Antony Sava v Leather Inside Out & Ors

This is the hearing of the Second and Fourth Defendants’ joint application for strike out or summary judgment, by application notice dated 21 May 2024 (“the Application”).

The issues identified for determination were:

The First Defendant is a charity established in April 2018, with Charity Number 1177993. Its purpose is to provide training, skills and employment in the production and retail of leather fashion goods to current and former convicted prisoners, to support their rehabilitation and to revive British crafts and manufacturing.

The First Defendant is presently in administration and has played no part in the Application. Insolvency practitioners at Evelyn Partners LLP are appointed as liquidators. The First Defendant is a Charitable Incorporated Organisation (“CIO”) within s.205 of the Charities Act 2011, hence it is a body corporate but not a company.

The Second Defendant was the founder of the First Defendant. The Third and Fourth Defendants were trustees and leather accessories designers. The Third Defendant is not an applicant and has played no part in the Application.

I will refer to the parties to the Application as the Applicants (jointly Ms Johns and Ms Riedweg) and the Respondent. I will refer to the First Defendant as LIO.

LIO had premises on Pratt Mews, London. The ground floor was operated as a retail shop. The first floor was used as office space.

In July 2019, while the Respondent was on licence in the community under the supervision of HM Prison and Probation Service, he was employed as a retail assistant by LIO’s non-charitable retail subsidiary, S&K Camden Ltd (Company number 11468327).

The Respondent’s employment did not run smoothly. Along with other employees and/or trustees of LIO, he raised concerns regarding how LIO was operated and alleged serious criminal conduct against senior individuals. The Applicants deny the allegations.

On 1 December 2019, the Respondent was dismissed on the ground of gross misconduct. The Respondent alleges that he was unfairly dismissed for whistleblowing. Lawyers acting for LIO wrote to the Respondent seeking written undertakings. When he refused, a report was issued to HM Prisons and Probation Service with the objective of ensuring that his license to remain in the community was revoked. The Respondent alleges that the report was false. The Applicants deny falsity. However, it was common ground that the report and the subsequent reports provided to external organisations comprised personal data about the Respondent.

On 24 March 2020, the Respondent was recalled back to prison. He was released in or around May 2020.

The Respondent then made annual data subject access requests for information. The pleaded requests were made or dated: 15 September 2020, 8 August 2021 and 3 May 2022 (“the DSARs”).

I take the following overview of the data subject access requests from the continuation document accompanying the Application, at paragraph 7:

“7.

The first request is addressed to the ‘data protection officer’ of LIO. It states, materially:

“Please supply us with any and all information you hold constituting personal data of which our client is the data subject. This should include, but is not limited to:

• All profiles or entries on any service or databases operated by you, whether current or archived, containing or in any way referring to our client's personal data. Note that this is not limited to profiles or entries where our client is the main subject, but includes any in which our client is named (for example as being 'linked' to the profile subject) as this would constitute their personal data.

•

All correspondence pertaining to decisions concerning current or superseded profiles or entries on or in any way referring to our client. This encompasses but is not limited to any electronically-generated documentation concerning decisions to amend or delete any profiles or entries on or referring to our client.

• All data pertaining to any internal interaction by leather inside out or its agents, in respect of our client's personal data.

• All documents and communications logs referring to or in any way connected with our client Antony Savva (or Savva, as he is commonly known) between June 2019 and September 2020.

In particular we require the supply of:

• Antony Savva's contract of employment or 'zero hours contract''.

• Antony Savva's beneficiary case file, including but not limited to any notes concerning disciplinary hearings, formal and informal complaints, including witness statements and investigation reports.

• All communication logs from and between LIO staff members and its trustees referencing Antony Savva (or Savva, Savor any similar reference to him by which he is commonly known) and in connection to communication referencing Antony Savva, particularly concerning complaints and allegations, including emails and text messages (including social media application platforms).

• All minutes of meetings relating to Antony Savva, in particular relating to his dismissal; to appoint a law firm to contact Antony Savva and the decision to report Antony Savva to the probation service and police.

•

All communication between Leather Inside Out and the St Giles Trust referencing Antony Savva.

• All communication between Leather Inside Out and, or its trustees or employees and any outside organisation referencing Mr Antony Savva.

•

All communication between LIO and staff at HMP Prison and Probation service referencing and in connection to communication referencing Antony Savva.

