Rudd v Bridle & Anor (Rev 1)

This has been the trial of a claim for remedies under the Data Protection Act 1998 (DPA), in which the claimant relies on the rights to subject information conferred by s 7 (also known as subject access), the rights to prevent processing conferred by s 10, and the right to compensation afforded by s 13.

The claimant has made subject access requests (“SARs”), and maintains that the responses are inadequate. He seeks orders pursuant to DPA s 7 compelling one or more of the defendants to provide further disclosure of information. He has served notices (“s 10 Notices”), requiring the defendants to cease processing personal data which relates to him. He complains that the s 10 Notices have not been complied with. He seeks orders enforcing these demands. And he seeks compensation for alleged contraventions of the requirements of the DPA.

The defendants’ case is that most of the data sought are exempt from subject access; that the claimant has received all the information to which he is entitled under the statute, and more; that neither of the defendants should be required to provide anything else, or ordered to comply with the claimant’s s 10 Notices; and that there is no pleaded or evidential basis for awarding any compensation.

The claimant, Dr Rudd, is a medical doctor who specialises in the science of exposure to asbestos, including chrysotile, or “white asbestos”, and the causal connections between such exposure and the development of mesothelioma, lung cancer and other diseases. He is a consultant physician with specialist accreditation in respiratory medicine and medical oncology. He has a special clinical and research interest in asbestos-related diseases and other occupational respiratory diseases. Until 2006, he worked in the NHS at the London Chest Hospital and St Bartholomew’s. He has published over 100 papers in peerreviewed journals. He is recognised as one of the UK’s leading experts in the science of asbestos-related diseases. Most relevantly, over 35 years he has given expert evidence in many cases in the United Kingdom in which claimants have sought damages for mesothelioma, lung cancer, asbestosis and pleural disease allegedly caused by exposure to asbestos, as well as in other claims for compensation for respiratory disease. His evidence has been cited or referred to in a number of first-instance and appellate decisions. His evidence in this present action is that “the links between white asbestos and cancer are … very well established” such that “… the consensus view in the scientific community has long been clear that chrysotile … causes all the diseases associated with asbestos exposure ….”

The first defendant, Mr Bridle, has been involved with the manufacture and use of chrysotile and asbestos cement products used in the building industry containing the fibre for some 50 years. Now 79, and retired from full time engagement in the business, he has more recently been active in advising and campaigning on issues relating to the links between asbestos and mesothelioma, lung cancer and other diseases. He is not a doctor, or a scientist. The evidence does not disclose what qualifications he holds. But he has the honorary title of Professor, conferred by the Council of the Research Scientific Institute of the Occupational Health of the Russian Academy of Medical Science. He has been active under the banner Asbestos Watchdog, describing himself as its “Principal”. His witness statements in this action include some commentary on what he calls “the scientific debate regarding Chrysotile Asbestos”.

The second defendant (“the Company”), is controlled by Mr Bridle and his son, Christopher Bridle. It appears to have taken over an asbestos consultancy business first started by Mr Bridle and his wife in 1993. The Company was added as second defendant to this claim, in the light of the Defence filed by Mr Bridle, which suggested that the “likely” position was that any personal data of Dr Rudd were being processed by the Company and not him.

White asbestos has been banned throughout the European Union since 2005.

As may already be apparent, the background to the action is a profound dispute or difference between Dr Rudd and Mr Bridle concerning the role of asbestos in causing mesothelioma and other diseases, and (specifically) Dr Rudd’s conduct in his role as an expert witness for claimants in actions for damages for disease attributed to exposure to asbestos cement products.

Each side has claimed that the other has misconducted itself, and these proceedings. The claimant pleads that Mr Bridle has been engaged, with other persons whose identities are not currently known, in a calculated attempt to discredit and intimidate him; and that Mr Bridle and the Company have put up a false and misleading case in answer to this claim. Three specific historic matters are relied on in a section of the Particulars of Claim headed “Relevant Background”:

“5.

In September 2014, the First Defendant made a complaint about the Claimant to the General Medical Council, alleging that expert reports prepared by the Claimant in court proceedings falsified the risks to health associated with chrysotile asbestos and chrysotile asbestos products, in order to claim compensation on behalf of patients suffering from mesothelioma (the “complaint”). In making the complaint the First Defendant was acting on behalf of, and was funded by, the asbestos industry. In January 2016, the GMC dismissed the complaint, deciding that it did not meet their threshold for investigation.

6.

The First Defendant also made allegations about the Claimant to the then Justice Secretary, Mr Michael Gove MP and to other Members of Parliament, alleging that the Claimant is involved in a “conspiracy” with various claimant law firms in which he provides false evidence about the risks associated with exposure to chrysotile asbestos (the “allegation to MPs”). In so doing, the First Defendant was acting on behalf of, and was funded by, the asbestos industry.

7.

In August 2015, the First Defendant was involved in the preparation of a letter sent to the Claimant by law firm Fisher Scroggins Waters LLP, acting on behalf of unnamed representatives of manufacturers of white asbestos in Thailand

(the “solicitor’s letter”). The solicitor’s letter asked the Claimant to provide “the evidential basis for his opinion that asbestos cement is capable of being a cause of malignant mesothelioma in humans”. The letter stated that the unnamed manufacturers were suffering ongoing loss and damage as a result of “the persistently adverse reporting of the risks from chrysotile products”. The solicitor’s letter was written on behalf of, and was funded by, the asbestos industry.”

Dr Rudd’s overall case is set out in paragraph 8 of his Amended Particulars of Claim:

“8.

The First Defendant is engaged in attempts, funded by the asbestos industry, to discredit the Claimant as an expert witness and/ or to intimidate him from continuing to act for claimants in mesothelioma cases. Further or alternatively, the same may properly be inferred from the facts and matters pleaded at paragraphs 5 to 7 above.”

Other formulations of the claimant’s case have gone further. In a 2017 witness statement the claimant’s lawyer, Harminder Bains, a Chartered Legal Executive at Leigh Day, describes Mr Bridle as “dishonest”. Dr Rudd has exhibited press cuttings to his witness statement, in which Mr Bridle is described by the journalist and activist George Monbiot as a “charlatan” with convictions for trading standards offences. In opening and closing argument at this trial, Counsel for Dr Rudd have alleged that the attempts to discredit him of which he complains are not only “inaccurate”, and “false”, but also “malicious”.

The defence case is, in summary, that the claim was initially brought against the wrong defendant (the data controller being the Company), and has been pursued at disproportionate cost, and in an unnecessarily aggressive way, the motives being “seemingly” to punish the defendants for challenging the claimant's publicly stated opinions on the health risks associated with the use of asbestos cement products. The defendants’ analysis, as presented by Mr Fairbairn, is that the core of this case concerns a matter of opinion, in which Mr Bridle disagrees with Dr Rudd’s views about the risks of chrysotile asbestos cement. It is suggested that the claims under DPA ss 10 and 13 are based on the proposition that “by challenging [Dr Rudd’s] views the defendants thereby discredit him and cause him distress”. This, the defendants suggest, is a misconceived attempt to shut down legitimate “debate” on a controversy which is of considerable public interest. That is how Mr Fairbairn seeks to present his clients’ position.

