England and Wales High Court (Queen's Bench Division) Decisions

IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION

		Royal Courts of Justice Strand, London, WC2A 2LL
		06/04/2016

Mr Justice Warby :

Introduction

1. This is the trial of a claim by two individuals for a declaration that the defendant, a private investigator, has failed to comply with the subject access duties imposed by s 7 of the Data Protection Act 1998 (DPA), and for an order under s 7(9) of the DPA requiring the defendant to comply with those duties.
2. The general scheme of the "subject information" regime established by the Data Protection Directive, 95/46/EC (the Directive) and implemented via Part II of the DPA is by now quite familiar.

(1) An individual has the right, on making a written request and paying a fee, to be informed by a data controller whether the data controller is processing "personal data of which the individual is the data subject", sometimes referred to as the individual's personal data.

(2) If the answer is yes, the individual is entitled to a description of the personal data, the purposes for which they are being or are to be processed, and those to whom they are or may be disclosed. The individual is also entitled to have communicated to him or her, in an intelligible form, the information in question and any information available to the data controller as to the source or sources of the information.

(3) These rights are set out in s 7(1)-(3) of the DPA. They are qualified in a variety of ways. Some of the qualifications are to be found in ss 7, 8, 9 and 9A. One of them is that the court has a discretion over whether to order a data controller to comply: s 7(9).

(4) But some personal data are altogether exempt from the individual's right of access under s 7. Section 29(1) of the DPA contains an exemption for personal data processed for the purposes of the prevention or detection of crime or the apprehension or prosecution of offenders (the crime exemption). Schedule 7 paragraph 10 exempts personal data covered by legal professional privilege (the privilege exemption).

3. In this case a formal written subject access request (SAR) was made to the defendant by the claimants on 15 June 2015, by letter from their solicitors, Brown Rudnick. It is common ground that at that time the defendant was a data controller, and was processing personal data of each claimant. The defendant's evidence is that this is the consequence of an investigation, as a result of which it holds around 1,500 documents. There are three issues before me:-

(1) Validity: whether the claimants have made a valid SAR; if so

(2) Exemption: whether the personal data that were being processed at the time of the SAR are exempt from the access provisions by virtue of

a) the crime exemption; and/or

b) the privilege exemption; and if not

(3) Discretion: whether the court's discretion should be exercised so as to require compliance by the defendant with the duties under s 7.

4. The principal ground on which the defendant contends that, if I have a discretion, I should exercise it against the claimants is abuse of process. It is argued that the SAR, and this action, represent a misuse of the information rights conferred by the DPA. The claimants are said to be using the DPA as a device with the purpose of gaining an illegitimate procedural advantage in criminal proceedings which have been brought against the claimants in Cyprus by one of the defendant's clients. In connection with the privilege exemption, the defendant relies also on the scale of the data in question and the alleged difficulties of compliance. It would be disproportionate, submits the defendant, to require it to seek legal advice on the privilege exemptions in respect of each and every page it holds.

The hearing

5. The claim is brought under CPR Part 8, on the basis that it involves no substantial dispute of fact. In October 2015 the claimants served a statement from Neil Micklethwaite, a partner in Brown Rudnick. In November the defendant served a statement from Michael O'Keefe, a director of the company. The defendant has not suggested that the claim should proceed under Part 7 and, as is normal in a Part 8 claim, I have heard no oral evidence.
6. The defendant applied at the outset of the hearing for an adjournment on the basis of late service of a second witness statement from Mr Micklethwaite, and the illness of Mr O'Keefe. I refused the application.

(1) The late evidence was little more than an update on the status of the Cyprus proceedings. The defendant had put in responsive evidence from another director, Mr Ghaffur. Justice could be done without the need to allow the defendant time to investigate the issues further.

(2) The witness's illness was of no consequence as he would not have given oral evidence in any event. His statement stood as his evidence in chief and the claimants did not wish to cross-examine him. He was not needed for the purpose of giving instructions.

7. The defendant had warned that it might wish to cross-examine Mr Micklethwaite, but in the event Ms Addy chose not to do so. I must therefore resolve the issues on the basis of the written evidence, drawing or not drawing inferences as necessary where there are rival factual cases, as there are on the question of the claimants' purposes. It is mainly because of that dispute that it is necessary for me to record and reach some findings about the factual background to the SAR.

The factual background

8. This dispute is part of a larger one concerning a Russian company called OJSC PhosAgro (PhosAgro), a producer of fertilisers. The claimants, who are Russian nationals, are husband and wife. The first claimant, Mr Guriev, is the Deputy Chairman of PhosAgro. The couple, together with their family, are the main beneficial owners of the company. Since 2011 PhosAgro has been listed on the London Stock Exchange (LSE).
9. The evidence of the defendant (CSD), is that PhosAgro was founded in or around 2001 by Alexander Gorbachev, and that he was its chairman until 2004. He is said to have fled Russia in 2003 after being accused by a Russian prosecutor of fraud in connection with PhosAgro's affairs. He currently lives in the United Kingdom. He denies the fraud allegations. He was granted asylum here in 2005, and an Interpol arrest warrant in respect of him was withdrawn in 2015. At some point, precisely when is not clear, Mr Gorbachev and a company named Marholm Limited (Marholm) instructed CSD by "in respect of claims issued and/or which may be issued" against the claimants
10. CSD is a London-based company incorporated in 2011 by Tarique Ghaffur a former Assistant Commissioner in the Metropolitan Police, and led by Mr Ghaffur, Mr O'Keefe, who is a former Chief Inspector in the CID, and Robert Marshall, a former constable. CSD offers security and investigative services. Marholm is "funding the investigations into the claims" according to Mr O'Keefe. He also says that the UK and Cyprus legal representatives of Mr Gorbachev and Marholm were clients of CSD. Some doubt has been cast on that, and some of the documents suggest it may be inaccurate, but I do not need to decide the point.
11. On 11 March 2015, Mr O'Keefe on behalf of CSD sent Mr Guriev as Deputy Chairman of PhosAgro a letter marked "personal and in confidence". It said that CSD had been instructed by Marholm to "conduct a criminal and regulatory investigation into the circumstances leading to the flotation of PhosAgro" on the LSE. The letter said that Marholm had also instructed Kennedys solicitors in London to advise on the matter, and later correspondence confirms that Kennedys were instructed by Mr Gorbachev. But Kennedys did not write to Mr Guriev. Only CSD did so.
12. The letter referred to the prospect of criminal, regulatory and/or civil liability for fraudulent statements or omissions in the prospectus for the 2011 "flotation" and posed questions for Mr Guriev to answer. Mr Weekes, for the claimants, describes the letter as threatening. Ms Addy resists that characterisation. It is appropriate to cite parts of what was said, verbatim.

