Mark Harrison v Alasdair Cameron & Anor

Introduction

This is a claim under the UK General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018 (‘DPA 2018’) for an order that the Defendants comply with the Claimant’s subject access requests (‘SARs’) made under article 15 of the UK GDPR. The Claimant’s first SAR, addressed to the First Defendant, Mr Alasdair Cameron, was made on 6 July 2022. The second SAR, addressed to the Second Defendant, Alasdair Cameron Ltd (‘ACL’), was made on 24 August 2022 (‘the ACL SAR’).

The Claimant, Mr Mark Harrison, is a private individual working in the property investment industry and is the Chief Executive of Praxis Group Ltd, a real estate investment company (‘Praxis’). Mr Cameron is a landscape gardener who owns and operates ACL, a landscape gardening business, of which he is a director and the largest shareholder. The First Defendant’s wife, Victoria Cameron, is also an owner and the only other director of the Second Defendant.

On 7 May 2022, as I explain more fully below, Mr Harrison and Mr Cameron spoke several times on the telephone. Mr Cameron recorded two of their conversations (‘the Recordings’), during which Mr Harrison threatened him. Mr Cameron subsequently shared the Recordings with 12 people, namely, five employees (‘ACL1-5’), two family members (‘Family 1-2’) and five friends (‘Friends 1-4 and 7’). ‘Family 1’ further shared the Recordings with ‘Friend 5’, who in turn shared them with his brother, ‘Friend 6’; and Mr Cameron’s wife shared transcripts of the Recordings made by the Defendants’ solicitor with ‘Family 3’.

The central question in this claim is whether Mr Cameron and/or ACL were required, in response to Mr Harrison’s SARs to disclose to him the names of those 15 people to whom the Recordings (or transcripts) were disseminated; and whether the Court should order them to do so.

An underlying feature of this claim is the evidence adduced by the Claimant that the Recordings have been shared with several of his professional peers and competitors in the property investment industry, causing (he contends) Praxis to lose out on the acquisition of the Grosvenor Shopping Centre in Chester in June/July 2022. Mr Harrison has expressed the belief that he has suffered financial loss in excess of £10 million as a result of someone circulating the Recordings “with the express and singular purpose of damaging me in relation to that deal” (Harrison, §26). However, the current claim does not include any claim for compensation or damages.

The Issues

The agreed issues for determination are these:

The parties’ list of issues included a fourth issue, namely, whether the Defendants were entitled to withhold the redacted communications in their entirety when responding to the SARs. In view of the fact that this issue goes only to costs, as the redacted communications were provided by the Defendants to the Claimant, albeit pursuant to their disclosure obligations in these proceedings rather than in response to either of the SARs, and given the tight timing of the hearing, I indicated at the outset of the hearing that I would postpone consideration of issue 4 until after I had given judgment on issues 1-3.

A potential further issue was whether the Claimant is entitled to an Order under article 18 UK GDPR. However, Ms Sara Mansoori KC, Counsel for the Claimant, confirmed at the hearing that Mr Harrison does not pursue his claim for such relief in light of paragraphs 50 and 68 of Mr Cameron’s second witness statement, in which Mr Cameron confirmed, both in his personal capacity and as director of ACL, that the Defendants have no intention of disclosing the Recordings to the public (as stated in a letter from the Defendants’ solicitor, Charles Fussell, dated 10 August 2022). Accordingly, the pleaded allegations that the Defendants have unlawfully processed Mr Harrison’s personal data have not been pursued and do not fall for consideration.

The Witnesses

Mr Harrison has made three witness statements in these proceedings, dated 6 April 2023, 7 February 2024 and 5 March 2024. An employee of Praxis, Mr Mark Smith, has made one statement on behalf of the Claimant, dated 7 February 2024. Mr Cameron has made one statement on his own behalf, dated 10 January 2023 (as he was, at that stage, the only Defendant) and one statement, dated 9 February 2024, on behalf of both Defendants. Although I have read all their statements, the most pertinent of Mr Harrison’s statements is his second, dated 7 February 2024, and, similarly, the most pertinent of Mr Cameron’s statements is his second, dated 9 February 2024. References in this judgment to Mr Harrison’s statement or Mr Cameron’s statement are, in each case, to their second statements unless I state otherwise. All three witnesses gave oral evidence.

As I have explained below, Mr Harrison’s evidence on central issues was untenable and untrue. Mr Cameron was an honest witness, although as I identify below, his recollection was mistaken on some points. I also find that Mr Smith gave truthful and reliable evidence on factual matters, but aspects of his evidence ventured into surmise and opinion evidence to which I gave less weight.

Background: the contractual dispute

It is common ground that a contractual dispute between the parties forms the background to these proceedings but is not a matter for my determination. In around October 2021, work commenced on Mr Harrison’s property (‘the Property’) pursuant to a landscaping and works agreement (‘the Agreement’). During the course of the work, disputes arose between the parties. Mr Harrison’s position is that he lost confidence in the Defendants and terminated the Agreement; and that he was not behind with payments under the terms of the Agreement. ACL’s position is that Mr Harrison unlawfully terminated the engagement and was behind with payments for works that had been carried out and materials supplied. ACL contends that by 6 May 2022 it had completed about 97% of the works.

The Recordings/Transcripts

On Saturday 7 May 2022, Mr Harrison was moving into the Property. That day the site foreman, Barrie Smith, told Mr Harrison that “Mr Cameron had been going round and asking a number of the other contractors who were working both inside and outside the house whether they had been paid and telling them that he had not been paid himself” (Harrison, §9). In his statement, Mr Harrison stated “this despite me having paid ACL some £600,000 in fees up to that point”, but he readily accepted in cross-examination that that figure should be corrected to £492,000. I accept Mr Harrison’s evidence that that is what Barrie Smith told him, that he “took great objection” to this (Harrison, §9) and was “angry about him going around the site asking people whether they’d been paid. That was the genesis of the call.”

Mr Cameron’s evidence was that on 6 May 2022, when at the Property doing some planting, he “asked the electrician whether he’d been paid, not realising that he actually worked for Mr Harrison”. Mr Cameron’s recollection in his oral evidence was that he had only asked one person, however, in that regard I consider it likely his recall is mistaken. On 13 May 2022, Charles Fussell wrote to Hanover Law (the Claimant’s solicitors in the contract dispute) that “during the morning of Friday 6 March 2022 [sic], he asked Mr Smith, two individuals working on the gate posts and Mr Mark Trevena, an electrician employed by Cross Limited, whether or not they had been paid by your client”. That letter was, doubtless, written on Mr Cameron’s instructions, and his recollection just one week after those conversations took place is bound to have been better than when he gave oral evidence, nearly two years later.

At 1.48pm on 7 May 2022, Mr Harrison tried to call Mr Cameron via WhatsApp. The record of their chat shows that was a missed call. Seconds later, Mr Harrison sent a message that read, “Call me immediately”. At 1.51pm Mr Harrison made another missed call to Mr Cameron. At the time of those missed calls, Mr Cameron was in his car, driving from Tiverton to the Badminton horse trials in Gloucestershire, accompanied by his youngest son and a friend of his son. Mr Cameron gave evidence, which I accept, that:

“I did not answer those calls because I did not want to speak to the Claimant. I knew from recent experience of him that he was aggressive, that he had taken a dislike to me and that he was prone to swearing and … I was in my car with one of my children and his friend.”

Once Mr Cameron had parked and guided the children to relatives nearby, he called Mr Harrison. Mr Cameron’s evidence is that, although he does not recall the precise time of that first call, it would have been between 2 and 2.30pm. I accept Mr Cameron’s evidence that he would not have kept Mr Harrison waiting. Similarly, Mr Harrison gave evidence that “shortly” after those missed calls, Mr Cameron called him back. I also note that by 2.18pm Mr Cameron’s call log shows he was calling someone else. It is probable that Mr Cameron had already responded to Mr Harrison’s message and missed calls by then.

There is a dispute between the parties as to the number of times Mr Cameron called Mr Harrison prior to the two recorded calls. Mr Harrison’s evidence is that Mr Cameron called him three or four times before the two recorded calls. Whereas Mr Cameron recalls making one call prior to the two recorded calls. Mr Harrison’s telephone log does not record incoming calls. Mr Cameron has obtained his own telephone log which shows various outgoing calls that he made on the afternoon of 7 May, but none to Mr Harrison’s number, although it is common ground that at least three such calls were made. The reason the calls do not appear on Mr Cameron’s call log is unclear, but the probable answer, suggested by Mr Cameron in his oral evidence, is that as Mr Harrison had called him via WhatsApp, he responded by making a WhatsApp call; and at the time a successful call did not show in the chat record.

