Sometimes the Easter Bunny comes bearing mysteriously non-egg shaped gifts to the data protection practitioner. The judgment of the always-worth-reading Warby J in Rudd v Bridle & J&S Bridle Ltd [2019] EWHC 893 (QB) is just such a delivery, albeit that this one appears to contain a high content of asbestos.

The factual background to the case is set out in the judgment in some detail, and it is, frankly, too long, boring and depressing to warrant repetition here. In essence, Dr Rudd is a medical expert on exposure to asbestos. Mr Bridle is a long-standing campaigner on asbestos issues, who takes a heavily divergent view from Dr Rudd and is mostly sceptical of claims about the effects of asbestos exposure. Mr Bridle has been running an almost equally long-standing campaign against Dr Rudd, which including reporting him to the GMC on the grounds of having made false reports in his expert evidence in various legal proceedings. It is clear from the evidence set out in the judgment that Mr Bridle considers that Dr Rudd is part of conspiracy to assist asbestos claimants to recover damages on (in his view) a false basis.

Entirely unsurprisingly, Dr Rudd is unkeen on Mr Bridle’s allegations against him and wished to learn more about what Mr Bridle was doing. He made a subject access request under section 7 DPA, and indeed issued a notice under section 10 DPA 1998. This, on any view, somewhat spiralled. On being told by Mr Bridle that he was not the data controller at all, but rather his company was, a second SAR and notice were issued against the company. The view of the Defendants in response to the issued subsequent claim was that almost all of the data requested was exempt on grounds of legal professional privilege (para 10 of Sch 7), the journalism exemption (section 32) or the regulatory proceedings exemption (section 31). By the time of trial, the data withheld on the basis of the latter two exemptions had been disclosed, but on the basis that it had been properly within the exemptions.

The judgment of Warby J is long, but it contains an array of interesting and knowledgeable discussions about those exemptions and about the finer points of the various limbs of the section 7 right, much of which has never really been judicially considered (or indeed considered by requestors).

Before getting to the meat of the law, the judgment contains a lengthy section which might well have been – but regrettably was not – headed ‘A Plague on Both Your Houses’. There are some important lessons from it for all. As to Mr Bridle, his problem was that the judge thought his evidence unreliable and unimpressive. In particular, he considered that Mr Bridle had falsely sought to downplay the extent to which there was a real enmity between the parties and the nature, extent and forcefulness of the campaign he was waging against Dr Rudd. That clearly did not assist Mr Bridle on any of the substantive points when they were reached.

As to Dr Rudd, his problem was not his own evidence, but rather the approach of his legal team. In particular, Warby J was (yet again – as he had had to do in NT1 v Google LLC – see here) obliged to castigate an approach to data protection litigation whereby a party rocks up to trial claiming all manner of relief under sections 10, 13 and 14 DPA without having performed the elementary steps of properly pleading its case in respect of them. All such forms of relief have various elements within the statutory tests, and it is incumbent on a claimant to plead, even in broad terms, how it is said that they are met. Warby J kindly did not say it, but it is not that hard: DPA claims are ordinary civil litigation and have to be pleaded and proved like any other claim. If we as practitioners want the courts to take DPA claims seriously, we have to treat them seriously and not just wing it in the skeleton argument (see too the recent decision in Adelukun v Yorkshire Building Society [2019] EWHC 856 (QB) which does not otherwise warrant note). Dr Rudd’s team had also spent a large part of the litigation (dropped by trial) demanding disclosure of documents rather than data, which is pretty much DPA error 101.

With that admonishment over, let us turn to a summary of what Warby J held on the various legal issues (in respect of pretty much all of which the various ICO Guidance documents got a lot of airtime, mostly positive):

• The section 32 journalism exemption is broad but not so broad to cover every conveyance of opinion. The statutory limbs must be met, and that involves a subjective and an objective element: at [77].
• Mr Bridle’s evidence did not come close to addressing all of the statutory tests, and it was not necessary to have cross-examined him on it. No details had been given what sort of publication would occur, or had ever occurred, and a campaigning purpose is not the same as a journalistic one. It is not sufficient simply to say that a solicitor has reviewed the data and applied the exemption (especially where the inference is that the only source of the solicitor’s views was an unreliable witness): at [78]-[82].
• It was probably – but not definitively – the case that section 31 only applies to the regulatory body and cannot be claimed by a controller who has supplied information to it (c.f. section 29): at [88].
• But in any event, if section 31 is to be relied upon the prejudice necessary to engage it must be properly evidenced and there was none at all. It could not be inferred from the fact that the GMC, for example, had not volunteered all the data to Dr Rudd itself, and in any event there could be no prejudice where the GMC involvement had long since concluded: at [89]-[90]. (On the last point, it is not entirely clear whether Warby J was intending to suggest that the relevant time was other than the date of the SAR, although it may not have mattered on the facts.)
• Strikingly, Warby J was not prepared to accept the evidence of Mr Bridle’s solicitors about the application of LPP. He did, somewhat cautiously, accept legal advice privilege where it was claimed, but did not consider that the evidence bore out litigation privilege in circumstances where it was very hard to understand logically what that could relate to: at [92]-[97]. The judge did not compare the evidence he had with that before him in Holyoake v Candy [2017] EWHC 52 (QB), but the comparison is likely to be a useful one for practitioners seeking to understand what level of detail the Court will expect in order to satisfy itself the exemption is made out.
• Dr Rudd claimed the responses to his SARs were inadequate because they did not provide him with the specific recipients of his personal data: see section 7(1)(b)(iii). Warby J accepted that the right did not encompass identities of individual recipients, but did encompass a description of a class or, if to a specific persons, a description of the type of person: at [106]-[107].
• As to whether specific identities of recipients were Dr Rudd’s personal data at all, the judge drew distinctions. Those who were alleged to be his co-conspirators were Dr Rudd’s personal data too. Nor could they sensibly be withheld under section 7(4), which had simply been asserted without any particular analysis. But persons to whom data of Dr Rudd had been sent was not his personal data, and he did not need to know it: at [116]-[118].
• Section 7(1)(c)(ii) encompasses sources of data. Warby J noted the absence of guidance and concluded that the difference of language meant that the controller had to disclose the actual source (and not a description or class of source). That is in itself important. Again, section 7(4) could not be relied on in the circumstances, and it was likely that a number of the sources were not natural persons anyway: at [122]-[125].
• The judge quite rightly rejected the submission that there was any requirement of intelligibility that obliged the controller to disclose more than personal data so as to place it in context, as that would collapse into disclosure of documents: at [126]-[127].
• As to a description of the purposes of the processing, that must be considered with proportionality in mind given the range of contexts of processing. It need not be done on a document-by-document basis, but could be met by the essence of what the controller is doing with the data: at [130].
• Warby J, having considered the various potential factors in Ittihadieh, rejected any request to exercise his discretion against ordering compliance. That he accepted there was one is important, but the particular decision is very fact-specific and ordered what had been held above Dr Rudd was entitled to: at [133]-[137]. He would though have refused to order any wider disclosure of purposes as disproportionate and of documents as inappropriate: at [138].

The final issue was also a very fact-specific one as to whether or not Mr Bridle was a/the data controller, rather than the company. There was relatively little law discussed. On the facts, and unsurprisingly given the facts, Warby J held that he was.

A veritable Easter treat for all those interested in the finer granular points of section 7 DPA 1998 (now Article 15 GDPR). And who isn’t?

Christopher Knight