"We have had sight of the prospectus… Such Prospectus needed to adhere to the relevant Prospectus Regulations as apply to the same, including, in particular in relation to the strict disclosure requirements. We know from our previous experience that English Common Law requires that an IPO prospectus must be 'strictly and scrupulously accurate' and that if a publically published prospectus does not make proper disclosure and an investor subscribes for securities on the basis of that wrong disclosure liability may flow for loss caused thereby.

In addition to, and in tandem with, the above civil litigation considerations which may follow you should note that certain criminal liability will almost certainly arise for serious breaches of the said Prospectus Regulations: In particular I would like to draw your attention to Sections 2-4, Fraud Act 2006, and Part VI, of the Financial Services and Markets Act 2000."

13. The letter posed 7 questions, which Mr Guriev was asked to answer in his capacity as Deputy Chairman, "to assist in our investigation". It was said that this request was made "under the provisions of United Kingdom's Freedom of Information Act 2000, as it relates to public entities registered within the United Kingdom and as regulated within the various Financial Services Regulatory Bodies." This of course was legally misconceived. PhosAgro, as a private company, is not subject to FoIA. The questions sought information about any trusts in which shares were held and included the following:

"2. Please explain your position within the company structure in 2011 and your role in the IPO as 'proposer'

…

5. Please confirm your knowledge of any errors or omissions of information within the IPO.

6. Please confirm your knowledge of any authorised exemptions from disclosure of information …

7. Please explain if and why these exemptions included any reference to Alexander Gorbachev and produce any documents where he is mentioned in this context."

14. It is clear that this letter was indicating that Mr Guriev might be civilly liable for failures of disclosure in the prospectus. That is plain from the first paragraph cited above. The second paragraph I have quoted is open to more than one interpretation, but I accept Mr Weekes' submission that it would not be unreasonable to read it as asserting that Mr Guriev was almost certainly criminally liable for serious breaches of the Prospectus Regulations, amounting to fraud. Mr Weekes points to the mysterious identity of CSD's client, Marholm. Its role was unexplained. Ms Addy submits that there is no mystery; it must have been clear that Mr Gorbachev stood behind CSD. I assume therefore that CSD's case is that he had by this time instructed them. The evidence does not say this. If it is so, then the letter did not say so and it is a mystery why not. I accept Mr Weekes' submission that a reasonable reader could conclude that CSD did not expect answers to its questions, but aimed rather to intimidate.
15. Mr O'Keefe's letter asked for answers to his questions by 23 March 2015. Similar letters were sent to other board members and executives of PhosAgro. On 16 March 2015 Mr O'Keefe wrote to Mr Micklethwaite, referring to this "series of letters" and concluding "I would be grateful to receive responses to our questions at our registered office by 14 March 2015". On 19 March 2015 Mr O'Keefe wrote to the second claimant, Mrs Gurieva, notifying her of the instructions given by Marholm. He posed 5 questions, on the basis that "you are your family members are referred to as the economic beneficiaries of the trusts holding" 70.9% of the shares in PhosAgro. He pointed out that Mrs Gurieva was "under no obligation to answer such questions" but asked for answers by 3 April 2015. The questions were an inaccurate cut and paste from those asked of Mr Guriev. They included a request to explain "if these exemptions included any reference to Alexander Gorbachev", although there was no other reference to "these exemptions". Again, I find it would be reasonable for a reader in Mrs Gurieva's position to regard the letter as threatening or intimidating. It is objectively unlikely that anyone in receipt of such a letter would answer the questions posed.
16. The response to CSD's correspondence came from PhosAgro's Deputy CEO for Corporate and Legal Affairs, Alexei Sirotenko. In a letter of 2 April 2015 he pointed out that CSD had not provided any particulars of its allegations, or explained the interest of Marholm. He described the allegations as "very serious in nature and potentially very damaging to the company" and threatened action to protect the company's reputation "should you continue to make such statements to third parties without providing any proper justification for doing so." He invited CSD to address any legitimate concerns to the company, giving details, or to take its concerns to the Financial Conduct Authority. CSD did neither. What happened next was the launch of a private prosecution by Mr Gorbachev.
17. In May or early June 2015, Mr Gorbachev brought criminal proceedings in the District Court of Limassol, Cyprus against the claimants and some 12 or 13 others, alleging that they had defrauded him of a 24% stake in PhosAgro worth $1.2 billion. It is evident from a judgment of the Cyprus court, to which I shall refer again later, that private prosecution is not only possible in Cyprus, it is a method of proceeding which is at the present time popular among private litigants. In a judgment of 11 January 2016 Judge L Paschalides of the Limassol District Court wrote of "The enormous volume of cases of similar nature with which I am dealing every day". This is evidently not a process popular with the Judge, who deprecated "The conscious choice to circumvent the authorities charged with investigating and prosecuting criminal offences, and to register, without limitation, criminal cases about everything …"
18. On 11 June 2015 a London agency called Powerscourt issued a press release under the heading "Criminal indictment against PhosAgro principal shareholder and Director Andrei Guryev and others confirmed; former PhosAgro Chairman Alexander Gorbachev's rightful 24% stake was stolen, it is alleged." The press release said, among other things:

"Guryev … and 13 other defendants were criminally indicted by the District Court Limassol in Cyprus last month. They are accused by the prosecuting authorities in Cyprus of using fraudulent means to deprive Gorbachev ... of a stake in the business worth around US$1.2 billion at current market prices.

…

If found guilty, individual defendants face jail sentences …. PhosAgro arguably failed to convey the seriousness of the case to investors last month. The company's regulatory filing stated that Gorbachev had issued proceedings; in fact, the case is not a civil action and is being brought by a criminal prosecutor.

London-based Gorbachev … said:

...