Mr Bridle himself, in his witness statement, professes to accept that Dr Rudd may be both honest and right: “I do not of course dispute Dr Rudd’s entitlement to his view. Nor do I say he is wrong”. His witness statement suggests that his position is that Dr Rudd has failed to take account of some relevant evidence, and that the risks of exposure to chrysotile asbestos have been much misunderstood and greatly exaggerated. In other contexts, Mr Bridle has gone a lot further than this. In documents written and published before this trial he has referred to “the great asbestos scam”. The defendants’ SAR responses make clear that Mr Bridle places Dr Rudd at the centre of this “scam”. In communications to people whom he declines to identify, Mr Bridle has said of Dr Rudd that he is a “crook… using the panic for [his] own profit”, who is “discredited”, and who could easily have answered questions asked of him “if he was an honest and genuine asbestos expert”. He has referred to Dr Rudd as the “main expert” for the “forces of evil”, and made clear that he thinks it desirable that Dr Rudd should be prosecuted, and sued for damages, in respect of his “fraudulent submissions”.

Mr Fairbairn acknowledges this, but he has suggested that Dr Rudd and Ms Bains have both been over-sensitive about the GMC complaint. He points to the open hostility which they have shown to Mr Bridle from the outset, suggesting that it cannot be explained by the SAR disclosures I have summarised, because they were unknown to the claimant before this claim began. The GMC complaint letter, says Mr Fairbairn, does not justify such hostility. It does not use the word “dishonesty”, nor does it allege any conspiracy with solicitors. Its “thrust … is to ask the GMC to investigate an issue”, he says.

Fundamental to the DPA regime are the concepts of “data”, “personal data”, “data subject”, and “data controller”. The definitions of these terms, so far as relevant, are to be found in s 1(1):

“‘data’ means information which--

(a)

is being processed by means of equipment operating automatically in response to instructions given for that purpose, [or]

(b)

is recorded with the intention that it should be processed by means of such equipment, …

…

‘data controller’ means a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed …

…

‘personal data’ means data which relate to a living individual who can be identified-- (a) from those data, or

(b)

from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual

…

‘data subject’ means an individual who is the subject of personal data”

I shall have to look at aspects of this regime in more detail later, but it is helpful to start with this summary, drawn from Guriev v Community Safety Development (UK)Ltd [2016] EWHC 643 (QB) [2]:

“The general scheme of the “subject information” regime established by the Data Protection Directive, 95/46/EC … and implemented via Part II of the DPA is by now quite familiar.

(1)

An individual has the right, on making a written request and paying a fee, to be informed by a data controller whether the data controller is processing “personal data of which the individual is the data subject”, sometimes referred to as the individual's personal data.

(2)

If the answer is yes, the individual is entitled to a description of the personal data, the purposes for which they are being or are to be processed, and those to whom they are or may be disclosed. The individual is also entitled to have communicated to him or her, in an intelligible form, the information in question and any information available to the data controller as to the source or sources of the information.

(3)

These rights are set out in s 7(1)-(3) of the DPA. They are qualified in a variety of ways. Some of the qualifications are to be found in ss 7, 8, 9 and 9A. One of them is that the court has a discretion over whether to order a data controller to comply: s

7(9).

(4)

But some personal data are altogether exempt from the individual's right of access under s 7.… Schedule 7 paragraph 10 exempts personal data covered by legal professional privilege

(the privilege exemption).”

Two other, qualified, exemptions from the subject information rights are relevant in the present case:

Where personal data are not exempt, and it is shown that the data controller has failed to comply with a SAR, the Court has a general and untrammelled discretion to make or decline to make an order. The authorities do, however, give guidance on considerations which may be relevant, depending on the circumstances of the case. The issue has quite recently been addressed by the Court of Appeal in Ittihadieh v 5-11 Cheyne Gardens[2017] EWCA Civ 121 [2018] QB 256 (“Ittihadieh”).

DPA s 10 confers two relevant rights on a data subject. By s 10(1) an individual has the right to serve what could be termed a “cease and desist” notice. The individual

“is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons--

(a)

the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and

(b)

that damage or distress is or would be unwarranted.”

The data controller must respond within 21 days, complying or stating that he will comply with the notice, or explaining why not: s 10(3).

The second right is to seek enforcement by the Court. Section 10(4) provides that:

“If a court is satisfied, on the application of any person who has given a notice under subsection (1) which appears to the court to be justified (or to be justified to any extent), that the data controller in question has failed to comply with the notice, the court may order him to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.”

DPA s 13(1) provides that:

“(1)

An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.”

“Damage” for this purpose is to be interpreted as encompassing distress: Vidal-Hall v Google Inc [2015] EWCA Civ 311 [2016] QB 1003. But s 13(1) does not entitle a claimant to recover compensation just because there has been a contravention of the Act; he must prove that he suffered distress or other damage, and show a causal link between that damage and one or more of the contraventions he has established: Lloyd v Google LLC [2018] EWHC 2599 (QB) [56].

It is necessary to examine this in a little detail. In parts, it is something of a cautionary tale.

On 4 January 2016, Dr Rudd received a letter from the GMC, informing him of the GMC complaint. This was the first Dr Rudd had heard of the matter. It was the first ever GMC complaint against Dr Rudd. The GMC’s letter began by stating that it had decided that the complaint “does not meet our threshold for investigation and we have not opened a case.” But the GMC advised that it would share the complaint with Dr Rudd’s “responsible officer”, in order for them to consider “in the wider context of your practice and revalidation”. Dr Rudd was invited to consider the complaint with his responsible officer in that context, and to “reflect, identify learning and incorporate development needs identified in your personal development plan.”

A copy of the complaint was enclosed. It took the form of a letter dated 7 November 2015 addressed to Antoinette La Bella of the GMC, and headed “Concerns relating to Expert Witness Reports in Asbestos Court Cases by Dr Robin M Rudd…” It was accompanied by a number of annexes, and followed up by an email dated 9 November 2015, with what purported to be supporting evidence. There was much subsequent correspondence, in the course of which Mr Bridle offered further evidence said to support his allegations or “concerns”.

The letter was sent on headed notepaper of “Asbestos Watchdog”, bearing a distinctive logo. The printed part of the notepaper listed the “Advisory Board”: “Principal – Professor John Bridle. Consultant Toxicologist – Dr John Hoskins M Tech (Brunnel) Ph D (ANU) FRSC C.Chem – Agricultural Consultant – Bryan K Edley MBE FRSA”. It was signed “Prof John Brindle, Principal, Asbestos Watchdog”.

The letter included the following (emphasis added):

“I write to thank you for our telephone discussion on 12^th October 2015 on the subject of our concerns which we first referred to the GMC in September 2014. These concern the complaints which we receive about doctors, and in particular DrRobin M Rudd, providing Expert Witness reports which appearto falsify the risks to health associated with the Chrysotile formof asbestos, and manufactured products such as asbestos cementcontaining chrysotile, in order to claim compensation on behalfof patients suffering from mesothelioma. Chrysotile cement products account for 90% of ALL asbestos materials in the built environment

…

GMC is respectfully requested to decide whether Dr Rudd mayhave been guilty of deceiving the Court by purporting to be anExpert Witness on the medical aspects of health claims arisingfrom exposure to asbestos fibres – when in fact he appears not tohave kept abreast of recent research in this field.”

Other parts of the letter set out allegations in support of these assertions, or suggestions.