• All communication with accountants in regards to PAYE, National Insurance contributions and Pension contributions, that references Antony Savva.

• Any communication with HMRC in connection with or that references Antony Savva.

• Any pay slips referencing Antony Savva, including Antony Savva's P45 and P60.”

8.

The subsequent SARs put the requests in slightly different terms, but seek materially similar information.”

In October 2020 solicitors acting for LIO in relation to the 15 September 2020 DSAR, refused to supply the information requested, relying on continuing criminal investigations and exemptions relating to the prevention or detection of crime and the apprehension or prosecution of offenders and/or on the request being disproportionate in nature or extent. The 8 August 2021 DSAR was refused on similar grounds. In addition, it was suggested a response would provide premature disclosure in various employment tribunal proceedings then being pursued by the Respondent against LIO.

The DSARs were not complied with, inasmuch as no documents were provided, whether in the 40-day time frame or at all. The Respondent says this was contrary to the requirements of the UK GDPR and that each of the Defendants, legal and natural, are responsible as data controllers.

Proceedings were issued under CPR Part 8 on 20 October 2022, with Particulars of Claim dated 27 July 2022. The Defendants’ Defence, dated 31 January 2023, pleads that only the First Defendant is a controller of the Respondent’s personal data and hence the Second, Third and Fourth Defendants should be removed from the claim (paragraph 3). This Application was made by application notice dated 21 May 2024.

I take the following excerpt of the Claimant’s case from the Particulars of Claim:

“1.

I am an ex-employee of the respondents charity, Leather Inside Out (LIO). LIO provides employment and training to ex-offenders such as myself. The charity was founded and is managed by Ms Victoria Johns, who is also an ex-offender; convicted for money laundering and fraud. I was also a beneficiary of the charity because of my status as an ex-offender subject to a license, and I performed my duties for LIO’s subsidiary company S & K Camden Ltd.

2.

During my employment I uncovered several malpractices, failed obligations and serious criminal conduct (invoice fraud and potentially money laundering). After I raised these concerns, I was dismissed and victimized. The respondents wrote to me through their legal representation and made false accusations against me (AS1). Their letter made implicit threats to file a false report against me, knowing and highlighting that I was serving the remainder of my sentence in the community subject to a written license. They demanded that I sign ‘prepared statements’ and to never repeat my allegation of money laundering and fraud.

3.

When I refused to comply the respondents indeed filed a false report to the probation service to ensure that my license to remain in the community was revoked…/…

6.

Victoria Johns’ shadow controls the charity which is illegal. She claims to take directions from the Trustees, Anat McKenzie and Nicole Riedweg, who are legally responsible for the charity and any important decisions that the charity takes. This would invariably include the decision to file a report to the probation service because of the ‘safeguarding’ implications arising from its consequence.”

I take the following excerpt of the Defendants’ case from the Defence:

“8.

The first sentence of paragraph 3 is admitted, save that it is denied the report to the Probation Service was a false one. The Claimant is required to prove the matters set out in the second sentence of paragraph 3, which are outside of the Defendants’ knowledge.

9.

Paragraph 4 is admitted, save that it is denied that a false report was filed or that the Claimant was entitled to such information under the DPA 2018…/…

11.

Paragraph 6 is denied to the extent that it is alleged that Victoria Johns has acted illegally in the manner pleaded. The matters pleaded are in any event irrelevant to these proceedings…/…

16.

Paragraph 11 is denied. A report was made to the north London branch of the Community Rehabilitation Company (CRC) on behalf of First Defendant in December 2019 and two referrals were made to the Metropolitan police. The processing of the Claimant’s personal data for these purposes was related to the prevention or detection of crime and/or the apprehension or prosecution of offenders.”

The Applicants’ evidence comprises the application notice and continuation document, dated 21 May 2024, the DSARs, a witness statement from Ms Johns, dated 20 May 2024, and a witness statement from Ms Riedweg, dated 20 May 2024.

The Respondent relies on his witness statement, dated 1 July 2024 and exhibits AS1-19.

I have a lever arch bundle of documents and have had the benefit of Skeleton Arguments by Mr Jacobs and the Respondent supplemented by oral submissions.

The Applicants’ witness statements, surprisingly, provide little factual support for the Application nor do they explain the central events going to whether the Applicants were data controllers.