This is a criminal case brought by the prosecuting authorities in Cyprus. …"

19. It is an agreed fact that the prosecution was not "being brought by a criminal prosecutor" or "by the prosecuting authorities in Cyprus". The evidence of Mr O'Keefe is that the press release was put out on the instructions of Marholm. It is accepted by the claimants that this was not CSD's work, and they do not suggest that Marholm knew it was false. But they are entitled to point to the facts that the press release was false and misleading, and contains a quote which is false and misleading, which is attributed to Mr Gorbachev, who is a client of CSD in relation to this very matter. Those are grounds for believing that in the matter on which CSD was instructed, CSD's client was engaged in an aggressive and intimidating litigation PR strategy which involved the issue of false and misleading information. It follows that there are grounds for believing that CSD may have had personal data relating to the claimants which is not accurate.
20. The claimants are also entitled to rely on CSD's next letter, dated 16 June 2015. This was addressed to Mr Micklethwaite. It said that "we are now aware of the commencement on 9 June 2015 of the private criminal prosecution of Mr Guriev, his wife [and others]. We also note the substantial media coverage recently concerning the same." On the face of things, it would be reasonable for the claimants to infer that CSD had by this time learned of the press release. The letter, sent by Mr O'Keefe, continued by explaining that CSD had "carried out a personal security risk assessment of the main prosecution witness, Alexander Gorbachev" and were formally writing to "seek formal assurances … that your clients will not engage in criminal acts directly or through third parties, that are calculated to intimidate or interfere with Mr Gorbachev's … human rights, including his .. safety, security and welfare." Similar assurances were sought with regard to Mr Gorbachev's family. Mr O'Keefe's evidence is that the letter "did not accuse Mr Guriev, Mrs Gurieva or any related party of committing any criminal acts". That is strictly true, but the letter clearly was implying that the claimants posed a risk of physical harm to Mr Gorbachev and his family. That clearly forms a basis for believing that CSD, in its role on behalf of Mr Gorbachev, had personal data relating to the claimants suggestive of a readiness to use or procure the use of intimidation or worse.
21. On 15 June 2015, the claimants' SAR was made. This was five days after the issue of the press release. It was before the letter to which I have just referred. However, I accept the submission for the claimants that in the light of the background I have set out they had every reason at the time of the SAR to be concerned about CSD's role on behalf of Marholm and Mr Gorbachev, and a proper interest in determining what personal data CSD held relating to them, and assessing its accuracy.
22. The SAR of 15 June 2015 was in relatively standard form. It read in its material parts as follows:-

" RE: Subject Access Request under section 7 of the Data Protection Act 1998

We are instructed by the Russian citizens;

(1) Mr Andrei Grigoryevich Guriev; and

(2) Mrs Evgeniya Victorovna Gurieva.

We confirm that we have our clients' authority to make this subject access request on their behalf.

We hereby make a subject access request that you:

(1) inform us whether any of the clients' personal data is being processed;

(2) give a description of the personal data of the clients you hold or process;

(3) give reasons for the clients' personal data being processed;

(4) inform us if the clients' personal data will be or has been given to any organisations or people and identify those if that is the case; and

(5) provide us with a copy of the information comprising the data and give details of the source of the data.

Please provide the reasoning behind any automated decisions to process.

We would draw your attention to "Personal Data" under section 1 of the DPA includes "any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual"

23. CSD's initial response to the SAR came from Mr O'Keefe, on 22 June 2015. It was short, its core content being as follows: "2. Our clients instruct us through Kennedy's and as such, any relevant processing of personal data would be subject to legal privilege. 3. I regret therefore that I am unable to assist you on this occasion.. ." Kennedys later wrote to Brown Rudnick (on 2 July 2015) that "we do not act for CSD and nor have we instructed CSD to act on our behalf on any matter. We do act for Mr Gorbachev." Kennedys added that they were not involved in the Cyprus proceedings.
24. Meanwhile, on 30 June, Brown Rudnick wrote a detailed response to Mr O'Keefe. They sought confirmation that CSD acted for Mr Gorbachev as well as Marholm. They questioned CSD's assertion of privilege, pointing out that CSD was wrong if it believed that simply because it had been instructed by lawyers, legal professional privilege would apply. They asked for details of the nature and basis of the privilege relied on. They pointed out that pre-existing documents are not protected by privilege merely because they have been obtained by a party for a privileged purpose: Ventouris v Mountain [1991] 1 WLR 607.
25. It was not until 22 July 2015 that Mr O'Keefe replied. When he did so, he recorded that CSD had now had the opportunity to take advice on the SAR and had found it to be "non-compliant with the requirements of section 7". Two points were taken: that Brown Rudnick had failed to provide "sufficient evidence" that they were acting on behalf of the data subjects in question; and that they had not provided identity documents "to allow us to identify the data subjects". The firm was asked to produce identity documents for its clients. These were, to say the least, surprising points to take. CSD knew very well who Mr Guriev and Mrs Gurieva were: it had written to each of them; it had itself initiated correspondence with Brown Rudnick in March, on the footing that the firm acted for the couple; and the SAR itself stated in terms that the firm acted for Mr Guriev and Mrs Gurieva, giving their full names and nationality.
26. Mr O'Keefe concluded his letter by stating that pending receipt of "your complete request" CSD reserved its position in relation to legal privilege, but he made no attempt to deal with any of the points made in Brown Rudnick's letter of 30 June 2015. CSD also reserved its position on proportionality and "whether the request is being made for collateral purposes." This was the first indication of what was to become the abuse of process argument.
27. On 4 August 2015 Brown Rudnick replied, making the point that their authority and the identity of their clients were both clear from previous correspondence. They threatened proceedings in the absence of a substantive response by 11 August. There was none, but on 14 August CSD replied at some length. It sought to defend its demand for identification evidence but not (I note) its demand for proof of Brown Rudnick's authority. In addition, it raised the other two points that are now in issue: exemption and abuse of process. Its position on exemption had now expanded to embrace the crime exemption under s 29 of the DPA, as well as "litigation privilege". The claimants' response was a letter before action, on 8 September, and these proceedings were issued on 16 October 2015.
28. Somewhat surprisingly, the present status of the criminal proceedings in Cyprus is the subject of disagreement between the parties. The matter was dealt with in Mr Micklethwaite's second statement, made on 16 March 2016, two working days before this hearing. He states that after his first statement was made Mr Gorbachev made a number of attempts to serve the Cyprus proceedings but had failed and that "as a result, the Cyprus proceedings were dismissed against the claimants." Mr Ghaffur's statement in reply speaks of his understanding that significant efforts have been made to try and serve the claimants with the court proceedings issued by Mr Gorbachev. He says that it appears they are deliberately avoiding service. He does not dispute that the original proceedings were dismissed, but he points out that no evidence is exhibited to support the assertion.
29. Mr Micklethwaite further states that Mr Gorbachev issued a second private prosecution against Mr Guriev and others on 16 November 2015, and attempted to obtain an order for service of those proceedings on Mr Guriev outside the jurisdiction, which was dismissed. These assertions are supported by evidence, in the form of a translation of the judgment and order of Judge Paschalides to which I have referred. That judgment shows that the court's conclusion was, putting it broadly, that it had no jurisdiction to grant the relief sought. The Judge observed that:

"The issues and concerns arising during the dealing of this application fully reflect the problems resulting from the immediate registration of private criminal cases and in particular cases involving a 'foreign' element, both as to the nationality of the parties and the substance of the case. These problems may be even more pronounced when the claimed offences are not only serious but also of such a complex nature to the extent that the involvement of specialised prosecuting authorities is at the least desirable, if not imperative."

30. Mr Ghaffur does not dispute this part of Mr Micklethwaite's evidence, but he says "it is our belief" that it does not present the full picture. His suggestion, based on information from Mr Gorbachev's Cypriot lawyers, is that the second proceedings have been suspended by the Attorney General, and do not stand dismissed. He interprets the Judge's observations as encouragement to Mr Gorbachev to refer his grievances to the authorities with a view to a public prosecution. He suggests that such a prosecution may ensue. Ms Addy points out that the judgment is entitled 'Interim Decision.'
31. Against this background I informed the parties when giving reasons for dismissing the adjournment application that I would deal with the claim on the basis that Mr Ghaffur's understanding may be correct; in other words, that it may be that criminal proceedings remain in place, and that these may be taken over by the Attorney General or other prosecuting authority in Cyprus, or that a fresh public prosecution will be started. As I also made clear, I am not at all sure that this matters for my purposes because it is clear, and not in issue, that the court must deal with a dispute about a SAR on the basis of the facts as they stood at the time it was made or, at the latest, at the end of the 40 days which the data controller is given in which to respond. The statutory scheme would not be workable on any other basis.

Validity of the SAR

32. The first issue identified in Ms Addy's skeleton argument was "whether a valid SAR has been made and D has failed to respond appropriately to the request within the time limit". On inquiry it turned out that validity is raised as an issue separate from abuse of process, but that the defendant makes no positive case on the point. It simply requires the claimant to prove that its SAR complied with the DPA. I can deal shortly with this.
33. I have identified above the two points taken by CSD in correspondence as to the validity of the SAR. They were clearly bad points on the face of the correspondence. Section 7(3) of the DPA allows a data controller to require proof of identity before complying with a SAR, if the data controller "reasonably requires further information in order to satisfy himself" as to identity. For reasons I have given already, it is obvious that there was no such reasonable requirement here. Where the requester is not the data subject it may be reasonable to look for proof of authority. But if the requester is a firm of solicitors which confirms its authority in the SAR itself, no more should ordinarily be required. Here, for good measure, the firm's authority is expressly confirmed in Mr Micklethwaite's witness statement, over a statement of truth. He has not been cross-examined and there is no evidence to the contrary, nor any reason at all to doubt what he says. But he should not have needed to address the point. CSD has never had any reason to doubt what was said in the SAR.

Exemption

The crime exemption

34. Although it was raised second in time it is convenient to deal with the crime exemption first. Section 29 provides, so far as relevant, as follows:

"(1) Personal data processed for any of the following purposes—

(a) the prevention or detection of crime,

(b) the apprehension or prosecution of offenders, …

…

are exempt from … section 7 in any case to the extent to which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection."

35. On the face of this wording it is clear that the court can only conclude that this exemption applies if and to the extent it is satisfied of two things: that the personal data in question were being processed for one of the specified purposes, and that the application of the s 7 provisions would be likely to prejudice one or more of the specified matters. (The specified matters include taxation, but that is immaterial for present purposes, so I have omitted the wording).
36. Although at one stage there appeared to be a dispute about the matter it is not now in issue that in principle CSD can benefit from the s 29(1) exemption. A criminal investigator or prosecutor which is a private person or body would appear to have no lesser right to exemption than a public body processing data for the same purposes. The issue is whether the exemption applies to the personal data that CSD holds in respect of the claimants.
37. Section 29 was considered in detail by Munby J, as he then was, in R (Lord) v Secretary of State for the Home Department [2003] EWHC 2073 (Admin). He held, among other things, that it is for those who assert the exemption to show that their case comes within it: [99]. Ms Addy does not argue the contrary. Nor does she dispute Munby J's further conclusions (ibid.) that the applicability of the exemption must be proved convincingly, by evidence. The ordinary civil standard applies: Robertson v Nottinghamshire NHS Trust [2009] EWHC 1934 (QB), [2009] PTSR 421 [12] (Cranston J).
38. The first issue is whether CSD has proved in this way and to this standard that the claimants' personal data were being processed by it for one of the specified purposes. Mr O'Keefe relies on both s 29(1)(a) and s 29(1)(b), stating in his witness statement that the processing of any data relating to the claimants "is clearly for the purposes of preventing or detecting crime (namely the wrongful appropriation of Mr Gorbachev's shareholding in PhosAgro), and/or apprehending or prosecuting offenders of the conduct complained of." This however is assertion, rather than evidence. His account of CSD's instructions and activities is neither entirely clear, nor wholly supportive of this assertion.
39. Mr O'Keefe says that CSD were instructed by Marholm, Mr Gorbachev and their legal representatives "in respect of claims which have been issued and/or which may be issued against Mr Guriev and Mrs Gurieva". This wording implies civil claims. He goes on to say that:-

"CSD is instructed by its clients to conduct regulatory and criminal investigations into the circumstances leading to the flotation … the alleged misappropriation of Mr Gorbachev's shareholding and other alleged criminal activities relating to Mr Guriev and Mrs Gurieva. The purpose of these investigations is to gather evidence on behalf of Mr Gorbachev to enable him to pursue claims against Mr Guriev and Mrs Gurieva and to provide further evidence for use in the Cyprus proceedings."

