England and Wales High Court (King's Bench Division) Decisions

IN THE HIGH COURT OF JUSTICE
KING'S BENCH DIVISION

		Royal Courts of Justice Strand, London, WC2A 2LL
		18 November 2024

This judgment was handed down remotely at 10.30 am on 18 November 2024 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

Deputy Master Alleyne:

INTRODUCTION

1. This is the hearing of the Second and Fourth Defendants' joint application for strike out or summary judgment, by application notice dated 21 May 2024 ("the Application").
2. The issues identified for determination were:

a. Whether only the First Defendant was capable of being a data controller, for the purposes of Article 15 of the GDPR; and if not

b. Whether the Respondent's pleaded case lacks sufficient factual basis for the Second or Fourth Defendant to be data controllers.

THE BACKGROUND TO THE CLAIM AND THIS APPLICATION

3. The First Defendant is a charity established in April 2018, with Charity Number 1177993. Its purpose is to provide training, skills and employment in the production and retail of leather fashion goods to current and former convicted prisoners, to support their rehabilitation and to revive British crafts and manufacturing.
4. The First Defendant is presently in administration and has played no part in the Application. Insolvency practitioners at Evelyn Partners LLP are appointed as liquidators. The First Defendant is a Charitable Incorporated Organisation ("CIO") within s.205 of the Charities Act 2011, hence it is a body corporate but not a company.
5. The Second Defendant was the founder of the First Defendant. The Third and Fourth Defendants were trustees and leather accessories designers. The Third Defendant is not an applicant and has played no part in the Application.
6. I will refer to the parties to the Application as the Applicants (jointly Ms Johns and Ms Riedweg) and the Respondent. I will refer to the First Defendant as LIO.
7. LIO had premises on Pratt Mews, London. The ground floor was operated as a retail shop. The first floor was used as office space.
8. In July 2019, while the Respondent was on licence in the community under the supervision of HM Prison and Probation Service, he was employed as a retail assistant by LIO's non-charitable retail subsidiary, S&K Camden Ltd (Company number 11468327).
9. The Respondent's employment did not run smoothly. Along with other employees and/or trustees of LIO, he raised concerns regarding how LIO was operated and alleged serious criminal conduct against senior individuals. The Applicants deny the allegations.
10. On 1 December 2019, the Respondent was dismissed on the ground of gross misconduct. The Respondent alleges that he was unfairly dismissed for whistleblowing. Lawyers acting for LIO wrote to the Respondent seeking written undertakings. When he refused, a report was issued to HM Prisons and Probation Service with the objective of ensuring that his license to remain in the community was revoked. The Respondent alleges that the report was false. The Applicants deny falsity. However, it was common ground that the report and the subsequent reports provided to external organisations comprised personal data about the Respondent.
11. On 24 March 2020, the Respondent was recalled back to prison. He was released in or around May 2020.
12. The Respondent then made annual data subject access requests for information. The pleaded requests were made or dated: 15 September 2020, 8 August 2021 and 3 May 2022 ("the DSARs").
13. I take the following overview of the data subject access requests from the continuation document accompanying the Application, at paragraph 7:

"7. The first request is addressed to the 'data protection officer' of LIO. It states, materially:

"Please supply us with any and all information you hold constituting personal data of which our client is the data subject. This should include, but is not limited to:

• All profiles or entries on any service or databases operated by you, whether current or archived, containing or in any way referring to our client's personal data. Note that this is not limited to profiles or entries where our client is the main subject, but includes any in which our client is named (for example as being 'linked' to the profile subject) as this would constitute their personal data.

• All correspondence pertaining to decisions concerning current or superseded profiles or entries on or in any way referring to our client. This encompasses but is not limited to any electronically-generated documentation concerning decisions to amend or delete any profiles or entries on or referring to our client.

• All data pertaining to any internal interaction by leather inside out or its agents, in respect of our client's personal data.

• All documents and communications logs referring to or in any way connected with our client Antony Savva (or Savva, as he is commonly known) between June 2019 and September 2020.

In particular we require the supply of:

• Antony Savva's contract of employment or 'zero hours contract''.

• Antony Savva's beneficiary case file, including but not limited to any notes concerning disciplinary hearings, formal and informal complaints, including witness statements and investigation reports.

• All communication logs from and between LIO staff members and its trustees referencing Antony Savva (or Savva, Savor any similar reference to him by which he is commonly known) and in connection to communication referencing Antony Savva, particularly concerning complaints and allegations, including emails and text messages (including social media application platforms).