The evidence states (in each of the witness statements): “I described my experience of matters relevant to the Application [to Forsters LLP]” and “…I am advised by my lawyers that I am not a controller of this personal data (in any legal sense)…”. In my view, referring to privileged advice piecemeal, and absent relevant evidence going to the issues before the Court, is wholly unsatisfactory.

The Applicants’ roles, duties and responsibilities for LIO, as agents, are not explained. The high point of the evidence is “I was the Chairperson of the Charity” (Ms Riedweg); and “I was a consultant in respect of financial and legal affairs” (Ms Johns).

Ms Johns’ evidence as to her role is inconsistent with the Defence, which pleads “The Second Defendant is the founder and CEO” and the continuation document, which states “The Second Defendant was the founder and CEO of Leather Inside Out”. The Respondent invited me to draw an adverse inference by reason of this inconsistency, which I have declined. The issues before me were limited and I make no finding as to the reason for the inconsistency nor as to which role Ms Johns held in 2019.

I find the Applicants’ witness statements of little to no use in respect of the issues I must decide. This is because both statements lack factual evidence in support of reverse summary judgment; whether on the issue of ‘real prospect of success’ or ‘no other compelling reason the case should be determined at trial’.

The provisions draw a distinction between a ‘data controller’ and a ‘data processor’. The UK GDPR provides, so far as material, as follows:

“Chapter I General Provisions

Article 4 (Definitions)

The application for strike out is made pursuant to CPR 3.4(2)(a), which provides:

“(2)

The court may strike out a statement of case if it appears to the court —

(a)

that the statement of case discloses no reasonable grounds for bringing or defending the claim;”

Paragraph 1.2 of Practice Direction 3A gives examples of cases where the court may conclude that particulars of claim disclose no reasonable grounds for bringing the claim, including: claims which set out no facts indicating what the claim is about; claims which are incoherent and make no sense; and claims which contain a coherent set of facts but those facts, even if true, do not disclose any legally recognisable claim against the defendant.

The notes to the White Book 2024, at 3.4.2 recap that a claim should not be struck out unless the court is certain that it is bound to fail (Hughes v Colin Richards & Co [2004] EWCA Civ 266 at [22]). Furthermore, if a statement of case is found to be defective, the court should consider whether there is reason to believe that defect might be cured by amendment and, if it might be, the court should refrain from striking it out without first giving the party concerned an opportunity to amend (Kim v Park [2011] EWHC 1781 at [40-41]).

Pursuant to CPR 24.3:

“24.3

The court may give summary judgment against a claimant or defendant on the whole of a claim or on an issue if—

(a)

it considers that the party has no real prospect of succeeding on the claim, defence or issue; and

(b)

there is no other compelling reason why the case or issue should be disposed of at a trial.”

The notes to the White Book 2024, at 24.3. recap that the burden of proof rests on the applicant to establish that both limbs of the test are satisfied. If the applicant adduces credible evidence in support of the application; then the respondent comes under an evidential burden of proving some real prospect of success, or other reason for having a trial: Sainsbury’s Supermarkets Ltd v Condek Holdings Ltd [2014] EWHC 2016 (TCC) at [13].

Although I was not referred to Easyair Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch) at [15], Lewison J (as he then was) provides a summary of the principles to be applied on a summary judgment application brought by a defendant that is uncontroversial and useful:

“As Ms Anderson QC rightly reminded me, the court must be careful before giving summary judgment on a claim. The correct approach on applications by defendants is, in my judgment, as follows:

The Respondent is not required to show that its case will likely succeed at trial, merely that it has some real (not fanciful or imaginary) prospect of success. The hearing of a summary judgment application is not a mini trial. The court will therefore only consider the merits of the respondent’s case to the extent that it is necessary to determine whether it has sufficient merit to pass the threshold and proceed to trial.

The second limb of CPR 24.3 requires separate consideration of whether there is any other compelling reason for a trial.

The Application is summarised as follows, at paragraph 20:

“(a)

It is only the CIO, the First Defendant, that is the data controller, to whom a SAR can be made, and against whom any obligation to respond arises.

(b)

There is no basis to contend that either of the Second or Fourth Defendants were acting as data controllers, in respect of any of the personal data sought. As above, the requests quite clearly relate to the course of the Claimant’s employment with a subsidiary of the First Defendant. Data gathered and processed in the course of that employment is at the direction and control of the CIO and not by the CEO or a trustee (save as agents of the CIO).