40. No further detail is given of what kinds of investigation have been undertaken, or of the nature of the data obtained as a result, or what uses such data have been put to. The wording adopted, coupled with the content of the initial letters to Mr Guriev and Mrs Gurieva, clearly suggests three different kinds of investigation: civil, regulatory and criminal. It also tends to suggest that the primary aim of CSD's client and hence the main purpose of the investigations is, as one might suppose, the pursuit of civil remedies for the alleged "theft". So far as criminal matters are concerned, I am not persuaded that there is any evidence that CSD's activities include any crime prevention purpose, or the apprehension of offenders. I accept that it is likely that some of the personal data held by CSD relating to these claimants is held and has been processed for the purposes of detecting crime, or prosecuting crime. However, it is clear that those are not the only purposes for which CSD has been retained, and I am not persuaded that all the personal data it holds in relation to these claimants is or has been processed for those purposes.
41. I am not persuaded, either, that CSD has satisfied the second condition. It has not shown in relation to any, let alone all, the personal data of the claimants that it holds that the application of s 7 would be likely to prejudice any of the matters specified in s 29(1). Mr O'Keefe asserts that "Many individuals, communities, companies, government agencies and law enforcement bodies rely on the services of organisations, such as CSD, to outsource investigatory work for the purposes set out at section 29 of the DPA. It would, in my view set a dangerous precedent were those organisations required to give disclosure of personal data under section 7 of the DPA. That would undermine the exemption at section 29 of the DPA." Mr O'Keefe goes on to describe the claimants' position as a request for the "disapplication of section 29", which he claims would cause "very real prejudice to the criminal and/or civil proceedings which have been issued and or are in contemplation" against the claimants. He says that Mr Gorbachev does not consent to disclosure "as that would prejudice the litigation and Mr Gorbachev's position in respect of his claims". Mr O'Keefe asserts that disclosure would cause serious prejudice "more widely to CSD's business" as it would "wholly undermine the work which CSD, and other similar organisations, carry out."
42. I pause to note that the references to prejudice to "civil proceedings", to "the litigation", and to "claims" support my conclusions as to purposes. Moreover, prejudice of these kinds clearly could not support a claim to the s 29 exemption. Nor would any prejudice to "CSD's business" of itself support a claim to the exemption. That would only be so if the prejudice to CSD resulted from or caused some prejudice to one of the specified purposes. It also appears to be a clear exaggeration to maintain that CSD's work would be "wholly undermined" when it is clearly not exclusively engaged in criminal investigations. Much of what Mr O'Keefe says therefore cannot be relied on to support CSD's claim to exemption. More generally, however, I consider that there is force in Mr Weekes' submission that in substance what CSD are claiming is a blanket exemption from s 7 for organisations such as themselves, or for criminal investigators, and that he is right to argue that such an approach is wrong in principle.
43. What s 29(1) requires is "a selective and targeted approach to non-disclosure, based on the circumstances of a particular case": Lord [124]. The court is required to make a finding of fact based on those circumstances (Lord [87]). The evaluation must be structured. The factual issue here is whether compliance by CSD with the duty of disclosure (or some particular facet of the s 7 duty) would be likely to cause prejudice to the investigation of the alleged crimes, or to the prosecution of the alleged offenders. As the Information Commissioner's Office explains in "Using the crime and taxation exemptions" at [10-13], a blanket approach to such an issue not legitimate; to apply the exemption it is necessary to identify the prejudice, show how disclosure would cause that prejudice, and show that failure to apply the exemption would be likely to cause that prejudice. "Likely" here means a very significant and weighty chance of prejudice to the particular public interest: Lord [100]. What needs consideration in the present instance, therefore, is what disclosure would reveal, how the revelation would affect the proceedings, and whether the effect would have a weighty and significant chance of prejudicing the public interest in the investigation or prosecution. It is necessary to focus on the specifics, not generalities.
44. Moreover, if the court concludes that some prejudice would be likely it will still need to consider "the extent to which" such prejudice would be likely. That is what s 29(1) requires. Part of this evaluation, as Mr Weekes points out, is whether the restriction of the right of subject access that would result from the application of the exemption in the particular case can be described as "necessary". This is because, as Munby J pointed out in Lord at [99], s 29(1) is based upon, and must be interpreted consistently with, Article 13(1) of the parent Directive; and Art 13(1) authorises Member States to adopt legislative measures to restrict the right of access "when such a restriction constitutes a necessary measure to safeguard … (d) the prevention, investigation, detection and prosecution of criminal offences,…" (emphasis added).
45. The test of necessity is a strict one, requiring any interference with the subject's rights to be proportionate to the gravity of the threat to the public interest. The exercise therefore involves a classic proportionality analysis: Lin v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB) [78] (Green J). In making any proportionality assessment the court would naturally have to take into account the value of the access right. The right to verify the accuracy of personal data about oneself is an important one, which has been identified as an element of the fundamental right to a private life under Article 8 of the Convention: Durant v. Financial Services Authority [2003] EWCA Civ 176, [2004] FSR 28 [4]. For all these purposes the court requires proper and convincing evidence.
46. It may well be that Mr Gorbachev would rather not show his hand in relation to any criminal proceedings that may be extant against the claimants. The evidence does not properly engage with the point, and I am not persuaded that disclosure would have that effect. It seems to me that CSD have approached this matter on the assumption that disclosure under s 7 would require the provision of documents. That of course would be wrong. What is required is information. As the CJEU has recently held in YS v Minister voor Immigratie, Integratie en Asiel [2015] 1 WLR 609, the Directive "does not establish a right of access to any or every document or file in which personal data are listed or used."
47. The requirement to provide a copy of the data in "permanent form" can be satisfied by the provision of redacted copy documents but that is not the only way. Another is a transcript of the data. Moreover, it is only personal data that must be disclosed. Domestic authority holds that not all information retrieved from a computer search against an individual's name or unique identifier is that person's personal data within the DPA: Durant [28] (Auld LJ). Auld LJ there identified two notions of assistance in assessing whether information is personal data: whether it is significantly biographical, and whether it has the data subject as its focus, rather than some other person or some other transaction or event in which the data subject may have figured. Concerns expressed by CSD about disclosing strategic thinking via a SAR response are in my judgment not shown to be well-founded, on the state of the evidence before me. There is no evidence here that satisfies me that compliance with s 7 by CSD would pose any significant risk of material prejudice to the public interest in the proper investigation and prosecution of crime, either in this particular case or more generally.
48. It is true that Mr O'Keefe offers some limited explanation of the kind of prejudice he asserts. He says that disclosure "would allow the claimants a tactical advantage and would clearly undermine the fairness of the ongoing and any contemplated proceedings." This however is evidence or assertion of a very broad and generalised nature. It fails to identify the nature of the information, the disclosure of which would cause prejudice. (It is not necessarily the case that this cannot be done without disclosing the information itself). Mr O'Keefe does not explain what tactical advantage would be obtained, how, or in what way the fairness of the proceedings would be undermined. It is far from self-evident that disclosure to a defendant of relevant non-privileged information held by a prosecutor or his agent is unfair. On the contrary, disclosure is ordinarily considered to be a pre-requisite of fairness. No evidence has been adduced as to the procedures in Cyprus, or as to what prosecution disclosure has taken place or would take place and when if the criminal proceedings continued.
49. The defendant's case as to what I might call the knock-on or "chilling" effect, if s 7 is applied in this case, is in my judgment ill-founded also. Such a consideration is legitimate in principle: in weighing the competing rights and interests where s 29 is invoked, the court may look beyond the instant case, and consider whether prejudice would be caused to the activities and aims set out in s 29 more generally: Lord [122], Lin [104]. But in my judgment there can be no credible argument that if I reject this defendant's claim to a s 29(1) exemption for the reasons that I do reject it, a chill will be cast over the work of criminal investigators. SARs are frequently directed to public authorities which investigate and prosecute crime, which have extensive experience of the process and a good understanding of it. They, and properly advised private investigators, will understand that the effect of my decision is that an organisation in the position of CSD must carry out a proper evidence-based evaluation of the need to claim such an exemption. If it decides to claim the exemption it must be in a position to demonstrate in detail why the application of the DPA in the usual way would be likely to prejudice one of the specified purposes.
50. I accept that this exercise requires some reasonably careful work, which may take some time and could require some legal advice. But I do not think that CSD's argument that the application of s 7 would impose disproportionate burdens can have any application at this stage of the analysis. Proportionality in this respect falls for consideration as a matter going to discretion, which is where I shall address it.

