Aven & Ors v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB)

[2020] EWHC 1812 (QB)IN THE HIGH COURT OF JUSTICEQUEEN'S BENCH DIVISIONMEDIA AND COMMUNICATIONS LISTVenue Royal Courts of Justice Strand, London, WC2A 2LLDate 08/07/2020
Between
Petr AvenClaimantsMikhail FridmanClaimantGerman KhanClaimantOrbis Business Intelligence LimitedDefendant
Before
MR JUSTICE WARBY- - - - - - - - - - - - - - - - - - - - -Between:
Hugh Tomlinson QC and Kirsten Sjøvoll (instructed by CMS Cameron McKenna Nabarro Olswang LLP) for Claimants Gavin Millar QC and Robin Hopkins (instructed by Reynolds Porter Chamberlain LLP) for the DefendantHearing Hearing dates: 16 - 19 March 2020
Approved JudgmentINDEX Section Paragraphs Introduction 1-9 The Trial 10-11 The overall legal framework 12-17 Issues on liability 18-19 The Personal Data Issue 20-45 A narrative 46-62 The Legal Purposes Issue The relevant provisions 63-73 The parties’ contentions 74-78 Assessment 79-104 The National Security Issue The law 105-112 The facts 113-118 Submissions 119-122 Assessment 123-129 The Fairness Issue Conclusions 130 Reasons 131-144 The Accuracy Issue The issues in dispute 145-149 Fact or opinion?150-151 Inaccurate or misleading?152-174 Accurate recording?175-176 Reasonable steps?177-187 Remedies 188-203 Summary of Conclusions 204

Introduction

[1]This is a claim for the correction of the record and other remedies in relation to one component of the so-called “Steele Dossier”. That is the name that has been given to a set of memoranda produced by the defendant (“Orbis”) in 2016, on the instructions of a Washington DC consultancy. Orbis’ instructions were to provide intelligence memoranda concerning any links which might exist between Russia, its President, Vladimir Putin, and Donald Trump.[2]The claimants are three businessmen of Russian or Ukrainian origin. They are all among the ultimate beneficial owners of the Alfa Group Consortium (“Alfa Group”), a Russian financial-investment conglomerate which includes Alfa Bank JSC (“Alfa Bank”). (These are Anglicisations of the Russian, Альфа.Although Alfa Bank itself favours this spelling, the name sometimes appears in English as “Alpha”).[3]Orbis is an English company, incorporated in 2009, which holds itself out as providing strategic insight, intelligence and investigative services to clients around the world. Orbis was established by two British former public officials, Christopher Steele and Christopher Burrows. Mr Steele is a director and principal of Orbis, and in that capacity he was the main if not sole author of the “Steele Dossier”.[4]On 10 January 2017, BuzzFeed News published an online article headed “These Reports Allege Trump Has Deep Ties to Russia” (“the Buzzfeed Article”). It described “A dossier, compiled by a person who has claimed to be a former British intelligence official” which contained, “… explosive — but unverified — allegations that the Russian government has been “cultivating, supporting and assisting” President-elect Donald Trump for years and gained compromising information about him.”[5]The Buzzfeed Article went on:- “Now BuzzFeed News is publishing the full document so that Americans can make up their own minds about allegations about the president-elect that have circulated at the highest levels of the US government.”[6]Sixteen memoranda were made accessible via a link in the article. This is how the claimants came to know about “Memorandum 112”, a document contained in the Dossier, which made reference to the claimants.[7]Memorandum 112 is dated 14 September 2016. Its full title is “COMPANY INTELLIGENCE REPORT 2016/112 - RUSSIA/US PRESIDENTIAL ELECTION: KREMLIN-ALPHA GROUP COOPERATION”. Its full text is as follows: - “Summary - Top level Russian official confirms current closeness of Alpha Group-PUTIN relationship. Significant favours continue to be done in both directions and FRIDMAN and AVEN still giving informal advice to PUTIN, especially on the US - Key intermediary in PUTIN-Alpha relationship identified as Oleg GOVORUN, currently Head of a Presidential Administration department but throughout the 1990s, the Alpha executive who delivered illicit cash directly to PUTIN - PUTIN personally unbothered about Alpha's current lack of investment in Russia but under pressure from colleagues over this and able to exploit it as lever over Alpha interlocutors Detail - Top level Russian official confirms current closeness of Alpha Group-PUTIN relationship. Significant favours continue to be done in both directions and FRIDMAN and AVEN still giving informal advice to PUTIN, especially on the US - Key intermediary in PUTIN-Alpha relationship identified as Oleg GOVORUN, currently Head of a Presidential Administration department but throughout the 1990s, the Alpha executive who delivered illicit cash directly to PUTIN - PUTIN personally unbothered about Alpha's current lack of investment in Russia but under pressure from colleagues over this and able to exploit it as lever over Alpha interlocutors 1. Speaking to a trusted compatriot in mid-September 2016, a top level Russian government official commented on the history and current state of relations between President PUTIN and the Alpha Group of businesses led by oligarchs Mikhail FRIDMAN, Petr AVEN and German KHAN. The Russian government figure reported that although they had had their ups and downs, the leading figures in Alpha currently were on very good terms with PUTIN. Significant favours continued to be done in both directions, primarily political ones for PUTIN and business/legal ones for Alpha. Also, FRIDMAN and AVEN continued to give informal advice to PUTIN on foreign policy, and especially about the US where he distrusted advice being given to him by officials. 2. Although FRIDMAN recently had met directly with PUTIN in Russia, much of the dialogue and business between them was mediated through a senior Presidential Administration official, Oleg GOVORUN, who currently headed the department therein responsible for Social Co-operation With the CIS. GOVORUN was trusted by PUTIN and recently had accompanied him to Uzbekistan to pay respects at the tomb of former president KARIMOV. However according to the top level Russian government official, during the 1990s GOVORUN had been Head of Government Relations at Alpha Group and in reality, the “driver" and “bag carrier" used by FRIDMAN and AVEN to deliver large amounts of illicit cash to the Russian president, at that time deputy Mayor of St Petersburg. Given that and the continuing sensitivity of the PUTIN-Alpha relationship, and need for plausible deniability, much of the contact between them was now indirect and entrusted to the relatively low profile GOVORUN. 3. The top level Russian government official described the PUTIN-Alpha relationship as both carrot and stick. Alpha held 'kompromat' on PUTIN and his corrupt business activities from the 1990s whilst although not personally overly bothered by Alpha’s failure to reinvest the proceeds of its TNK oil company sale into the Russian economy since, the Russian president was able to use pressure on this count from senior Kremlin colleagues as a lever on FRIDMAN and AVEN to make them do his political bidding.[8]On 4 May 2018, the claimants began this action seeking remedies under the Data Protection Act 1998 (“the DPA”). The claimants’ case is that Orbis has acted in breach of its duties under s 4(4) of the DPA, in that Memorandum 112 contains personal data relating to the claimants, some of it sensitive personal data, which are inaccurate, contrary to the Fourth Data Protection Principle (“the Fourth Principle”), and which have been processed by Orbis in ways that are unfair, unlawful or otherwise non-compliant with the First Data Protection Principle (“the First Principle”). The claim form seeks four remedies: a declaration that the personal data are inaccurate; an order for blocking, erasure, destruction and rectification of the personal data; an order that the defendant inform those to whom it disclosed Memorandum 112 of the inaccuracies; and compensation.[9]Orbis denies liability. It has not disputed the applicability of the DPA to the activities that are the subject of the claim. It does not dispute that it processed information relating to the first and second claimants. But its case is that not all of the information in Memorandum 112 is personal data, and none of it relates to the third claimant; the personal data do not include any that are sensitive personal data; the data are not inaccurate; and there is no breach of the Fourth Principle. Orbis further maintains that its processing of the data complied with the First Principle. Further and alternatively, Orbis relies on provisions that exempt processing where the processing is necessary for the purpose of prospective legal proceedings, or obtaining legal advice, or establishing, exercising or defending legal rights (DPA s 35(2) (“the Legal Purposes Exemption”)), and where exemption that is required to safeguard national security 10. (DPA s 28(1) (“the National Security Exemption”)). If liability is established, Orbis denies that the claimants are entitled to compensation or any other remedy, disputing that any of them have suffered any damage or distress. The trial

Exemption”)), and where exemption that is required to safeguard national security

[10]I heard evidence and argument over four days in March 2020. This was the week before the Prime Minister’s announcement on 23 March 2020 of what has become known as “lockdown” and the enactment, on 25 March 2020, of the Coronavirus Act 2020 and, on 26 March 2020, of the Health Protection (Coronavirus, Restrictions) (England) Regulations 2020 (SI 2020/350), known to some as the “stay-at-home” regulations. The trial documents were all provided in electronic form, but the hearing was held in an appropriately large Court, with all the claimants and Mr Steele present for most of the time.[11]Each of the claimants made a witness statement, gave oral evidence and was crossexamined by Mr Millar QC, on behalf of Orbis. The claimants also relied on a written expert report from Eleonora Sergeeva, a partner in the Russian law firm of Padva and Partners, who specialises in criminal law relating to business offences, and anticorruption regulations. The only witness for Orbis was Mr Steele, who made three witness statements, gave oral evidence and was cross-examined by Mr Tomlinson QC.

The overall legal framework

[12]Data protection has been part of our domestic legal landscape for over 20 years now. The regime with which I am concerned in this case is the one introduced by the Data Protection Directive (95/46/EC) and transposed into English law by the DPA, which came into force on 1 March 2000. This is complex and technical legislation which has been likened to a “thicket”, Campbell v MGN Ltd [2002] EWHC 499 (QB); [2002] EMLR 30 [77] (Morland J). but the general principles have become familiar.[13]The provisions that are relevant for present purposes are to be found in Part I (ss 1, 2, 4, 13 and 14), Part IV (ss 27, 28, 35) and Part VI (s 70) of the DPA, and Schedules 1, 2 and 3. Their effect, so far as is relevant to this case, can be quite shortly summarised. It is convenient to do that before I come to the issues, and the more detailed examination of the law that is required in order to resolve them.[14]“Data” refers, in essence, to computerised information. “Personal data” is a broad term, covering most computerised information about an identifiable living individual (the “data subject”). “Processing” is a term that covers almost anything that can be done with personal data, including holding it and disclosing it to others. A person who determines how and why personal data are processed (a “data controller”) owes a statutory duty to the data subject, to ensure the processing complies with the Data Protection Principles. There are eight such principles. As will be clear already, only the First and Fourth Principles are material in this case.[15]The First Principle requires that the processing of all personal data should be fair, lawful and satisfy at least one condition in DPA Schedule 2. Some kinds of data are classed as “sensitive”. Processing of such data must also satisfy at least one Schedule 3 condition. The categories of sensitive personal data include information about a person’s actual or alleged criminality. The Fourth Principle requires data to be accurate, although – as will be seen – it can be enough that the data controller has taken reasonable care to ensure they accurately record what a third party has told the data controller.[16]The duty to process data in compliance with the Data Protection Principles is subject to a variety of exemptions, set out in DPA Part IV and subordinate legislation. One category of exemption, where it applies, ousts the Fourth Principle altogether, and ousts the First Principle “except to the extent to which it requires compliance with the conditions in Schedules 2 and 3”. The Legal Purposes Exemption belongs in this category. Other exemptions, where they apply, can oust all the Data Protection Principles. The National Security Exemption is one of these.[17]A data subject who suffers distress or damage as a result of a data controller’s contravention of the requirements of the DPA is entitled to recover compensation. But the DPA provides the Court with a range of additional or alternative remedies, including all those claimed by the claimants in this case, as mentioned in paragraph 8 above.

Issues on liability

[18]The disputes between the parties can be reduced to five main issues:(1) What is the scope and nature of the personal data relating to the claimants that is contained in Memorandum 112? (“The Personal Data Issue”).(2) To what extent, if at all, is the processing of those data which was undertaken by Orbis protected by the Legal Purposes Exemption? (“the Legal Purposes Issue”).(3) To what extent, if at all, is the processing of those data which was undertaken by Orbis protected by the National Security Exemption? (“the National Security Issue”).(4) Did Orbis process any of the data in contravention of the First Principle? (“the Fairness Issue”).(5) Did Orbis process any of the data in contravention of the Fourth Principle? (“the Accuracy Issue”).[19]The majority of the claimants’ evidence went to the Accuracy Issue. Most of Mr Steele’s evidence-in-chief went to the Legal Purposes and National Security Issues. He also gave evidence, and was cross-examined quite extensively, in relation to the Accuracy Issue.

The Personal Data Issue

[20]This is a matter that turns purely on the application of the law to the contents of Memorandum 112.[21]The claimants’ case is set out in paragraph 6 of the Particulars of Claim. This identifies five propositions as “personal data of which the claimants are the data subjects”, contained in Memorandum 112:(a) That significant favours are done by President Putin for the Claimants and for President Putin by the Claimants.(b) That the First and Second Claimants give informal advice to President Putin on foreign policy.(c) That shortly before 14 September 2016, the Second Claimant met directly with President Putin in Russia.(d) That the First and Second Claimants used Mr Oleg Govorun as a “driver” and “bag carrier” to deliver large amounts of illicit cash to President Putin when he was Deputy Mayor of St Petersburg.(e) That the First and Second Claimants do President Putin’s political bidding.[22]Orbis accepts that Memorandum 112 contains information to the effect set out in paragraphs (b), (c), (d) and (e) above, which is “to varying extents” the personal data of the first and/or second claimants. There are two points of dispute:(1) whether proposition (a) sets out any personal data contained in Memorandum 112; and(2) whether the information in paragraph (d) consists of sensitive personal data. “Significant favours”[23]It will be clear that the claimants’ proposition (a) reflects the wording of the second sentence of the Summary of Memorandum 112, and the third sentence of numbered paragraph 1 of the “Details” section. But it goes beyond the literal meaning of those sentences, which do not mention any of the claimants by name. The claimants’ case is that proposition (a) reflects the natural and ordinary meaning of the words used, in their context within numbered paragraph 1 of the Memorandum, and the document as a whole. Any ordinary reader of the words, in their context, would understand them to refer to the three individuals identified by name as the leaders of the Alfa Group, and to mean that the significant favours were being done by and for those individuals.[24]Orbis contends that this approach is wrong in principle. Mr Millar points out that this is not a defamation case, but a claim brought under the DPA. In that context, he submits, one needs to focus on the items of information – and specifically, the items of data – rather than on documents in the round. In Memorandum 112, Mr Steele clearly distinguishes who he is talking about in each paragraph and each sentence. Each item of information must be assessed discretely by reference to the definition of “personal data” in DPA s 1(1). For that purpose, information about an individual must be distinguished from information about a company, which is not personal data: see Smith v Lloyds TSB [2005] EWHC 246 (Ch) [32]. An individual can only show that information is his personal data if he is identifiable from the sentence in question, and it “relates to” him in the sense explained by the Court of Appeal in Durant v Financial Services Authority [2003] EWCA Civ 1746 [2004] FSR 28 [28] (Auld LJ) and Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd [2017] EWCA Civ 121 [2018] QB 256 [61-66] (Lewison LJ).[25]Assessed in this way, it is submitted, the passages in Memorandum 112 that refer to “significant favours” contain no personal data about any of the claimants. They contain information about Alfa Group, a corporate entity, and are “plainly not a reference to any living individual”. The claimants are not identifiable from the sentences in question, and even if they were that would not be enough to make the information personal data that “relates to them”. As the claimants’ other propositions all refer to the first and/or second claimants only, it follows that Orbis’ case is that the Memorandum contains no personal data of the third claimant.[26]The outcome of this aspect of the case turns on the right approach to the ascertainment of whether information contains the personal data of an individual. The rival approaches contended for can be broadly characterised as holistic and atomised. In my judgment, the holistic approach is consistent with principle and authority, and the right approach to the facts of this case.[27]It is fair for Mr Millar to submit that the claim is one that calls for the faithful interpretation and application of a statutory code (construed in the light of the Directive). But the statutory definition of personal data, on which he relies, does not provide the answer to the question. I quote the relevant parts of s 1(1): “data” means information which –(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose … “personal data” means data which relate to a living individual who can be identified— (a) from those data, or(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller … and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;” possession of, or is likely to come into the possession of, the data controller[28]This wording identifies some criteria, such as “relate to”, and “can be identified from …”, but it contains nothing that assists on the question of how to approach the identification of the “data” to which those criteria are to be applied. It certainly does not demonstrate or indicate that where a claimant complains of a document, an itemby-item approach to the contents of that document must be adopted. In those circumstances, the Court must look to the DPA and Directive as a whole for guidance, and may also look to extraneous sources for approaches that have been adopted in other, related contexts. That is what I did when a similar issue arose in the “delisting” case, NT1 v Google LLC [2018] EWHC 799 (QB) [2019] QB 344. The claimant sought an order requiring the defendant to remove from search results returned by using the claimant’s name information contained in newspaper articles and book extracts about an old, rehabilitated criminal conviction. One aspect of the claimant’s case was that the information was inaccurate, contrary to the Fourth Principle. Mr Tomlinson QC, appearing for the claimant, initially argued that for this purpose that the Court should look, not at the natural and ordinary meaning of a document, but rather at each discrete “item of information”. He moved away from that position in the course of the trial, and I rejected it.[29]I concluded that the right approach was to look at the articles and book extracts as a whole, and interpret any element of them by reference to the meaning that the ordinary reader would take from that element, read in its full context. My reasons were set out in detail at [80-84]. It is unnecessary to set them out here. In summary I concluded, and it remains my view, that support for this approach can be found in aspects of the DPA itself, the work of the Article 29 Working Party, domestic authority on the application of the DPA and its predecessor (the Act of 1984), and the logic and common sense to be found in the law of meaning in defamation.[30]Another, overarching, factor that counts in favour of this approach is the overall purpose of data protection law, namely to give practical effect to the fundamental right of individual privacy guaranteed by Article 8 of the European Convention on Human Rights: see Article 1.1 of the Directive. As Judge Jacobs observed in Farrand v Information Commissioner & Anor [2014] UKUT 310 (AAC) [18]: “To ignore context would render the legislation ineffective in numerous circumstances to which it is clearly intended to apply, thereby reducing its effectiveness”.[31]There may be cases involving data sets of a more abstract or more granular kind, where the question of whether the set contains the claimant’s personal data calls for an individualised assessment of each constituent element, read in isolation from other components of the data set. I do not believe that would be inconsistent with the principles I have identified. On the contrary, it would be an application of those principles; it is always necessary to identify what is and is not the proper context for any given statement or item of data. At any rate, I am satisfied that what I have called the holistic approach should be applied to Memorandum 112. The document is a report, not a bare list of separate and discrete propositions. It is a coherent narrative, concerning relationships between Alfa Group and its principals, Mr Putin, and others. It would be artificial to read any individual sentence in isolation from the remainder of the document.[32]Applying that approach, I find that Memorandum 112 did contain the information in claimants’ proposition (a). The claimants are plainly identifiable from Memorandum 112; they are named. Any ordinary reasonable reader of the Memorandum would understand the statements about the giving and receipt of “significant favours” as referring not only to Alfa Group but also to the three individual claimants. That would be the result of reading the whole document, which an ordinary reader would do; but in order to explain this conclusion, it is not necessary to look beyond the immediate context of the words in numbered paragraph 1. The two immediately preceding sentences identify the claimants by name as leaders of the Alfa Group, and assert that they are on “very good terms” with Putin. The reader of the sentence that follows would naturally take its reference to favours being done “in both directions” as a statement that Putin does favours for the claimants, and they for him. The mention of Alfa at the end of the third sentence would be read as synonymous with the claimants. In my judgment, further, the information is personal data within the meaning of DPA s 1.[33]The cases relied on by Orbis – Durant, Smith v Lloyds, and Ittihadieh – are consistent with these conclusions. Those cases are authority for the proposition that not all data that refer to an individual necessarily “relate to” him or her within the meaning of DPA s 1(1). In particular, whether information comprises personal data depends on where it falls in a continuum of relevance or proximity to the data subject; and for that purpose it is relevant to consider whether the information is biographical in a significant sense, whether it has the data subject as its focus, and whether it affects his privacy (whether in a personal, business or professional capacity). These propositions have been developed to guide those confronted with claims based on the notion that all information in any document that makes mention of an individual is that individual’s personal data. They are of scant relevance here. The information in the claimants’ proposition (a) is not merely incidental to a report on some larger or separate and distinct topic, about some other person or organisation. The claimants’ behaviour, and their relationships with Mr Putin, are the subject-matter and theme of the Memorandum. This particular information in proposition (a) is focused on them, biographically significant, and impinges on their privacy, albeit in a business context. “Illicit cash”[34]It is agreed that the Memorandum conveyed the information in the claimants’ proposition (d).