• All minutes of meetings relating to Antony Savva, in particular relating to his dismissal; to appoint a law firm to contact Antony Savva and the decision to report Antony Savva to the probation service and police.

• All communication between Leather Inside Out and the St Giles Trust referencing Antony Savva.

• All communication between Leather Inside Out and, or its trustees or employees and any outside organisation referencing Mr Antony Savva.

• All communication between LIO and staff at HMP Prison and Probation service referencing and in connection to communication referencing Antony Savva.

• All communication with accountants in regards to PAYE, National Insurance contributions and Pension contributions, that references Antony Savva.

• Any communication with HMRC in connection with or that references Antony Savva.

• Any pay slips referencing Antony Savva, including Antony Savva's P45 and P60."

8. The subsequent SARs put the requests in slightly different terms, but seek materially similar information."

14. In October 2020 solicitors acting for LIO in relation to the 15 September 2020 DSAR, refused to supply the information requested, relying on continuing criminal investigations and exemptions relating to the prevention or detection of crime and the apprehension or prosecution of offenders and/or on the request being disproportionate in nature or extent. The 8 August 2021 DSAR was refused on similar grounds. In addition, it was suggested a response would provide premature disclosure in various employment tribunal proceedings then being pursued by the Respondent against LIO.
15. The DSARs were not complied with, inasmuch as no documents were provided, whether in the 40-day time frame or at all. The Respondent says this was contrary to the requirements of the UK GDPR and that each of the Defendants, legal and natural, are responsible as data controllers.
16. Proceedings were issued under CPR Part 8 on 20 October 2022, with Particulars of Claim dated 27 July 2022. The Defendants' Defence, dated 31 January 2023, pleads that only the First Defendant is a controller of the Respondent's personal data and hence the Second, Third and Fourth Defendants should be removed from the claim (paragraph 3). This Application was made by application notice dated 21 May 2024.

THE CLAIMANT'S PLEADED CASE

17. I take the following excerpt of the Claimant's case from the Particulars of Claim:

"1. I am an ex-employee of the respondents charity, Leather Inside Out (LIO). LIO provides employment and training to ex-offenders such as myself. The charity was founded and is managed by Ms Victoria Johns, who is also an ex-offender; convicted for money laundering and fraud. I was also a beneficiary of the charity because of my status as an ex-offender subject to a license, and I performed my duties for LIO's subsidiary company S & K Camden Ltd.

2. During my employment I uncovered several malpractices, failed obligations and serious criminal conduct (invoice fraud and potentially money laundering). After I raised these concerns, I was dismissed and victimized. The respondents wrote to me through their legal representation and made false accusations against me (AS1). Their letter made implicit threats to file a false report against me, knowing and highlighting that I was serving the remainder of my sentence in the community subject to a written license. They demanded that I sign 'prepared statements' and to never repeat my allegation of money laundering and fraud.

3. When I refused to comply the respondents indeed filed a false report to the probation service to ensure that my license to remain in the community was revoked…/…

6. Victoria Johns' shadow controls the charity which is illegal. She claims to take directions from the Trustees, Anat McKenzie and Nicole Riedweg, who are legally responsible for the charity and any important decisions that the charity takes. This would invariably include the decision to file a report to the probation service because of the 'safeguarding' implications arising from its consequence."

THE DEFENDANTS' PLEADED CASE

18. I take the following excerpt of the Defendants' case from the Defence:

"8. The first sentence of paragraph 3 is admitted, save that it is denied the report to the Probation Service was a false one. The Claimant is required to prove the matters set out in the second sentence of paragraph 3, which are outside of the Defendants' knowledge.

9. Paragraph 4 is admitted, save that it is denied that a false report was filed or that the Claimant was entitled to such information under the DPA 2018…/…

11. Paragraph 6 is denied to the extent that it is alleged that Victoria Johns has acted illegally in the manner pleaded. The matters pleaded are in any event irrelevant to these proceedings…/…

16. Paragraph 11 is denied. A report was made to the north London branch of the Community Rehabilitation Company (CRC) on behalf of First Defendant in December 2019 and two referrals were made to the Metropolitan police. The processing of the Claimant's personal data for these purposes was related to the prevention or detection of crime and/or the apprehension or prosecution of offenders."