(c)

The Particulars of Claim does not set out any basis pursuant to which it could be said that the Second or Fourth Defendant were data controllers.”

The Applicants’ Skeleton Argument states (paragraph 3):

“(c)

Insofar as the Second and Fourth Defendants were involved at all, they were acting as agents for the CIO, and the CIO is the data controller. The position is made clear by Mr Justice Richards in Southern Pacific Loans Ltd [2013] EWHC 2485 (Ch) (see the Statement of Case at §§17-18)

(d)

That is uncontroversial as a matter of law and, accordingly, the court should grant strike out (or summary judgment) on the claims against the Second and Fourth Defendant. The Court should, of its own motion, make the same Order in respect of the Third Defendant.”

It was submitted that the Court’s jurisdiction under CPR 3.4(2)(a) is engaged because the Second to Fourth Defendants could only have acted as agents of LIO in their capacities as consultant or trustee and cannot, personally, be data controllers. It was argued that this approach accords with the emphasis in the authority relied upon in oral submissions: Southern Pacific Loans Ltd [2013] EWHC 2485 (Ch) at [19].

As a secondary position, if the claim is not strikable as a matter of law, it was submitted that the pleading does not set out any basis pursuant to which the Respondent might succeed on the claim that the Applicants were controllers.

The Respondent’s witness statement includes:

The Respondent’s Skeleton Argument states (paragraphs 10-13):

“10.

The defendants cite paragraph 17 of Southern Pacific Loans Limited [2013] EWHC 2485 (Ch) in paragraph 3(c) of their skeleton argument and present a hypothetical scenario suggesting that SARs should only ever be directed to the company, not its directors. In doing so, they suggest this proves that only a company or charity can be a controller.

11.

However, this only supports the notion that companies are the ‘primary’ data controllers. The law is clear: individuals responsible for processing and determining how data is processed also become controllers, as referenced in 4 (a)-(d) above. Again arguing otherwise renders these provisions meaningless.

12.

In WM Morrisons Supermarkets plc v Various Claimants [2020] UKSC 12 (at paragraph 55), the Supreme Court explicitly identified an employee as a data controller. It said - “since the DPA neither expressly nor impliedly indicates otherwise, the principle of vicarious liability applies to the breach of the obligations which it imposes, and to the breach of obligations arising at common law or in equity, committed by an employee who is a data controller in the course of his employment, as explained in Dubai Aluminium.

13.

The defendants referenced paragraph 19 of Southern Pacific Loans Limited during the previous hearing to make a similar argument. However, their point is contradicted by the very paragraph they cite. It merely clarifies that natural persons and senior officers do not automatically become controllers based solely on their senior roles - it does not suggest they cannot become controllers…”

It was submitted that while LIO was the primary controller, Ms Johns made the decision to file the allegedly false report because of her personal interest in concealing allegations of financial crime and/or her alleged criminal conduct. The Third and Fourth Defendants’ failure to investigate the allegations and/or respond to the DSARs was said to show that they were collectively seeking to conceal criminality, contrary to LIO’s interests, and thus controllers.

The correct starting point is the broad definition of controller in the UK GDPR. Of central importance is that the definition includes a natural or legal person, public authority, agency or other body and that there may be joint controllers. On plain reading of the provisions, it is incorrect to suggest that an allegation of joint controllers is, per se, not a legally recognisable claim.

Paragraph 19 of Southern Pacific Loans cannot bear the weight the Applicants seek to place upon it. If the Applicants were correct it would restrict the natural meaning of the provisions of the UK GDPR. Furthermore, officers of an organisation with legal personality would benefit from blanket immunity when interacting with personal data. On this basis, if for example, a director used personal data held by organisation A when setting up their own competing business (organisation B), it would be processing over which only organisation A was controller. This cannot be right.

The point being made in Southern Pacific Loans is, in my judgment, simply that the position and/or authority of directors does not of itself, automatically make them data controllers, despite one reading of Article 4(7) of the UK GDPR permitting such an argument. This is sufficiently clear from the third sentence of the paragraph, as follows: “Given the definition of “data controller” as a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed, it might be argued that the directors as persons who in fact determine the purposes for which any personal data are to be processed on behalf of their company are within the definition.”

During submissions, the Applicants accepted that the controller would not always and exclusively, be the company, or in this case the CIO. The adjusted argument was that if an officer of an organisation acts properly as agent for the organisation then the organisation alone is the controller. Although not submitted, the corollary of this submission must be that if an officer acts improperly the organisation is not the controller.

