

[2008] EWHC 1729 (Comm)

[2008] 2 CLC 258 [74-75] and [86](3) (Beatson J).

(c) Beatson J said the following:

“Inspection should be a last resort … It should not be undertaken unless there is credible evidence that those claiming privilege have either misunderstood their duty or are not to be trusted with the decision making or there is no reasonably practical alternative.”

None of these conditions is satisfied here.

[98]It is true that this, and other authorities to similar effect, were concerned with the question of whether a claim to privilege should be upheld at the interlocutory stage. But it seems to me that whenever the issue arises the court should be hesitant to embark on what might prove to be an interference with a fundamental right, at least in the absence of some good reason such as those identified by Beatson J. Another authority drawn to my attention concerns a decision at the final stage, and suggests that the right approach is stricter still. In BBGP v Babcock at [72] Norris J proceeded on the basis that before the court examines closed material of this kind there must be “some exceptional factor of real weight” to justify adopting that course.

[99]The submission for Mr Holyoake is not, in the end, that he can show grounds to believe that the USG data involves or reveals unlawful behaviour by Mr Candy. He wishes to have the court examine the material in order to see whether it reveals a breach of his fundamental rights. As Ms Proops puts it in her skeleton argument:

“Plainly, these are not issues which Mr Holyoake can effectively test for himself, because he has been denied access to the crucial evidence on these issues, namely the USG Data itself.”

The argument is that the only way in which these issues can be tested at all is by the court, “on an ex parte/closed basis under s. 15(2) DPA.” In consequence there has been discussion of how such a procedure might be implemented.

[100]The adoption of such a procedure is unappealing for many reasons. They include reasons to do with the proper and proportionate use of judicial resources, and concerns about open justice. Such a procedure would also involve the court embarking on something amounting to an inquisition or mini-trial of whether privacy infringements had taken place, as a precursor to ruling on the applicability of LPP. This would be novel, and in my judgment this is not in general a proper approach for the court to take, in the absence of good reason to suppose that the examination might turn up some evidence of wrongdoing. I recognise that in Zaw Lin v Commissioner of Police for the Metropolis

[2015] EWHC 2484 (QB)

the Court did choose to look at the section 15(2) material for itself, but the present case is in my judgment clearly distinguishable. Zaw Lin was very different on its facts, and was not an LPP case. Conclusions

[101]I find that the defendants’ searches were reasonable and proportionate, and that there is no basis on which to exercise the power conferred by s 7(9) of the DPA to require further searches. I am satisfied that the LPP Exemption has been properly claimed by Mr Candy, and that it is not appropriate to make any order under s 7(9) in that respect either. I have not found it necessary or appropriate to inspect the data for which the LPP Exemption is claimed before reaching my conclusions on the LPP Issue. The claim is therefore dismissed.

Holyoake v Candy & Anor [2017] EWHC 52 (QB)

(c) Beatson J said the following:

Cited in 5 later judgments