DOCUMENTS IN THE APPLICATION

19. The Applicants' evidence comprises the application notice and continuation document, dated 21 May 2024, the DSARs, a witness statement from Ms Johns, dated 20 May 2024, and a witness statement from Ms Riedweg, dated 20 May 2024.
20. The Respondent relies on his witness statement, dated 1 July 2024 and exhibits AS1-19.
21. I have a lever arch bundle of documents and have had the benefit of Skeleton Arguments by Mr Jacobs and the Respondent supplemented by oral submissions.

THE APPLICANTS' WITNESS STATEMENTS

22. The Applicants' witness statements, surprisingly, provide little factual support for the Application nor do they explain the central events going to whether the Applicants were data controllers.
23. The evidence states (in each of the witness statements): "I described my experience of matters relevant to the Application [to Forsters LLP]" and "…I am advised by my lawyers that I am not a controller of this personal data (in any legal sense)…". In my view, referring to privileged advice piecemeal, and absent relevant evidence going to the issues before the Court, is wholly unsatisfactory.
24. The Applicants' roles, duties and responsibilities for LIO, as agents, are not explained. The high point of the evidence is "I was the Chairperson of the Charity" (Ms Riedweg); and "I was a consultant in respect of financial and legal affairs" (Ms Johns).
25. Ms Johns' evidence as to her role is inconsistent with the Defence, which pleads "The Second Defendant is the founder and CEO" and the continuation document, which states "The Second Defendant was the founder and CEO of Leather Inside Out". The Respondent invited me to draw an adverse inference by reason of this inconsistency, which I have declined. The issues before me were limited and I make no finding as to the reason for the inconsistency nor as to which role Ms Johns held in 2019.
26. I find the Applicants' witness statements of little to no use in respect of the issues I must decide. This is because both statements lack factual evidence in support of reverse summary judgment; whether on the issue of 'real prospect of success' or 'no other compelling reason the case should be determined at trial'.

RELEVANT PROVISIONS OF THE UK GDPR

27. The provisions draw a distinction between a 'data controller' and a 'data processor'. The UK GDPR provides, so far as material, as follows:

"Chapter I General Provisions

Article 4 (Definitions)

4(7) 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data …

4(8) 'processor' means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; …/…

Chapter III Rights of the data subject

Section 2 Information and access to personal data

Article 15 (Right of access by the data subject)


15(1) The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;…"

THE APPLICATION - RELEVANT LAW

Strike Out

28. The application for strike out is made pursuant to CPR 3.4(2)(a), which provides:

"(2) The court may strike out a statement of case if it appears to the court —

(a) that the statement of case discloses no reasonable grounds for bringing or defending the claim;"

29. Paragraph 1.2 of Practice Direction 3A gives examples of cases where the court may conclude that particulars of claim disclose no reasonable grounds for bringing the claim, including: claims which set out no facts indicating what the claim is about; claims which are incoherent and make no sense; and claims which contain a coherent set of facts but those facts, even if true, do not disclose any legally recognisable claim against the defendant.
30. The notes to the White Book 2024, at 3.4.2 recap that a claim should not be struck out unless the court is certain that it is bound to fail (Hughes v Colin Richards & Co [2004] EWCA Civ 266 at [22]). Furthermore, if a statement of case is found to be defective, the court should consider whether there is reason to believe that defect might be cured by amendment and, if it might be, the court should refrain from striking it out without first giving the party concerned an opportunity to amend (Kim v Park [2011] EWHC 1781 at [40-41]).

Summary Judgment

31. Pursuant to CPR 24.3:

"24.3 The court may give summary judgment against a claimant or defendant on the whole of a claim or on an issue if—

(a) it considers that the party has no real prospect of succeeding on the claim, defence or issue; and

(b) there is no other compelling reason why the case or issue should be disposed of at a trial."

32. The notes to the White Book 2024, at 24.3. recap that the burden of proof rests on the applicant to establish that both limbs of the test are satisfied. If the applicant adduces credible evidence in support of the application; then the respondent comes under an evidential burden of proving some real prospect of success, or other reason for having a trial: Sainsbury's Supermarkets Ltd v Condek Holdings Ltd [2014] EWHC 2016 (TCC) at [13].
33. Although I was not referred to Easyair Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch) at [15], Lewison J (as he then was) provides a summary of the principles to be applied on a summary judgment application brought by a defendant that is uncontroversial and useful:

"As Ms Anderson QC rightly reminded me, the court must be careful before giving summary judgment on a claim. The correct approach on applications by defendants is, in my judgment, as follows:

i) The court must consider whether the claimant has a "realistic" as opposed to a "fanciful" prospect of success: Swain v Hillman [2001] 2 All ER 91;

ii) A "realistic" claim is one that carries some degree of conviction. This means a claim that is more than merely arguable: ED & F Man Liquid Products v Patel [2003] EWCA Civ 472 at [8];

iii) In reaching its conclusion the court must not conduct a "mini-trial": Swain v Hillman;

iv) This does not mean that the court must take at face value and without analysis everything that a claimant says in his statements before the court. In some cases it may be clear that there is no real substance in factual assertions made, particularly if contradicted by contemporaneous documents: ED & F Man Liquid Products v Patel at [10];

v) However, in reaching its conclusion the court must take into account not only the evidence actually placed before it on the application for summary judgment, but also the evidence that can reasonably be expected to be available at trial: Royal Brompton Hospital NHS Trust v Hammond (No 5) [2001] EWCA Civ 550;

vi) Although a case may turn out at trial not to be really complicated, it does not follow that it should be decided without the fuller investigation into the facts at trial than is possible or permissible on summary judgment. Thus the court should hesitate about making a final decision without a trial, even where there is no obvious conflict of fact at the time of the application, where reasonable grounds exist for believing that a fuller investigation into the facts of the case would add to or alter the evidence available to a trial judge and so affect the outcome of the case: Doncaster Pharmaceuticals Group Ltd v Bolton Pharmaceutical Co 100 Ltd [2007] FSR 63;

vii) On the other hand it is not uncommon for an application under Part 24 to give rise to a short point of law or construction and, if the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and that the parties have had an adequate opportunity to address it in argument, it should grasp the nettle and decide it. The reason is quite simple: if the respondent's case is bad in law, he will in truth have no real prospect of succeeding on his claim or successfully defending the claim against him, as the case may be. Similarly, if the applicant's case is bad in law, the sooner that is determined, the better. If it is possible to show by evidence that although material in the form of documents or oral evidence that would put the documents in another light is not currently before the court, such material is likely to exist and can be expected to be available at trial, it would be wrong to give summary judgment because there would be a real, as opposed to a fanciful, prospect of success. However, it is not enough simply to argue that the case should be allowed to go to trial because something may turn up which would have a bearing on the question of construction: ICI Chemicals & Polymers Ltd v TTE Training Ltd [2007] EWCA Civ 725."

34. The Respondent is not required to show that its case will likely succeed at trial, merely that it has some real (not fanciful or imaginary) prospect of success. The hearing of a summary judgment application is not a mini trial. The court will therefore only consider the merits of the respondent's case to the extent that it is necessary to determine whether it has sufficient merit to pass the threshold and proceed to trial.
35. The second limb of CPR 24.3 requires separate consideration of whether there is any other compelling reason for a trial.

SUBMISSIONS

The Applicants' submissions

36. The Application is summarised as follows, at paragraph 20:

"(a) It is only the CIO, the First Defendant, that is the data controller, to whom a SAR can be made, and against whom any obligation to respond arises.

(b) There is no basis to contend that either of the Second or Fourth Defendants were acting as data controllers, in respect of any of the personal data sought. As above, the requests quite clearly relate to the course of the Claimant's employment with a subsidiary of the First Defendant. Data gathered and processed in the course of that employment is at the direction and control of the CIO and not by the CEO or a trustee (save as agents of the CIO).

(c) The Particulars of Claim does not set out any basis pursuant to which it could be said that the Second or Fourth Defendant were data controllers."

37. The Applicants' Skeleton Argument states (paragraph 3):

"(c) Insofar as the Second and Fourth Defendants were involved at all, they were acting as agents for the CIO, and the CIO is the data controller. The position is made clear by Mr Justice Richards in Southern Pacific Loans Ltd [2013] EWHC 2485 (Ch) (see the Statement of Case at §§17-18)

(d) That is uncontroversial as a matter of law and, accordingly, the court should grant strike out (or summary judgment) on the claims against the Second and Fourth Defendant. The Court should, of its own motion, make the same Order in respect of the Third Defendant."

38. It was submitted that the Court's jurisdiction under CPR 3.4(2)(a) is engaged because the Second to Fourth Defendants could only have acted as agents of LIO in their capacities as consultant or trustee and cannot, personally, be data controllers. It was argued that this approach accords with the emphasis in the authority relied upon in oral submissions: Southern Pacific Loans Ltd [2013] EWHC 2485 (Ch) at [19].
39. As a secondary position, if the claim is not strikable as a matter of law, it was submitted that the pleading does not set out any basis pursuant to which the Respondent might succeed on the claim that the Applicants were controllers.