“Dr Rudd, or one of the companies associated with him, claim to provide expertise in the medical science of claims of ill health caused by asbestos in over 900 cases per annum. Transcripts of proceedings from three such specific instances are shown in Annex 1 hereto …

…

Currently around 20 million tonnes of asbestos (chrysotile) cement manufactured products are produced each year throughout the world without any evidence that it is a causation of any asbestos related disease. Annex 4 hereto is a letter sent by Fisher Scoggins Waters, Solicitors and High Court Advocates, to Dr Rudd at our suggestion on behalf of one of these manufacturers in Thailand who had sought our advice. This followed the Medical Reports for the Court prepared by Dr Rudd such as his Report dated 23^rd June 2014 (see Annex 2 hereto) in which on its pages 7 & 8 under ‘Causation of Mesothelioma, General Comment’ Dr Rudd comments:-

‘there is no doubt that mesotheliomas occur in persons exposed only to commercial chrysotile’

This Medical Report is contrary to the findings of all research known to us and is damaging the reputation and the trade of manufacturers such as this client of Fisher Scroggins Waters. Dr Rudd has neither acknowledged this letter to him nor answered the request to justify his statement by providing details of any research on which he based his statement. Furthermore it would appear that Dr Rudd produced this Medical Report to the Court without examining the patient who is subject of his Report.

In 2013 I was asked by the Rt Hon Owen Patterson MP to provide a briefing note for a Cabinet Meeting where the subject of health risk from asbestos was on the agenda. My report included the following information:-

“The official statistics give 4500 asbestos cancer deaths per annum of which 2000 are caused by mesothelioma. However that figure is in doubt, and should perhaps be corrected to fewer than 1000 cases of mesothelioma, which is the most wrongly diagnosed condition in medical history. A majority, perhaps 90%, of all mesotheliomas claims purport to be from exposure to asbestos cement, which has never been proved to be the cause of the cancer. Asbestos lunch cancer is clinically indistinguishable from cancer cause by other factors, such as smoking.

Asbestosis is a legally notifiable disease. The HSE’s Death Book shows that only around 100 persons per year succumb to this version of the cancer. It also transpires that virtually no one born after 1940 will develop an asbestos related cancer. So this is not the epidemic one would believe but an exceedingly rare event.

When we interview doctors who have made the asbestos mesothelioma diagnosis for legal claims they are forced to admit that they have no means of knowing how to identify asbestos in cancer, nor how they could say what type it was. All confirmed that they received fees of around £4000 to record this unsubstantiated opinion”

I now attach further relevant papers as listed in the ‘Schedule of Papers Annexed’ which are relevant to the subject of risks to health from asbestos and to specific cases which have hinged on Dr Rudd’s expert opinion. At the foot of the Schedule I have noted some of the Press Articles which have been published between 2005 and September 215 referring to this subject as “The Great Asbestos Scam”.

Whilst this is not an issue for the GMC we are informed that the producer of chrysotile cement products on whose behalf Fisher

Scoggins Waters’ Letter of 27^th August 2015 (See Annex 4) was written is now consulting with other overseas companies to consider a private action against Dr Rudd for the damage to their businesses caused by Dr Rudd misleading the Court.

I respectfully request the GMC to investigate Dr Rudd’s Expert Opinions to the Court in those in which he claims that

Mesothelioma had been caused by exposure to asbestos cement.”

The annexed articles were all written by one journalist, Christopher Booker. The headlines to some of the articles convey their gist. Besides “The Great Asbestos Scam Continues” (2005) there were “Farmers to Fight a £6 billion Asbestos Scam” (2012), “There’s Money in Asbestos – Ask a Lawyer” (2013), and “Asbestos Judgment Fuels Bogus Claims” (2015).

In the course of these proceedings it has become clear why it was that the GMC considered the complaint did not meet its standards for investigation. By letter of 14 December 2015, the GMC explained that an Assistant Registrar had very carefully considered but rejected the “concerns” raised by Mr Bridle, which it summarised as follows:

“… you have stated that you consider that Dr Rudd has written a number of medical reports and in doing so he has conspired with certain law firms. You have said that you are concerned that Dr Rudd has falsified the risks to health associated with certain types of asbestos and you consider that in writing certain reports he has deceived the court by providing incorrect information.…” The Assistant Registrar’s conclusions were summarised. They included the following. There was no evidence of dishonesty; expert witnesses must be allowed to form their own opinions; if there are concerns about these, they should be raised in the legal proceedings. A failure to respond to correspondence did not require the GMC to investigate Dr Rudd’s fitness to practice. The report expressing an opinion about a person whom Dr Rudd had not examined made clear that he had not done so, and thus set out clearly the scope of his instructions and report.

Mr Bridle responded by offering what he described as further evidence, including a report from the New York Times referring to “the fraud that is crippling US businesses”, and a report concerning “someone who could be described as an ‘American Dr Rudd’ who, it is said, behaved as a ‘quintessential expert for hire’”. He suggested that “From our many experiences in helping innocent companies that have been crippled by Dr Rudd’s manipulated evidence the courts do not in fact accept any defence intervention”. The GMC responded on 23 December 2015 that none of this amounted to fresh evidence worthy of consideration. On 4 January 2016 Dr Rudd reported to the GMC that papers studied by him and his Advisory Board “indicate… that Dr Rudd’s expert opinions to the Court … amount to deliberate deception for monetary gain.”

None of this was known to Dr Rudd before the disclosures he has secured by reliance on the DPA.

On 1 February 2016, Ms Bains sent six letters on behalf of Dr Rudd: she sent a SAR and a s 10 Notice to each of Mr Bridle, Asbestos Watchdog Limited, and Fisher Scoggins Waters (“SCW”). The SARs were in simple terms, stating that they were subject access requests under s 7 of the DPA and asking for “the information about Dr Rudd that he is entitled to under the [DPA]. In particular … information containing his personal data which relates to his work in acting as an expert in cases brought by individuals seeking compensation for mesothelioma.”

The s 10 Notices asserted that the recipient had, in recent months, breached the DPA by “failing to process Dr Rudd’s personal data fairly and lawfully and in accordance with his rights as a data subject”. They alleged that the recipients had been involved in an attempt to discredit Dr Rudd and that the processing of his data in this manner “is causing and is likely to cause substantial damage and substantial distress to Dr Rudd and that damage is, and would be, unwarranted.” All the letters sought urgent responses, indicating that proceedings would be issued promptly if satisfactory replies were not received.

Mr Bridle did not reply. The others did. Their replies told Ms Bains that (as was the case) Asbestos Watchdog Limited had been dissolved in 2010, and SCW did not act for Mr Bridle.

On 13 July 2016, Ms Bains called Mr Bridle to obtain an email address for him, then emailed threatening proceedings unless within 7 days he responded to the first SAR. She said, “We will be applying for an Order that you comply with the SAR and pay our client’s legal costs”. It is to be noted that she did not say that any claim would be made for failure to comply with the s 10 Notice, nor that any claim would be made for compensation.