The test I apply is to ask whether “the statement of case discloses no reasonable ground for bringing the claim”. This requires that there be no legal claim that can be sustained against anyone holding the office of trustee or consultant, irrespective of their conduct with respect to personal data. That is something the Applicants have failed to establish.

Despite the Applicants’ best efforts to persuade me otherwise, this limb of the application cannot be dispositive of the claim against the natural Defendants. There plainly are factual scenarios in which a trustee or consultant would not be acting for LIO and would themselves be the data controller. The issue is whether this case, as alleged, includes sufficient facts to disclose a legally recognisable claim against the Applicants as data controllers. This leads into the Applicants’ alternative submission.

The Particulars of Claim allege, and the Defence admits, that the Defendants collectively filed a report to the probation service to ensure that the Respondent’s licence to remain in the community was revoked. There is no averment that filing the report was itself criminal, improper, or not done on behalf of LIO. As I view it, pleading falsity alone is not sufficient to displace the default position that only LIO is controller, let alone to make all the Defendants controllers.

If I were wrong about this, the Particulars of Claim go on to allege that the trustees “are legally responsible for the charity and any important decisions that the charity takes. This would invariably include the decision to file a report to the probation service because of the safeguarding implications arising from its consequence.”

Thus, the pleading fails to allege any decisions or acts in respect of personal data which were outside the authority of the trustees as agents for LIO, or otherwise to set out a factual basis for why the Second to Fourth Defendants are said to be data controllers in addition to LIO. There is no plea whatsoever regarding why the contract of employment, employee file, P45 and/or P60 might have been data over which all Defendants were or became data controllers.

In my judgment, the pleading lacks sufficient factual basis for the claims against the natural Defendants; whether regarding all personal data or publication of the disputed report. This requires me to go on to consider whether there is reason to believe this defect might be cured by amendment.

The Applicants did not submit that the information which the Respondent provided for and during the hearing was provided too late to have any effect on the decision to strike out the proceedings, and in any event, I find that it was not, particularly given the Respondent has had no legal assistance and appeared in person. In that regard, I take into account the overriding objective to deal with cases justly.

However, the Respondent’s submissions demonstrated he wrongly conflated the immutable fact that a legal person must have a natural person through whom its decisions are carried into effect, with his case that the natural person must be assuming the defined status of data controller in their personal capacity.

At its highest, the case was that Ms Johns obtained an incidental personal benefit from the decision of LIO to publish the report to the probation service, and that the Fourth and/or Third Defendant failed to investigate allegations and/or respond to the DSARs. There was no explanation of how this rendered them each data controllers. Absent any factual basis for alleging there were multiple controllers when data was processed, I conclude that it would be wrong in principle not to strike out the claims against the natural Defendants.

Whilst I understand the Respondent is aggrieved about the reports issued about him in circumstances where he believes the statements to be false, and some or all of the authors to have acted in bad faith, that does not in my judgment weigh significantly in his favour, in circumstances where he avers that LIO was a controller and was unable to identify his factual case as to why the other Defendants acted other than as agents for LIO.

I have concluded, not without some caution, that the factual basis required for this matter to proceed to trial fairly, with each of the Defendants able to understand the case against them, is not set out, nor is there reason to believe this defect might be cured by amendment.

I can state my conclusions on this issue shortly.

The witness statements in support of this Application do not identify in any sensible detail, the factual basis for the case made in submissions before me that the Applicants in fact, were not, and could not in the present circumstances be, data controllers.

I raised this issue and it was submitted that the witness statement evidence was provided for completeness only. I was told that all it really does is confirm their roles and that they do not have ongoing duties following the administration of LIO. I agree with that. Unfortunately, this approach to the evidence rendered the summary judgment application hamstrung from the start and I reject that application.

Stepping back and looking at the matter in the round, and considering the overriding objective, I reject the basis for strike out advanced as a blanket immunity for senior officers, but I also find that the claim sets out no facts relevant to claims against the natural Defendants, and that there is no reason to believe that that defect is curable by amendment. I therefore grant the application for strike out.

I strike out the claim against the Third Defendant of my own volition.

In the premises, the application for summary judgment does not arise, but for completeness, I would dismiss the application, for the reasons already given.

I will hear the parties on consequential matters and costs.