The Respondent's submissions

40. The Respondent's witness statement includes:

"12. A SAR is a legal administrative request that falls squarely under Victoria's self-proclaimed remit. As the CEO and general manager of the first defendant, she personally liaised and shared my data with third parties, including the St Giles Trust and the National Probation Services/Community Rehabilitation Company ('CRC'), Blue Light Consultants, Carter-Ruck, and Ashfords LLP [AS9/AS10].

13. As the decider of who and how my data was processed, she was the controller as defined by Article 4.7, and as the party sharing my data, she was also the processor of my data as defined by Article 4.8. …/…

19. The documents requested under the SARs related to who participated in the decision to file the [false] report and on what evidence, or put another way, who was the controller that authorised the processing and against my consent?

20. My SAR imposed a legal obligation to supply information about how my data was processed, but she refused to supply it, thereby restricting it as defined by Article 4.3, and the act of restricting it [on false grounds] means that she becomes the controller of my data related to that processing (Article 28)."

41. The Respondent's Skeleton Argument states (paragraphs 10-13):

"10. The defendants cite paragraph 17 of Southern Pacific Loans Limited [2013] EWHC 2485 (Ch) in paragraph 3(c) of their skeleton argument and present a hypothetical scenario suggesting that SARs should only ever be directed to the company, not its directors. In doing so, they suggest this proves that only a company or charity can be a controller.

11. However, this only supports the notion that companies are the 'primary' data controllers. The law is clear: individuals responsible for processing and determining how data is processed also become controllers, as referenced in 4 (a)-(d) above. Again arguing otherwise renders these provisions meaningless.

12. In WM Morrisons Supermarkets plc v Various Claimants [2020] UKSC 12 (at paragraph 55), the Supreme Court explicitly identified an employee as a data controller. It said - "since the DPA neither expressly nor impliedly indicates otherwise, the principle of vicarious liability applies to the breach of the obligations which it imposes, and to the breach of obligations arising at common law or in equity, committed by an employee who is a data controller in the course of his employment, as explained in Dubai Aluminium.

13. The defendants referenced paragraph 19 of Southern Pacific Loans Limited during the previous hearing to make a similar argument. However, their point is contradicted by the very paragraph they cite. It merely clarifies that natural persons and senior officers do not automatically become controllers based solely on their senior roles - it does not suggest they cannot become controllers…"

42. It was submitted that while LIO was the primary controller, Ms Johns made the decision to file the allegedly false report because of her personal interest in concealing allegations of financial crime and/or her alleged criminal conduct. The Third and Fourth Defendants' failure to investigate the allegations and/or respond to the DSARs was said to show that they were collectively seeking to conceal criminality, contrary to LIO's interests, and thus controllers.

DISCUSSION

Whether only the First Defendant was capable of being a data controller, for the purposes of Article 15 of the UK GDPR.

43. The correct starting point is the broad definition of controller in the UK GDPR. Of central importance is that the definition includes a natural or legal person, public authority, agency or other body and that there may be joint controllers. On plain reading of the provisions, it is incorrect to suggest that an allegation of joint controllers is, per se, not a legally recognisable claim.
44. Paragraph 19 of Southern Pacific Loans cannot bear the weight the Applicants seek to place upon it. If the Applicants were correct it would restrict the natural meaning of the provisions of the UK GDPR. Furthermore, officers of an organisation with legal personality would benefit from blanket immunity when interacting with personal data. On this basis, if for example, a director used personal data held by organisation A when setting up their own competing business (organisation B), it would be processing over which only organisation A was controller. This cannot be right.
45. The point being made in Southern Pacific Loans is, in my judgment, simply that the position and/or authority of directors does not of itself, automatically make them data controllers, despite one reading of Article 4(7) of the UK GDPR permitting such an argument. This is sufficiently clear from the third sentence of the paragraph, as follows: "Given the definition of "data controller" as a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed, it might be argued that the directors as persons who in fact determine the purposes for which any personal data are to be processed on behalf of their company are within the definition."
46. During submissions, the Applicants accepted that the controller would not always and exclusively, be the company, or in this case the CIO. The adjusted argument was that if an officer of an organisation acts properly as agent for the organisation then the organisation alone is the controller. Although not submitted, the corollary of this submission must be that if an officer acts improperly the organisation is not the controller.
47. The test I apply is to ask whether "the statement of case discloses no reasonable ground for bringing the claim". This requires that there be no legal claim that can be sustained against anyone holding the office of trustee or consultant, irrespective of their conduct with respect to personal data. That is something the Applicants have failed to establish.
48. Despite the Applicants' best efforts to persuade me otherwise, this limb of the application cannot be dispositive of the claim against the natural Defendants. There plainly are factual scenarios in which a trustee or consultant would not be acting for LIO and would themselves be the data controller. The issue is whether this case, as alleged, includes sufficient facts to disclose a legally recognisable claim against the Applicants as data controllers. This leads into the Applicants' alternative submission.