Mr Bridle responded by email the same day, stating that “I have no intentions to harm Dr

By letter of 15 July 2016, Ms Bains made clear that it was not accepted that, apart from

Again, Mr Bridle’s response came promptly, on the same day. He complained that it had not been explained what he had done to harm Dr Rudd. He claimed “the only information that I have collected myself is from Dr Rudd’s website. All other information he held had been sent to him by law firms dealing with cases that involve Dr Rudd’s witness statements” which he was not allowed to disclose without permission. He said that “in all of these cases … I am expected to act as an expert witness.” He said again that he was willing to meet, but threatened to report Ms Bains to the Solicitors Regulatory Authority “if you attempt to intimidate me further”. The claim is issued

A claim form accompanied by Particulars of Claim was issued and served on Mr Bridle on 27 July 2016. These described the claim as “brought under s 7 of the Data Protection Act 1998 seeking an order requiring the defendant to comply with the claimant’s [SAR] dated 1 February 2016.” This corresponded with the original letter before action. The Particulars of Claim described the parties and then set out the words I have quoted at [9] above. These appeared under the heading “Relevant Background”.

Mr Bridle served his Defence on 9 August 2016. In it, he claimed for the first time that he would only be processing Dr Rudd’s personal data in a domestic capacity and thus was exempt. That exemption has since been abandoned. Mr Bridle further suggested that a SAR “might be addressed instead” to [the Company] which is the likely data controller in this matter.” He had responded to the SAR nonetheless, he said, and he re-asserted the privilege exemption, this time on the basis that any personal data he had obtained from third party law firms “was acquired and is being processed in order to assist him in his capacity as an expert witness”. He added that the Journalism Exemption might also apply.

In November 2016, Leigh Day served their first costs estimate for the claim, in the sum of some £122,000. On 21 November an order was made by consent, staying the matter until 20 December 2016 to allow the parties to attempt to settle. In the event, no settlement meeting took place. The parties are at odds about the responsibility for that. It is however clear that Leigh Day were requiring compliance with the SAR before any meeting, and that at this stage Leigh Day were seeking “documents”, not information.

In January 2017, Dentons served notice of acting, and shortly afterwards served an Amended Defence, in substitution for the original. This unequivocally asserted that all relevant activities undertaken by Mr Bridle were at all material times undertaken on behalf of the Company, in his capacity as a director, and that the Company not Mr Bridle was the data controller. It went on to categorise the contexts in which personal data of Dr Rudd were processed by the Company, and to assert that “the said processing is exempt from the subject information provisions” pursuant to the Privilege Exemption, the Journalism Exemption, or the Regulatory Exemption. It was thus denied that Mr Bridle or the Company were in breach of s 7, and denied that the Court should exercise its discretion to make an order. The Amended Defence addressed the allegations set out as

“Relevant Background” in the Particulars of Claim, by describing them as “tendentious and unparticularised averments” whose “relevance to any matter properly in issue in the present claim was denied.”

The Second SAR and s 10 Notice

Understandably, in the circumstances, Leigh Day addressed a SAR and s 10 Notice on the Company. This was done by letters of 28 February 2017. As Mr Fairbairn has pointed out, the procedure adopted was inappropriate, as the documents were sent to Dentons who at that stage were acting for Mr Bridle. However, they had in that capacity advanced a case on behalf of or at least about the Company, and no fundamental point is taken about this error. Indeed, it was Dentons who responded to the Second SAR on 21 March 2017. Unsurprisingly, the position set out in that letter mirrored the Amended Defence. It went on, however, to assert that the Company was concerned to seek a proportionate resolution to the second SAR. They offered “a granular review” of the personal data with a view to assessing whether the Company was in a position to provide the information which Dr Rudd was seeking, “in a manner which is consistent with its overriding obligations to third parties”. A list of proposed search terms was provided. It was said that once the search had been completed, Dentons would “review the relevant data and revert”.

At the same time, but under separate cover, Dentons responded to the s 10 Notice by asking what statements were said to be “unfair and inaccurate” and why and in what regards. They also asked for the basis on which it was alleged that the statements were part of an attempt to undermine Dr Rudd’s reputation, funded by the asbestos industry. There was never any response to that letter.

Following further discussion and in due course agreement on search terms, the promised exercise was carried out and eventually, by letter of 26 June 2017, Dentons provided their response on behalf of the Company. This reported as follows. A business called Millnet had been engaged to capture information on “our client’s computer” using the agreed series of search terms. The search had identified a total of 2,251 potentially relevant documents. Review by Millnet and “a senior solicitor in our office” had concluded that “most of the … processing of your client’s personal data by our client is exempt”. A total of 1,429 of these documents were said to be covered by the Privilege Exemption, 134 by the Journalism Exemption, and 543 by the Regulatory Activity Exemption. Reasoning in support of the applicability of those exemptions was provided. The letter concluded with an offer to provide a witness statement detailing the search and review method employed to locate the data and reach the conclusions set out in the letter.

On 6 July 2017, Leigh Day replied. They complained that Dentons had taken 4 months to respond to the SAR, and had then not provided “a single document”, although their own figures showed there must be at least 115 documents that were not covered by any exemption. They demanded copies of these documents without delay. They noted (accurately) that Dentons’ account of why the exemptions applied closely tracked the wording of the Amended Defence, and sought clarification on a substantial number of points about the claims to exemption, asking for these points to be addressed in the proffered witness statement.

Nearly a month later, on 4 August 2017, Dentons replied. They pointed out (correctly) that Leigh Day had demanded documents, when the DPA affords access to information. They promised to provide a schedule “to summarise the data and how it was processed”. They explained that the figures they had given involved some overlap between categories, as some documents contained more than one reference to Dr Rudd (for instance in a chain of emails). They provided some responses to the queries raised by Leigh Day about the exemption claims. Among the information provided was the identity of the solicitor who reviewed the documents. This was a Mr Skinner, who had left the firm’s employment. It was said, however that Dentons had “no reason to believe that he adopted an improperly generous approach” to the scope of privilege. As to the witness statement, it was said that “if you insist on it being provided it will do little more than verify the previous letter.”

A witness statement was later provided, in draft for review. Ultimately, it was signed with a statement of truth by Mr Fairbairn. The delay has been criticised. I am not persuaded that it was culpable. It is the case, however, that the statement does little more than verify that the maker believes the contents of the letter of 26 June 2017 to be true. It does not address the queries raised by Leigh Day on 6 July 2017.

When the promised Schedule was provided, on 14 August 2017, exemptions were relied on in respect of information contained in 2,106 documents. Dentons had identified some additional documents as privileged or covered by the journalism exemption. Extracts from some 100 documents were provided. The following extracts illustrate the format of the Schedule, the nature and extent of the information provided, and the manner in which it was presented:

On 23 January 2018, permission was granted to join the Company as Second Defendant, and to amend the Particulars of Claim. This was done by consent, or at least without opposition. Dr Rudd’s amended case went beyond claiming a s 7 order. The claim form was amended to state that the claim arose from “the Defendants’ failure to comply with” the First and Second SARs and s 10 Notices. In the Particulars of Claim, the “Relevant Background” section remained unchanged. But it was alleged (in paragraph 23) that the First Schedule supported the Claimant’s pleaded case that Mr Bridle had worked in conjunction with others in a calculated attempt to discredit Dr Rudd, deter him from acting as an expert in mesothelioma cases, and discredit him in Parliament. The remedy sought under s 7 was expanded to encompass an order requiring the Second Defendant “to provide copies of all the documents referred to in the Schedule without any redactions so that he may identify the persons responsible for the matters pleaded at paragraph 23 above.” Claims were also made for orders under s 10 requiring the Defendants to cease processing the claimant’s personal data, and for “damages for distress” pursuant to DPA s 13. The Particulars of Claim did not, however, contain any allegation that Dr Rudd had suffered any distress nor (as must follow) did they explain what was alleged to have caused such distress.