(g) That defines “sensitive personal data” to include:

“… personal data consisting of information as to - … (g) the commission or alleged commission by [the data subject] of any offence.”
[35]As is common ground, whether information falls within DPA s 2(g) is a question of fact to be resolved in the light of the circumstances of the case, having regard to the immediate context of the information: Information Commissioner v Colenso-Dunne [2015] UKUT 471 (AAC) [37], [46].[36]In this case, the issue has become complicated by a request for further information about the nature of the offence relied on, the provision of such information and the introduction of expert evidence. I outlined the history in a judgment given at the PreTrial Review, debarring the defendant from adducing an expert report in response: [2020] EWHC 474 (QB) [33]. The claimants’ case, as stated in Voluntary Further Information, is that the Memorandum suggested the giving of a bribe to an official, contrary to Article 174 of the Criminal Code of the Russian Soviet Federated Socialist Republic. The claimants sought and obtained permission to rely on Ms Sergeeva’s expert report to support that proposition. This, self-evidently, invites an exploration of matters that are extraneous to the personal data with which I am concerned. But the claimants’ primary case was, and by the end of the trial both parties were contending, that this was not the right approach.[37]Mr Tomlinson’s main submission is that an allegation that the claimants committed a criminal offence flows by “obvious and inevitable implication” from the statement in numbered paragraph 2 of the Memorandum that “large amounts of illicit cash” had been passed to a public official by Govorun, acting as the first and second claimants’ driver and bag carrier. The term “illicit” is emphasised by its appearance in the second bullet point in the Summary. The word means improper, irregular or unlawful. It is not necessary, he submits, to specify the criminal offence, giving chapter and verse. In this regard he relies on Gray J’s decision in Lord Ashcroft v Attorney-General [2002] EWHC 1122 (QB), that reference to the claimant’s “laundry arrangements” could be understood as a reference to the offence of money laundering. On the face of it, however, the illicit funds were being paid to a public official, thus indicating bribery. The implication of criminality is bolstered, submits Mr Tomlinson, by the use of quotation marks around the terms used to describe Govorun’s role, suggesting that they are being used euphemistically, and by the context. Mr Tomlinson relies on references in paragraphs 2 and 3 to the “continuing sensitivity” of the Alfa-Putin relationship and “kompromat” on Putin and his “corrupt business activities from the 1990s” held by Alfa.[38]Mr Millar adopts some observations of mine at [38-39] of the PTR judgment mentioned above, where I commented that the issue is what information, allegation, statement or imputation was conveyed by the Memorandum, and – first of all - “what conduct did the relevant part of Memorandum 112 attribute to the first and second claimants, by what it said about the use of Govorun to convey ‘illicit cash’ to Mr Putin?”. That question must be answered on the basis of the Memorandum alone, as the claimants have not pleaded any extraneous contextual material. Reliance on the expert report of Ms Sergeeva is therefore misplaced. On the face of the Memorandum 112, no clear allegation of criminality can be discerned. Lord Ashcroft v Attorney General, which decided only that it was arguable that an express reference to “laundry arrangements” contained an insinuation of money laundering. This case is not comparable. The reference to “illicit cash” in the Memorandum means no more than cash that was in some way furtive or secret. There may be an implication of some moral judgment, at least by Western standards, but that is not enough to impute the commission of a criminal offence.[39]The debate about Ms Sergeeva’s evidence, and the contention it goes to support, are further aspects of the argument which contain echoes from defamation law. In slander, it is occasionally necessary to consider what if any criminal offence is imputed by the words complained of. That is because words that impute the commission of a criminal offence for which a person can be imprisoned are one of the exceptions to the general rule that spoken words are actionable as slander only if they cause special damage. Claimants relying on this rule may need to identify a specific offence that is expressly or impliedly imputed by the words complained of: see my discussion of this exception in Umeyor v Ibe [2016] EWHC 862 (QB) [71-77].[40]In this instance, however, any attempt to read across from defamation would clearly be misleading. In the slander context the reason, or at least the main reason, why a claimant may need to identify a specific offence imputed by the words complained of is to show that it carries a sentence of imprisonment. That is an artificial and, to some extent, arbitrary requirement, but it would seem to follow from a legal policy of establishing some threshold of seriousness. In the absence of any similar restriction in data protection law (and without any rationale for introducing one) it would be artificial and wrong to apply any similar rule.[41]In my judgment, this issue must be determined by considering only the text of Memorandum 112, identifying the relevant information conveyed by that text, isolating the conduct imputed to the claimants, and deciding whether ordinary readers would conclude that such conduct was prohibited by the criminal law. A claimant relying on s 2(g) may reasonably be asked to identify the conduct he says the words impute to him such as, in this case, the payment of a bribe. But to go further and ask for particularisation of the applicable provisions of the criminal law is to go too far. To this extent, the defendant’s request for information and/or the pleaded response and the introduction of evidence to support it were uncalled for.[42]The substance of the information is an agreed fact, and the passages of the Memorandum which convey that information are easily identified. In my judgment, the information comprised in the claimants’ proposition (d) is “information as to the commission or alleged commission by [the first and second claimants] of a criminal offence” within the meaning of DPA, s 2(g). I am satisfied that the ordinary reader would understand the suggestion to be one of criminal behaviour on the part of the first two claimants.[43]I believe that some readers would take the suggestion to be one of bribery, but there is another interpretation. And, if a single meaning has to be attributed to the relevant words, I would not find that the crime implied is bribery. Rather it is one of dealing with the proceeds of corruption, a species of money laundering. That is because the key imputation is one of delivering “illicit cash” via a courier, Govorun, whose true role was disguised. The use of quotation marks around the words “driver” and “bag carrier” suggests these are not Govorun’s real functions but fronts. It suggests conduct that was “furtive” or “secretive”. But those are not connotations of the word “illicit”. That is an adjective that qualifies the noun “cash”, suggesting it has an unlawful or otherwise illegitimate origin. (As it happens, a newspaper report published as I was preparing this judgment supports the point. It referred to HMRC’s new “powers to crack down on illicit finance” by using “account freezing orders” to “block … suspicious funds.”) The use of illicit cash is not a defining feature of bribery, which can be undertaken with “clean” funds.[44]The Memorandum states that Govorun was delivering the cash to Putin “during the 46. 1990s”. Numbered paragraph 3 tells the reader that in the 1990s Putin was engaged in “corrupt activities”, to the knowledge of the first and second claimants. The information conveyed by the relevant passages of the Memorandum is, in my judgment, that the claimants were using Govorun, acting under cover of the role of “driver” and “bag carrier”, as a courier to deliver directly to Putin large amounts of cash which was the proceeds of corruption.[45]I have heard no argument on whether the qualities to be attributed to the reader when deciding this issue are those of readers in this jurisdiction, or those of some other jurisdiction or jurisdictions. Nor do I have any evidence going to that issue. I do not believe it matters, given the nature of the candidate crimes. One would expect an ordinary reader in any civilised country to consider dealing with the proceeds of crime and bribing a public official to be prohibited by the criminal law.

A narrative

[46]Before addressing the issues arising from the defendant’s reliance on the Legal Purposes and National Security Exemptions, I need to say more about the origins of the Steele Dossier, and what was done with Memorandum 112. The essential points can be identified quite shortly. The genesis of the Steele Dossier[47]In January 2010, at an early stage of its existence, Orbis entered into a relationship with a journalist, Glenn Simpson. Mr Simpson was one of three journalists who founded Fusion GPS (“Fusion”), a consultancy based in Washington DC, to provide research and strategic intelligence services. Mr Simpson signed a Confidentiality Agreement dated 27 January 2010 by which he formally undertook (among other things) that “during and after the termination of my work with [Orbis] I may not disclose any trade secrets or other information of a confidential nature … relating to the company or its business … except in the proper course of my work hereunder or as required by law.”[48]Orbis worked with Fusion on a handful of occasions between 2010 and 2016. Sometimes, Orbis would engage Fusion, and on other occasions Fusion would engage Orbis.[49]In about late May 2016, Mr Simpson, on behalf of Fusion, contacted Mr Steele with instructions to investigate Donald Trump and his alleged links with Russia and Russian officials, specifically President Putin. Mr Trump was then the presumptive Republican candidate for the Presidency. Fusion was acting on the instructions of a Washington DC law firm called Perkins Coie, which in turn was acting on the instructions of one or more persons or bodies at the top of the Democratic Party (“the Ultimate Client”).[50]Pursuant to Fusion’s instructions, between June 2016 and the Presidential Election on 8 November 2016, Orbis produced the 16 memoranda that were eventually published in the Buzzfeed Article. The first memorandum was dated 20 June 2016. Four more were prepared in July, four in August, three in September, and four in October 2016. For this work, Orbis was paid a retainer of £100,000, in five monthly instalments. Orbis invoiced and was paid by Fusion. Disclosures[51]Orbis, through Mr Steele, admit or maintain that they made or authorised disclosures of memoranda from the Steele Dossier on the following occasions:(1) On 5 July 2016, Mr Steele and Mr Burrows met FBI officials at Orbis’ offices in London. Mr Steele provided the FBI with the reports which Orbis had prepared by that point. This did not include Memorandum 112. Mr Steele made a note of this meeting (“the FBI Note”).(2) In August 2016, Mr Steele provided the FBI with all the memoranda prepared to date. These did not include Memorandum 112. He promised to provide further reports.(3) On 14 September 2016, Memorandum 112 was delivered to Fusion. Orbis has dubbed this “the Fusion Disclosure” and I shall adopt that label.(4) In September 2016, to the FBI. Orbis’ pleaded case is that it delivered a copy of Memorandum 112 to “a senior US national security official” in or around September 2016. Mr Steele’s evidence is that within a few days of the Fusion Disclosure, that is to say in about mid-September 2016, he provided a copy of Memorandum 112 to the FBI. That is disputed.(5) In November 2016, Mr Steele made three further disclosures of Memorandum 112 and other memoranda from the Steele Dossier, to politicians and government officials: - a) Strobe Talbott, a former US Deputy Secretary of State; b) an unnamed individual described by Mr Steele as a “UK government national security official”; and c) David Kramer, a former US Assistant Secretary of State for Democracy, Human Rights and Labor, in the Bush Administration.[52]At some point between late November 2016 and 10 January 2017, Mr Kramer gave Buzzfeed access to the Steele Dossier, thereby causing or contributing to the publication of the Buzzfeed Article.[53]In December 2016, Mr Kramer asked Mr Steele to agree to him discussing the Steele Dossier with a senior US national security official, Celeste Wallander. Mr Steele maintains that he did not give or withhold consent, but in any event did not authorise the disclosure of Memorandum 112 by Mr Kramer to Ms Wallander. That has not been challenged, so I do not need to address any disclosure that may have been made by Mr Kramer to Ms Wallander.[54]Orbis has given a collective label to four disclosures of Memorandum 112: Mr Steele’s alleged disclosure to the FBI in September 2016, and the three disclosures of57. November 2016 for which he admits responsibility. Orbis calls these “the National Security Disclosures”. It is helpful to have a collective label, and I shall adopt this one, but without adopting any tendentious overtones it may possess. It is not disputed that Mr Steele’s motivation in making these disclosures was to protect the national security of the UK and/or the US. The question is whether that purpose requires that the data in question be exempted from the relevant aspects of the DPA.58. Responsibility for disclosure[55]Orbis accepts responsibility for the Fusion Disclosure and the National Security Disclosures. The only issue in dispute about those disclosures is whether Orbis did in fact disclose Memorandum 112 to the FBI in September 2016.[56]Orbis denies responsibility for any other disclosures, or any other processing activities of other controllers. That includes any disclosures to or publications by Buzzfeed, or other media organisations, which Orbis maintains are the responsibility of the media or of other individuals.