In my judgment, it is probable that there were two unrecorded calls prior to 3.20pm. Mr Harrison was angry from the outset of the first call, and he peremptorily terminated the contract, telling Mr Cameron to remove his tools by 6pm. In my view, it is likely that in that first conversation Mr Cameron would have been too surprised to have raised the issue of the materials that were not yet paid for, or the need for more than a few hours on a Saturday afternoon to remove ACL’s tools. It is likely, having regard to his telephone log, that Mr Cameron spoke by telephone to someone else before gathering his thoughts sufficiently to call Mr Harrison back to seek to reason with him. I note that in the second of the recorded calls Mr Harrison said:

“I told you earlier that if you call me again, I was gonna take a very dim view, you are too stupid to follow simple instructions.”

However, I consider it likely that Mr Harrison has exaggerated the number of calls he received from Mr Cameron in order to bolster his claim that “Mr Cameron was deliberately trying to provoke me to lose my temper by repeatedly calling me”, with a view to seeking to excuse his conduct during the recorded calls – albeit the number of calls provides no excuse. It was only after he was provided with the Recordings that Mr Harrison claimed, through his solicitor, that Mr Cameron had called him five or more times, despite his solicitors having responded to letters regarding those telephone conversations on 12 and 13 May 2022. It is apparent from the content of the first recorded call that it was made just after Mr Cameron received the email that Mr Harrison sent at 3.20pm (see paragraph ‎19 below). Any earlier, unrecorded calls would have been before that email was sent, yet there is nothing in that email to indicate that Mr Cameron had already, by then, called Mr Harrison three or four times. On the contrary, the email simply refers to “our conversation just now”. It would have been very easy for Mr Harrison to have ignored or blocked Mr Cameron’s calls, and I consider it unlikely that he would have continued answering if the first recorded called was already the fourth or fifth call made by Mr Cameron that afternoon, and he was feeling harassed by those calls.

At 3.20pm Mr Harrison sent an email to Mr Cameron, three ACL employees and three people who were working for Mr Harrison. The subject was “Contract terminated”. The email stated:

“Alasdair

Per our conversation just now, as a result of your flagrant dishonest conduct, which compounds the rank incompetence and failure that has characterised your entire conduct and management of the project, the contract is terminated with immediate effect.

For the avoidance of doubt, I want all your people off site immediately. You have the rest of the day to remove tools only. If you attempt to remove materials of any description, all of which now belong to me, it will be considered as theft and dealt with accordingly.

You are not permitted to return to The Gate House under any circumstances or for any reason after 6pm today.

To the extent that monies are due to you, they will be paid following a detailed reconciliation in due course and once I have had the opportunity to assess any losses arising from your breach of contract.

My personal solicitor is copied.”

(Original emphasis.)

Following that email, Mr Cameron made two further calls to Mr Harrison. His evidence was that because “the Claimant had threatened to ‘execute’ me, I decided, having discussed it with a family member [Family 1] … that I would record that subsequent conversation” (Cameron, §24). In my judgment, Mr Cameron was being honest in expressing his belief that Mr Harrison threatened to “execute” him, however it is improbable Mr Harrison used that term. I consider it likely that Mr Cameron’s belief is based on a degree of subconscious reconstruction from his knowledge that during the first of the recorded calls Mr Cameron said, “I’m a bit concerned you’re saying you’re going to have me executed”. In my view, it is probable that during an unrecorded call just before the 3.20pm email was sent, Mr Harrison threatened Mr Cameron with physical violence in similar terms to those he used during the recorded calls. It is evident from the Recordings that, although Mr Harrison’s threats were far from subtle, he refrained from expressing them in direct terms, even when Mr Cameron asked him what he meant. When Mr Cameron expressed the concern that I have quoted above, it seems to me that he was genuinely questioning, with a tone of disbelief, the meaning of the veiled threats Mr Harrison had earlier made, rather than quoting back to Mr Harrison words he had used.

Mr Cameron’s evidence, initially, was that the recorded calls were made before he received the email at 3.20pm. However, he readily accepted in cross-examination, in light of what he said during the first recorded call, that the calls were made after he received that email. This was no more than an understandable failure of recollection. It is apparent from his solicitor’s letter of 12 May 2022 that he must have correctly instructed them, much closer to the time, as to the timing of the calls, and I do not consider that he had (or perceived that he had) anything to gain from claiming the recorded calls were made earlier.

Mr Cameron gave the following evidence, which I accept, as to how he made the Recordings:

“I did not (and do not) know how to record conversations but I noticed that there was another iPhone in the car. That was an iPhone without a SIM card or a telephone number but which could access WiFi and which my children would use to play games or play with the camera and video facility while they were in the car. I set that up to take a video recording of me while I spoke to the Claimant using my own iPhone, which played through the car’s hands-free facility. I repeat that the only reason I did this as a video recording rather than an audio one is that, to be frank, I am not very technologically sophisticated and I did not know how to use either my iPhone or this second iPhone to make an audio recording.”

It is common ground that Mr Harrison was unaware that the Recordings were being made, and he did not consent to those calls being recorded. I accept Mr Cameron’s evidence that he recorded the calls, at the suggestion of Family 1, because Mr Harrison had threatened him. However, in circumstances where ACL’s contract had just been terminated, and the calls inevitably concerned the contract, it is probable that Mr Cameron recorded them in part, in the hope any admissions might help him and his company in the impending contractual dispute.

I have listened to the Recordings which were played in court during Mr Harrison’s evidence. Although they are, strictly, video recordings, I understand that the images merely show the car dashboard. There is no dispute as to the authenticity of the Recordings; and transcripts of them have been agreed between the parties. As the Recordings are central to this claim, I shall set out what was said in full. It is apparent that the first recording did not catch the beginning of the call.

Transcript of first recorded call on 7 May 2022 between Mark Harrison (MH) and Alasdair Cameron (AC)

Transcript of second recorded call

Mr Harrison’s pleaded case is that these were “heated discussions”, and as a result of Mr Cameron’s persistent calling he “allowed his anger to get the better of him and made a number of ill-judged comments”. In his statement, Mr Harrison acknowledged that he lost his temper during the calls, but he claims that he was being provoked, harassed, goaded and set up by Mr Cameron to lose his temper (Harrison §§14, 18, 41 and 58). He expressed the concern that “the Recordings make me sound like a gangster”, whilst claiming that “it is clear that what I said during the calls could not be taken as a threat, whether of physical violence or otherwise” (Harrison §§22 and 58).

In cross-examination, Mr Harrison maintained that he did not threaten Mr Cameron during the calls on 7 May. In particular:

I agree with Mr Hopkins’ characterisation of Mr Harrison’s behaviour during those calls as seriously and persistently menacing. It is true, as Mr Harrison asserted, that he wanted Mr Cameron to “go away”. But it is manifest that to achieve that object Mr Harrison resorted to serious and ugly threats of violence to intimidate Mr Cameron into compliance; and Mr Cameron did comply, ensuring his workforce and tools (and nothing else) were removed from the Property before 6pm on Saturday 7 May 2022.

Mr Cameron exchanged the following WhatsApp messages with ‘Family 1 and 2’ the following morning, after sending them the Recordings at 11.07am on 8 May 2022:

11:10:31: Alasdair Cameron: need to update you [‘Family 2’]

11:13:09: Alasdair Cameron: listen to this one first

11:17:57: Alasdair Cameron: i was trying to wind him on second video to get him to loose it but sadly he didn’t [sic]

11:43:31: [‘Family 1’]: Put the kettle of….[laughing emoji]

11:45:38: [‘Family 1’]: I’ve sent a message to [‘Friend 5’] let’s see what he comes back with.

11:49:05: [‘Family 2’]: Threaten to report him to the police A, you have ample evidence – he will be in serious shit if you do with what I’ve heard – sounds exactly like the chap we bought the warehouse off in Perth… . . call if you like

11:51:26: Alasdair Cameron: [rolling around laughing emoji]

Mr Harrison contends that Mr Cameron was seeking to goad or provoke him during the recorded calls, and did not feel scared, or take what Mr Harrison said as a threat towards himself or his family. Mr Harrison relies on the WhatsApp messages above as confirming his previously stated belief that Mr Cameron was trying to bait him. Mr Harrison gave evidence that:

“Mr Cameron’s tone of voice changed in the phone calls which he recorded; he sounded more reasonable which was a marked difference to how he had previously been speaking that only served to wind me up even more.”