A Re-Amended Defence made not only a number of consequential amendments, but also responded to the altered case with which the defendants were now faced. Paragraph 23

On 6 March 2018, Dr Rudd served a Reply. In paragraph 6, this noted that Mr Bridle had not pleaded to any of the allegations in paragraphs 6 to 8 of the Amended Particulars of Claim ([9] and [10] above) and asserted that Dr Rudd “will invite the Court to draw the inference that this is because these allegations are true.” The Reply addressed the issue about which defendant was the data controller. It took issue with each of the claims to exemption, providing reasons for the inapplicability of each.

In December 2018, by Order of Senior Master Fontaine, the original Schedule was expanded and supplemented, to provide information as to the letterhead and email addresses, and “sign off”, used in entries from 1 January 2015 to 31 December 2017, together with the words used to make any express references to the Company or Asbestos Watchdog. The purpose of this Order was to afford the claimant disclosure of information of relevance to the issue as to who was the data controller. The revised Schedule incidentally revealed rather more about some of the content and purpose of the communications. The following extracts illustrate the position.

By letter dated 12 February 2019, Dentons gave notice that their clients had decided to “waive the reliance on the journalism and regulatory exemptions”. They provided a schedule of personal data for which those exemptions had previously been claimed (“the Third Schedule”). The reason given was to reduce the areas in contention and hence the amount of time spent at trial. It was suggested that this step would obviate the need for any discussion as to whether the validity of these exemptions was a pleaded issue. But

On 20 February 2019, there was a Pre-Trial Review before Senior Master Fontaine. She had to deal with a number of procedural wrangles. Importantly, there were disputes as to what were and were not issues for trial. The day before the PTR the defendants had served a Part 18 Request demanding answers to detailed questions about Dr Rudd’s views about chrysotile, and the links between asbestos exposure and cancer. The defendants had also proposed to put before the trial Court a bundle of “Technical Documents” none of which had been included in their disclosure lists. Master Fontaine declined to order Dr Rudd to respond to the Part 18 Request, and directed that the technical material should not be in evidence unless by permission of the trial Judge, on application by the defendants. In an attempt to narrow and clarify the real issues in dispute, she devised a regime by which the claimant would provide a list of issues, the defendants would respond, and if agreement was not possible a list comprising both sides’ contentions should be produced, and the issue resolved by me. She also referred to the trial Judge the following question:

“whether, in relation to the disagreement between the parties relating to the scientific debate about the effect of exposure to chrysotile, the parties are permitted to rely on those parts of their evidence in chief dealing with this issue and/or whether crossexamination should be permitted, alternatively be limited, and if so to what extent.”

In the event, I was provided with a List of Issues which showed that the parties were significantly at odds about what these were. And the Skeleton Arguments revealed an even greater gulf between the parties.

It will be obvious that the parties’ approach to this case has been not only fractious but also undisciplined and disorderly, bordering at times on the chaotic. My first task has been to determine – applying the overriding objective - what issues can fairly and properly be tried and, having done so, to control the evidence and submissions accordingly. Conventionally, the issues are to be identified by examining and analysing the parties’ statements of case. I see no reason to depart from that approach here. On the contrary. It is fundamental to a fair trial that a party can only be expected to address, and the Court can only be called on to determine, issues which have been clearly and sufficiently raised and defined through the process of exchanging statements of case. It is a matter for dismay that the parties have generated such a procedural muddle.

In my judgment, it is tolerably clear that the main issues raised by the final statements of case in this action can be fairly categorised under four headings, as follows:-

Having said that, I need to make some further comments, and to explain why not all of these issues were in a fit state for trial.

Having reached those conclusions, I made them clear during Mr Vassall-Adams’ opening. As a result, after taking instructions, he announced that he intended to proceed only with the claim under s 7. That decision having been made, the pleadings and evidence which related solely to the other issues were not explored further. At the end of the trial, I reserved judgment and decided to stay those aspects of the claim, and to postpone any argument on what should become of them in the longer term, until after handing down judgment on the s 7 claim.

In the result, of the issues listed above, this judgment will deal only with issues (1), (2) and (4)(a). To be quite clear, the consequences of these decisions include the following. This judgment contains no determination of whether or not any genuine scientific controversy exists in relation to the causal links between chrysotile asbestos, or the cement version of it, and mesothelioma or any other disease. Nor do I assess the merits of any of the complaints which Dr Rudd wished to advance at this trial, that the personal data processed by the defendants were inaccurate and the processing of those data unfair and/or unwarranted. I have put to one side those parts of the witness statements and Skeleton Arguments, that address these issues. I have not been taken to, nor have I considered, any of the Technical Documents. They are wholly immaterial. I have, however, reached conclusions about the reliability of the oral evidence I have heard, and as to the positions adopted in the documents, where that is relevant to the limited range of issues for my determination.

The principal evidence was documentary. If the Technical Documents are included, there were ten lever arch files, together with three files of authorities. But there were also witness statements and oral evidence. For the claimant, this came from Dr Rudd himself, and Ms Bains. For the defendants, Mr Bridle and his son Christopher gave evidence. There was a statement from Mr Fairbairn, which stood as unchallenged evidence. The other witnesses were all cross-examined. To some extent, my assessment of the witnesses and their evidence has a bearing on my resolution of the issues, so I will record it here.

Dr Rudd was a straightforward witness who gave clear and relevant answers to all questions asked. I am quite satisfied that he was seeking to assist the Court and that his evidence was honest. There is much that was put to him that I do not need to deal with here, but I should record that I was satisfied that his animosity to Mr Bridle was not merely based, as was suggested to him, on articles by George Monbiot or other material drawn from the internet. He told me, and I accept, that he had been familiar with Mr Bridle’s campaigning on asbestos issues from early this century, and was familiar with Christopher Booker’s articles, which he regarded as largely based on misinformation provided by Mr Bridle, and misconceived.

Ms Bains was a combative witness, who did not always pay close attention to the question posed, and had a tendency towards diversion or attack rather than response. That said, I do not doubt the honesty of her evidence. Her objectivity may be compromised by her evident passion on the subject of mesothelioma, from which her father died, and on which she has been an active campaigner for some years. That passion may also have contributed to the robustness of her approach to the SARs and this litigation, for which she was much criticised in cross-examination. She has provided some of the material, critical of Mr Bridle, on which Dr Rudd has placed reliance in this case. But that does not show that she has behaved unreasonably.

In the end I have not been persuaded by Mr Fairbairn’s contentions, properly put to Ms Bains, that the claim was premature; or that Mr Bridle was dealt with unfairly when he was acting in person; and that the claim could have been settled if only Dr Rudd and his lawyers had been prepared to engage in constructive dialogue. I note that these lines of attack, not heralded by any complaints of oppression in Mr Bridle’s witness statements (though he did complain of the way claim had been handled). In fact, Mr Bridle was not without legal assistance. It is obvious that he had the benefit of some legal advice from the outset, though he has declined to reveal from whom. His Defence contains a good deal of informed legal argument, and citation of relevant authority. He is a very experienced businessman, well able to express himself. He could have, but never did ask for more time, to allow him to consult with lawyers. I do not consider that Mr Bridle’s offers to engage in talks were a genuine attempt to reach a resolution, other than one in his own favour; or that he would ever have made any reasonable offer, prior to the involvement of Dentons.