Steele’s alleged disclosure to the FBI in September 2016, and the three disclosures of

[57]In his opening submissions, in cross-examination, and in his argument on remedies, Mr Tomlinson raised the question of whether Orbis was responsible for disclosures of Memorandum 112 made by Mr Kramer to the Washington Post and to Buzzfeed, and thereby responsible for media publication of the personal data in Memorandum 112. In cross-examination, Mr Tomlinson showed Mr Steele the transcript of Mr Kramer’s deposition on 13 December 2017 in Gubarev v Buzzfeed Inc., a case brought in the US District Court for the Southern District of Florida. Mr Kramer gave evidence, in those proceedings, that Mr Steele knew that Mr Kramer was going to provide a copy of Memorandum 112 to the Washington Post. As for Buzzfeed, Mr Tomlinson secured an admission that Mr Steele had put Mr Kramer in touch with Ken Bensinger of Buzzfeed. He put it to Mr Steele that he did that when he knew, or should at least have foreseen, that Mr Bensinger would ask for the dossier and that Kramer wouldprovide it.[58]I was a little surprised by this aspect of the claimants’ case, as I had not detected any clear averment to this effect in the Particulars of Claim. There is mention there of disclosure to “third parties” including “the media” but no details, and no allegation that Orbis disclosed to Buzzfeed, or the Washington Post, or that it caused or authorised any such disclosure. The Particulars of Claim state that details of the identity of the recipients of Memorandum 112, other than Fusion, would be added after disclosure and/or the provision of further information by Orbis. But this was never done. Nor am I aware that any notice was given of an intention to rely on the Kramer transcript as hearsay evidence at the trial. In any event, the claimants have not persuaded me that any disclosures of Memorandum 112 by Mr Kramer represented the processing of data by or on behalf of Orbis.[59]Mr Steele admits briefing journalists about Orbis’ work, and the documentary evidence and cross-examination make it clear that, in and after late September 2016 he was heavily and enthusiastically involved in doing so. His explanation is that he wished to make known what he regarded as “wholescale Russian US election interference project”. But oral disclosures are not caught by the DPA: Scott v LGBT Foundation [2020] EWHC 483 (QB) [55] (Saini J). And encouraging the media to report on a story, and giving them background information about it, are not the same thing as providing or authorising the provision of documents for that purpose. The high point of this aspect of the claimants’ case would seem to be an article in Mother Jones dated 31 October 2016, for which Mr Steele has admitted he was a source. That article states that the authors have reviewed some of the Orbis reports, and appears to quote from them. The OIG report corroborates this, suggesting that a Mother Jones journalist provided one of Mr Steele’s reports to the FBI (footnote 259). Crossexamined, however, Mr Steele insisted that he had not given or read any of his reports to Mother Jones. He has been clear and consistent in his denials that he provided any journalist with a copy of Memorandum 112, or any other part of the Dossier, or authorised others to do so. In paragraph 57 of his revised first witness statement he said he did not disclose or discuss the content of Memorandum 112 with the media, and did not intend, authorise or envisage that the Memorandum “and the information it contains about the First and Second Claimants” would become more widely disseminated. In paragraph 58 he specifically denied giving permission for the provision of a copy of the Dossier to Ken Bensinger. That was not directly challenged.[60]The deposition of Mr Kramer is not a satisfactory basis for an invitation to reject Mr Steele’s evidence and find Orbis liable for disclosure and publication of Memorandum 112 made by others. Besides the procedural shortcomings I have identified, the deposition is provided to me shorn of its context. I am told nothing else about the Gubarev v Buzzfeed litigation, and very little about Mr Kramer except that (as is obvious) he had a clear motive for tailoring his evidence. In any event, knowledge that a person intends to make a disclosure is not enough to bring home liability. And the substance of Mr Kramer’s evidence, so far as Buzzfeed is concerned, is this. Mr Steele asked him to meet Mr Bensinger, but without asking him to provide a copy of the Dossier; Mr Kramer did not provide Mr Bensinger with a copy, but left him in a room with the memos for 20-30 minutes, on the agreed basis that Mr Bensinger would use the time to read them; in that period, Mr Bensinger took photos of the documents, without Mr Kramer’s knowledge or consent; and Mr Kramer only found out about this when he saw the Buzzfeed Article, and did not intend the Dossier to be published. Mr Tomlinson, having effectively called Mr Kramer as his witness, could not and did not question this account. It undermines the case he sought to advance.[61]On the basis of this evidence, I see no room for concluding that Mr Kramer made a disclosure to the Washington Post or Buzzfeed of the personal data contained in Memorandum 112 which amounted to processing of those data by or on behalf of Orbis, still less that the publication of those data by the Washington Post and Buzzfeed represented, or even resulted from, processing by or on behalf of Orbis. A data controller is responsible for persons who process data on his behalf (Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd (Information Comr intervening) [2017] EWCA Civ 121 [2018] QB 256 [70] (Lewison LJ)), but not for processing carried out by independent actors to whom the data controller has transferred a copy of the data (Various Claimants v Wm Morrison Supermarkets plc [2017] EWHC 3113 (QB) [2019] QB [47] (Langstaff J)).[62]It follows that the disclosures to be considered are the Fusion Disclosure and the National Security Disclosures.

The Legal Purposes Issue

[63]This issue relates only to the Fusion Disclosure. But I use that term to cover the compilation of the disputed information and its inclusion in Memorandum 112. It was not really controversial, and I accept that, for the purposes of this issue at least, the steps of acquisition, compilation, drafting, and disclosure of the information in question should be treated as a single interconnected act of processing. The relevant provisions The exemption[64]DPA s 35(2) provides that:
“Personal data are exempt from the non-disclosure provisions where the disclosure is necessary— (a) for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), or (b) for the purpose of obtaining legal advice, or is otherwise necessary for the purposes of establishing, exercising or defending legal rights.”
[65]“The non-disclosure provisions” is a term defined exhaustively in s 27(3) and (4) as follows:- “(3) In this Part “the non-disclosure provisions” means the provisions specified in subsection (4) to the extent to which they are inconsistent with the disclosure in question. (4) The provisions referred to in sub-section (3) are - (a) the first data protection principle, except to the extent to which it requires compliance with the conditions in Schedules 2 and 3, (b) the second, third, fourth and fifth data protection principles, and (c) sections 10 and 14(1) to (3).” which they are inconsistent with the disclosure in question. (a) the first data protection principle, except to the extent to which it requires compliance with the conditions in Schedules 2 and 3, (b) the second, third, fourth and fifth data protection principles, and (c) sections 10 and 14(1) to (3).”[66]Five uncontroversial points can be made about the Legal Purposes Exemption.(1) It only applies to a disclosure which is made for one or more of the specified purposes.(2) It only applies if the disclosure is “necessary” for one or more of those purposes. It is however agreed, and I accept, that in this context the term “necessary” does not bear the strong meaning of “indispensable” or “absolutely necessary”, but nor is it as weak as “desirable”; it bears an intermediate meaning which can be summarised as “reasonably necessary”: Cooper v National Crime Agency [2019] EWCA Civ 16 [89-90] (Sales LJ). The decision related to the term as used in the Schedule 2 Conditions, but I agree that it applies also to s 35(2).(3) The exemption is qualified by s 27(3): even if a disclosure is necessary for a specified legal purpose it will only be exempt from any “non-disclosure provision” if the application of that provision would be “inconsistent” with the disclosure in question.(4) Fourthly, as I have indicated, whilst s 35(2) can operate to exclude the duty to comply with the Fourth Principle it can only afford a partial exemption from the First Principle. A data controller which successfully invokes this exemption will still need to establish compliance with a Schedule 2 condition and, in relation to sensitive personal data, a Schedule 3 condition.(5) Finally, the burden of establishing purpose, necessity, inconsistency, and compliance with Schedule 2 and 3 conditions lies on the data controller.[67]In order to assess whether it would be “inconsistent with” the Fusion Disclosures to apply the Fourth Principle, or the First Principle’s requirements of fairness and lawfulness, it is relevant, if not essential, to consider what the impact of those provisions would be. The fairness requirement[68]The relevant provisions are located in DPA Schedule 1 Part II, which contains provisions as to the interpretation of the Data Protection Principles. Paragraph 2 contains these provisions about the First Principle, which I shall call “the Notice Requirements”: - “(1) Subject to paragraph 3, for the purposes of the first principle personal data are not to be treated as processed fairly unless … (b) in any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph 3 … … (3) The information referred to in sub-paragraph (1) is as follows, namely—(a) the identity of the data controller,(b) if he has nominated a representative for the purposes of this Act, the identity of that representative,(c) the purpose or purposes for which the data are intended to be processed, and(d) any further information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair.” processed fairly unless … (b) in any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph 3 … (a) the identity of the data controller, (b) if he has nominated a representative for the purposes of this Act, the identity of that representative, (c) the purpose or purposes for which the data are intended to be processed, and (d) any further information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair.”[69]Paragraph 2(2) also requires notification of the information in paragraph 2(3) within “a reasonable period”. This is either the time at which the data is first processed or when disclosure is first made to a third party. Accuracy[70]The Fourth Principle, so far as relevant, states simply that “Personal data shall be accurate ….”. DPA s 70(2) contains a "supplementary definition" which explains that “For the purposes of this Act, data are inaccurate if they are incorrect or misleading as to any matter of fact.” It is implicit in this wording that information may be “accurate” or “correct”, and yet misleading. These provisions, as any lawyer would swiftly appreciate, beg the question of what exactly is the information contained in the data or, putting it another way, what the data mean. I have discussed this issue already, in reaching my decision on the scope and content of the personal data.[71]There is a distinction, familiar to media and communications lawyers, between the literal meaning of a statement and a meaning that may be implied rather than spelled out, and will often be more serious. Any court tasked with deciding whether personal data or other kinds of information are or are not “accurate” will need to know which kind of meaning is to be attributed to data or information for that purpose. DPA Schedule 1 Part II contains provisions which reflect this. Paragraph 7 provides:
“The fourth principle is not to be regarded as being contravened by reason of any inaccuracy in personal data which accurately record information obtained by the data controller from the data subject or a third party in a case where— (a) having regard to the purpose or purposes for which the data were obtained and further processed, the data controller has taken reasonable steps to ensure the accuracy of the data, and (b) if the data subject has notified the data controller of the data subject’s view that the data are inaccurate, the data indicate that fact.”
[72]This may save the data controller from having to pay compensation for breach of the Fourth Principle. But, even if paragraph 7 applies, the Court has power to grant remedies in relation to personal data that it finds to be inaccurate. These include orders that the data controller rectify, block, erase or destroy the data and (where it considers it reasonably practicable) an order that the data controller inform third parties that this has been done. Those are consequences of DPA s 14(1)-(3), and remedies under those provisions can be granted even if there is no finding that the processing has been carried out in breach of the Fourth Principle: see NT1 v Google [85-86]. Rectification, blocking, erasure and destruction[73]These remedies are governed by s 14. They are available in a case where the data subject establishes(a) a right to compensation for breach of any of the requirements of the DPA and(b) a substantial risk of further contravention in respect of those data in such circumstances: see s 14(4) and (5). But the Legal Purposes Exemption is only available in respect of s 14 (1)-(3), which are concerned only with inaccuracy. Those subsections provide as follows: - “(1) If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data. (2) Subsection (1) applies whether or not the data accurately record information received or obtained by the data controller from the data subject or a third party but where the data accurately record such information, then— (a) if the requirements mentioned in paragraph 7 of Part II of Schedule 1 have been complied with, the court may, instead of making an order under subsection (1), make an order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve, and (b) if all or any of those requirements have not been complied with, the court may, instead of making an order under that subsection, make such order as it thinks fit for securing compliance with those requirements with or without a further order requiring the data to be supplemented by such a statement as is mentioned in paragraph (a). (3) Where the court— (a) makes an order under subsection (1), or (b) is satisfied on the application of a data subject that personal data of which he was the data subject and which have been rectified, blocked, erased or destroyed were inaccurate, it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.” (a) if the requirements mentioned in paragraph 7 of Part II of Schedule 1 have been complied with, the court may, instead of making an order under subsection (1), make an order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve, and (b) if all or any of those requirements have not been complied with, the court may, instead of making an order under that subsection, make such order as it thinks fit for securing compliance with those requirements with or without a further order requiring the data to be supplemented by such a statement as is mentioned in paragraph (a). (a) makes an order under subsection (1), or (b) is satisfied on the application of a data subject that personal data of which he was the data subject and which have been rectified, blocked, erased or destroyed were inaccurate, The parties’ contentions[74]Orbis’ case is that the creation of Memorandum 112, and the Fusion Disclosure which followed, were necessary, in the sense I have identified, for the carrying out of instructions Orbis received from Fusion, at the instigation of Perkins Coie, shortly after 29 July 2016. The purpose of those instructions, it is said, was “to facilitate an understanding of the extent to which Alfa worked with President Putin, given concerns about(i) potential interference by the Russian state in the US Presidential election process and(ii) suspected communications between the servers of Alfa Bank and Trump Tower.”[75]It is submitted that Mr Steele understood that the intelligence he gathered would be used to advise the Ultimate Client on the prospect of legal proceedings and, if necessary, deployed in such proceedings to challenge the eventual outcome of the Presidential Election. Orbis’ instructions, and thus the Fusion Disclosure, were reasonably necessary to enable such advice to be given and for decisions to be made about the legal implications of those matters and/or to assist the Ultimate Client with those implications. Specifically, it is said that the Fusion Disclosure was necessary as a step towards establishing whether any rights under electoral law might flow from the matters recorded in the memoranda. That brings the case within the concept of “establishing legal rights” in s 35(2).[76]This has the following consequences, submits Mr Millar:-(1) The Fourth Principle “falls away”. Memorandum 112 was an intelligence report, the fruit of investigative activities. It was a “piece of the mosaic” on unresolved questions which were the subject of continuing enquiry, as part of a wider exercise of assessing the alleged links between Russia and the Trump campaign. That was a matter of some urgency, given the election on 8 November 2016. In all these circumstances, compliance with the duty of accuracy would have been inconsistent with the purposes for which Memorandum 112 was compiled and disclosed.(2) The Notice Requirements also “fall away”. The purposes of the Fusion Disclosure, and the duties of confidence owed to clients in such contexts, were plainly inconsistent with a requirement to give the data subjects advance notice.(3) Although the duty to comply with a Schedule 2 condition and (on the basis of my findings) a Schedule 3 condition remains in place, that duty is discharged by virtue of the very purposes that justify the application of the Legal Purposes Exemption.[77]Mr Tomlinson argues that the defendants have failed to show(a) that the claimants’ personal data was processed for any of the specified purposes,(b) that, if it was, such processing was “necessary” for such purposes, or(c) that, if it was, compliance with the Fourth Principle would be inconsistent with those purposes. It is said that Orbis’ submissions are based on a legal misconception, have no evidential foundation, and are at odds with the evidence as a whole.[78]Mr Tomlinson makes the following main points: -(1) As a matter of law, the purposes that matter are those of the data controller - Mr Steele and Orbis - not those of Perkins Coie or the Ultimate Client. Orbis and Mr Steele were not processing data for any legal purpose. They were merely concerned to fulfil the contract with Fusion.(2) Moreover, Orbis’ case about the purposes for which Perkins Coie gave their instructions relies on nothing more than “assumptions” made by Mr Steele, based on the fact that Fusion had been instructed by a law firm (references to his assumptions are to be found in several passages in his witness statement). Mr Steele’s beliefs about those matters are irrelevant. There is no evidence that the Memoranda were ever used for the purposes of obtaining legal advice or establishing legal rights. It is obvious, on the evidence, that they were being used for political campaigning purposes.(3) In any event, the focus must be on Memorandum 112 and the personal data it contains about the claimants. Whatever might be said about the Dossier generally, there is no basis on which that personal data could even have been relevant to any of the legal purposes identified. Even if, contrary to that submission, the defendant was able to establish that the data were disclosed for “legal purposes” it could not be said that the disclosure was “reasonably necessary” to that end. It was not needed for any such purposes.(4) There is no inconsistency between the Fourth Principle and the disclosure of Memorandum 112 for the alleged legal purposes. In this kind of “evidence gathering” context it is important to ensure the accuracy of personal data. Assessment Purposes