The privilege exemption

51. The privilege exemption is provided for by Paragraph 10 of Schedule 7 to the DPA, in these terms:

"Personal data are exempt from the subject information provisions if the data consist of information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality of communications could be maintained in legal proceedings."

52. As with the crime exemption, the onus lies on CSD as the party claiming exemption to prove that the privilege exemption applies, and to do so convincingly, by evidence, to the civil standard. The burden of establishing that a communication is privileged lies on the party claiming privilege in any event: West London Pipeline and Storage Ltd v Total UK Ltd [2008] EWHC 1729 (Comm) [50] (Beatson J). The court needs to be cautious about such issues given that, unusually, the legal advisers to a party claiming privilege are judges in their own client's cause: Bank Austria Akt v Price Waterhouse (16 April 1997) (Neuberger J). For this reason the evidence should be specific enough to show something of the deponent's analysis of the purpose for which the documents were created, something which it is possible to do without disclosing the substance of that which the claim for privilege is designed to protect: West London Pipeline [53].
53. The matters that need to be established in order to make good a claim for litigation privilege in respect of a document or part of a document were summarised by Lord Carswell in Three Rivers District Council v Governor and Co of the Bank of England (No 6) [2004] UKHL 48, [2005] 1 AC 610 [102]:

"communications between parties or their solicitors and third parties for the purpose of obtaining information or advice in connection with existing or contemplated litigation are privileged, but only when the following conditions are satisfied: (a) litigation must be in progress or in contemplation; (b) the communications must have been made for the sole or dominant purpose of conducting that litigation; (c) the litigation must be adversarial, not investigative or inquisitorial."

54. Here, there were undoubtedly criminal proceedings in progress at the time of the SAR. Such proceedings appear to have been in contemplation for some time beforehand; at least from March 2015, when CSD sent its letters to Mr Guriev and Mrs Gurieva. It appears that some form of civil litigation was also in contemplation. CSD's evidence as to the nature of its instructions is not challenged. In these circumstances it is not disputed by the claimants that some personal data that was held and processed by CSD may be covered by litigation privilege. The claimants argue, however, that it is inconceivable that all the personal data are so protected.
55. The case for CSD faces a number of serious difficulties. The first of these is that CSD has not attempted to provide the kind of detail required by the court in order to uphold a claim to privilege. The second and related problem is that on its own evidence there has been no attempt to analyse which of the personal data it held and processed were covered by litigation privilege. This is necessarily implicit in Mr O'Keefe's assertion that "To require CSD to assess every document to determine whether it attracts privilege in connection with the Cyprus Proceedings and in any other contemplated proceedings would be disproportionate." Thirdly, it is not at all likely that all the data held will attract privilege.
56. That is so for several reasons. One is the Ventouris v Mountain point (above); it is normal for investigators to obtain copies of pre-existing documents, which do not thereby become privileged. Another is that CSD's role has on its own account been multi-faceted, and not limited to investigations in respect of litigation. Indeed, Mr O'Keefe accepts that there are documents in CSD's possession which will (or would) be disclosable "in the context of the Cyprus Proceedings and/or other contemplated litigation in due course". He states that CSD's position is that it should not be required to disclose such documents under the DPA process. It is thus implicitly conceded by the defendants that the privilege exemption will not apply to all the data held by CSD.
57. The position is, therefore, that instead of analysing the material held to determine which documents or parts of documents are privileged, and advancing a reasoned case as to why a claim to privilege should be upheld, CSD has chosen to argue that "it is neither reasonable nor proportionate" to require it to undertake such tasks. In these circumstances I could not uphold the claim to an exemption under paragraph 10 of Sch 7. To do so would be to grant a blanket exemption for what may be a substantial quantity of data, some of which is not shown to be privileged and some of which is by concession not privileged. Any argument based on proportionality must be addressed at the discretion stage, as must the argument that decisions on disclosure should be the preserve of the Cyprus court, or other court(s) in which Mr Gorbachev chooses to litigate against Mr Guriev and Mrs Gurieva.