Whether the Respondent's pleaded case lacks sufficient factual basis for the Second or Fourth Defendant to be data controllers.

49. The Particulars of Claim allege, and the Defence admits, that the Defendants collectively filed a report to the probation service to ensure that the Respondent's licence to remain in the community was revoked. There is no averment that filing the report was itself criminal, improper, or not done on behalf of LIO. As I view it, pleading falsity alone is not sufficient to displace the default position that only LIO is controller, let alone to make all the Defendants controllers.
50. If I were wrong about this, the Particulars of Claim go on to allege that the trustees "are legally responsible for the charity and any important decisions that the charity takes. This would invariably include the decision to file a report to the probation service because of the safeguarding implications arising from its consequence."
51. Thus, the pleading fails to allege any decisions or acts in respect of personal data which were outside the authority of the trustees as agents for LIO, or otherwise to set out a factual basis for why the Second to Fourth Defendants are said to be data controllers in addition to LIO. There is no plea whatsoever regarding why the contract of employment, employee file, P45 and/or P60 might have been data over which all Defendants were or became data controllers.
52. In my judgment, the pleading lacks sufficient factual basis for the claims against the natural Defendants; whether regarding all personal data or publication of the disputed report. This requires me to go on to consider whether there is reason to believe this defect might be cured by amendment.
53. The Applicants did not submit that the information which the Respondent provided for and during the hearing was provided too late to have any effect on the decision to strike out the proceedings, and in any event, I find that it was not, particularly given the Respondent has had no legal assistance and appeared in person. In that regard, I take into account the overriding objective to deal with cases justly.
54. However, the Respondent's submissions demonstrated he wrongly conflated the immutable fact that a legal person must have a natural person through whom its decisions are carried into effect, with his case that the natural person must be assuming the defined status of data controller in their personal capacity.
55. At its highest, the case was that Ms Johns obtained an incidental personal benefit from the decision of LIO to publish the report to the probation service, and that the Fourth and/or Third Defendant failed to investigate allegations and/or respond to the DSARs. There was no explanation of how this rendered them each data controllers. Absent any factual basis for alleging there were multiple controllers when data was processed, I conclude that it would be wrong in principle not to strike out the claims against the natural Defendants.
56. Whilst I understand the Respondent is aggrieved about the reports issued about him in circumstances where he believes the statements to be false, and some or all of the authors to have acted in bad faith, that does not in my judgment weigh significantly in his favour, in circumstances where he avers that LIO was a controller and was unable to identify his factual case as to why the other Defendants acted other than as agents for LIO.
57. I have concluded, not without some caution, that the factual basis required for this matter to proceed to trial fairly, with each of the Defendants able to understand the case against them, is not set out, nor is there reason to believe this defect might be cured by amendment.

Summary Judgment

58. I can state my conclusions on this issue shortly.
59. The witness statements in support of this Application do not identify in any sensible detail, the factual basis for the case made in submissions before me that the Applicants in fact, were not, and could not in the present circumstances be, data controllers.
60. I raised this issue and it was submitted that the witness statement evidence was provided for completeness only. I was told that all it really does is confirm their roles and that they do not have ongoing duties following the administration of LIO. I agree with that. Unfortunately, this approach to the evidence rendered the summary judgment application hamstrung from the start and I reject that application.

CONCLUSION

61. Stepping back and looking at the matter in the round, and considering the overriding objective, I reject the basis for strike out advanced as a blanket immunity for senior officers, but I also find that the claim sets out no facts relevant to claims against the natural Defendants, and that there is no reason to believe that that defect is curable by amendment. I therefore grant the application for strike out.
62. I strike out the claim against the Third Defendant of my own volition.
63. In the premises, the application for summary judgment does not arise, but for completeness, I would dismiss the application, for the reasons already given.
64. I will hear the parties on consequential matters and costs.