The facts

[79]My first task is to consider the period of about 3 ½ months between Orbis’ instructions and the Fusion Disclosure, to identify the purpose or purposes for which Memorandum 112 was created and disclosed to Fusion. Mr Tomlinson is right to say that the answer does not depend on any beliefs or “assumptions” of Mr Steele. Nor is the answer dictated by the fact that Fusion were instructed by a law firm. But the process does involve drawing inferences from facts that are agreed, and other evidence that I accept.[80]A purpose is an aim or goal or end in view, or the reason why something is done. In the light of Counsel’s submissions, I need to make an assessment of the purposes of different participants in the process.[81]This task faces some obstacles. There were a number of participants who were directly involved, and could have shed light on the questions for determination, but I have evidence from only one of them: Mr Steele. He has given two very different versions of events, which are mutually inconsistent in a number of respects. This was, on any view, an intelligence-gathering exercise, inherently unlikely to be heavily documented. Mr Steele kept few records, and most of these he did keep have been lost or destroyed. One contemporaneous record of relevance has survived: the FBI Note, recording the substance of a meeting on 5 July 2016. But this only helps with some relatively minor aspects of the story. There is little other documentation that throws any light on the facts. Much of what there is consists of press cuttings, from several months after the events to which they relate, containing hearsay from anonymous or unidentified sources. Against that background I take a cautious approach, but find the following relevant facts.[82]Orbis’ engagement by Fusion was first mooted at a meeting between Mr Simpson and Mr Steele at Carluccio’s restaurant at Heathrow Airport in late May 2016, and confirmed by Mr Simpson in a telephone conversation between them about a week later. I accept Mr Steele’s evidence: the words used were to the effect that Orbis was to collect intelligence from sources on Trump-Russia issues and interference in the US Presidential campaign, which would be “fed to” a “respectable” law firm based in Washington DC which was Fusion’s client. The initial engagement was for one month on a retainer of $20,000. The retainer was in due course increased. But there was no documentation, at that time or later. The law firm, though not named at the time, was Perkins Coie. As was apparent to Mr Steele, the law firm had a principal: the Ultimate Client.[83]Mr Steele’s evidence is that he now believes the Ultimate Client was the Democratic National Committee. Mr Millar submits that the Ultimate Client was the Clinton election campaign, “Hillary for America”. This is in line with the FBI Note of 5 July 2016, which records Mr Steele telling the FBI that Orbis had been instructed by Mr Simpson of Fusion and “Democratic Party Associates” but that “the ultimate client were (sic) the leadership of the Clinton presidential campaign”. The FBI Note also indicates that Mr Steele had been told by that stage that Mrs Clinton herself was aware of what Orbis had been commissioned to do.[84]I have little reliable evidence as to who exactly was the Ultimate Client, but I have enough to find that Perkins Coie were instructed by one or more people or organisations within the upper echelons of the Democratic Party, concerned to ensure Hillary Clinton’s election as President. I also find that Mr Steele knew this much from early June 2016, at least. I do not believe it is necessary, or relevant, to go further. I shall continue to refer to the Ultimate Client, without identifying who they were.[85]It would be naïve and unreal to suppose that the Ultimate Client, when instructing Perkins Coie, did not have political aims. The role and position of the Ultimate Client, the relationship in which that client stood to Mr Trump, and the nature of the instructions, make it obvious that they did. But it does not follow that there was no legal purpose. In my judgment, on the evidence before me at this trial, there was one, and it applied to the commissioning of the Dossier as a whole, including the creation and delivery of Memorandum 112. The purpose was obtaining legal advice.[86]The Ultimate Client’s instructions were not given to Orbis or to Fusion. They were given to a law firm, and passed on by that firm to the investigative organisations. The plan from the outset was that the output of the investigative activities that Perkins Coie commissioned would then (to use Mr Steele’s words) be “fed back” to the law firm. This raises the question of why a law firm was involved at all. In crossexamination, Mr Tomlinson put it to Mr Steele that Perkins Coie were effectively the “legal arm” of the Democratic Party. He accepted that, but I cannot give any real weight to this rather vague proposition. Nor can I uphold the further proposition about the firm that was put by Mr Tomlinson to Mr Steele:
“they instruct investigators to obtain material about political opponents in a privileged setting so it can then be used for campaigning by the Democratic Party”
. There is no evidence before me that could sustain that suggestion. “they instruct investigators to obtain material about political opponents in a privileged setting so it can then be used for campaigning by the Democratic Party”.[87]My conclusion is that Perkins Coie were approached by the Ultimate Client and given the instructions they were with a view to obtaining information for the purpose (though not the exclusive purpose) of taking legal advice on its legal implications and what, if any, legal steps could be taken as a result. On the balance of probabilities, Perkins Coie’s sole or dominant purpose in commissioning the Dossier was to obtain information for the purpose of providing legal advice. These are not mere assumptions nor are they speculation, as suggested by Mr Tomlinson. They are reasonable inferences from the fact that a law firm was instructed at all, and from such of the evidence as I accept about the nature of the firm, its dealings with Fusion and Orbis, and the individual lawyers who were involved.(1) It was in the latter part of July 2016 that Mr Steele first learned the identity of the law firm, the existence and role of which had been known to him from the outset. He was given the name by Mr Simpson and looked up the firm’s website. It is on that basis that he accepted the proposition that the firm was “the legal arm” of the Democratic Party.(2) After this, on about 29 July 2016, Mr Steele and Mr Simpson met a partner from the firm’s Privacy and Data Security Practice, named Michael Sussman. Mr Sussman mentioned allegations about suspicious server activity involving Alfa Bank and the Trump organisation.(3) At this meeting, Mr Steele was told that the team instructing him and Fusion included another partner, Marc Elias. Mr Elias was General Counsel to the Clinton Presidential campaign, and an electoral law specialist. The firm’s website suggests that he is one of the foremost electoral litigators in the United States. Mr Steele gave evidence suggesting that Mr Elias was or may have been in an adjacent room at the time of this meeting. I am not confident of that, and make no finding on it. I do find that Mr Elias was not at the meeting.(4) It was shortly after this meeting that Mr Simpson gave instructions by telephone for Orbis to produce a Memorandum on Alfa Bank’s links with the Kremlin. Memorandum 112 responded to those instructions, and was prepared over the four to six weeks immediately preceding the Fusion Disclosure.(5) After the Fusion Disclosure Mr Steele had a second meeting with Perkins Coie, at which its contents were discussed. This was on or about 22 September 2016.(6) At some point in his dealings with Perkins Coie, Mr Steele was told by them that they wanted to obtain information and monitor irregularities in the election campaign.[88]These findings represent an acceptance of evidence given by Mr Steele in his second witness statement dated 15 March 2020, and on oath at the trial. They mean that the account given in first witness statement was significantly mistaken. That statement said that Mr Steele had one meeting with the lawyers in late July, then another which took place on 11 September 2016, which is when he was instructed to produce Memorandum 112. This is a big change of story, and that obviously casts doubt on the revised account. The new account comes several years after the events.[89]I have given careful thought to this, but I accept Mr Steele’s revised account. It is coherent, more probable than the original one, and there is an explanation, supported by documents. Mr Steele says that when preparing to give evidence he was prompted to reconsider his original account by noting something in the December 2019 Report of the Office of the Inspector General (“OIG”). This recorded that Mr Steele had met a Department of Justice official on 23 September 2016. Examination of his passport shows that he entered the USA on 29 July and 21 September 2016. A credit card statement shows he flew out of London on 21 September, and on 24 September paid for a stay at the Hilton Hotel in Washington DC. All this was at odds with a meeting on 11 September.[90]As for the late July meeting, I have taken account of Mr Tomlinson’s challenge to the suggestion that Perkins Coie briefed Mr Steele on suspicious server activity at that time. Mr Tomlinson relied on two media articles, one by Franklin Foer in Slate, dated 31 October 2016, entitled “Was a Trump Server Communicating With Russia”, and another by Dexter Filkins in The New Yorker dated 15 October 2018, entitled “Was there a connection between a Russian Bank and the Trump Campaign?” Mr Steele was cross-examined to the effect that these articles were inconsistent with his evidence. It was put to him that there was not a shred of evidence that, in late July 2016, anyone had reached the conclusions that, according to Mr Steele, were put to him by Perkins Coie. These are articles based on anonymous sources which sought to tell the story of an emerging “scandal”, months or years after the event. They both suggest that computer scientists were investigating the possibility of Russian hacking of the Republican Party from as early as June 2016. The articles were not aimed at, and did not confront, the propositions advanced by Mr Steele in his evidence to me. They do not profess to set out a minutely detailed chronology. Neither the authors nor their sources have given evidence or addressed the specifics of Orbis’ case in writing. I do not regard this anonymous second-hand hearsay as a sound basis for rejecting Mr Steele’s evidence.[91]As for the prospect of taking legal action, Mr Tomlinson is right: there is no evidence of any legal action being taken, or of any thought being given to it, or as to what might have been done, legally. I can however draw inferences. My conclusion is that the possibility of litigation may well have been in the minds of the Ultimate Client and Perkins Coie at the outset, in the sense that it would have been devoutly hoped for, and would have been pursued if favourable advice had been given. By the time of the election, I infer that any thought of litigation had been abandoned. It is likely that this came about much earlier, by the time of the media briefings in which Mr Steele was involved, in late September. By that time political purposes had come very much to the fore. As Mr Millar reminded me, it would be dangerous to read purposes back from the period of the pre-election media campaign to the position at and before the time of the Fusion Disclosure. But I cannot find that litigation was at any time up to the delivery of Memorandum 112 anything more than a speculative, remote and unlikely prospect.[92]I have dealt with the purposes of the Ultimate Client and Perkins Coie. What of Fusion and, most importantly, Orbis? They knew the information would be passed to Perkins Coie, and they knew or believed that Perkins Coie would use it for legal purposes. But at least in a narrow sense, Mr Tomlinson is right: their purposes were to perform the tasks they had been engaged to undertake: to collect and report back on intelligence from sources on Trump-Russia issues and interference in the US Presidential campaign. They were not interested in obtaining legal advice, or establishing legal rights. The law[93]In the light of the findings I have made there are four main questions to consider:(1) whose purpose matters,(2) what if a legal purpose is accompanied by another,(3) what is the scope of “establishing legal rights”, in this context, and(4) is a disclosure made “for the purposes of or in connection with … prospective legal proceedings” within s 35(2)(a), if the prospect of any such proceedings is remote and unlikely?[94]Different parties concerned with a disclosure may have different aims in view, and different motives. In my judgment it is too narrow to say that it is only the data controller’s purpose that matters, for the purposes of s 35(2).(1) That approach would have some odd consequences. A client seeking information for the purpose of obtaining legal advice would be protected. It is not clear that the same would be true of a lawyer acting for the client. The supplier of the information, who is unlikely to share, may not care about, and may not even be aware of the client’s purposes, would be unprotected.(2) The statute does not refer to the purpose of the data controller; it poses the more abstract question of whether “the disclosure” is necessary for certain purposes. This also indicates that an objective, holistic approach is appropriate.(3) The Information Commissioner’s guidance on “When can I disclose information to a private investigator” takes a similar approach:
“The organisation being asked for the information must consider each request, on a case by case basis, and be satisfied that it is genuine and within the scope of the exemption. In particular they will need to be satisfied that the prospect of proceedings is genuine, proceedings are already underway or legal advice is genuinely being sought. …”
I do not read this as suggesting that the application of the exemption depends on the care taken by the data controller. It is practical guidance on how best to ensure that the exemption can be relied on. But it assumes, in my view rightly, that if the underlying purpose for which disclosure is requested is to obtain legal advice or use the information in legal proceedings, the data controller that makes the disclosure is protected.[95]In my judgment, if a lawyer obtains information with the aim of using it for the purpose of formulating legal advice to a client on a matter within the scope of the lawyer’s instructions, the disclosure of that information to the lawyer is made for the purpose of obtaining such advice.[96]Turning to the second question, the argument proceeded largely on the unstated twin assumptions that (in this context at least) a disclosure of data can only have one purpose or, at any rate, that the Fusion Disclosure had only one, and the task is to search for and identify that single purpose. I am not convinced that either assumption is correct. They do not reflect the ordinary experience of life or the experience of the law. As everyone knows, actions are often undertaken for more than one reason, and with more than one aim in view. This is a well-known feature of politics. It is also reflected in the established English law on legal professional privilege, which is conferred on a communication only where its “dominant purpose” is pending or contemplated litigation or obtaining legal advice.[97]Section 35(2) speaks of a disclosure for “the purpose of … legal proceedings” and “the purpose of obtaining legal advice”, using the singular. The wording is not dictated by the Directive, which permits but does not prescribe this exemption or define its scope. So, it seems to me that the words of s 35(2) must be given their ordinary meaning. I see no reason to read in the word “dominant” (which comes from a different legal context) or any similar qualifier. There seem to be two candidate interpretations: either the exemption is available only if the legal purpose is the sole purpose, or it is sufficient if it is a purpose. The latter is the more natural interpretation. If one of the purposes of a disclosure is to obtain legal advice it is fair to say that it is made for that purpose, even if there is a collateral political aim. This approach does not give too free a rein to the exemption, as the exemption will only apply if the data controller makes out the requirement of necessity.[98]As to the third question, authority shows that the concept of “establishing legal rights” is a broad one, encompassing investigations to establish whether such rights exist.(1) In Cooper v National Crime Agency (above) the claimant was an officer of the Serious Organised Crime Agency (“SOCA”). His involvement in an altercation outside a pub led to him being arrested and charged by Sussex police with being drunk and disorderly, and assaulting a police officer. Information about these matters was used by SOCA to consider, initiate, and conduct disciplinary proceedings which led to Mr Cooper’s dismissal, and for an internal appeal against that dismissal. The County Court held that this processing satisfied a Schedule 3 condition, as it fell within the scope of paragraph (c) of condition 6, which reads as follows: “The processing – (a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), (b) is necessary for the purpose of obtaining legal advice, or (c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.” (a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), (b) is necessary for the purpose of obtaining legal advice, or (c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.”(2) At [121], the Court of Appeal agreed, holding that SOCA’s processing of sensitive personal data relating to Mr Cooper was necessary for the purposes of establishing whether SOCA was entitled to dismiss him and “… whether others, such as a victim, the IPCC or central Government, had legal rights to require SOCA to proceed against Mr Cooper by way of investigation, disciplinary proceedings and dismissal.”(3) This is not a decision on the meaning and effect of DPA s 35(2), but the wording is identical; only the punctuation and paragraph lettering differ. The two provisions, in different parts of the same Act, cannot sensibly be construed as having different meanings.[99]On the fourth question, it is enough to say that it would be artificial to speak of a disclosure as “made for the purpose of or in connection with” prospective legal proceedings, when no proceedings are yet contemplated, the prospect of any being brought is remote, and the disclosure is made for the purpose of obtaining legal advice on whether there is any arguable basis in law for such proceedings. Application of the law to the facts[100]It has not been shown that the Fusion Disclosure was made for the purpose of or in connection with any prospective legal proceedings; the evidence does not reveal any realistic prospect of proceedings at or before the time of the disclosure. However, in my judgment the Fusion Disclosure was made for the purposes of obtaining legal advice, and establishing legal rights in the broad sense illuminated by the decision in Cooper. Those are purposes for which the Ultimate Client instructed Perkins Coie. They are purposes for which Fusion commissioned the work that led to the production of the Steele Dossier, and its disclosure to Fusion. I do not think I can place weight on the absence of evidence that Memorandum 112 was actually used to obtain legal advice. Care is needed before basing a finding on the absence of evidence. Here, there are many possible explanations, including legal professional privilege. It would be wrong to speculate. Necessity[101]In my judgment, the Fusion Disclosure was necessary for the purposes of obtaining legal advice and establishing legal rights. Mr Tomlinson’s approach is unduly narrow, on the facts and as a matter of law.(1) As to the facts, it is true that there is nothing in Memorandum 112 that goes to the question of whether there were links between Mr Trump and President Putin, or Russian officials. But as Mr Millar rightly says, the relevance of this document should not be considered in isolation, or in blinkers. It must be assessed in the context of the overall project, and the totality of Orbis’ instructions.(2) As to the law, “reasonable necessity” and proportionality go hand in hand, and there is a margin of appreciation: see the discussion in Cooper v National Crime Agency [89-92]. It is not a question of whether the Ultimate Client could not have been advised, in the absence of this information.[102]It is tolerably clear on the evidence that the reason why Alfa, and its connections with Mr Putin, were investigated was that Perkins Coie were in possession of information that there had been server activity linking Alfa Bank with Trump Tower in New York, where Mr Trump’s organisation was based. On the evidence, the source of that information is unclear. But there were media reports to this effect later on. And by 29 July 2016 Mr Steele was told about this, and Perkins Coie suggested to him that the links were suspicious: see [87(2)] above. I accept Mr Steele’s evidence that his instructions in respect of Memorandum 112 resulted from this information. Orbis was, on the law firm’s instructions, looking for evidence as to whether Alfa and its principals might represent a Trump/Putin link.[103]It was, in my judgment, well within the margin of appreciation to conclude that, in order for the Ultimate Client to obtain legal advice on possible Russian interference in the Presidential election, it was reasonably necessary and proportionate for Orbis to obtain and pass to Fusion, for onward disclosure to Perkins Coie, information about links between Alfa, its principals, and President Putin. Inconsistency[104]The question is whether the application of the Notice Requirements, Fourth Principle and/or ss 14(1)-(3) would be inconsistent with “the disclosure in question”. The answer must depend on the particular facts of the case.(1) I accept Orbis’ submission, that the application of the Notice Requirements would be inconsistent with the Fusion Disclosure. The idea that, before information is passed to a lawyer for the purposes of obtaining legal advice, or establishing legal rights, it must be sifted for personal data to identify each individual whose data is contained in the information and give them notice of what is proposed is more than surprising. I do not accept that before passing this information to Fusion, for onward transmission to Perkins Coie, Orbis was duty bound to give notice to each of the claimants of what it was doing, in what capacity, and why. The interference with private life involved in an undisclosed but narrowly focused disclosure of this kind is proportionate to the purposes in hand.(2) It would be inconsistent to subject a data controller making a disclosure for the purpose of obtaining legal advice or establishing legal rights to the full rigour of an absolute duty of accuracy, accompanied by a right to compensation for breach. I do not accept Mr Tomlinson’s submission that the importance of accuracy in disclosures made for these purposes makes this necessary. But in my judgment, it would not be inconsistent to apply the Fourth Principle to the Fusion Disclosure. That is because of the qualification on the duty of accuracy provided for by paragraph 7 of Sch 1 Part II. a) To the extent that the information in Memorandum 112 was accurate and factual, as opposed to expression of opinion, it was “information obtained by the data controller from … a third party”. It follows that if Orbis can show that (a) it took reasonable steps to ensure accuracy and (b). the data indicate the claimants’ view that the data are inaccurate, any inaccuracy would not amount to a breach of the Fourth Principle. Orbis would be immune from a compensation claim. b). Reasonableness for this purpose is context-specific: it must be assessed “having regard to the … purposes for which the data were obtained and further processed”. I do not consider the application of such a limited duty of care would be inconsistent with the Fusion Disclosure. Mr Millar has not argued that it is or would be inconsistent. c). The submission on behalf of Orbis has been a different one: that paragraph 7 is in a “separate compartment” from s 35(2) and 27, and not tied in with the applicability or non-applicability of the exemption. It is concerned only with after-the-event assessment of processing, and its consequences. This was an ingenious submission, but a freestanding argument for which I have found no support in the legislative scheme, or the legal texts I have consulted (see Jay, Data Protection Law and Practice para 14-13 and 19-16 to 19-23). On the contrary, paragraph 7 is part of a Schedule expressly concerned with “Interpretation of the Principles in Part I”. (3). It would not, in my judgment, be inconsistent with the Fusion Disclosure for the Court to apply ss 14(1)-(3). This is not an issue which either Counsel addressed in detail. Both addressed these provisions in the context of remedies, advancing submissions as to whether and how the discretion conferred by these provisions should or should not be exercised. It seems to me that, analytically, there is a prior question: whether the disclosure is exempt from these provisions pursuant to s 35. I do not believe it is. Sections 14(1)-(3) confer discretions. There may be disclosures within the Legal Purposes Exemption in respect of which it would be inconsistent even to consider whether the remedies of rectification, blocking, erasure or destruction should be granted. The Fusion Disclosure is not such a case. The National Security Issue 113. The law[105]DPA s 28(1) provides that “Personal data are exempt from any of the provisions of -(a) the data protection principles,(b) Parts II, III and V, and(c) section 55, if the exemption from that provision is required for the purpose of safeguarding national security.” (a) the data protection principles, (b) Parts II, III and V, and (c) section 55, if the exemption from that provision is required for the purpose of safeguarding national security.”[106]Typically, the data controller relying on this provision will be a Government department or other public body. The authorities on this exemption are all concerned with cases of that kind. It is however common ground, and I agree, that this exemption is available to any data controller.[107]“National security” is not defined by the DPA, but it plainly means the security of the United Kingdom as opposed to any other nation. Safeguarding national security involves affording protection against some threat or risk to the security or well-being of the nation and its people, but this must not be looked at too narrowly; actions which are targeted at other nations may indirectly threaten the national security of the UK: Secretary of State for the Home Department v Rehman [2001] UKHL 47 [2003] 1 AC 153 [16-17] (Lord Slynn), [50] (Lord Hoffmann). National security encompasses not only military defence but also the protection of democracy and the legal and constitutional systems of the state: Baker v Information Commissioner and the Cabinet Office (EA/2006/0045, 4 April 2007) [26] (a decision on the similarlyworded provisions of s 24 of the Freedom of Information Act 2000 (“FoIA”)).[108]Provision is made by s 28(2) for a Minister of the Crown to issue a certificate that the exemption is “required”. Sections 28(2)-(12) provide for such a certificate to be conclusive subject to certain specified rights of appeal. The authorities are largely concerned with the scope and application of those provisions, and the validity of certificates issued thereunder. No case has been cited in which the exemption has been tested on facts such as those of this case, in the absence of any certificate. Nonetheless, I accept that it is in principle open to a private body, such as Orbis, to assert and seek to prove that an exemption from a given principle or provision is required for the specified purpose. The statute does not make certification the only method of determining whether that is so.[109]The organs of the State are likely to be best placed to assess whether an exemption is required for the purpose of safeguarding national security. One reason for that is that this is a matter of evaluation and judgment, which must take into account not only the likelihood and degree of any prejudice to national security, but also the importance of the security interest at stake and the consequences for others of the judgment made; c.f. Rehman [17] (Lord Slynn) and [56] (Lord Hoffmann). Another is that the state is likely to have access to more relevant information than a private body or individual. The state does not have exclusive competence in this area; evidence from a state official is not a legal pre-requisite of a finding that a s 28 exemption is required. But any litigant asserting before a Court or tribunal that personal data are required to be exempt from a provision of the DPA for the purpose of safeguarding national security must put forward a cogent basis for such a conclusion.[110]The parties are at odds about the meaning to be given to the term “required”. Mr Millar submits that the word has the same meaning as “necessary” in s 35(2). He submits that if the Court accepts Orbis’ contention that the National Security Disclosures were reasonably necessary for the purposes of safeguarding the national security of the US and/or the UK then it should also agree that exemption from the First and Fourth Principles was and is “required” within the meaning of s 28(1). Mr Tomlinson submits that the difference in wording reflects a legislative intention to impose a more exacting test. Personal data are only exempt if such an exemption is “required”, in the sense that it is “essential”. As will become apparent, I do not consider the answer is decisive in this case, but I prefer Mr Tomlinson’s submission.[111]The structure and the language of s 28 are both different from those of the Legal Purposes Exemption. It might be said that the differences are more semantic and apparent than real. There are however two points about the language which are, in my judgment, significant for present purposes.(1) The first is that the s 28 exemption applies to personal data and not to a disclosure. This is a broad exemption which protects, or is capable of protecting, specified kinds or categories or descriptions of information rather than disclosures that take place for certain kinds of purpose. It can be a classbased exemption. This is reflected in s 28(3), which provides that a Ministerial certificate may “identify the personal data to which it applies by means of a general description”.(2) Secondly, the test imposed by s 28 is not whether the application of a principle or provision would be “inconsistent with” a disclosure which is “necessary” for a purpose. The question posed is whether the exemption is “required” for the specified purpose.[112]The concept of necessity is a familiar one, much used, much litigated and well understood in the context of human rights and data protection law. “Necessary” is the term used in the “parent” of s 28(1), namely Article 13(1)(a) of the Directive which provides that “Member States may adopt legislative measures to restrict the scope of the obligations … provided for in Article… 6(1) … when such a restriction constitutes a necessary measure to safeguard: (a) national security …” It would have been easy, indeed natural, to use the same word in s 28(1), but Parliament chose a different term. The Court should treat that choice as significant. It cannot denote a broader concept than the word “necessary”. The intention I attribute to Parliament is to impose a more exacting test, limiting the scope of this broad exemption to cases where it is judged to be indispensable to the safety and well-being of the nation that certain personal data be exempt from a Data Protection Principle or other DPA provision. If this analysis is correct, it follows that there may be cases in which a disclosure of personal data is “reasonably necessary” for the purposes of national security but the purpose of safeguarding national security does not require that the personal data be exempt from any of the specified DPA provisions. The facts