Discretion

58. The right to seek an order requiring a data controller to comply with its statutory duty is enshrined in s 7(9) of the DPA:

"If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request."

59. For the reasons given above, I am satisfied that CSD has failed to comply with the claimants' SAR, in contravention of the requirements of s 7. I can therefore order compliance but, as the word "may" indicates, I have a discretion.
60. In considering how to exercise that discretion it is important to keep in mind that the relief sought is an order that CSD comply with the provisions of s 7. This does not mean that it would, if I grant relief, be obliged to make disclosures which would be prejudicial to any extant criminal proceedings or investigation. Nor does it mean that it would be bound to disclose information protected by litigation privilege. Rather, it would have to undertake a review and assessment of the personal data it holds; identify and disclose that which is not exempt; and, to the extent that it considers that data is exempt, provide a reasoned assertion of the exemption relied on.
61. The right approach to the discretion has been considered on several occasions, with two different approaches being favoured. In obiter remarks in Durant, at [72], Auld LJ described the discretion as 'general and untrammelled'. See also HHJ Behrens, also obiter, in Dawson-Damer v Taylor-Wessing LLP [2015] EWHC 2366 (Ch), [2016] 1 WLR 28 [42]. A different view had been expressed by Ward LJ when granting permission in Durant. This was that the discretion "might arguably be better expressed to be to allow disclosure unless good reason is shown why it should not be disclosed". That is the view preferred, obiter, by Cranston J in Robertson at [13] as "more faithful … to the purposes of the Data Protection Directive." The closest to a decision on the point is Lord, in which Munby J exercised his discretion in favour of enforcement on the basis that there was "nothing here sufficiently weighty to justify the court exercising its discretion against the claimant or in favour of the [defendant]": [163]. As Ms Addy recognises, it seems to be implicit in that passage that the discretion to enforce will ordinarily be exercised in favour of a claimant who has made a valid SAR, in the absence of a good reason not to. That seems right to me. It would be consistent with a recognition that what is at stake is a fundamental right.
62. But I am not sure the correct approach to the discretion matters in the present case, because I would find in the claimants' favour on either view. I do not consider that any of the reasons urged on me by CSD for refraining from enforcement can bear any significant weight.

Proportionality

63. I have already outlined the submission based on proportionality. Ms Addy refers to a "large cache" of documents, pointing out that any privilege belongs to Mr. Gorbachev and not CSD. It is submitted that the exercise of determining which personal data is privileged should be carried out in the context of the Cyprus proceedings, or other proceedings brought by Mr Gorbachev. In support of this argument Ms Addy prays in aid the reasoning of HHJ Behrens at [62]-[66] and [73] of Dawson-Damer, in which he declined to make an order under s 7 on what can be broadly described as proportionality grounds.
64. I am not persuaded by these arguments.

(1) I do not accept that the task of assessing whether the contents of the documents are privileged in English law is an onerous one. The "cache" of documents is not vast. It is of a scale that litigation solicitors are quite used to dealing with, and assessing. The pre-existing documents to which privilege cannot attach will be readily identifiable. The strong likelihood is that the other documents will fall into a number of classes. The answer to the question whether one document in the class is privileged is likely to apply to each other document in the same class. The task of determining whether a communication is privileged is not an unduly prolonged or complex one.

(2) The fact that the privilege is that of Mr Gorbachev is not a matter of any great weight, given that (a) he is CSD's client and has a clear interest in ensuring that the privilege is asserted; and (b) CSD's evidence is that its clients include Mr Gorbachev's lawyers in both jurisdictions. At one point Ms Addy appeared to suggest that the task of analysis would impose an unacceptable financial burden on CSD. The evidence does not suggest that CSD or Mr Gorbachev lack the means to undertake the task, or that Mr Gorbachev would require CSD to pay for the entirety of the ask, and Ms Addy in due course made clear that this was not her submission.

(3) The possibility that a disclosure exercise may take place in the Cyprus proceedings, or in some other proceedings yet to be started, does not weigh against the grant of relief. There may be no such exercise. If there is, then prior examination of the data for litigation privilege in the context of the SAR will save time and money at that stage. There is no evidence that the Cypriot law of litigation privilege differs from our own.

(4) That is one of the many points of distinction between the present case and Dawson-Damer.

65. In Dawson-Damer beneficiaries of a discretionary trust contemplated litigation against the sole trustee, a Bahamian company. They served a SAR on the solicitors to the trustee. The trust claims could only be litigated in the Bahamas. It was apparent that there would be a substantial overlap between the disclosure issues in such litigation and the subject matter of the SAR. It was conceded that the SAR would not have been made but for the contemplated proceedings. The defendants had not yet undertaken any search. There was evidence that the Bahamian law of privilege differed from English law. In those circumstances the Judge held that it would be disproportionate to order such a search when the same exercise would be more appropriately undertaken in the context of the Bahamian litigation. He based his conclusion on s 8(2) of the DPA, which provides that "the obligation imposed by section 7(1)(c)(i) must be complied with by supplying the data subject with a copy of the information in permanent form unless— (a) the supply of such a copy … would involve disproportionate effort …" Having found that this exception was applicable on the facts, he did not consider the question of discretion under s 7(9).
66. Here, by contrast, the search has been undertaken and the documents containing the personal data are identified ( the "cache" of 1,500 documents); the litigation privilege issue to be addressed in response to the SAR is not complex, as a matter of English law; it is uncertain whether there will be a disclosure exercise in Cyprus or elsewhere; if there is one, there is no reason to believe that it would be more appropriate to determine the issue of litigation privilege in that context than the present one; further, it is not conceded that the SAR has been made for the purpose of the Cyprus proceedings, and I do not consider it has been made for that dominant purpose.