I have borne in mind that Mr Cameron was aware that what he said was being recorded. However, I reject Mr Harrison’s evidence that there was a marked difference in the way in which Mr Cameron spoke to him during the unrecorded calls compared to the Recordings. It is evident from the WhatsApp chat and emails between Mr Harrison and Mr Cameron over a period of years that Mr Harrison was a difficult client, often appearing to be tetchy, domineering, and at times sarcastic or angry. Despite this, Mr Cameron comes across from the contemporaneous correspondence as polite, calm, genial and inclined to defuse any confrontation with his client wherever possible. The Amended Particulars of Claim aver that Mr Cameron continued, after the 7 May calls, to act in a “genial and solicitous” manner towards Mr Harrison (AmPOC §12). I find that Mr Cameron spoke in a similarly reasonable way throughout the unrecorded and recorded calls with Mr Harrison on 7 May 2022.

Mr Cameron denied that he tried to wind up Mr Harrison. I accept Mr Cameron’s evidence that he did not seek to provoke Mr Harrison. In my judgment, what Mr Cameron was referring to when he wrote that he was “trying to wind him [up]”, was his own questions as to why Mr Harrison was coming down to Devon, and what he meant by saying he was going to “administer an education”. Those were not genuine questions: Mr Cameron understood full well that he was being threatened. When asking those questions, Mr Cameron was feigning a lack of understanding in the hope that Mr Harrison would express (and be caught expressing) his threats in more blatant, less veiled terms. To that extent, Mr Cameron’s response was affected by his awareness that he was recording the calls. It is also apparent, in my view, that Mr Harrison’s anger was heightened by his perception that Mr Cameron was “too stupid” to understand his threats, even though he felt he could not warn him “any more clearly”. However, nothing Mr Cameron said could sensibly be treated as goading or provoking Mr Harrison to speak as he did. I accept Mr Cameron’s evidence that he sought to put “a brave face on things” with family members and in some of his messages.

Mr Cameron maintained that he was scared for his and his family’s safety, although he felt reassured on 7 May 2022 by the fact that he and his family were away from home, and Mr Harrison was unaware of their location. Ms Mansoori KC, Counsel for Mr Harrison, strongly challenged his claim that he felt threatened, and took what Mr Harrison had said seriously, pointing out the exchange of laughing emojis between him and ‘Family 1’ (see paragraph ‎28 above); and when he shared the Recordings with ‘ACL4’ and ‘ACL5’ (see paragraph ‎41 below). She also relies on the time Mr Cameron took to contact the police as indicative that he did so to bolster his legal case, not because of any genuine fear of Mr Harrison.

I accept Mr Cameron’s evidence that he felt scared, distressed and seriously concerned that Mr Harrison might act on his threats. Despite the inconvenience on a Saturday, when he was away and had only a skeletal crew at the Property, Mr Cameron complied with Mr Harrison’s demands both in respect of what should or should not be removed, and the time by which ACL’s equipment had to be removed. It is understandable that Mr Cameron did not perceive that the threat was so imminent that he needed to report it to the police immediately in circumstances where he had done what Mr Harrison had asked of him, he lived in Devon, a considerable distance from Mr Harrison’s home in London, and he and his family were away on the weekend of 7 May 2022.

In those circumstances, Mr Cameron chose to obtain legal advice first. Through his solicitors, on 12 May 2022, he sought confirmation that Mr Harrison would cease and desist from any repetition of his conduct on 7 May 2022. As the response was an outright denial from Mr Harrison, on Friday 13 May 2022 Mr Cameron’s solicitors wrote that he would now report the matter to the police. I find that Mr Cameron first tried to report the matter at Cullompton police station on or about Monday 16 May 2022, but was unable to do so because it was shut. He then tried to report the matter to Devon and Cornwall Police by calling 101 several times and filling out an online enquiry form. By 17 May 2022 he was seeking help from ‘Friend 7’ in relation to police matters. The matter took some time as it had to be referred by Devon and Cornwall Police to the Metropolitan Police, in view of Mr Harrison’s place of residence.

In his evidence, Mr Harrison denied the characterisation of his words as amounting to threats of violence, while accepting that he had said the words as recorded. I have rejected his characterisation of what he said for the reasons given above. In pre-action correspondence, within days of the calls and unaware that they had been recorded, Mr Harrison went further and denied that he had said what was alleged at all.

On 12 May 2022, Charles Fussell wrote to Hanover Law that during a number of telephone calls on the afternoon of 7 May 2022 Mr Harrison:

“intimated to Mr Cameron amongst other things, the following:-

1.

that if Mr Cameron attempted to remove any materials from the Site then your client would send two of his friends from Manchester to pay him a visit that he and his family would never forget:

2.

that if Mr Cameron removed any materials from the Site there would be severe consequences;

3.

that he was on his way to visit Mr Cameron and his family at his home in Devon in order to administer ‘an education’ and to ‘thrash it out’.”

Hanover Law responded the same day, no doubt on Mr Harrison’s instructions, specifically denying each of the allegations made at “bullet points 1-3”, and stating that those allegations “exemplify the personality of Mr Cameron as an inherently dishonest individual and a fantasist”; and reiterated the following day that Mr Cameron is “a charlatan and a fantasist, and fundamentally dishonest”. That language echoed Mr Harrison’s own emails to Mr Cameron in which he accused him of “flagrant[ly] dishonest conduct” (7 May 2022 email) and of being “a fantasist, charlatan and epic buffoon” (8 May 2022 email).

In cross-examination, Mr Harrison asserted that he had not lied when instructing his lawyers to write that the three bullet points quoted in paragraph ‎35 above were denied. That was untrue. Mr Harrison sought to evade the question by treating it as one of characterisation of what he had said as threats. However, as Mr Hopkins pointed out to him, Charles Fussell’s letter did more than characterise what Mr Harrison had said as threats: it gave details of what he had said. Mr Harrison claimed he “didn’t recall the detail of the calls” and then asserted (inaccurately) that “nothing was particularised in the Fussell letter”. My assessment is that Mr Harrison did not give truthful evidence. He knew on 12 May 2022, just five days after the telephone calls, that (however his words might be characterised) he had said what Charles Fussell’s letter alleged in the three numbered points. Even if, on 12 May 2022, Mr Harrison could not recall the precise words he had used in anger, he knew that the details of what he had said (as given in Charles Fussell’s letter) were, at least, substantially accurate. Mr Harrison knew that the vehement denial made on his behalf by his solicitors was a lie; and he was evasive and dishonest in answering questions in cross-examination about it.

Dissemination of the Recordings/Transcripts

Mr Cameron explained that after sending the Recordings to himself during the evening of 7 May 2022, he deleted them from the device on which they were recorded, as it was used by his children.

Mr Cameron stated (§40):

“I shared the Recordings almost immediately with a small number of family and friends because I wished them to know that I had been threatened in case the Claimant made good on any of his threats of violence. I also wanted their advice and assistance about what I should do in this difficult situation. I did this for purely personal reasons and in a personal capacity as a father and husband, as well as for myself and my own personal safety. My concern was for my and my family’s safety.”

Mr Cameron shared the Recordings with his wife, whose identity he has not sought to protect on the grounds it would be obvious he would have shared them with her (Cameron, §43(c)) and with the following individuals whose identities Mr Harrison seeks:

In addition, to the direct dissemination of the Recordings by Mr Cameron detailed above:

It is also evident that the Recordings have been disseminated more widely, including to individuals involved in the sale of the Grosvenor Shopping Centre in Chester.

On 21 May 2022, Paul Jones of Metis Real Estate Advisors Ltd (‘Metis’) asked Richard Bousfield of Titanium Real Estate Advisors Ltd, “Can you send me the Harrison plus gardner [sic] recording mate?” Mr Bousfield sent the Recordings to Mr Jones the same day. There is no evidence before me as to how Mr Bousfield obtained the Recordings. Metis’s solicitors informed Rosenblatt (in response to a SAR) that the Recordings were obtained by Metis, as adviser to the Grosvenor Estate (then the owner of the freehold estate in the Grosvenor Shopping Centre in Chester) because a factor of concern to the Grosvenor Estate is “the buyer’s conduct and reputation and any potential reputational impact that sale to a particular party could have on the Estate”.