The National Security Issue

[113]I have set out Orbis’ case on the facts at 51(2)-(3), (4) and (5) above. Mr Steele has given evidence supporting that case. For the most part, he was not challenged about what took place. On the one disputed issue, namely whether Mr Steele provided the FBI with a copy of Memorandum 112 in September 2016, within a few days of the Fusion Disclosure, I find in favour of Orbis.(1) The FBI Note indicates that the meeting of 5 July 2016 was one at which Mr 123. Steele volunteered disclosures to the FBI. It records that the FBI officials were “generally impressed with the reporting”, “stunned” by one aspect, and asked when there might be follow-up opportunities. One of the officers said he would circulate the reporting to “a small group of senior managers and analysis at FBI HQ”. The note was made on 8 July 2016, apparently for internal purposes. It reflects Mr Steele’s state of mind at that time, and I consider it likely to be an accurate reflection of what actually happened.(2) In oral evidence he elaborated, by explaining that his understanding in July 2016 was that the FBI officer he met had cleared his lines with the Assistant Secretary of State, Victoria Nuland. He was challenged over that, which was not in his statement, but I accept it.(3) It is an agreed fact that, by 31 July 2016, the FBI had opened an investigation into allegations of foreign interference with the US Presidential Elections, under the name “Crossfire Hurricane”.(4) It is an undisputed fact, and I accept, that Mr Steele provided further “Dossier” memoranda to the FBI in August 2016. I accept his evidence, which has not been contradicted, that he did so, without seeking permission from his principals, because the FBI asked him “to provide them with all the intelligence we had gathered in the course of our engagement by Fusion”, he considered the intelligence to be important, and considered it his duty to the Crown to seek to ensure that the intelligence was brought to the attention of appropriate authorities and thoroughly investigated.(5) As already mentioned, by late September, Mr Steele was enthusiastically briefing journalists about Orbis’ findings.(6) Mr Steele’s evidence that he provided Memorandum 112 to the FBI in September is consistent with the pattern of these other items of evidence.(7) There is documentary evidence of a meeting on 11 October 2016, between Mr Steele, another Orbis representative, and Kathy Kavalec of the State Department at which Orbis’ “investigation into the Russia/Trump connection” was discussed. Mr Steele was, at this stage, still regarded by the FBI as a covert human source. He told me that it was clear to him at this meeting that the Memorandum was being discussed between the FBI and State Department. A State Department note of this meeting provides some support for that evidence. It refers to three “Russian lines of effort” that are being tracked by Orbis. One is “Contacts between Trump – via Manafort – and the Kremlin”. This section of the note contains the following:
“Peter Aven of Alfa Bank has been the conduit for secret communications between the Kremlin and Manafort; messages are encrypted via TOR software and run between a hidden server managed by Alfa Bank (see separate paper on this channel) … Steele said Aven’s contacts with Putin go back to St Petersburg, when Putin made $100M in the oil-for-food business while Aven was Minister of Foreign Trade.”
This further demonstrates Mr Steele’s enthusiasm for providing the US authorities with information of the kind contained in Memorandum 112, and suggests that the State Department already had a separate paper on the topic of communications via a hidden server managed by Alfa Bank. (8) The claimants rely on three footnotes to the OIG Report. Footnote 231 identifies Memorandum 112 as one of a four “reports … that Steele did not furnish to the FBI, which range in date from July 30 to September 2016”. Footnote 259 states that the Crossfire Hurricane team received Memorandum 112 “on or about November 6, 2016, from a Mother Jones journalist through then FBI Counsel James Baker”. Footnote 319 refers to the provision of (among others) Memorandum 112 to the FBI by Senator John McCain, on 9 December 2016. It states that FBI records show that it “had not previously received” that report from Steele. (9) There is no evidence to explain these footnotes. The sources on which they are based have not been identified to me. Again, I am asked to prefer multiple hearsay evidence from unidentified sources to that of a witness, supported to some extent by a contemporaneous document. In my judgment, it is unlikely that Mr Steele failed to provide the FBI with a report on matters which he plainly considered to be important, and which he was briefing journalists about and discussing with the State Department within a month of making the Fusion Disclosure. On the balance of probabilities, the footnotes are mistaken insofar as they suggest that Mr Steele did not provide Memorandum 112 to the FBI. That could be because its provision was somehow not recorded, or that the records were not identified in the course of preparing the OIG Report, or for some other reason.[114]This means that there are four National Security Disclosures for consideration. My findings, about those disclosures are as follows. September 2016: The FBI[115]The memorandum was volunteered by Mr Steele, rather than requisitioned or demanded by the FBI. He did this because he felt “duty bound” to make the disclosure. He probably did it by secure email, this being the method he used to provide the FBI with other Dossier reports. The State Department note indicates that a record was made at that department. The evidence does not suggest, however, that the FBI or the State Department took any particular interest in the claimants, or Alfa, or Memorandum 112. The best explanation for the footnotes to the OIG report may be that the FBI did not regard the contents of Memorandum 112 as of high importance. Early November 2016: Strobe Talbott[116]In early November, Mr Steele personally provided a copy of the Dossier, including Memorandum 112, to Mr Talbott. The background, as explained in Mr Steele’s first witness statement, is this. Mr Talbott, who was at the time the President of the Brookings Institution and a member of the Council on Foreign Relations, approached Mr Steele. He said that he was due to meet a group of individuals at the State Department, and asked Mr Steele to “share a copy of the Dossier with him, with a view to him being able to discuss the national security issues raised with these individuals”. Mr Steele agreed. He did so on the understanding that Mr Talbott had been speaking to the US Secretary of State John Kerry, and Ms Nuland, who knew of the Dossier and its broad content; and that the individuals whom Mr Talbott was due to meet included the then US Deputy Secretary of State, Tony Blinken. Mid-November 2016: the UK government national security official[117]By mid-November, Mr Steele had come to the view that the intelligence he was receiving had national security implications for the UK, which he thought “could be exposed to similar risks as those apparently arising in the US”. He considered he owed a continuing duty to report to his former employer on “any matter pertinent to UK national security”. On or about 15 November 2016, he conferred with a former colleague, without providing copies of his memoranda or discussing the content. They agreed he should report to “the national security apparatus of the UK government”, for the purpose of helping safeguard UK national security. He therefore contacted “a senior UK government national security official”, who indicated agreement with Mr Steele’s assessment that he should report the relevant intelligence. The official requested and Mr Steele provided copies of the memoranda, including Memorandum 112. Late November 2016: David Kramer[118]On 28 November 2016, Mr Steele met Mr Kramer. Shortly afterwards, Mr Steele arranged for Fusion, in the person of Mr Simpson, to print copies of his memoranda and provide them to Mr Kramer. The background to this is explained in Mr Steele’s first witness statement, and can be summarised as follows.(1) Orbis had a relationship with a former British diplomat, Sir Andrew Wood, a Russianist, a former Ambassador to Russia, and a friend of Mr Steele. In early November, Mr Steele confided the substance of his reports to Sir Andrew.(2) Sir Andrew then met David Kramer at an international security conference, where they discussed mutual concerns about Mr Trump’s links to Russia. Mr Kramer was at that time the aide to Senator McCain. Senator McCain was Chair of the Senate Armed Services Committee.(3) Mr Kramer introduced Sir Andrew to Senator McCain, who asked him to arrange a meeting between Mr Kramer and Mr Steele “to share the concerns about Russian interference in the US presidential election arising from the intelligence we had gathered and give him sight of this intelligence on a confidential basis”.(4) When that meeting took place, on 28 November, Mr Kramer said that he considered the intelligence raised issues of potential national security importance to the US. Mr Steele showed him, and they discussed, the reports that had been prepared by then, including Memorandum 112.(5) After Mr Kramer had returned to the US, he asked for copies. Mr Steele arranged this, understanding the purpose to be the provision of those copies to Senator McCain by Mr Kramer, in person, with a view to taking appropriate action, such as discussion with senior Congressional colleagues. Submissions[119]Orbis’ case is that each of the National Security Disclosures was reasonably necessary for the purposes of national security, and hence exemption from the First and Fourth Principles was required. Mr Millar submits that in these circumstances:(1) The Notification Requirement “falls away”, for “obvious reasons”.(2) The need to satisfy a Schedule 2 and/or 3 Condition cannot apply. Where a disclosure is reasonably necessary for national security purposes, the discloser cannot be expected to satisfy itself that the processing meets such conditions.(3) Equally, exemption from the Fourth Principle is required. It is unreasonable to require a person making a disclosure for national security purposes to ensure that the data are factually correct and not misleading. This is particularly so when the disclosure is of raw intelligence or a distillation of raw intelligence.[120]In short, Mr Millar submits, if a national security incident has arisen, the Data Protection Principles cannot be allowed to prevent or slow down the necessary disclosures. That would be contrary to the very interests which the exemption is there to protect. That is why this exemption is cast in such wide terms, in contrast to the other exemptions under the DPA. The evidence is that all the disclosures were made to people who asked for them, when they were concerned in national security matters. In principle, a person who is asked and complies, should be protected. Judgments should be left to the recipients responsible for safeguarding national security.[121]Mr Tomlinson submits that on a proper analysis, none of the National Security Disclosures resulted from any official demand. The FBI disclosure (if made) was volunteered. The disclosure to Mr Talbott was requested by him, but not in any official capacity. He had no national security responsibilities; he was a retired politician who had heard about the memoranda and wanted to show them to others. The other two disclosures were also requested, but only after Mr Steele had taken the initiative to prompt the request. Mr Kramer, like Mr Talbott, lacked any official status. He was approached at Mr Steele’s instigation by a retired British diplomat.[122]Mr Tomlinson accepts that Mr Steele believed his reports had national security implications, but submits that it is difficult to say that any of these disclosures was “for the purpose” of safeguarding national security. In any event, the relevant question is whether exemption from the Data Protection Principles is or was required for that purpose. He submits that there is no evidence whatever that this is so. This was not a “ticking bomb” case – the disclosures in question were in November 2016, two months after Memorandum 112 was prepared. There was no obstacle whatever to compliance with the data protection principles. Assessment[123]The application of this exemption does not turn on whether the party claiming it was motivated by a desire to protect the realm, or believed that the processing in question was necessary for national security purposes. The purpose of the person making the disclosure is relevant but not decisive. Nor can the issue be dealt with in a blanket fashion. The Court must look at the personal data in question, consider each relevant principle or provision, and make an objective assessment of whether the purpose of safeguarding national security requires those data to be exempt from that provision.[124]Ideally, that assessment will be informed by a reasoned official evaluation, and based on some evidence. There is however scant evidence before me of any official assessment of the need for Memorandum 112, or any other element of the Dossier, to be provided by Mr Steele to those responsible for national security in the US, or the UK. Almost the only evidence comes from Mr Steele, in the form of hearsay. Even that has its limits. Orbis’ best case is that in August 2016 the FBI asked Mr Steele to provide all his intelligence, and in November the unidentified UK official took the view, following a discussion, that disclosure to him of the Dossier was appropriate. It is not said that Sir Andrew Wood formed any view on this issue, and, in any event, he was a retired diplomat, not a serving official with current awareness of the overall national security picture. As Mr Tomlinson points out, Messrs Talbott and Kramer were not in Government or the executive. Nor, for that matter, was Senator McCain, however distinguished and exalted his position in the Senate hierarchy. There is no evidence that, in either country, anyone with Government or executive responsibility for national security has ever reached a conclusion that it was necessary for any of this material to be provided to Mr Talbott or Mr Kramer, or Senator McCain. There is no evidence that any such person has ever made, or even considered making, an assessment of whether and, if so, why exemption from the First or Fourth Principle was required to any extent.[125]I have concluded nonetheless that the purpose of safeguarding national security required the personal data of the claimants that were contained in the National Security Disclosures to be exempt from the Notice Requirements. The provision of information in confidence is an essential part of the national security process. As a rule, it is essential for that purpose that there should be no fetter on the provision to those responsible for ensuring national security, and with a view to protecting or enhancing national security, of unpublished intelligence. As a rule, it is inimical to national security for the subject of such unpublished intelligence to be forewarned of or alerted to its disclosure to officials, or notified of its intended use for official purposes. It will normally be for those who have official duties to protect national security to assess the intelligence, and determine the extent to which it is consistent with national security for the data subject to be informed of any further processing of the data. I accept that these considerations applied to these disclosures of these data.[126]That conclusion is quite easily reached in relation to the disclosure to the UK official. Mr Steele’s evidence is that the responsibilities of that official encompassed “… monitoring and giving early warning of the development of direct and indirect threats and opportunities to British interests or policies and to the international community as a whole in the fields of external affairs, defence, terrorism, major international criminal activity, scientific, technical and international economic matters and other transnational issues, and to keep under review threats to security at home and overseas and to deal with such security problems as may be referred to them.” 137. Mr Kramer. But the US and UK are the world’s leading English-speaking democracies, with a wealth of closely integrated interests. It is a matter of common knowledge that co-operation between the US and UK on matters of security is a vital part of our nation’s security arrangements. The question of whether a world power may have interfered with the highest tier of the US democratic process is a matter of considerable significance to the UK. In my judgment, the national security interests of this country in that respect are so closely aligned with those of the US that those disclosures also needed exemption from the Notice Requirements.[127]I have not been persuaded, however, that the process of safeguarding national security required any further exemption from the First Principle. I have no evidence to explain, and see no reason why, generally, a disclosure made for such a purpose must or should be exempt from the need to have a lawful basis (that is, to satisfy a condition in Schedule 3 and/or Schedule 2), or from the overall requirement of lawfulness. The fact that these disclosures were made with national security in view is not of itself enough to displace these general principles. The other requirements of fairness will always depend on the particular context, allowing the particular facts of any case to be considered.[128]Nor am I persuaded that national security requires that the personal data of the claimants, contained in the National Security Disclosures, should be exempt from the Fourth Principle. Accuracy is important to that purpose. Perhaps it would be harmful to national security if those making disclosures with a view to protecting national security were subjected to an absolute requirement of factual accuracy. But I do not need to address that broad question. The factual content of the personal data in this case was derived from third party sources. On the facts, the qualification inherent in paragraph 7 of Schedule 1 Part II is a sufficient safeguard for Orbis, and the interests of national security. The requirements of paragraph 7 are flexible and depend on the purposes for which the data were obtained and further processed.[129]In reaching those conclusions I have applied the interpretation of the word “require” discussed above. I have however noted that the Information Commissioner has argued, and the Information Tribunal has accepted, that the word “required” in s 24 of FoIA means “reasonably necessary” (see Kalman v Information Commissioner and the Department of Transport (EA/2009/0111 8 July 2010) [33]). That was not a decision on the issue before me now. The point made to, and accepted by, the Tribunal was that it is “not sufficient that the information sought simply relates to national security”, which is plainly correct. But in case I am wrong in my interpretation of the word “required” in DPA, s 28 I have assessed the position by reference to this less demanding standard. I would reach the same conclusions. The Fairness Issue