Christopher Bridle gave evidence of little importance, but he was a good witness. I accept his sincerity. What came across most strongly was his belief in his father, and his wish to support his father in his campaigning activities, and otherwise. Christopher Bridle holds no medical or scientific qualifications, but told me that he had written a number of substantial articles on the science of asbestos related disease, copies of which were in the bundle.

I was unimpressed with Mr John Bridle’s evidence, and his conduct of this action, for a number of reasons. He did not strike me as a witness who was keen to give me an unvarnished picture of the true position. I conclude that his evidence is not reliable, except where it finds support in contemporary documents, or other independent evidence that I find reliable. I should set out some of the main grounds for my adverse conclusions about him. I shall start with the GMC complaint letter, and the defendants’ case about it.

As indicated by that last finding, I have concluded that Mr Bridle was and is the, or a data controller in respect of the personal data which are the subject of this claim. I do not accept the defendants’ case that the Company is the, or a data controller in respect of those data. I shall give reasons for those conclusions later. I shall follow the course adopted by Mr Fairbairn in his closing submissions, and deal at the end of this judgment with the question of the identity of the data controller(s). There is no dispute that at least one defendant qualifies.

“No stone unturned”

Prominent in Mr Fairbairn’s argument on behalf of the defendants is the submission that a data controller, responding to a SAR, is only required to act reasonably and proportionately; the DPA does not require an approach which “leaves no stone unturned”. Mr Fairbairn relies on Ittihadieh [96-103], and the ICO’s Code of Practice, at p28 for the submission that the legislature did not intend to impose excessive burdens on data controllers.

It is indeed clear law, at least domestically, that a data controller on which a SAR is served is only required to conduct a reasonable and proportionate search for the applicant’s personal data. This principle, first identified by Judge Hickinbottom (as he then was) in Ezsias v Welsh Ministers (unreported, 23 November 2007) at [97], is authoritatively confirmed in the passages cited from Ittihadieh. One consequence is that compliance “does not necessarily mean that every item of personal data relating to an individual will be retrieved”: Ittihadieh [103] (Lewison LJ).

It is less clear that a data controller has such latitude when determining whether personal data which have been retrieved as a result of a reasonable and proportionate search are subject to one or more of the exemptions from the subject access provisions. I do not read either Ittihadieh or the passage cited from the Code of Practice as clear authority for that proposition. Indeed, what Lewison LJ said about the Privilege Exemption in Ittihadieh at [102] seems at odds with such an argument. He pointed out that this exemption only relieves the data controller of the duty of search “to the extent that personal data are covered by legal professional privilege”. Of course, the nature and extent of the operations conducted by the data controller will be a factor to bear in mind in the exercise of any discretion. If the data controller has acted with reasonable diligence, and there is no reason of substance to doubt the validity of the conclusions arrived at, the Court would be likely to refuse an order under s 7(9). But, as will appear, I do not believe this is such a case.

The defendants’ original position, that virtually all the personal data of Dr Rudd that they process is privileged and hence exempt from subject access, was abandoned some time ago. Reliance was placed on the Journalism and Regulatory Activity exemptions, then waived, but only in the qualified way that I have already described. Dr Rudd still seeks further information about the personal data that has been disclosed pursuant to the “waiver”. The defendants resist that claim. And there has been no waiver of reliance on the Privilege Exemption. So I ought to address all three exemptions. I shall deal first with the two that have been “waived”. Journalism

I accept Mr Vassall-Adams’ submission that there is no evidence capable of supporting the claim to this exemption.

The relevant provisions of DPA s 32 are as follows:

“32.

– (1) Personal data which are processed only for the special purposes are exempt from any provision to which this subsection relates if –

(a)

the processing is undertaken with a view to publication by any person of any journalistic, literary or artistic material,

(b)

the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and

(c)

the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.”

The “special purposes” are journalistic, artistic and literary purposes: DPA, s 3.

The onus lies on a data controller who seeks to rely on this exemption to establish that the personal data in question were processed “only” for the special purposes, and that each of the three requirements of s 32(1)(a)-(c) is met. The concept of journalism is a broad one, but “it is not so elastic that it can be stretched to embrace every activity that has to do with conveying information or opinions. To label all such activity as “journalism” would be to elide the concept of journalism with that of communication. The two are plainly not the same”: NT1 v Google LLC (above) [98]. Data which are processed for more than one purpose are not exempt: Buivids [2019] EUECJ Case C345/17 [59], andData protection and journalism: a guide for the media” (Version 1.0, 4 September 2014) (“the journalism guide”) published by the Information Commissioner

Mr Vassall-Adams has drawn attention to passages in the ICO’s journalism guide which express the view that s 32(1)(b) requires proof that “the issue of public interest was actually considered … at the time of the relevant processing of personal data”; and that what s 32(1)(c) requires is proof that “it was impossible to both comply with a particular provision and to fulfil [the] journalistic purpose” or that “it was unreasonable in the circumstances to comply with a particular provision, by virtue of it being impractical or inappropriate”. It is not necessary to decide whether those views are correct, because the

This was not elaborated in Mr Bridle’s oral evidence, and Mr Vassall-Adams did not cross-examine on the issue. Understandably so, as this evidence could not be said to meet the essential requirements I have identified in paragraph [77-78] above.

This passage does assert that some information has been “assembled with a view to publication”, but does not elaborate. It does not identify the information, or the process of assembly in any way. It does not identify or explain the nature of the publication referred to. It is unclear whether this is said to be publication that has taken place, or which will or might take place, or to what audience or audiences such publication has been or will or might be addressed. As it happens, there is no evidence that any personal data relating to Dr Rudd have been included in any publication made by either defendant to the public or any section of the public. Nor is there any evidence – other than this passage - that the defendants intended or planned to include any reference to Dr Rudd in any publication by them to the public or any section of the public. The manner in which the personal data were or were to be used to “raise public awareness” evidence is not explained. The evidence is that the purpose was a campaigning one. It does not contain, let alone explain or justify a contention that (1) the purpose of the publication(s) referred to is “journalistic” or “literary”; or (2) that the information referred to has been processed “only” for such purposes. And the requirements of s 32(1)(b) and (c) are not addressed at all.

It cannot be sufficient to say that Dentons have concluded that the material is covered by this exemption. I have already explained why I reject Mr Fairbairn’s contention that Dr Rudd is estopped from contesting Dentons’ conclusions. I should add that in answer to questions from me, Mr Fairbairn expressly confirmed that he was not suggesting that the process whereby Dentons reviewed the material on their clients’ behalf was, or was akin to, an arbitration by which the parties agreed that Dentons’ conclusions would be binding. The applicability of the Journalism Exemption depends on the purposes and state of mind of the data controller, which are matters of fact which require proof. It also depends on an assessment of the reasonableness of the data controller’s beliefs, assuming they are established as a matter of fact. The evidence does not suffice. Dentons’ letter of 26 June 2017 does not explain the basis for the claim to the Journalism Exemption. Mr Fairbairn’s witness statement does no more than verify that letter. All I have is hearsay evidence of the fact of a solicitor’s opinion on the overall issue of law.