On 23 May 2022, Mr Jones forwarded the Recordings to Nigel Driver of the Grosvenor Estate (or, to be more precise, the Head of Commercial Property Management for The Trustees of the 4^th Duke of Westminster’s 1964 Settlement). When sending the Recordings, Mr Jones wrote, “Obviously please treat sensitively Nigel….” Mr Driver responded a little over an hour later that he was just reading Praxis Capital v Burgess [2015] EWHC 2631 (Ch) (to which he provided a link), a judgment which was highly critical of Mr Harrison’s bullying and abusive behaviour. Metis’s solicitors subsequently informed Rosenblatt that the processing undertaken by Metis was limited to obtaining the Recordings, storing them on Mr Jones’ work telephone, and disclosure to the Grosvenor Estate. The Grosvenor Estate’s solicitors have confirmed to Rosenblatt that Mr Driver did not further disclose the Recordings, other than by showing them on his telephone to his managers.

On 19 May 2022, Praxis made an offer to buy the freehold and leasehold interest in the Grosvenor Shopping Centre, which was being marketed by Knight Frank. By the end of May 2022, Mark Smith of Praxis had been made aware by Knight Frank that Metis was reticent about recommending Praxis to the Grosvenor family as the preferred bidder.

On 8 June 2022, Mr Smith spoke to Mr Jones who told him that he could not accept the risk to his reputation that selling to Praxis may cause. He was clear that money was not necessarily the main motivating factor as Chester was on the doorstep of the Grosvenor family in the North West, and if they were to sell their freehold interest they would want to make sure it was sold to a counterparty that would not tarnish their reputation in any way. Mr Jones told Mark Smith that he, personally, had fallen out with Mr Harrison who was “not a nice person” and that he had acquaintances who had had similar experiences in the past with Mr Harrison. Mr Smith could not recall whether he gave names but understood Mr Jones to be referring to Jack Burgess (the defendant in Praxis v Burgess) and Chris Beckerman. Mr Jones referred to the Recordings as evidence Mr Harrison had not changed. That was the first Mr Smith had heard of the Recordings, although he pretended otherwise to Mr Jones.

Shortly after that conversation, Mr Smith viewed the Recordings on the telephone of Antony Nickalls of Time Retail Partners. Mr Nickalls refused to tell Mr Smith who had sent him the Recordings, other than describing them as a very good client. He said the Recordings were of no interest to him, he had not forwarded them to anyone, and that he was going to destroy the copies he held.

On 12 June 2022, Mr Smith discussed the matter with Ross Needham and David Willis of Knight Frank who both said they “knew about” the Recordings. Mr Smith’s evidence is that the existence of the Recordings became “‘common knowledge’ within our small industry”. From speaking to them, he understood that Toby Ogilvy-Smals and Mark Garmon-Jones, both of Savills, had viewed the Recordings. Mr Smith said that “nobody is prepared to say where they received the Recording from”.

On 28 June 2022, Praxis made a revised offer for the long leasehold only, with the aim of later acquiring the freehold, which was also rejected. I have heard limited evidence about the circumstances in which Praxis’s attempts to buy the Grosvenor Shopping Centre were rebuffed. It sets the context in which Mr Harrison is seeking the identities of the recipients of the Recordings. But it is not necessary for me to determine how high or low Praxis’s prospects of buying the Grosvenor Shopping Centre would have been if Mr Jones and Mr Driver had been unaware of the terms in which Mr Harrison spoke to Mr Cameron on 7 May 2022. Nor what, if any, financial loss Praxis has suffered. There is no damages or compensation claim and, in any event, Praxis is not a party to this claim. Suffice to say that the Recordings were plainly not the only evidence Mr Jones and Mr Driver took into account in advising as to the suitability of Praxis as a counterparty; and there was no evidence before me as to the decision-making process within the Grosvenor Estate, save to the extent that their prioritisation of reputation over price was relayed by Mr Jones to Mr Smith.

The Subject Access Requests and responses

On 16 June 2022, Rosenblatt wrote to Charles Fussell that Mr Harrison “has become aware that your client has disclosed and/or sent copies of the Recordings to several third parties in the property industry”. Among other matters, they sought from Mr Cameron, by return, disclosure of “the names of all the individuals to whom [he] has disclosed the Recordings”. Charles Fussell’s response did not provide that information.

On 6 July 2022, Mr Harrison’s solicitors sent a letter before claim to solicitors for Mr Cameron (only, at that stage). The letter also included a SAR, in the following terms:

“Without prejudice to the requests above, made under the Protocol, please also treat this letter as a formal subject access request under Article 15 UK GDPR and provide us with a copy of all of Mr Harrison’s personal data being processed by Mr Cameron and all of the following information:

a.

The purposes of the processing;

b.

The categories of personal data concerned;

c.

The recipients or categories of recipients to whom the personal data have been or will be disclosed; and

d.

Where such personal data were not collected from the Mr Harrison [sic], any available information as to their source.”

Charles Fussell responded on 12 July 2022 that the UK GDPR was irrelevant as Mr Cameron was entitled to the general exemption (i.e. the purely personal or household activity exception). Nevertheless, the letter confirmed that Mr Cameron had not disseminated the Recordings or Transcripts to any of the persons listed in the letter before claim and specified the purpose of recording the calls. On 15 July 2022, Mr Harrison’s solicitors sought confirmation that Mr Cameron would comply with the SAR. On 21 July 2022, Mr Cameron’s solicitors reiterated that the UK GDPR and the DPA 2018 “have no application on these facts”.

On 11 August 2022, the claim, together with particulars of claim, were served on Mr Cameron.

On 24 August 2022, the Claimant’s solicitors addressed a SAR to ACL (the ACL SAR) in the following terms:

“Specifically, ACL must provide our client with the following information required under Article 15 UKGDPR:

a.

Confirmation of the ways in which ACL processed/continues to process Mr Harrison’s personal data including, in particular, the Recordings and Transcripts …

b.

A comprehensive list of all individuals with whom the Recordings and/or Transcripts have been shared (including any and all individuals who were given access to them at any point);

c.

The Recordings and Transcripts, along with any and all documents or other records pertaining to the Recordings/Transcripts being made, retained, shared and/or otherwise processed, including all records of communications involving the sharing of such data or reference to it (e.g. by email or text message).

d.

Any and all documents or other records setting out ACL’ purported rationale and/or basis for processing the Recordings/Transcripts.”

On 26 September 2022, Charles Fussell provided ACL’s response to the ACL SAR. The letter disclosed that Mr Cameron transferred the Recordings to a device owned by ACL and, acting in his capacity as a director of ACL, sent the Recordings to a total of four WhatsApp accounts held by members of staff on 8 and 9 May 2022. Four days later, ACL’s solicitors provided Rosenblatt with the Recordings.

On 10 January 2023, in his first witness statement, Mr Cameron disclosed that he had “shared the Recordings almost immediately with a small number of family and friends”; and that in his professional capacity as a director of ACL he shared them with “a few members of senior staff”.

In an open letter from Charles Fussell dated 12 December 2023, the Defendants offered to disclose the names of ‘ACL1-5’, ‘Family 1-3’, ‘Friends 1-4’ and ‘Friend 7’. This offer was made subject to the Claimant discontinuing the claim and providing a written undertaking not to threaten, harass, or bring any claims against any of those persons, “with the sole exception of claims which your client may be entitled to make in the County Court under the Data Protection Act 2018 or the UK GDPR”. The letter reiterated that the Defendants have “no interest in disseminating the Recordings to the public” and offered to use their best endeavours to delete any copies of the Recordings and Transcripts in their control. The Claimant rejected the proposal as “wholly unacceptable and inappropriate”. Mr Harrison’s evidence is that he rejected it “on the basis that it was demanding wholly unreasonable compromises which would not permit me to continue to consider and potentially pursue all my legal options regarding the individual(s) who disseminated the Recordings” (Harrison §51).

(1) Article 2(c): purely personal/household activity exception

The General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) was saved into UK law by s.3 of the European Union (Withdrawal) Act 2018 and s.3(10) of the DPA 2018 (which defines it as the ‘UK GDPR’). This includes the recitals, which do not themselves have the status of a legal rule, but which are capable of casting light on the interpretation to be given to a legal rule: s.3(1) EU (Withdrawal) Act 2018 and paragraph 83 of the Explanatory Notes to that Act.