Conclusions

[130]The claimants’ case is twofold:(1) The admitted failure of Orbis to notify the claimants of the disclosures made by way of Memorandum 112, or to “give them an opportunity to comment on the accuracy of the data” is said to have been a breach of the Notice Requirements. For the reasons already given, I reject that case. The Fusion Disclosure and the National Security Disclosures were exempt from the Notice Requirement.(2) It is said that Orbis’ processing did not comply with any of the conditions in Schedule 2, or Schedule 3. For the reasons that follow, I reject that contention, and hold that the Fusion Disclosure and the National Security Disclosures all satisfied at least one condition in each Schedule. Reasons The Fusion Disclosure[131]The lawful bases for the Fusion Disclosure lay in condition 6(1) of Schedule 2 and conditions 6 (b) and (c) of Schedule 3.[132]I have already set out the terms of Schedule 3, condition 6, and noted that it is materially identical to the Legal Purposes Exemption: [95] above. I have explained my reasons for finding that the Legal Purposes Exemption applied to the Fusion Disclosure: [100-104] above. Those reasons also explain my conclusion that paragraphs (b) and (c) of condition 6 were satisfied.[133]Schedule 2 condition 6(1) is that:
“The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”
This condition calls for a determination of whether the processing interferes with the data subject’s rights, freedoms or legitimate interests in a way that is necessary for, and proportionate to the legitimate interests of the data controller or the recipient(s) of the data, giving due weight to any rights, freedoms or legitimate interests of the data subject that are engaged. As already noted, “necessary” in this context means reasonably necessary, and involves the concept of proportionality: Cooper v National Crime Agency [89-93].[134]The pursuit of a legitimate business is a legitimate interest: Murray v Express Newspapers [2007] EMLR 22 [76]. The Fusion Disclosure was reasonably necessary for the pursuit by Orbis of the legitimate interest of fulfilling its contractual duties to Fusion. Fusion had a legitimate interest in receiving that disclosure, and it was reasonably necessary for it to receive it, for onward transmission to Perkins Coie and the Ultimate client, whose own interests in the giving and receiving of legal advice based upon the contents of the Dossier were also legitimate.[135]The claimants accept that Orbis, Fusion and Fusion’s clients may have had legitimate interests in processing personal data relevant to the investigation that Orbis was contracted to carry out. Mr Tomlinson argues, however, that the claimants’ personal data contained in Memorandum 112 had nothing to do with those legitimate interests and was entirely irrelevant to those interests. It did not concern Russian efforts to influence the 2016 US Presidential campaign or links between Russia and Donald Trump. So, the processing was not needed at all for the legitimate interests which were in play. The flaw in this argument is the one I have dealt with already: see [75(3)] and [98-100] above. It wrongly treats Memorandum 112 in isolation, rather than as part of a package, prepared and produced because of and in the context of suspicions of server activity linking Alfa and Mr Trump.[136]I do not accept Mr Tomlinson’s further and alternative submission, that the Fusion Disclosure was unwarranted. He relies in particular on the allegations that the first and second claimants used Govorun to deliver “large quantities of illicit cash” to Mr Putin, describing these as “serious interferences” with the claimants’ Article 8 rights. This approach seems to me arguably to beg the question of whether the data are accurate, which is a separate issue. But in any event, in my judgment, the Fusion Disclosure was not unwarranted by any prejudice to the claimants’ rights, freedoms or legitimate interests.[137]The allegations contained in the data are unquestionably serious. A person has a legitimate interest in the protection of his reputation and business: Evans v Information Commissioner and the MOD, (Information Tribunal, 23 June 2008) [19]. Those legitimate interests were engaged. So, in my judgment, were the claimants’ Article 8 rights; although this was information about their public or business lives, it 149. was of sufficient gravity to fall within the scope of Article 8. But the interference with those rights and interests was limited, and proportionate to the legitimate interests I have identified.[138]This was not mass publication but disclosure to a single small company, Fusion. The claimants were not the focus of the overall disclosure. Memorandum 112 was part of a larger package of information, the remainder of which did not engage the claimants’ rights, interests or freedoms. Fusion itself had no particular interest in the detail of the Dossier. Its function was to procure the intelligence and then forward it with a view to its use by a law firm as the (or a) basis for the provision of legal advice to a national political party on a matter of great significance. There is no evidence to suggest that the Fusion Disclosure caused the claimants any material loss, or any serious reputational harm, or that their reputations in the eyes of Fusion (or for that matter Perkins Coie or the Ultimate Client) were a matter of any real significance to them. This was something entirely different from the mass media publication that came later. The National Security Disclosures[139]Orbis’ primary case is that the lawful bases for these disclosures lay in condition 5(b) of Schedule 2 and condition 7(b) of Schedule 3, which are in identical terms:- “The processing is necessary— … (b) for the exercise of any functions conferred on any person by or under any enactment…”[140]Mr Millar points to a range of statutory provisions conferring functions in respect of national security on (among others) the FBI, the State Department, and the Senate Armed Services Committee and, in the UK, the Central Intelligence Machinery and the agencies it tasks. The short submission is that each of the National Security Disclosures was reasonably necessary to enable such functions to be performed.[141]The claimants do not quarrel with Orbis’ interpretation of the legislation relied on, or challenge Orbis’ approach as a matter of principle. The claimants’ short response is that the statutory provisions are all irrelevant to the processing of the personal data in Memorandum 112, which had nothing to do with the FBI, the State Department, or the Senate Armed Services Committee, or with the intelligence services here, and was certainly not “necessary” for any of their statutory functions.[142]I have no expert evidence on US law. I have however examined the US legislative materials relied on by Orbis in relation to the functions of the FBI Title 28, Section 533 of the U.S. Code; Title 50, Sections 401 and 1801 of the same; Executive Order 12333; Title II of the Intelligence Reform and Terrorism Prevention Act of 2004, Public Law 108-458, 118 Stat. 3638. , the Armed Services Committee Rule XXV, 1(c)(1) of the Standing Rules of the Senate. 5 Title 22, Section 2656 of the U.S. Code. , and the State Department 5. The texts appear to justify Orbis’ submissions as to the functions of these institutions and bodies. The Intelligence Services Act 1994, s 1 provides that the functions of the Secret Intelligence Service 155. include “to obtain … information relating to the actions or intentions of persons outside the British Islands … in the interests of national security…”. This would explain the stance adopted by the claimants in respect of the relevant functions.[143]In my judgment, all the disclosures at issue here were reasonably necessary for those functions. My conclusions on this issue mirror those I have reached in respect of similar arguments on which the claimants have relied in other contexts. First, the question is not whether the disclosure was essential or indispensable for the due performance of the national security functions in question. It is enough that it was reasonably necessary. Secondly, it is wrong to apply too strict a test of relevance, and to look at Memorandum 112 in isolation, without regard to the overall context in which it was provided. That included at all times suspicions about server links between Alfa and Trump Tower. By November 2016, those suspicions were firmly in the public domain. An assessment of the links between Alfa, the claimants, and Mr Putin was therefore material to the overall question of whether Russia might have been interfering in the election.[144]It is therefore unnecessary to address the other lawful bases relied on by Orbis. But I would accept Orbis’ case that condition 6(1) of Schedule 2 applied also. The Accuracy Issue The issues in dispute[145]The legal framework is set out and discussed at [70-73] and [104(2)] above. The burden of pleading and proving inaccuracy, and breach of the Fourth Principle, lies on a claimant. That of course does not preclude a defendant from advancing and seeking to prove a positive case of accuracy.[146]As originally pleaded, Orbis’ Defence put the claimants to proof of inaccuracy, but it also asserted that “none of the personal data” complained of were “incorrect or misleading as to any matter of fact”, and that the data were “not inaccurate”. The claimants applied to strike out parts of Mr Steele’s witness statement, on the basis that although the Defence impliedly pleaded a positive case that the data were accurate, that case was insufficiently pleaded as it lacked the necessary particulars. At the PreTrial Review, three weeks before the trial began, I agreed with this analysis. Orbis withdrew a late application for permission to amend, to plead explicitly that the data were true. I granted the claimants’ application to strike out passages in Mr Steele’s first witness statement that could only be relevant to such a case. Since then, Orbis’ positive case on this issue has involved two main contentions that(a) aspects of the personal data were not factual but expressions of opinion; and(b) the factual elements were not in breach of the Fourth Principle, by reason of paragraph 7 of Schedule 1 Part II.[147]The Amended Defence asserts that, of the personal data complained of, propositions (a) and (e) (paragraph [21] above) are matters of opinion. In other words, that it is a matter of opinion, not fact, that the claimants and President Putin do “significant favours” for one another, and that the first and second claimants “do President Putin’s political bidding”.[148]Paragraphs 6 and 10 of the Amended Defence contain the following, which adequately reflects the terms of Sch 1 Part II paragraph 7:
“6. … (g) The Defendant … relies on paragraph 7 of Part II, Schedule 1 of the DPA. The Defendant accurately recorded information it obtained from a third party. The identity of that third party is confidential. By virtue of section 10 of the Contempt of Court Act 1981, the Defendant is not required to disclose the source of that information. The Defendant’s records have since 8 February 2019 indicated that the Claimants contest the accuracy of some of their personal data as contained in Memorandum 112. … 10. … The Defendant took such care as was reasonably required in the circumstances … to establish the accuracy of the personal data complained of.”