There are, moreover, cogent reasons to believe that the solicitor’s opinion on this issue was wrong. Mr Bridle senior seems to be the author of all the material in question, but he does not appear to have engaged in any journalism. In any event, Mr Vassall-Adams submits that a cursory glance at the information contained in the Journalism section of the Third Schedule shows that this is not processing for journalistic purposes, with a view to publication, but internal communications between members of what he calls “the Asbestos Watchdog lobbying group”. That is an argument with considerable force. It is far from self-evident that the conditions in s 32 are satisfied. No attempt has been made to supply the deficiency in the evidence, by explaining why it would be reasonable to believe that publication would be in the public interest. It could certainly be said that some of the material goes to an issue of public interest, but that is not the same thing: cf Economou v De Freitas (above), at [139(1)]. Nor have I heard any argument as to why it might reasonably be thought that compliance with s 7 would be “incompatible” with the “special purposes” for which the defendants say the information was and is being processed. The solicitor who concluded that this exemption was applicable must have relied on Mr Bridle, whom I have concluded is an unreliable witness.

I accept Mr Vassall-Adams’ submission that the defence has failed to make out the case for this exemption also.

DPA s 31(1) provides as follows:

“Personal data processed for the purposes of discharging functions to which this subsection applies are exempt from the subject information provisions in any case to the extent to which the application of those provisions to the data would be likely to prejudice the proper discharge of those functions.”

The defendants rely on DPA s 31(2)(a)(iii), which provides that the functions to which s 31(1) section applies include “protecting members of the public against dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons authorised to carry on any profession or other activity”. Reliance is placed on the GMC’s statutory responsibilities under the Medical Act 1983.

The defendants’ pleaded case is that this exemption applies to “Correspondence and documents passing between the Second Defendant and the GMC Fitness to Practice Team and relevant appeal bodies (including the GMC’s Appointed Investigating Officer, Corporate Review Team, the Information Commissioner’s Office and the General Regulatory Chamber) in respect of a complaint made about the Claimant to the GMC in 2014”.

It will be noted that the pleaded case for this exemption goes beyond data relating to the GMC itself; it is claimed for data passing between the defendants and the ICO and the General Regulatory Chamber (“GRC”) as well. That would seem to be processing for the purpose of regulatory and adjudicatory functions carried out by those bodies, not the GMC. Moreover, the disclosure now made in the Third Schedule following the “waiver” of this exemption indicates that the information to which this exemption was in fact applied by the defendants, on Dentons’ advice, goes even further. It goes well beyond the classes of information for which the exemption is claimed in the Defence, or could properly be claimed. The passages I have cited, or most of them, are evidently communications with third parties, not with any of the bodies mentioned in the Defence. For these reasons, it appears that the exemption has been applied to items or indeed whole categories of data which could not, or could not reasonably be said to fall within the scope of the exemption, or the pleaded case.

It may be that, in addition, the defendants’ reliance on this exemption as a basis for withholding information about their contacts with the GMC is ill-founded on grounds of status. Mr Vassall-Adams’ primary submission is that only a regulator can rely on s 31. I note that Jay on Data Protection says that “In most circumstances only data controllers who have a regulatory function can rely on these exemptions.” (3^rd ed, para 11-48). The ICO’s guidance on this exemption suggests that “the exemption is not available to all organisations and only applies to the core regulatory activities of bodies which perform appropriate public regulatory functions, primarily watchdogs”. But there is a counterargument, advanced by Mr Fairbairn: an informant or “whistleblower”, who reports an individual to a regulator is processing that person’s data for the protected purposes, and such processing falls within the scope of the exemption. I am inclined to think that the wording of s 31(1), “for the purposes of discharging”, indicates that only processing by the regulatory body is covered. But it is not necessary to resolve these issues because, again, the evidence does not come close to establishing the matters required in order to sustain the claim to this exemption.

This is a qualified exemption, which only applies “to the extent to which” the provision of subject access “would be likely to prejudice the proper discharge” of the relevant functions. The defendants have provided no evidence that compliance with s 7 would cause any such prejudice. That issue is not addressed at all in the evidence of Mr Bridle senior, or that of his son. The pleaded case is an inferential one. It is said that, in so far as the GMC has not itself provided Dr Rudd with the data in question (following the grant of consent by the Company), the inference to be drawn is that “this was a considered assessment of the GMC in accordance with the proper discharge of its regulatory function” which would be undermined if the defendants were to disclose such material under the DPA. This is an unusual line of argument. There is nothing from the GMC itself to support it. Having examined the relevant correspondence, I am not persuaded that it is a reasonable inference to draw. No explanation has been offered as to why compliance with the SAR should be prejudicial to the proper discharge of the GMC’s functions.

Even if the Court could infer that giving subject access to Dr Rudd, as the target of a GMC complaint, would at some stage have prejudiced the GMC’s functions, is hard to see how such an argument could be sustained today, over three years after the GMC rejected the complaint as falling short of its threshold for investigation. The defendants’ case certainly does not meet the high standard which has been set by the authorities, which hold that the standard of “likely” prejudice connotes “a very significant and weighty chance of prejudice to the identified public interests”: R (Lord) v Secretary of State for the Home Department [2003] EWHC 2073 (Admin) [100] (Munby J) (cited in the ICO guidance, p5).

I do not overlook the fact that Dentons have reviewed the underlying material and assessed it, before concluding that reliance could be placed on the Regulatory Activity Exemption. In other circumstances that fact, if appropriately verified before the Court, might lead to a conclusion that the exemption is made out. But, as with the Journalism Exemption, the solicitor was dependent on instructions from an individual whom I have found to be unreliable. Moreover, the evidence that I actually have about the assessment process is very limited indeed and, for the reasons I have given, there are good grounds to believe that the exercise undertaken was flawed and mistaken in this respect as well.

This is an exemption of a different kind from the Journalism and Regulatory Activity Exemptions. It is absolute and unqualified, and does not depend on proof that the defendants held a reasonable belief in anything. It is also harder to provide an auditable explanation of the process by which a claim to privilege has come about. For these reasons, evidence from a solicitor that he or she has reviewed the documents and concluded that they are protected by the exemption should carry more weight than a similar claim in respect of the Journalism and Regulatory Activity Exemptions; and the same would be true of evidence that an associate had carried out such a task, provided always that the Court could see that no error of law had been made. Here, the correspondence sets out the legal criteria adopted by Dentons, and the claimant has not quarrelled with these either in correspondence or at this trial. At one stage the claimant was contending that Dentons had erred by taking an impermissible “class” approach to the review (see Guriev v Community Safety Development (UK) Ltd (above)). I do not believe that was a justified criticism. On such evidence as I have, it was an individualised assessment process, albeit not “detailed”.

I have nonetheless concluded that the privilege exemption is not fully made out. The evidence, sparse though it is, is sufficient to justify the claim to legal advice privilege; but the focus has been on the claim to litigation privilege, and the evidence does not satisfy me that the relevant principles have been correctly applied.