The UK GDPR imposes specific duties on “controllers” (and in some limited respects that are not relevant to this claim, “processors”) in respect of their “processing” of the “personal data” of “data subjects”: see the definitions in article 4. The duties (including the duty to respond to SARs) are subject to exclusions and exemptions contained within the UK GDPR or, so far as relevant to this claim, Schedule 2 to the DPA 2018.

Article 2 of the UK GDPR addresses the material scope of the Regulation. Article 2(2) provides, so far as relevant:

“This Regulation does not apply to -

(a)

the processing of personal data by an individual in the course of a purely personal or household activity;…”

The following recitals are relevant in considering the interpretation of article 2(2)(a) of the UK GDPR:

“(4)

The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties. In particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.

…

(18)

This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.”

Authorities addressing the predecessor data protection regime (EU Directive 95/46/EC, as implemented in the Data Protection Act 1998) remain relevant in considering the interpretation of article 2(2)(a). In Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd [2017] EWCA Civ 121, [2018] QB 256, the Court of Appeal (Lewison LJ, with whom Lloyd Jones and McCombe LJJ agreed) determined that communications between members of a management board for an apartment block about another resident of the block fell within the personal and household exemption (then contained in s.36 of the DPA 1998, reflecting article 3 of the Directive).

Lewison LJ considered the CJEU’s judgments in Lindqvist (Case C-101/01) [2004] QB 1014 and Ryneš v Úřad pro ochranu osobních údajů (Case C-212/13) [2015] 1 WLR 2607, in Ittihadieh at [72]-[75]. As those CJEU judgments pre-date 11pm on 31 December 2020, they are comprised within “retained EU law” and binding on the court: ss.5(2) and (6(1) of the EU (Withdrawal) Act 2018. Any question as to the validity, meaning or effect of any retained EU law is to be decided in accordance with any retained case-law, any retained general principles of EU law, and having regard to the limits, immediately before exit day, of EU competencies: s.6(3) EU (Withdrawal) Act 2018.

Lindqvist’s case concerned information posted on the internet about parishioners in Sweden. The Court of Justice held at [47]:

“That exception must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people.” (Emphasis added.)

Mr Ryneš had installed a video surveillance camera outside his house which recorded activities in the public road. He did so because his home had been attacked, and he captured images of two vandals. The Fourth Chamber held that the exception for purely personal and household activity was inapplicable because the video surveillance in part monitored a public space. However, as Lewison LJ noted in Ittihadieh, the court added that correspondence was a purely personal or household activity “even if they incidentally concern or may concern the private life of other persons” (Ittihadieh, [76], Ryneš, [32]).

Lewison LJ observed that, “a requirement on an individual to provide personal data relating to his household affairs under a SAR is itself an intrusion into that person’s privacy” (Ittihadieh, [75]). He continued, at [76]:

“It follows, in my judgment, that in construing the scope of the personal and household exemption, the balance must be struck between two competing entitlements to privacy: that of the data subject and that of the individual data controller. This in turn informs the scope of the personal and household exemption. It is not necessary to attempt to draw the line. But wherever the line is drawn I consider that activities relating to the management of a private block of flats in which the putative data controller resides (including the processing of his neighbour’s personal data in so far as they concern matters arising from or relating to the management of that block) fall within the scope of the exemption because they directly concern his private life and also directly concern his household.”

In Tietosuojavaltuutettu v Jehovan todistajat-uskonnnollinen yhdyskunta (Case C-25/17) [2019] 4 WLR 1 the CJEU held that the collection of personal data during door-to-door preaching activities by members of a religious community was not processing in the course of a purely personal or household activity. The Grand Chamber emphasised that the exception applies only to “data processing carried out in relation to an activity that is ‘purely’ personal or household in nature” ([40]); and held at [42] that the exception:

“must be interpreted as covering only activities that are carried out in the context of the private or family life of individuals. In that connection, an activity cannot be regarded as being purely personal or domestic where its purpose is to make the data collected accessible to an unrestricted number of people or where that activity extends, even partially, to a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner…”

Mr Cameron relies on article 2(2)(a), which he contends applies to his activity in disseminating the Recordings to his family and friends. The parties agree that article 2(2)(a) does not apply to any dissemination of the Recordings by ACL (which is not a natural person), nor to the dissemination of the Recordings to ACL employees (‘ACL1-5’).

Mr Hopkins submits that the test is activity-based. He emphasises that Mr Cameron has his own privacy rights which must be weighed in the balance when construing article 2(2)(a), as reflected in recital 4. The exception should not be construed so narrowly that it intrudes into his private life. Mr Hopkins contends that the activities in which Mr Cameron was involved were communicating with family and friends to obtain support and protection, in circumstances where he had been threatened, and advice in his capacity as a friend or family member.

Mr Hopkins submits that the words “no connection” in recital 18 do not add an additional element to the legal test; they are a characterisation consequent on the legal test. If any connection with professional or commercial activity sufficed, a person chatting via WhatsApp with a friend about applying for a promotion at work, or messaging their spouse about an upsetting event they experienced in the workplace, would be within the scope of the Regulation.

Ms Mansoori stresses that all Mr Cameron’s dealings with Mr Harrison were carried out in Mr Cameron’s capacity as director of ACL. It was a professional and business relationship in which Mr Harrison was the customer. The calls and the Recordings arose directly from, and their content related to, that professional and business relationship. Mr Cameron made the telephone calls on 7 May 2022 in his capacity as director of ACL. The matters that he and Mr Harrison discussed during those calls concerned the termination of the contractual agreement between ACL and Mr Harrison. Mr Cameron transferred the Recordings on to a device owned by ACL and it was from that device that he shared them. The Recordings contained Mr Harrison’s personal data relating to the contractual and business relationship. Ms Mansoori submits that the fact that, on his own case, Mr Cameron carried out the same act of processing, namely forwarding the Recordings to ACL employees for a business purpose, demonstrates that this was not (and could not be) a purely personal or household activity.

In my judgment, when Mr Cameron recorded the calls, that act of processing was plainly done by him in his capacity as a director of ACL. Mr Cameron was telephoning Mr Harrison about his decision, as a client of ACL, to terminate their contract. The way Mr Harrison spoke to Mr Cameron during an earlier unrecorded call prompted the latter’s decision, following discussion with ‘Family 1’, to record the calls. Nonetheless, he did so, at least in part, for business reasons and, in any event, it was a business call recorded by him as director of ACL. The Recordings constituted personal data collected and held by ACL.

When Mr Cameron sent the Recordings to five ACL employees, he did so as a director of ACL. Rightly, the Defendants do not suggest that article 2(2)(a) applies to those acts of processing.

In my judgment, it is clear that when Mr Cameron sent those recordings of business calls (held by his company) to certain members of his family and friends, he was not acting in the course of “a purely personal or household activity”. I accept that it is important not to construe article 2(2)(a) so narrowly that it intrudes on the right to private life of an individual who may, naturally, chat (including via text) with family or friends about their day at work. However, I do not consider that sharing a client’s recorded personal data, obtained by a company during a business call, as Mr Cameron did, is analogous to such a general chat between friends or spouses.

The CJEU has emphasised the word “purely” in the exception, which is reflected in recital 18. The activity in which Mr Cameron engaged was not merely seeking support and advice in respect of threats to his and his family’s safety. The activity was the sharing of personal data held by ACL in respect of its business; and seeking support and advice in relation to the termination of the contract. Accordingly, I reject the First Defendant’s contention that the data processing in respect of his family and friends fell outside the scope of the UK GDPR.

(2) Article 4(7): is the First Defendant a data controller?

It is uncontentious that in respect of Mr Harrison’s personal data, ACL is a “controller”. The question is whether Mr Cameron is, too. The term “controller” is defined in article 4(7), so far as relevant to this case, as follows:

“‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data…”

In In re Southern Pacific Personal Loans Ltd [2014] Ch 426, David Richards J (as he then was) addressed this issue at [19]:

“… Given the definition of ‘data controller’ as a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed, it might be argued that the directors as persons who in fact determine the purposes for which any personal data are to be processed on behalf of their company are within the definition. Correctly, however, it is not suggested by the commissioner that directors are, by virtue of their position and authority as directors, data controllers. The person who determines the purposes for which and the manner in which data are to be processed is the company, albeit acting by its directors. Save as agents for the company, the directors do not make any determination, either alone or jointly or in common with their company. It is therefore the company alone which is the data controller.”