Article 8 rights; although this was information about their public or business lives, it

[149]The final sentence of paragraph 6(g) is not in dispute. So, there are four sub-issues:(1) To what extent are the personal data in issue fact or opinion?(2) Have the claimants established that the factual content of the personal data was “incorrect or misleading”?(3) Has Orbis established that it accurately recorded the data obtained from its sources?(4) Has Orbis established that it took “reasonable steps to ensure the accuracy of the data”? Fact or opinion?[150]The DPA contains no guidance on this topic. But this is an issue that arises frequently in defamation cases. The principles are very well established, and familiar to this Court. The core points can be summarised in this way: a comment is something in the nature of a deduction, inference, conclusion, criticism, remark, observation, etc.; it must be recognisable as such; and the key question is how the words would strike the ordinary reasonable reader: see Koutsogiannis v The Random House Group Ltd [2019] EWHC 48 (QB) [2020] 4 WLR 25 [16-17] (Nicklin J). For this purpose, as ever, words must be looked at in their context. This, and the subject-matter, may be important indicators of whether they would strike the reader as fact or comment. Other important factors may be whether the statement is capable of verification, and whether the words in question stand by themselves, or accompany others.[151]I caution myself that this is not a libel action. But these principles are not technical matters, of relevance only to a niche area of the law. They reflect the experience of generations in analysing speech and striking a fair balance between the right to remedies for false factual statements, and the need to safeguard freedom of opinion. I have adopted and applied them in reaching my conclusions, which are these:(1) The information that the claimants and Mr Putin do “significant favours” for one another is factual in nature. A person does another a “favour” by performing some act that is not obligatory and confers some benefit on the recipient. It is easy to determine whether or not a person has done such a thing. The word “significant” is an adjective. It will often be evaluative; that will be so if the statement in question sets out what a person has done and then says it is “significant”. But that is not how the word is used in Memorandum 112. There is no detailed description of the favours referred to. The memorandum presents the intelligence without detailed explanation. In its context the word “significant” has the sense of substantial, consequential, or important, and is factual. I accept Mr Tomlinson’s submission that the phrase, in its context, conveys a sense that each party is conferring on the other important benefits, when under no obligation to do so.(2) The term “political bidding” is metaphor. But in its context the sense of it is clear, and again it is factual in nature. It means that the first and second claimants carry out tasks for Mr Putin when, for political reasons, he asks them to do so. This is an assertion made baldly in an intelligence memorandum, without any detailed explanation of the basis on which this assertion is made. The reader would conclude that the source was aware of specific conduct by the claimants in question, carried out at the request of Mr Putin. The statement is capable of verification. Incorrect or misleading? The Court’s task[152]In some cases, allegations of inaccuracy and breach of the Fourth Principle may raise quite subtle issues. R (Hussain) v Sandwell MBC [2017] EWHC 1641 (Admin) [2018] PTSR 142 was such a case. The Council commissioned solicitors to conduct an investigation into allegations that the claimant had acted improperly in relation to the sale of Council property at an undervalue to an individual known to him, and other matters. Having received the report (“the Wragge report”) the Council obtained Leading Counsel’s opinion upon it. This was that there was a serious case to be met by the claimant and that the report and the opinion should be published, which was done. Relying on Leading Counsel’s opinion that the Wragge report was “wrong, unfair or suspect in some respects”, the claimant alleged that this meant the report was not accurate, and that it and the Opinion which repeated those errors violated the DPA. At [238] Green J (as he then was) rejected that contention, for the following reasons (among others):
“… I can see that when the personal data in issue relates to matters such as name, address, age, marital status, nationality, etc, that accuracy is achievable. However, the concept of “accuracy” may need to be seen in a different context in relation to data contained in the Wragge report, the opinion and the audit report. These strive to make provisional findings only, not definitive findings. As a matter of logic a document can accurately set out findings which are understood as provisional or prima facie findings even if later those views are not upheld at a full hearing. The subsequent formal findings do not render inaccurate the earlier view inaccurate as provisional or prima facie. The claimant's objection, if valid, would preclude the publication of any report containing provisional findings which by their nature run the risk of later turning out to be inaccurate when tested at a trial or subsequent hearing convened to determine their truth. In my view a document which contains provisional findings and sets out no more than a prima facie case for further investigation cannot for this reason be said to be inherently inaccurate…”
[153]Mr Millar has sought to draw comfort from this decision, submitting that there is a “partial analogy” between Hussain and the present case. He submits that in resolving the issue of inaccuracy, the Court should take into account that Memorandum 112 was “a piece of the mosaic for an ongoing inquiry into unresolved questions” and “did not purport to be a definitive pronouncement”. In my judgment, the submission is misplaced.[154]In the passage quoted, Green J was striving to identify the true natural and ordinary meaning of a report which was, on its face, provisional. He found that the information in the data was not that the claimant was guilty but something less. A defamation lawyer would see this as a finding that its meaning lay at “Chase” Level 2 or 3: not guilt but reasonable grounds to suspect, or to investigate. No such complexity arises here. It is admitted by Orbis that Memorandum 112 contained the five items of personal data at [21] above. I have held that all five are factual in nature. The question is whether all or any of them have been shown to be inaccurate or misleading. At this stage of the enquiry, it is not a question of whether any of the statements in Memorandum 112 were literally true, or whether the document accurately recorded information provided to Mr Steele by a source. The issue relates to the natural and ordinary meaning of the Memorandum, and is straightforward: have the claimants established the pleaded case, that (for instance) “the Claimants and President Putin do not do ‘significant favours’ for each other” (paragraph 11(c)(i) of the Particulars of Claim) and did not “use Mr Oleg Govorun as a ‘driver’ and ‘bag carrier’ to deliver large amounts of illicit cash to President Putin…” (paragraph 11(c)(iv)).

Services Act 1994, s 1 provides that the functions of the Secret Intelligence Service

[155]Cross-examination of the claimants ranged over a wide canvas, exploring the nature and scope of Alfa’s business in the 1990s, its relations with members of the Yeltsin government, the 1996 elections, and a host of other matters collateral to the five factual propositions with which I am concerned. This culminated in a series of propositions advanced in Orbis’ written closing about “the claimants and their links to the Russian government since the 1990s”. Those propositions were largely based on a US judgment from 2005 169. reports. All of this is of course hearsay, some of it opinion, and much of it based on unverifiable information from unidentified sources. Mr Millar’s cross-examination largely involved putting questions based on these materials.[156]Mr Millar was entitled to test, challenge and seek to undermine the claimant’s evidence in these ways. I have kept in mind, however, that this is not a public inquiry into the claimants’ business practices or their relationships with Russian government over the last 30 years. The Court’s role is to resolve the specific issues I have identified, between these parties, on the balance of probabilities, on the basis of the relevant evidence of fact which the parties have introduced at this trial.[157]I have also kept in mind that the evidence that is directly relevant to those issues is quite limited. It consists largely of the testimony of the claimants, contained in their written witness statements, verified on affirmation, and tested in cross-examination. For the most part the claimants were unable to point to documentary evidence in support of their case. That is common, when a claimant’s task is to prove a negative. On the other hand, Mr Millar did not put it to any of the claimants that any of the items of personal data was true. In the circumstances, he could not do so. That is not Orbis’ pleaded case, and it has adduced no evidence from any witness or any document which is capable of establishing the truth of any of those statements.[158]I have also noted that not only are the materials relied on by Orbis hearsay in nature, the defendant itself has not felt able to assert the truth of some of the reports contained in those materials. Counsel’s written closing argument included, for instance, the contention that the first and second claimants supported Yeltsin’s 1996 election campaign “reported on certain terms”; that they were “reported to have wielded so much influence … they were ‘running Russia’ in the late 1990s; that the second claimant “is reported as saying” certain things; and that Alfa Group acquired a 50% stake in the TNK oil company from the Russian government “reportedly on very favourable terms”. A number of the other propositions advanced by Orbis in closing take the same form.[159]Mr Millar elicited a few admissions. He established, for instance, that Mr Aven served as Minister for Foreign Economic Relations in the Boris Yeltsin government, between 1991-1992; that he joined the Alfa Group in 1994; that Alfa Group acquired and benefited from the acquisition from the state of a controlling stake in TNK, part of which was sold to BP for billions of dollars; and that Mr Aven acted as Alfa’s channel of communication with the Russian government in the Yeltsin and Putin eras. But there was little that went directly to the issues for decision.[160]In these circumstances, it is unsurprising that the main thrust of Mr Millar’s closing argument on this issue was that the claimants have failed to discharge the burden of proof. In my judgment, however, they have done so. (a) Significant favours from or for Mr Putin?[161]The first claimant’s evidence is that he has never given or received such favours. He meets Mr Putin regularly, and does so on a one-to-one basis, and informs Mr Fridman of the topics discussed. But he has a purely professional relationship with President Putin, and that has been the case for many years. He maintains that he and Alfa do not want to be very close to the President. Rather, they want “good formal relations”. In cross-examination it was established that in 1999 Mr Aven hosted a dinner at President Putin’s request. Mr Aven’s evidence was that the only other attendee was Igor Malashenko, a founder of the NTV television channel. That was not challenged. I conclude that this was a favour. Whether or not it was significant is hard to say. But it is an isolated matter in fairly distant history, long before September 2016. It does not go to the accuracy of the specific personal data in question, and does not materially detract from Mr Aven’s uncontradicted evidence. There was no suggestion in crossexamination that there was any pattern of meetings between the two. It is not sufficient for Orbis to draw attention to passages in the Mueller Report, which the witness did not accept.[162]The evidence of the second claimant, Mr Fridman, is that he is no position to do favours for President Putin and he has not done such favours for him. He does not have a personal relationship with the President. As a board member of the Russian Union of Industrialists and Federalists he, like Mr Aven, meets Mr Putin. But these are formal group meetings. He was cross-examined about his relationship with Mr Yeltsin, and did not accept that he had supported his campaign in the expectation of favours.[163]Mr Millar questioned Mr Aven, and Mr Fridman, quite extensively about Alfa’s acquisition of TNK, the sale of a stake to BP, and their involvement in a joint venture between TNK and BP. He put it to Mr Fridman, for example, that two public documents in the documentary evidence make Alfa’s acquisition of its TNK shareholding “look like a gigantic sweetheart deal put in your lap by the Kremlin”, under the Yeltsin regime. One of the documents was the US judgment referred to. The other was a media profile. I did not find such lines of questioning persuasive or helpful. I do not think this could be a sufficient basis for a Judge to reject a witness’s evidence of fact. Mr Fridman’s answer was, anyway, that he had not seen the second document, and although that was what has been written it was not true. He denied that the claimants had received “payback for supporting Yeltsin”. He rejected, also, suggestions based on hearsay materials, that President Putin had secured for Alfa the lucrative deal with BP.[164]The third claimant’s evidence is that he has no personal relationship with President Putin and they do not do each other favours, significant or otherwise. This unchallenged evidence was not significantly affected by the cross-examination. (b) Informal advice on foreign policy (first and second claimants)[165]Both claimants deny giving any such advice, making the point that they are not politicians or diplomats, and suggesting that they had no expertise in such matters. Mr Aven is an economist, and it is economics that he discusses with Mr Putin when they meet. Mr Fridman is a businessman, who has never met Mr Putin on a one-to-one basis. That evidence has not been challenged. The issue between the parties, so far as this proposition is concerned, came down to this: have these claimants taken too narrow a view of what “informal advice on foreign policy” amounts to? Mr Millar submits that any form of advice will do, and that the claimants were wrong to take the position that economics is a different thing from foreign policy. The claimants’ approach is “unrealistically narrow”. I disagree. Foreign policy is a subject area that is distinct from that of economics, and I have been provided with no proper basis on which to doubt the claimants’ case that this proposition is inaccurate or (at best) misleading. (c) Mr Fridman: meeting directly with President Putin shortly before 14 September 2016?[166]I accept Mr Tomlinson’s submission that meeting “directly” implies a one-to-one or at least a personal meeting. Mr Fridman’s uncontradicted evidence is that he never had any such meeting with Mr Putin, whom he only saw in formal, public meetings. In any event, he says, he attended no meetings with Mr Putin at all in 2016, before the date of Memorandum 112. Mr Millar has argued that “recently” does not lend itself to any precise test. That may be so, but in its context in Memorandum 112 it certainly does not suggest a meeting more than 9 months earlier. On the evidence, the proposition is inaccurate or misleading. (d) Using Govorun to deliver large amounts of illicit cash to Mr Putin in the 1990s when he was Deputy Mayor of St Petersburg[167]The claimants have succeeded in demonstrating that this proposition is untrue. Both claimants denied involvement in any such activity. There is documentary evidence that Mr Putin ceased to be Deputy Mayor in June 1996, and that Mr Govorun was first employed by Alfa Bank on 3 March 1997, as a manager in the Department of Communications. Mr Aven recalled no dealings with Govorun, but his evidence is that enquiries he made suggested that he worked for Alfa for 3 years in the late 1990s, and was a Deputy Head of the Department for Communications with State Authorities. He was not Head of Government Relations nor did he hold any other senior position. Mr Fridman’s evidence is that he did not know Govorun at the relevant time.[168]Mr Steele admitted in cross-examination that Govorun was not working for Alfa before 1997, and that his source had erred in that respect. But he refused to accept that this meant that Memorandum 112 was inaccurate. He cavilled, suggesting that it might be the case that Govorun was used to deliver illicit cash to Mr Putin in the late 1990s, after his stint as Deputy Mayor. There is no evidence to support that. Even if there were, the Memorandum would remain inaccurate and misleading. Mr Millar’s closing submissions on this issue did not contend otherwise. They were focussed on the question of whether Mr Steele took reasonable care. (e) Messrs Aven and Fridman: doing Mr Putin’s political bidding?