Abuse of process

67. It is commonly said that the subject access regime under the DPA is "purpose blind". It is certainly the case that the Act does not require an individual seeking access to his or her personal data under s 7 to justify or explain the request in any way. Nor is there any provision in the Act which circumscribes the purposes for which a SAR can be made. CSD submit, nonetheless, that this SAR represents an illicit attempt to gain access to the information (via instructions) provided by Mr Gorbachev or his funders or their lawyers to CSD and the evidence obtained by CSD for them in return. It is submitted that this is the claimants' dominant motive and, relying on passages in Durant at [26]-[27] and Dawson-Damer at [38], it is argued that it is not a proper purpose of a SAR. The value to the claimants of such information is said to be obvious. It is submitted that to grant the relief sought would wholly undermine Mr Gorbachev's right to gather "materials for the brief" secretly, via agents such as CSD, and undermine a large part of the business model of CSD and similar organisations.
68. A major problem with these arguments is that they seek to introduce at the discretion stage matters which properly fall for consideration at an earlier point in the analysis, when assessing whether data are exempt pursuant to the crime or privilege exemptions. If it be right that the disclosure of particular personal data would seriously compromise the investigation or prosecution of crime, those data will be exempt and no question of discretion will arise. Similarly, if data are subject to litigation privilege then the privilege exemption can be relied on to protect Mr Gorbachev from the exposure to his opponents in litigation of the "materials for the brief". If, on the other hand, it proves on examination that there are personal data that are not privileged, which can be disclosed without any or any significant prejudice to the public interest in the investigation or prosecution of crime, CSD's arguments lose all or most of their force. On the evidence, given that CSD has undertaken no reasoned assessment of the extent to which the crime and privilege exemptions apply, it cannot be determined whether there is any force at all in these arguments on discretion. It seems unlikely that they do have any force.
69. This reasoning applies equally to the "improper purpose" argument. If it were the claimants' purpose to gain access to "materials for the brief" in pending or contemplated litigation, or to prejudice a prosecution by obtaining early disclosure, or disclosure which would not otherwise be obtained, such purposes could and would be thwarted by properly reasoned reliance on the privilege and crime exemptions. So even assuming (without deciding) that the doctrine of abuse of process is capable of application to a SAR and/or to proceedings under s 7(9), I find it hard to see how it could apply on the facts of the present case.
70. It seems to me that in general terms the court considering an application under s 7(9) should not enquire into or permit investigation of the purpose for which a SAR has been made. The principal authority relied on by Ms Addy is a dictum of Auld LJ in Durant [27], cited by HHJ Behrens in Dawson-Damer at [38], that it is not the purpose of s 7 to enable the individual to obtain discovery of documents that may assist him in litigation or complaints against third parties. I share the view expressed by David Richards J in In Re Southern Pacific Loans Ltd [2013] EWHC 2485 (Ch), [2014] Ch 426 [46] (before Dawson-Damer, but not cited to HHJ Behrens), that Auld LJ's dictum is not "authority one way or the other" for the proposition that a data controller can rely on the purpose of a SAR as a ground for refusing to respond. But I do not accept, in any event, CSD's case that the claimants' SAR had an abusive purpose.
71. The case for CSD relies on a further passage in paragraph [38] of Dawson-Damer, to the effect that an application will be an abuse of process where it is pursued with mixed motives, and it is shown that it would not have been made but for the improper, collateral motive. In this passage the burden of proof is on the person alleging abuse. CSD has not persuaded me that the motives of which CSD complains were the effective, "but for" cause of the claimants' SAR. It may be that an interest in seeing what Mr Gorbachev "had on them" played a role in prompting the SAR. However, as I have found when setting out the factual background, the correspondence from CSD was, objectively considered, intimidating and such as to give rise to legitimate concern that CSD was processing inaccurate data about the claimants. The evidence of Mr Micklethwaite is that the SAR was issued because the claimants considered that data held by CSD might be misleading and they wished to establish whether CSD was processing any personal data about them properly. Mr Micklethwaite has not been cross-examined. His evidence is credible and I accept it.
72. I have difficulty also with the notion that the use of a SAR for the purpose of obtaining early access to information that might otherwise be obtained via disclosure in pending or contemplated litigation is inherently improper. As Mr Weekes points out, the Court of Appeal seems to have taken a different view in a case not cited to HHJ Behrens in Dawson-Damer. In Dunn v Durham County Council [2012] EWCA Civ 1654, [2013] 1 WLR 1305, the court considered, in the context of proceedings claiming damages for child sexual abuse, the interaction of the disclosure regimes under the CPR and the DPA. The claimant had made a SAR. Munby and Tomlinson LJJ agreed with the judgment of Maurice Kay LJ, who saw nothing wrong in principle with using a SAR as a means of obtaining information from an adversary in actual or pending litigation. At [16], he observed:

"I do not doubt that a person in the position of the claimant is entitled — before, during or without regard to legal proceedings — to make an access request pursuant to section 7 of the Act. I also understand that such a request prior to the commencement of proceedings may be attractive to prospective claimants and their solicitors. It is significantly less expensive than an application to the court for disclosure before the commencement of proceedings pursuant to CPR r 31.16. Such an access may result in sufficient disclosure to satisfy the prospective claimant's immediate needs. …"

Section 15(2)

73. The court has power under this sub-section to examine personal data in order to determine how to exercise its discretion. The idea that I might undertake that exercise in this case was floated by Ms Addy, but not pursued with any vigour. It would in my judgment be a clearly inappropriate course of action. The first step must be for CSD to carry out its obligations under the Act. It is possible, as both sides recognised, that there will be further disputes after that has been done. If there are, then the court may decide to inspect the data as Green J did in Lin. But for me to do that at this stage would be to make the court the primary decision-maker in place of the data controller. The court's function is to review the data controller's conduct: Durant [60] (Auld LJ).

Conclusions

74. The claimants' SAR is and was valid. There was never any proper basis for questioning its validity. CSD's failure to disclose any personal data at all represents a breach of the claimants' rights. The personal data held by CSD that relates to the claimants may include some that is protected by the crime exemption, and some that is protected by litigation privilege, but it has not been proved that all of it is so protected. The reason for that is that CSD has not carried out the necessary analysis. I am not satisfied that enforcement would be disproportionate, or that the SAR or these proceedings represent an abuse of the claimant's rights or an abuse of process. It would be wrong for me to carry out the analysis in place of CSD. There is no good reason not to exercise my discretion in favour of enforcing the duties imposed by the Act. I will make an appropriate declaration and order. I have indicated the nature of the relief sought. The precise form of order will, if not agreed, be the subject of discussion with Counsel.