Lewison LJ cited that paragraph with approval in Ittihadieh when addressing the question “Who is a data controller?” at [70]-[71]:

“A data controller is a person who makes decisions about how and why personal data are processed. It is clear from the terms of section 7(1)(a) that the data controller is responsible for persons who process data on his behalf. Thus it follows that a person who processes data as agent for a data controller is not himself a data controller in respect of those data. Even where decisions about data are taken by natural persons, they will not themselves be data controllers if those decisions are made as agents of a company of which they are directors: In re Southern Pacific Personal Loans Ltd [2014] Ch 426, para 19.

On the other hand, if they are processing personal data on their own behalves they will be data controllers as regards that processing and those data…”

In both those cases, the courts were addressing the earlier data protection regime provided by the Directive and the DPA 1998. But the relevant provisions are similar, and the Claimant has not identified any differences that would warrant distinguishing either authority.

Ms Mansoori contends that, when recording the calls and sharing the Recordings, Mr Cameron was the natural person who determined the purpose and means of processing Mr Harrison’s personal data. That brings him within the definition of a “controller”, which can apply to individuals. She submits that if (as I have found), the purely personal and household activity exception is inapplicable, it does not automatically follow that Mr Cameron processed the data in his capacity as a director of ACL. She contends that he did so in his personal capacity.

Mr Hopkins submits that in light of Ittihadieh and In re Southern Pacific Personal Loans, for which further support is provided in the Information Commissioner’s Office guidance on the UK GDPR and the European Data Protection Board’s Guidelines 07/2020 on the concepts of controller and processor in the EU GDPR, it is clear that a director processing data in the course of their duties for their company is not a controller; the controller is the company. He contends that the Claimant’s case is illogical. If the activity in which Mr Cameron was engaged was sufficiently work-related for the purely personal and household activity exception not to apply, then clearly he was acting as a director of ACL and so he personally is not a controller.

In my judgment, applying Ittihadieh and In re Southern Pacific Personal Loans, the clear answer in this case is that Mr Cameron is not a controller. It is not an answer that Mr Cameron decided the means and purposes for which the personal data were to be processed. That is the point addressed by David Richards J. For the reasons I have given above in addressing issue (1), I find that Mr Cameron was acting in his capacity as a director of ACL when he recorded the calls and shared the Recordings.

My conclusion is not based on an assumption that it automatically follows that if the exception is inapplicable then Mr Cameron must have been acting in his capacity as a director, but on an assessment of the facts. If a rogue employee or director acts in an unauthorised fashion, they may become a “controller”. However, that is not the case here. Accordingly, I conclude that Mr Cameron is not a “controller” and so the claim against him falls to be dismissed.

(3): Article 15 and Sch.2 paragraph 16 DPA 2018: identities of recipients

In light of those conclusions, the question is whether Mr Harrison is entitled to be provided by ACL with the identities of the recipients of the Recordings or Transcripts, or whether it is lawful for ACL to withhold their identities.

Chapter II of the UK GDPR contains rights of the data subject. The parties agree that Mr Harrison is a data subject. Article 15 of the UK GDPR provides so far as relevant:

“1.

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a)

the purposes of the processing;

(b)

the categories of personal data concerned;

(c)

the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

…

3.The controller shall provide a copy of the personal data undergoing processing. …

4.

The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.” (Emphasis added.)

Articles 13 and 14 also make provision for information as to “the recipients or categories of recipients of the personal data” to be provided to the data subject. Article 13(1)(e) imposes an obligation on the controller where “personal data relating to a data subject are collected from the data subject” to provide information as to the recipients or categories of recipients, if any, “at the time when personal data are obtained”. Article 14(1)(e) imposes an obligation on the controller to provide information as to “the recipients or categories of recipients of the personal data, if any”, where “personal data have not been obtained from the data subject”.

The term “‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not” (subject to a qualification in the case of public authorities which is of no relevance to this case): article 4(9) UK GDPR. While “‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data”: article 4(10).

Article 15 should be read in the light of recital 63, which states so far as relevant:

“A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. … Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates.” (Emphasis added.)

Paragraph 16 of Schedule 2 to the DPA 2018 provides:

“(1)

Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) and Article 5 of the UK GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3) do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.

(2)

Sub-paragraph (1) does not remove the controller’s obligation where –

(a)

the other individual has consented to the disclosure of the information to the data subject, or

(b)

it is reasonable to disclose the information to the data subject without the consent of the other individual.

(3)

In determining whether it is reasonable to disclose the information to the data subject without consent, the controller must have regard to all the relevant circumstances, including –

(a)

the type of information that would be disclosed,

(b)

any duty of confidentiality owed to the other individual,

(c)

any steps taken by the controller with a view to seeking the consent of the other individual,

(d)

whether the other individual is capable of giving consent, and

(e)

any express refusal of consent by the other individual.

(4)

For the purposes of this paragraph –

(a)

‘information relating to another individual’ includes information identifying the other individual as the source of information;

(b)

an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from –

(i)

that information, or

(ii)

that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.”

The first sub-issue is whether article 15(1)(c) entitles the Claimant (subject to consideration of the second sub-issue: paragraph ‎106 et seq below) to be informed of the specific identities of the individual recipients, or only to be informed of the “categories of recipient” of the Recordings.

The First Chamber of the CJEU gave a preliminary ruling on the interpretation of article 15(1)(c) in RW v Österreichische Post AG (C-154/21) (‘the Austrian Post case’). It is common ground that the Austrian Post case does not bind this court, as it is a decision of the CJEU post-dating the UK’s exit from the EU, but I may have regard to it so far as it is relevant to any issue in this case: s.6(2) EU (Withdrawal) Act 2018.

In the Austrian Post case the CJEU held at [51]:

“… Article 15(1)(c) of the GDPR must be interpreted as meaning that the data subject’s right of access to personal data concerning him or her, provided for by that provision, entails, where those data have been or will be disclosed to recipients, an obligation on the part of the controller to provide the data subject with the actual identity of those recipients unless it is impossible to identify those recipients or the controller demonstrates that the data subject’s requests for access are manifestly unfounded or excessive within the meaning of Article 12(5) of the GDPR, in which cases the controller may indicate to the data subject only the categories of recipient in question.”

Ms Mansoori submits the right of subject access is of great importance as the gateway to being able to exercise the other rights provided to data subjects. That was recognised and described as a “foundational principle of data protection law” by Saini J in R (the3million Ltd) v Secretary of State for the Home Department [2023] EWHC 71 (Admin), [34] (citing the Austrian Post case). That is the backdrop to considering the Austrian Post case which she contends is an important decision, considering the very same issue that requires determination by this court, in which the CJEU gave compelling reasons for its decision.

Ms Mansoori refutes the contention that there is any incoherence in the CJEU’s reasoning when comparing article 15 to articles 13 and 14. The court did not interpret the words “the recipients or categories of recipients” differently in article 15(1)(c). The court focused on who has the choice (the controller or data subject) and drew attention to the structural difference between articles 13 and 14 which impose duties of disclosure on the controller, and article 15 which establishes a “genuine right of access” for the data subject ([36]).

The Claimant asked ACL to provide the identities of the specific recipients. It could not sensibly be suggested that disclosing the names of 15 individuals would be impossible or manifestly excessive. Ms Mansoori submits that the court should apply the Austrian Post case and conclude that in providing only categories of recipients in response to Mr Harrison’s SARs, the Defendants have breached their obligation under article 15(1)(c).

The Defendants submit that article 15(1)(c) can be complied with either by informing the requester of the “recipients” of their personal data or by informing them of the “categories of recipient”. ACL has complied with its duty by informing Mr Harrison of the “categories of recipient” of the Recordings/Transcripts.

Mr Hopkins submits this is the natural and ordinary interpretation of article 15(1)(c). There is nothing in the wording to suggest that the SAR requester can choose which of those forms of compliance they would prefer. Mr Hopkins contends that this court should not adopt the reasoning of the CJEU in the Austrian Post case. The court’s reasoning is not compelling or cogent. On the CJEU’s analysis, the same term has a different meaning in article 15 to that which it bears in articles 13 and 14, merely because the duty in article 15 is triggered by a request. On the CJEU’s approach, the effect is that an employer can be required in response to a SAR to list the names of every employee who handles an individual’s personal data (unless to do so would be impossible or manifestly unfounded or excessive). The same words appearing in the same piece of legislation must be given the same meaning, so it must follow that the same obligation would apply to a privacy notice.