US judgment from 2005

[169]I have rejected Mr Millar’s submission that this is a matter of opinion. The question is therefore whether either claimant took some step requested of them by Mr Putin, such as supporting a political campaign or policy. Both say not. Mr Aven maintains that his discussions with Mr Putin are limited to business and economics, and they do not discuss politics. Mr Fridman says that he has never been asked by Mr Putin to do anything politically. In the context of his position as a businessman, the idea of doing Mr Putin’s political bidding makes no sense.[170]There is nothing that casts doubt on Mr Fridman’s evidence on this issue.[171]Mr Aven was cross-examined about his dealings with Richard Burt, a former US diplomat who has been on the Alfa Bank Supervisory Board. He agreed that he had used Mr Burt to try to make contact with the Trump Transition Team. His explanation was that they spoke about the possibility of sanctions on Alfa. Mr Putin had expressed concern about this, of which there had been rumours. The President had suggested that the Bank would need contacts with the new US administration. Hence Mr Aven’s wish to contact the Transition Team. He raised another matter with Mr Burt, to do with unpaid debts to the Bank, which had nothing to do with Mr Putin. Mr Aven denies knowing at the time of a number of matters set out as fact in the Mueller report, including the role allegedly played by Mr Simes of CNI in lobbying for Mr Burt to be the new ambassador to Russia. Asked about a suggestion from Mr Burt that Mr Aven’s approach to him was made on behalf of the Russian government, Mr Aven says that was a misunderstanding, compounded he suggests by his poor English and heavy accent.[172]This is another area in which Orbis’ closing submissions seek to revisit the meaning of Memorandum 112. It is submitted that the document “does not state in terms that the Claimants do President Putin’s political bidding” (emphasis in original). That is a very subtle point, given that the document says that Putin is able to “make them do his political bidding”. Further, it is an admitted fact that the meaning or substance of this aspect of the information in Memorandum 112 is as stated at [21(e)] above.[173]Mr Millar further submits that the Court should conclude that the inaccuracy of this aspect of Memorandum 112 has not been established, having regard in particular to what he calls Mr Aven’s “entirely implausible account of his own evidence to the Mueller Inquiry”. This is a convoluted argument, that I have not found persuasive. I am invited to read and interpret a redacted copy of a section of the Mueller report, conclude that it is at odds with Mr Aven’s evidence to this Court, and reject that evidence. This is a complex process, besides its questionable legitimacy (whilst the Mueller report can be used as a source of hearsay evidence of fact, its secondary findings of fact are not binding, and are arguably not admissible). I have not heard evidence from Mr Burt or Mr Simes. I do not have before me a record of the statements the witnesses made to Mueller, which are summarised in the report. I have extracts from some documents, and summaries of others.[174]Having reviewed the extract from the Mueller report that is relied on, it does appear that Mr Burt’s account to Mueller was that Mr Aven was trying to help establish a communications channel between Russia and the Trump team, and that Mueller concluded that this was in fact the case. But I do not consider this to be a satisfactory basis on which to reject Mr Aven’s evidence to me. Accurate recording?[175]The evidence on this and the next issue comes of course from Mr Steele. His account is that the Dossier comprised intelligence obtained from 3 sources and approximately 20 sub-sources, all of whose identities were known to him. His contacts were with the sources. He met the sources and, during the meeting, made a manuscript note of what he was told. Within a day or so, he would compile a memorandum. He kept the manuscript notes for as long as necessary for that purpose, then destroyed them. Memorandum 112 was based on intelligence provided by a single source and a single sub-source. Mr Steele had a 2-hour meeting with the source, and wrote up the memorandum shortly after, destroying the manuscript notes.[176]Mr Tomlinson invites me to find that Orbis has failed to prove that Memorandum 112 accurately records the information provided by the source. He relies on passages in the OIG report, that record that the source told that investigation that Mr Steele had “misstated and exaggerated his statements in multiple sections of his reporting” and that had made it clear that it was “just talk”. The submission is that Mr Steele failed convincingly to counter these criticisms. I do not think that is the right approach. The question, rather, is whether the hearsay passages from the OIG report, summarising aspects of what the source said to the Department of Justice in January and March 2017, undermine the reliability of Mr Steele’s written and oral evidence to me about Memorandum 112. None of the statements goes directly to the content of Memorandum 112. It is clear that the source may have had an axe to grind. I accept Mr Steele’s account and find that the memorandum records accurately what he was told by the source. Reasonable steps?[177]Mr Steele describes in his witness statement the steps he took “to ensure as far as possible the reliability” of the content of the memoranda in the Dossier, including Memorandum 112:
“I assessed the intelligence I received having regard to what I knew of the sources and sub-sources and their roles, my knowledge of the structure of the Russian political system and its inter-connections with business, and the credibility of their story. I asked others about the individual source or sub-source and their story, and I cross-referenced the information I received against open source data where possible. I asked myself whether the appearance of the information (for example, whether it seemed sensationalist, had any discrepancies or any seemingly misleading information etc), the access of the individual, and the story itself added up and tallied with the intelligence being received from others, and was consistent with my own knowledge and experience. I did not take what was said at face value but instead looked at the open source data pertaining to the individuals involved, other reporting, including that provided by other sources, and tried to find out whether other government and intelligence institutions internationally had any relevant intelligence to corroborate or contradict the intelligence we received.”
[178]Mr Steele adds that the source and sub-source were established connections of his, whom he trusted. He says he “knew that they were in a position to report to me accurately” and that both “had a very good reporting record”. He explains what this means: that contributions they made on previous occasions had either been corroborated by others or had “turned out to be the case from open source and events on the ground”.[179]In cross-examination, no evidence emerged of any questions asked of others about the individual source and sub-source for Memorandum 112. The only “open source” internet checks carried out were internet searches conducted by Mr Steele, on Mr Govorun and the Russian Union of Industrialists. Those checks did not include verification of whether there was a time when Mr Putin was in St Petersburg and Mr Govorun was working for Alfa. The date of Mr Putin’s departure for Moscow is a matter of public record, to be found (for instance) in a biography in the trial bundles. Mr Tomlinson was able to show Mr Steele a page from Mr Govorun’s biography, on the Kremlin website, returned in response to a search on his name. It recorded his work history, stating that in the early to mid-1990s, he studied and worked in Moscow, then spent 2 years with ROSPROM closed joint stock company, before joining Alfa Bank in 1997.[180]Mr Steele said that his source had told him the sub-source was clear that Mr Fridman and Mr Putin were meeting directly. Mr Steele said that the sub-source had personal knowledge about significant favours being done for and by President Putin. But he conceded, in relation to other aspects of the document, that he had not checked with his source, whether they had confirmed the nature of the information obtained from the sub-source. He imagined so, but did not know. He said that the sub-source would have had access to some of the information by virtue of their job. He accepted that the sub-source had not been there in the 1990s, but “that doesn’t mean that they hadn’t talked to people who were”. Ultimately, he said he made a judgment based on his knowledge of the source and the sub-source, including the sub-source’s job.[181]Mr Millar submits that, in assessing the reasonableness of those steps, the Court must take into account the purposes of the processing: the Fusion Disclosure and the National Security Disclosures. Those, he submits, were legitimate and important purposes. Mr Steele carefully assessed their appropriateness based on his own extensive experience. The Court should also take into account the nature of Memorandum 112 and the specific sentences complained of.[182]Mr Tomlinson submits that Mr Steele took no proper care at all. He simply took the view that the information provided by his source appeared to be accurate and included it in Memorandum 112. Mr Tomlinson takes aim, in particular, at proposition (d), the allegation about “illicit cash”. He describes this as a serious charge in relation to which the sub-source lacked personal knowledge, and “considerable care was required but plainly not exercised”.[183]Again, assessment is hampered by the nature and limits of the evidence. In this instance, the limits include not only (again) the absence of contemporaneous records, but also the fact that I do not know the identity, or very much else, about Mr Steele’s source or his sub-source. That is a consequence of Mr Steele’s desire to preserve their anonymity. That wish is understandable, but it does mean that his explanation of what he did and did not do, and his justifications for his behaviour, are harder to scrutinise. The same is true of Mr Steele’s assertion that his sources had a reliable track record. What he says is cogent and logical on its face, but in the absence of any detail it is hard to evaluate.[184]The reasonableness of the steps taken must, however, be assessed “having regard to the purpose or purposes for which the personal data were obtained and further processed”. That means, as Mr Millar submits, that I am asking myself whether what Mr Steele did amounted to reasonable steps by way of verification of intelligence which was obtained, compiled, and disclosed for use in the limited contexts of legal advice and, latterly, national security purposes.[185]Reviewed in that context, I have been persuaded that Mr Steele took reasonable steps to ensure the accuracy of propositions (a), (b), (c) and (e) (favours, foreign policy advice, recent direct meeting and political bidding). None of these represents a grave allegation. Apart from the point about the meeting, these are all somewhat broad and generalised propositions. They are all credible on their face. The disclosures with which I am concerned are limited in number and scope. The purposes for which they were made were legitimate. It was inherently unlikely that any significant step, adverse to any of the claimants, would be taken on the basis of any of those propositions, without further enquiry. I accept that Mr Steele knew and trusted his sources, and that he had reasonable grounds to trust them. It was reasonable for Mr Steele to rely on the status and job of his sub-source and a history of proven reliability. It was not necessary for him to make detailed enquiries of his source about the reliability of his sub-source.[186]The position is different when it comes to proposition (d), concerning “illicit cash”. That is an allegation of serial criminal wrongdoing, over a prolonged period. Even in the limited and specific context of reporting intelligence for the purposes I have mentioned, and despite all the other factors I have listed, the steps taken to verify that proposition fell short of what would have been reasonable. It is of a nature and gravity which are wholly distinct from and far more serious than the other four propositions. It relates to a period of time 15-20 years before the compilation of the memorandum. Mr Steele knew that his source did not have direct personal knowledge of the underlying facts, but could only be relying on hearsay. He has failed to explain how that information would or could have come to the sub-source by virtue of his job. The allegation clearly called for closer attention, a more enquiring approach, and more energetic checking.[187]It is unclear what efforts Mr Steele made to verify this allegation, other than the one relevant internet search to which he has referred. Mr Steele’s evidence as to the single relevant internet search he undertook was unimpressive. All that he could recall of it was that it turned up the information that Mr Govorun had accompanied President Putin to the funeral of Present Karimov of Uzbekistan. That, however, was in 2016. Hindsight is to be avoided, but the inadequacy of the verification effort is illustrated by the fact that Mr Tomlinson was so easily able to demonstrate, and obtain Mr Steele’s acceptance, that a key element of this allegation was contradicted by information readily available on the internet. Mr Steele does not say that he questioned his source about it or asked the source to revert to the sub-source for details. He evidently did not ask for any details of the hearsay information. Remedies Rectification, etc.[188]In closing, Mr Tomlinson submits that while the claimants have suffered distress, an award of damages is very much a secondary consideration. The claimants’ primary focus is on correcting the record. The main area of contention is whether the Court should, to any extent, exercise its discretion to grant remedies under DPA ss 14(1)- (3). Mr Tomlinson argues for an order for rectification of the personal data and that Orbis communicates the inaccuracies to those to whom it disclosed Memorandum 112.[189]I am prepared to direct, if necessary, that the copy of Memorandum 112 which is held by Orbis for legal purposes should be marked up or filed in such a way that a reader will not fail to be aware of this judgment, its findings that the data are inaccurate or misleading, and the formal order that will follow. Otherwise, these seem to me to be somewhat unreal submissions in the context of this case.[190]True it is that the remedies under ss 14(1)-(3) are available in principle, in respect of all the data that I have found to be inaccurate or misleading. It does not follow that they should be granted. These remedies are doubtless useful and important in cases of large-scale disclosure to recipients whose identities are not known to the claimant, or where it is reasonable for the defendant to undertake the task of communication. But the disclosures complained of here were made privately, to a very limited audience. The content of the Memorandum has become public subsequently, through the Buzzfeed Article and other means including this trial. Insofar as it is an issue in this trial, I have held that Orbis are not responsible for that wider publication. An Order for notification of the inaccuracies to Fusion and the recipients of the National Security Disclosures would be pointless, or at least unnecessary. I am confident that all those to whom Orbis disclosed Memorandum 112 will be, or will be made aware of the outcome of this action, and my findings, soon after judgment has been given. If the claimants are unsure of that, they know the identities of the recipients and can provide them with a copy of the judgment and order. The Court cannot grant a remedy in respect of disclosures for which it has not held Orbis responsible. For those reasons I decline, as a matter of discretion, to grant any additional remedies under s 14. A declaration?[191]Mr Tomlinson has submitted that if I decided not to grant remedies under s 14 his clients would wish to press their pleaded claim for a declaration. The DPA does not provide for declarations, and no case has been identified in which the issue has been examined. My findings are analogous to a finding of liability for libel. But this is not a libel action. Anyway, English law and procedure do not permit the court to make a declaration of falsity at the end of a libel action: Jameel v Dow Jones, Inc [2005] EWCA Civ 75 [2005] QB 946 [67] (Lord Phillips MR). It is available, as a discretionary remedy, in limited circumstances, by way of a statutory “anomaly”: see Loutchansky v Times Newspapers Ltd (Nos 2-5) [2002] EWCA Civ 1805 [2002] QB 321 [98-99]. Other jurisdictions have taken different approaches, and there has been academic discussion: see, for instance Gatley on Libel and Slander 12th ed Chap 9, esp at nn 2-4 and text thereto. But there has been no real exploration of these issues at this trial, and I do not consider it necessary to explore them in this judgment.[192]Assuming but without deciding that a declaration is available in principle, I would decline to make one. Mr Tomlinson makes clear that he is only seeking a declaration between the parties. But a danger of declarations as between parties is that they may, mistakenly, be seen as binding the rest of the world. This case is not about the media publication of the Dossier; it relates to relatively limited disclosures. This judgment and the order that will follow are a sufficient statement of the position. The Order may contain recitals which record my findings of inaccuracy. I have also taken into account my conclusion on the issue of compensation, which affords some real vindication for the first and second claimants. Compensation[193]The governing provision is DPA s 13, which provides as follows: Compensation for failure to comply with certain requirements(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if— (a) the individual also suffers damage by reason of the contravention, or (b) the contravention relates to the processing of personal data for the special purposes.(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.[194]I have found that the “illicit cash” allegation ([21(d)] above) was inaccurate and that its disclosure, as part of the Fusion Disclosures and the National Security Disclosures, involved a contravention by Orbis of the Fourth Principle. Orbis has pleaded reliance on the defence provided for by s 13(3), but it follows from my rejection of Orbis’s case under paragraph 7 of Schedule 1 Part II that this defence fails. The first and second claimants are therefore entitled to compensation from Orbis for any damage they have suffered by reason of those contraventions. (For the reasons I have given, no other contravention of the DPA has been established, so none of the claimants is entitled to any compensation for any other act of processing that has been complained of in this case.)[195]“Damage” for these purposes is not confined to material loss. Compensation for distress is recoverable in any case, even if material loss is not sustained: Vidal-Hall v Google Inc [2015] EWCA Civ 311 [2016] QB 1003. And compensation is recoverable for a contravention that interferes with the data subject’s control over his data, even if this does not cause material damage or distress: Lloyd v Google LLC [2019] EWCA Civ 1599 [2020] 2 WLR 484. These, although not natural interpretations of the terms of s 13, have been held to be necessary by reason of the parent Directive, the Convention, and the Charter of Fundamental Rights of the European Union (2012/C 326/02). Mr Tomlinson is therefore entitled to submit, as he does, that the first and second claimants have a right to compensation.[196]That compensation must provide redress for the interference with autonomy, and any distress caused by the breach. What of reputational harm? If, as the authorities make clear, damage is not limited to material loss, it seems hard to exclude this as a matter of principle. And Mr Millar concedes that in principle, the Court can award compensation under s 13 for reputational harm. In a case such as this, where the inaccurate information is seriously defamatory, that seems right. The issue might deserve closer attention in different circumstances.[197]It seems to me that the Court’s approach to the assessment of damages for reputational harm and distress resulting from inaccurate disclosures of personal data should follow established common law principles. The Directive appears to leave such matters to be determined according to national law. The principles that apply in respect of the identification of recoverable loss, aggravation, mitigation, and the assessment of damages in this area are to be found in the law and practice of defamation. To adopt any other approach would lead to incoherence in the law. I summarised the majority of the principles relevant to this case in Barron v Vines [2016] EWHC 1226 (QB) [20-24]. In Sloutsker v Romanova [2015] EWHC 2053 (QB) [2015] EMLR 27 [80], I summarised and applied the established law on whether and when a reasoned judgment may mitigate damages.[198]I do not accept Mr Tomlinson’s ambitious submission that Orbis can and should be held responsible for damage caused by third-party republication of the content of Memorandum 112, including media publication consequent on Mr Kramer’s disclosures. A claim for damages of that kind (commonly known as “Slipper” damages) must be pleaded: Slipper v BBC [1991] 1 QB 283. It would be wrong to award any, when the issue has not been ventilated or explored in evidence or argument. Mr Millar’s submission that the remedy should reflect breach by Orbis and not punishment for what others do, is correct.[199]I accept that the claimants have suffered distress as a result of the disclosures complained of, though the majority of the distress they have been caused will inevitably have flowed from media publications for which Orbis is not responsible in law: the Buzzfeed Article and others. My assessment is that each of the claimants is a robust character, not given to undue self-pity. Mr Tomlinson was right to ask for only “modest” damages for distress.[200]Mr Millar submits that it is “fanciful” to assert that Memorandum 112 caused any material incremental distress or reputational damage “given what was already in the public domain about them”. In support of that submission, Orbis relies on two main strands of allegation. First, there is a list of allegations about “the claimants and their links to the Russian government since the 1990s” in which proved or admitted facts about the claimants are intermingled with things that the claimants or Alfa have “reportedly” done, citing media reports. This is an unsatisfactory approach which appears to treat hearsay reports as established fact. Secondly, reliance is placed on “a large amount of material in the public domain about the claimants”, containing a number of allegations about them. It is said, for instance that “It has been alleged that the First and Second Claimants were involved in trafficking heroin from Burma to East Germany…”. It is said that the New York Times has “reported on allegations of criminality, including drug dealing/running, corruption and embezzlement”. Reliance is placed on the judgment of Judge Bates, which refers to media reports. Mr Millar argues that the claimants’ complaint that Memorandum 112 represented a serious intrusion into their rights is “unsustainable” in the light of this material.[201]These submissions are contrary to established principle. A defendant can mitigate damages by proving that the claimant had an existing bad reputation, but(1) evidence is only admissible in respect of the “relevant sector” of the claimant’s reputation; proof of a bad reputation for something different is irrelevant;(2) bad reputation in the relevant sector cannot be proved by relying on specific acts of misconduct or third party reports, rumours, newspaper cuttings or media reports of bad behaviour: see Barron v Vines [21(5)-(6)], [23-24]. Those passages show that these rules have been firmly established since 1858, and were reaffirmed by the House of Lords in 1964, and the Court of Appeal in 2001. The rule against mitigation of damages by reliance on other publications was reaffirmed once more by the Supreme Court in 2019: see Lachaux v Independent Print Ltd [2019] UKSC 27 [2020] AC 612 [22], [24] (Lord Sumption).[202]That said, the “publication” I am concerned with is limited. I have no evidence that the opinion of any of the recipients was of particular concern to these claimants, or that the recipients took any particular steps that led to identifiable harm. This is one of those cases in which the fact and content of a reasoned judgment should have a moderating effect on the sum that is appropriate by way of vindication.[203]My conclusion is that I should award each of the first and second claimants compensation in the sum of £18,000.

Summary of Conclusions

[204]For the reasons given in this judgment I have reached the following main conclusions on the issues identified at [18] above:(1) The personal data about the delivery of “illicit cash” to Mr Putin did amount to sensitive personal data about alleged criminality.(2) The Fusion Disclosure was made for purposes falling within the Legal Purposes Exemption. The Fusion Disclosure was, for that reason, exempt from the Notice Requirement contained in Schedule 1 Part II para 2; the application of that requirement would be inconsistent with the disclosure. But the Fusion Disclosure was not exempt from the Fourth Principle, or from s 14(1)-(3).(3) The purpose of national security requires that the National Security Disclosures be exempt from the Notice Requirement. But it does not require any further exemption from the First or Fourth Principles.(4) Neither the Fusion Disclosure nor the National Security Disclosures were in breach of the First Principle. They all satisfied at least one condition in Schedule 2 and one in Schedule 3.(5) The personal data of which complaint is made are all factual, and not matters of opinion. The claimants have discharged the burden of proving that the data are inaccurate or misleading as a matter of fact.(6) No breach of the Fourth Principle has been established in relation to propositions (a), (b), (c) or (e), because Orbis has proved that this was third party information which it recorded accurately, and took reasonable steps to verify. But Orbis failed to take reasonable steps to verify the allegation in proposition (d), that the first and second claimant used Mr Govorun to deliver illicit cash to Mr Putin in the 1990s. A breach of the Fourth Principle is made out in that respect.(7) I am prepared to grant a limited order for rectification in respect of all the inaccurate data, but I decline to grant any wider remedy under DPA s 14(1)(3), on the grounds that this is not necessary or appropriate. I decline, for similar reasons, to make a declaration. But I award compensation to each of the first and second claimants. I assess the appropriate sum as £18,000 each.

Cited in 16 later judgments

and 7 more of the most senior