Mr Hopkins contends that the court’s approach in the Austrian Post case to interpretation (e.g. in relying on “effectiveness” at [29] and referring to terms being used in “succession” at [31]) is difficult to square with domestic principles and there are good reasons to take a different view (contrast X v Transcription Agency and Master James [2023] EWHC 1092 (KB), Farbey J, [89]).

Alternatively, Mr Hopkins submits that the Austrian Post case should be distinguished on the grounds that it was concerned with a requester’s wish to know the identities of the external parties to whom their personal data had been disclosed, not with a request for the identities of an employers’ employees. While it may make sense for a controller to have to identify external parties, so that the requester will know who to contact to exercise their rights under the GDPR, such concerns do not arise in respect of employees of the controller, as the data subject can exercise their rights under the GDPR against the company.

In the Austrian Post case, the CJEU first considered the wording of Article 15(1)(c) and determined that based on the wording alone it was not possible to “determine unequivocally” whether the data subject would have the right to be informed of the specific identity of recipients of their personal data ([30]-[32]). In my judgment, applying the domestic approach of considering the natural and ordinary meaning of the words, the same conclusion that the provision is open to more than one interpretation is reached.

In reaching the decision that I have quoted in paragraph ‎93 above, the First Chamber relied on the following factors:

In my judgment, this reasoning is coherent and compelling. It does not involve giving different meanings to the phrase “the recipients or categories of recipients” in different provisions. On the contrary, the term “recipient” is defined and there is no difficulty in ascertaining the meaning of “categories of recipient”. The question is, as the Advocate General and the Court identified, where the choice lies. If it lies with the data controller then the data subject would have no right to know to whom their personal data have been disclosed, even in a case where provision of the specific identities of recipients would be easy and there would be no grounds for relying on any exemption.

The distinction that the Defendants seek to draw between employees of the controller and external recipients is not supported by the terms of article 15(1)(c). Recipients clearly include those, such as the employees of ACL to whom the Recordings were disclosed, who are not third parties, and who process personal data under the direct authority of the controller. The term “recipients” in article 15(1)(c) cannot be interpreted as restricted to external recipients. The matters Mr Hopkins relied on as demonstrating the lack of need for disclosure of the identities of internal recipients may be of relevance in considering the application of an exemption, but do not affect the interpretation of article 15(1)(c). I also note that ‘Family 1-3’, ‘Friends 1-7’ and, it appears, ‘ACL3’ who is self-employed, are external recipients, so the argument that the Austrian Post case can be distinguished would not, in any event, assist ACL’s defence of the non-disclosure of any of their identities.

For the reasons I have given, in my judgment, the interpretation given by the CJEU in the Austrian Post case to article 15(1)(c) of the GDPR is correct and should be applied in determining the meaning of article 15(1)(c) of the UK GDPR. This is not a case in which it would be impossible or manifestly excessive for ACL to disclose the specific identities of the 15 recipients.

The final sub-issue is whether ACL are entitled, in reliance on article 15(4) of the UK GDPR and the exemption under paragraph 16 of Schedule 2 to the DPA 2018, not to inform Mr Harrison of the identities of the recipients of the Recordings/Transcripts.

Mr Hopkins submits that article 15(4) is developed and expanded through paragraph 16 of Schedule 2 to the DPA 2018 (‘the rights of others exemption’). The leading authority on this exemption is DB v General Medical Council [2018] EWCA Civ 1497, [2019] 1 WLR 4044, a case concerned with an equivalent provision to the rights of others exemption contained in the DPA 1998. The Court of Appeal concluded that this provision entailed a balancing of competing interests, without any presumption for or against disclosure. The controller may, but does not need to, seek consent for disclosure; the controller “has alternative courses of action”: DB v GMC, Arden LJ, [97]. Importantly, Mr Hopkins submits, Sales LJ and Arden LJ made clear that the controller has a wide margin of discretion to decide what is reasonable in this context, and courts should not lightly interfere with the controller’s assessment: DB v GMC, Sales LJ, [86] and Arden LJ, [105].

Mr Cameron’s evidence is that he is not prepared to give the names of ‘Family 1-3’ or ‘Friends 1-7’ voluntarily because “the Claimant’s conduct of these proceedings and generally leads me to have concerns about how the Claimant is likely to behave towards any of my family members and friends”, and what steps he would take against them (Cameron, §46(b), 48). The same is true of ‘ACL1-5’ (Cameron §60). Mr Cameron considers that it would not be fair or reasonable for him to expose any of them to the behaviour or action that he fears the Claimant would take against them. Mr Cameron states that none of these family members or friends, or ACL colleagues, consented at the time to disclosure of their identities. The family members and friends “did not want to face having to deal with the Claimant and his threats of legal action” (Cameron, §47). The ACL colleagues “did not want to face having to deal with the Claimant because they knew that he was very aggressive and unreasonable from their previous dealings with him. I would say they were frightened of him” (Cameron, §59). The recipients were prepared to consent to disclosure of their identities subject to the conditions proposed by the Defendants in their open offer (addressed in paragraph ‎58 above).

Mr Cameron’s evidence regarding ACL colleagues is that ‘ACL1’, ‘ACL2’, ‘ACL4’ and ‘ACL5’ are all senior employees of ACL who had been involved with the Claimant’s project. He sent them the Recordings so that they could understand the circumstances in which ACL’s contract had been terminated and the conduct of the Claimant. ‘ACL3’ was self-employed. He had worked on the Claimant’s garden and Mr Cameron wanted him to know what had happened. When they received the Recordings, they “were simply doing their jobs”. ACL1-5 have all confirmed in writing that they did not share the Recordings with anyone else, and Mr Cameron considers that they “should not be exposed as individuals to further unreasonable approaches from the Claimant” (Cameron §60).

Mr Hopkins relies on Mr Harrison’s behaviour in setting his solicitors onto at least 23 employees of ACL, directing SARs to each of them individually and, even when the Defendants’ solicitors pleaded with them to desist (on the basis that ACL is the controller), they wrote further threatening letters to the cohort of ACL employees, developing those threats in respect of some. Mr Harrison also set his solicitors onto Ms Alice Walker, a friend of Mr Cameron and godmother to one of his children, who is unconnected to ACL. Ms Walker uses her given name (Alice Constable Maxwell) for professional purposes and Mr Cameron is only connected to her on social media using her given name. Mr Hopkins submits that Mr Harrison has failed to explain how any connection between Mr Cameron and Ms Walker was made (other than an opaque reference in his oral evidence to his solicitors undertaking “due diligence”), given that Mr Cameron is unaware of anything in the public domain that would connect Ms Walker, by that name, to him.

Mr Hopkins submits that this correspondence was aggressive, intrusive and unwarranted, and he characterises it as bullying and intimidating conduct. If Mr Harrison gets hold of the identities of the recipients, he will subject those individuals to similar conduct. He submits that this is borne out by Mr Harrison’s rejection of the open offer made by the Defendants, and unwillingness even to undertake not to harass or threaten the recipients. As regards any competing interest of Mr Harrison’s, Mr Hopkins submits that Mr Harrison could not make the threats he did and have any reasonable expectation that Mr Cameron would stay silent about them. Given how Mr Harrison behaved on the calls, he has only himself to blame if someone learned of that behaviour and did not want to do business with him.

Mr Hopkins contends that, applying DB and Durant, the court should conclude that the Defendants’ assessments were reasonable, falling comfortably within the Defendants’ margin of discretion when responding to these SARs.

Ms Mansoori emphasises that the burden of proof lies on the controller to establish to the civil standard that an exemption applies. The standard should be the same as identified in X v Transcription Agency, at [49], where an exemption is invoked on the grounds that disclosure of personal data would “be likely to prejudice” a public interest protected by an exemption, namely, the controller should establish the exemption with “significant and weighty grounds and evidence”.

She contends that a critical factor is that Mr Harrison made no genuine threats. He made statements which were ill-judged, as a result of repeated provocation to which he had been subjected by Mr Cameron, but he made no genuine threats, and was not perceived by Mr Cameron to have done so.

Mr Harrison is seeking the identities of the recipients in order to be able to exercise his other rights under the UK GDPR, as well as, if appropriate, pursuing other legal remedies. Mr Harrison believes that the Recordings were deliberately disseminated into the investment property industry by a person or persons to cause him loss and damage; and that they resulted in very significant financial damage. He wishes to identify the individual(s) responsible and consider all his legal options. The Austrian Post case makes clear the importance of individuals rights over their personal data. Ms Mansoori submits that Mr Harrison’s legitimate interest in the identities of the recipients is very weighty. The provision of categories of recipients rather than specific identities would render his remedy under Article 15(1)(c) ineffective.

Ms Mansoori refutes the contention that the making of SARs to ACL employees, to seek to identify the recipients of the Recordings, can be relied on in support of the exemption. Mr Harrison has acknowledged that he addressed SARs to 26 ACL employees to try to find out who had received copies of the Recordings (Harrison §38). Ms Mansoori submits that the SARs were non-threatening, made in standard form, and Mr Harrison has not taken further legal action against those individuals. Moreover, Mr Harrison has stated in his witness statement that he has “no intention of ‘threatening’ or ‘harassing’ any of the recipients who received the Recordings” (Harrison §51). Accepting the open offer would have deprived him of the opportunity to pursue legal options other than under the UK GDPR.

Although, as Mr Harrison himself said, he lost his cool during the calls on 7 May 2022, and the Recordings make him sound like a gangster when that is obviously not the case, Ms Mansoori contends the statements he made during those calls were never genuine threats and Mr Cameron never took them as such. He had no genuine fears for his or his family’s safety. The information sought is only the recipients’ names; it is not information relating to them which is of a highly private or confidential nature. There is no evidence of a confidential relationship between Mr Cameron and any of the recipients, and he voluntarily disclosed the Recordings to them. In all the circumstances, the Defendants have failed to discharge the burden of proving that the exemption applies.

Paragraph 16 of Schedule 2 of the DPA 2018, “seeks to strike a balance between competing interests of the requester and the objector, both of which are anchored in the right to respect for private life in article 8 of the ECHR”, as reflected in the UK GDPR: DB v GMC, Sales LJ, at [69], discussing the disclosure regime under s7(4)-(6) of the DPA 1998, but applicable to the present legislative scheme; and see recital 4 (paragraph ‎62 above).

None of the recipients have given their consent to disclosure of their names. They were prepared to do so, if Mr Harrison gave undertakings not to threaten or harass them, or to bring any claims against them other than data protection claims in the County Court, but as no such undertakings have been given, this is not a case falling within paragraph 16(2)(a) of Schedule 2. (Footnote: ¹) The question for the controller, ACL, was whether it was reasonable to disclose their identities without their consent (paragraph 16(2)(b)). ACL having decided the answer to that question was ‘no’, the question for the court is whether it was reasonable in all the circumstances for the controller to refuse the request.

The controller is the “primary decision-maker” in assessing whether it is reasonable or not. The controller has a “wide margin of discretion” under paragraph 16(2)(b), including as to the factors to treat as relevant to the balancing exercise (subject to paragraph 16(3)) and the weight to be given to each factor they treat as relevant. This wide margin of discretion corresponds to the “wide margin of appreciation which a public authority enjoys when competing Convention rights under article 8 of the ECHR fall to be balanced against each other”: DB v GMC, Sales LJ, [86]-[87], Arden LJ, [96], [105]; and Durant, Auld LJ, [60].

The first mandatory consideration is the type of information that would be disclosed (paragraph 16(3)(a)). The identity of each of the 15 recipients is their personal data. Their names alone amount to limited personal data but their disclosure would not be shorn of context. In the case of each individual, disclosure of their name would identify them as a friend, work colleague or family member of Mr Cameron and a recipient of the Recordings. As their correspondence with Mr Cameron about the Recordings has been disclosed with their names and any identifying details redacted, revealing their names would also disclose some of their personal correspondence. That is true even in the case of ‘Friend 4’, as although no direct correspondence with him is in evidence, his response to Mr Cameron is quoted in full, and some identifying details are given by Mr Cameron in his messages to ‘Family 1 and 2’.

The second mandatory consideration is any duty of confidentiality owed to the other individual (paragraph 16(3)(b)). This is not a case in which ACL owed the recipients a duty of confidentiality in respect of their identities as recipients of the Recordings, and the Defendants have not sought to argue otherwise.

Factors (c), (d) and (e) in paragraph 16(3) of Schedule 2 are all, in differing ways, concerned with the circumstances in which consent has not been given. It is evident that the recipients would all be capable of giving consent. It is not a case of express refusal of consent, but they have only been willing to give consent on certain conditions which have not been met.

In essence, ACL’s objection to giving the recipients’ identities to Mr Harrison is based on Mr Cameron’s assessment that it would not be reasonable to do so in circumstances where it would put them at significant risk of being the object of intimidating, harassing and hostile legal correspondence and litigation. The assessment that they would be at such risk is based on the way in which Mr Harrison behaved towards Mr Cameron on 7 May 2022, the pre-existing fear of Mr Harrison among ACL staff who had contact with him, the fact and nature of the legal correspondence that has been sent on Mr Harrison’s behalf to seemingly every employee of ACL they could identify, and the evident investigatory efforts that must have preceded the legal correspondence sent to Ms Walker.

For the reasons I have given above, I reject the Claimant’s contention that Mr Harrison never genuinely threatened Mr Cameron. He obviously did so, and Mr Cameron was understandably concerned for his and his family’s safety, albeit his level of concern was mitigated by his own decision to comply with Mr Harrison’s demands and the fact that Mr Harrison did not know where he and his family were on the weekend of 7 and 8 May 2022. It was not unreasonable for the Defendants to give significant weight to such sustained and menacing behaviour in considering whether to protect or disclose the identities of friends, colleagues and family members.

Mr Harrison has stated he has “no intention of ‘threatening’ or ‘harassing’ any of the recipients” of the Recordings. However, the Defendants are entitled to give little weight to that in circumstances where Mr Harrison continues to deny that he threatened Mr Cameron with violence during the Recorded calls, in the face of incontrovertible evidence that he did so repeatedly.

Nor was it unreasonable, in my view, for the Defendants to take the view that the letters sent by Mr Harrison’s solicitors, on his instructions, to about two dozen employees of ACL were intimidating and unwarranted in circumstances where ACL had accepted it was the controller. While it may be said that the initial SARs were in fairly standard form (albeit they were sent to individual employees of a company, rather than the controller), follow up letters to such individuals included assertions that “you are required by law to respond” (original emphasis), “you are in breach of Article 15 UK GDPR”, and threats to issue legal proceedings.

Mr Harrison has an interest in knowing who has been sent the Recordings, containing his personal data. But there is no question about their accuracy, and I agree with Mr Hopkins that Mr Harrison could not make the threats that he did and have any reasonable expectation that Mr Cameron would stay silent about them.

In X v Transcription Agency, Farbey J observed at [73] (citing Durant, [27] and [31]) that the SAR regime:

“has a specific and limited purpose, which is to enable a person to check whether a data controller’s processing of his or her ‘personal data’ unlawfully infringes privacy rights and, if so, to take such steps as the DPA 2018 provides [citing Durant, para 27]. It is impermissible to deploy the machinery of the Act as a proxy for the wider purpose of obtaining documents with a view to litigation or further investigation (Durant, para 31).”

There is no general principle that the interests of the request should be treated as devalued by reason of a motive to obtain information to assist the requester in litigation (DB v GMC, Sales LJ, [79]). Nevertheless, as Farbey J observed in X v Transcription Agency, at [73] (citing Durant, [27] and [31]), the SAR regime “has a specific and limited purpose, which is to enable a person to check whether a data controller’s processing of his or her ‘personal data’ unlawfully infringes privacy rights and, if so, to take such steps as the DPA 2018 provides”. In my judgment, in the context of this case, it was reasonable for the Defendants to give weight to their desire to protect family, friends and colleagues from hostile litigation going beyond the exercise of rights under the UK GDPR and the DPA 2018 (as evidenced by the refusal of the open offer).

In all the circumstances, applying DB and Durant, I conclude that ACL’s assessment that it would not be reasonable to disclose the identities of any of the recipients to Mr Harrison fell well within its margin of discretion as the controller when responding to the ACL SAR. Accordingly, the rights of others exemption applies, and so ACL complied with Article 15 in their response to the ACL SAR.

For the avoidance of doubt, if I had concluded that Mr Cameron was a controller, I would have reached the same conclusion on issues 3(a) and (b) in relation to him as I have set out above in respect of ACL.

Conclusions

For the reasons I have given, the claim against the First Defendant is dismissed on the grounds he was not a controller, and the claim against the Second Defendant is dismissed on the grounds that the ‘rights of others’ exemption applied to the withheld personal data.