The approach that should be taken to claims for litigation privilege was summarised by Hamblen J (as he then was), in Starbev GP Ltd v Interbrew Central European Holdings

[2013] EWHC 4038 (Comm) [11]. Omitting the citations, the relevant passages are these:

“(1)

The burden of proof is on the party claiming privilege to establish it

(2)

An assertion of privilege and a statement of the purpose of the communication over which privilege is claimed in a witness statement are not determinative and are evidence of a fact which may require to be independently proved. The court will scrutinise carefully how the claim to privilege is made out and the witness statements should be as specific as possible…

(3)

The party claiming privilege must establish that litigation was reasonably contemplated or anticipated. It is not sufficient to show that there is a mere possibility of litigation, or that there was a distinct possibility that someone might at some stage bring proceedings, or a general apprehension of future litigation

(4)

It is not enough for a party to show that proceedings were reasonably anticipated or in contemplation; the party must also show that the relevant communications were for the dominant purpose of either (i) enabling legal advice to be sought or given, and/or (ii) seeking or obtaining evidence or information to be used in or in connection with such anticipated or contemplated proceedings. Where communications may have taken place for a number of purposes, it is incumbent on the party claiming privilege to establish that the dominant purpose was litigation. If there is another purpose, this test will not be satisfied.”

At [12], Hamblen J identified the approach to be taken to the evidence in support of a claim for privilege:

“… it is necessary to subject the evidence to "anxious scrutiny" in particular because of the difficulties in going behind that evidence" … "The Court will look at 'purpose' from an objective standpoint, looking at all relevant evidence including evidence of subjective purpose" …. Further, … it is desirable that the party claiming such privilege "should refer to such contemporary material as it is possible to do without making disclosure of the very matters that the claim for privilege is designed to protect".”

It does not take particularly anxious scrutiny to conclude that the evidence relied on by the defendants in the present case falls short of these requirements. Again, I have only summary and relatively superficial evidence from Dentons. Although this identifies the legal principles, it does not explain how the solicitor concerned reached the conclusion that the relevant tests were satisfied. I infer that the solicitor relied on Mr Bridle, an unreliable source in my view. My conclusions on the Journalism and Regulatory Activity Exemptions have a bearing on the present issue. In relation to each of those exemptions I have found cogent reasons to think that the solicitor who carried out the assessment on Dentons’ behalf was wrong in his conclusions. That further undermines my faith in the same solicitor’s conclusion that legal professional privilege applies to this category of information.

From Mr Bridle himself, all I have is three short paragraphs, which fail to address any of the criteria that I have set out. No litigation or prospective litigation is identified. The only documents specifically referred to are reports of Dr Rudd. As Mr Vassall-Adams submits, privilege cannot be an answer to a claim by Dr Rudd to know what information the defendants hold about the contents of his own reports. No other contemporary documentation is produced or mentioned. The evidence does not establish that the information withheld was possessed for the dominant purpose of litigation. Although Mr Bridle previously claimed that he was expected to act as an expert witness in “all of the cases that I have referred to”, there is no evidence before me that this is the position. It does appear that someone provided Mr Bridle with copies of expert reports produced by Dr Rudd. But the more likely position, on the evidence as a whole, is that the context in which this occurred was not one in which the purposes of existing or contemplated litigation predominated, but one in which Mr Bridle was assisting others with strategic advice on how to undermine Dr Rudd’s standing and credibility generally. The Adequacy Issues

Section 7 of the DPAprovides, relevantly, as follows:

“(1)

Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled—

(a)

to be informed by any data controller whether personal data of which that individual is the data subject are being processed

by or on behalf of that data controller,

(b)

if that is the case, to be given by the data controller a description of—

(i)

the personal data of which that individual is the data subject,

(ii)

the purposes for which they are being or are to be processed, and

(iii)

the recipients or classes of recipients to whom they are or may be disclosed,

(c)

to have communicated to him in an intelligible form—

(i)

the information constituting any personal data of which that individual is the data subject, and

(ii)

any information available to the data controller as to the source of those data, …”

Where the data controller is processing personal data relating to an individual, therefore, the data subject has (subject to the provisions identified in s 7(1)) a collection of information rights. These include a right to be given a description of the personal data, and (in intelligible form) the information constituting those data. But the provisions go beyond that, requiring the data controller to provide descriptions of the purposes of the processing and of the recipients or classes or recipients. The data subject is also entitled to have an intelligible account of what the data controller knows about the source of the personal data. These are rights to the provision of information which is not, or not necessarily, comprised in the personal data themselves: Ittihadieh [94], Gaines-Cooper v Revenue and Customs Commissioners [2017] EWHC 868 (Ch) [50] (HHJ Jarman QC, sitting as a Deputy Judge of the High Court).

Mr Fairbairn is right to submit that the case for Dr Rudd has too often demanded disclosure of documents, as opposed to information. A claim for documentary disclosure pursuant to the DPA is likely, almost always, to be a misconceived. The statutory rights relate to personal data; as Lewison LJ explained in Ittihadieh at [93], the duty cast on the data controller:

“is not an obligation to supply documents: Dunn v Durham CC [2012] EWCA Civ 1654, [2013] 2 All ER 213 at [16].It is of critical importance to distinguish between the two. Although it may be more convenient and cheaper in some cases for a data controller to supply copy documents, there is no legal obligation to do so.”

But this point cannot dispose of the claimant’s case.

It follows from my earlier conclusions that the defendants’ SAR responses are inadequate, at least to the extent that they have failed to provide any information at all about the matters for which legal professional privilege has been claimed. Further, although information has been provided about the data in respect of which the Journalism and Regulatory Activity Exemptions were previously claimed, Dr Rudd does not accept its adequacy.

Dr Rudd has three criticisms of the disclosure: that it fails to identify the source or the recipients of the personal data; that the information is incomplete and not provided in an

“intelligible” form; and that the purposes of the processing are described in too nebulous and standardised a form.

(i)

Recipients

Mr Fairbairn criticises this aspect of the claim as “Norwich Pharmacal-lite”, without the procedural safeguards. It was left unclear to which safeguards he was referring. But I can see why the Norwich Pharmacal jurisdiction was referred to. On Dr Rudd’s own case, the main aim of the claim under s 7 is to secure disclosure of the identities of persons, presently unknown, who are suspected of conspiring with the defendants to commit unlawful acts calculated to cause significant harm to Dr Rudd’s professional reputation and impede the development of his career - namely, the communication of derogatory statements about him, which are said to be false and dishonest. The Norwich Pharmacal jurisdiction would seem on the face of it an apt vehicle for this. But the fact that the claim might have been put in that alternative way cannot guide my decision. I do not believe that was Mr Fairbairn’s point. His argument was that DPA s 7 cannot be pressed into service for the same purpose.

Two issues arise: (1) does the DPA afford Dr Rudd a prima facie right to know the identities of recipients of his personal data? If so, (2) do the defendants have a duty or right to withhold that information?

The provisions relevant to the first issue are those of s 7(1). The provisions relevant to the second issue are contained in s 7(4) to (6), which provide as follows:

“(4)

Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless--

(a)

the other individual has consented to the disclosure of the information to the person making the request, or

(b)

it is reasonable in all the circumstances to comply with the request without the consent of the other individual.

(5)

In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.

(6)

In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to--

Superficially, it might seem that there is a ready answer to the first question at [104] above: the data subject’s rights to a description of the recipients or classes of recipient of the data, conferred by s 7(1)(b)(iii). I raised this possibility in the course of argument. But that is not how the claimant has put his case, and on analysis I do not believe this to be a sound point. On the face of the sub-section, data subjects are entitled to be given information about those to whom their personal data have been disclosed in the past, or may be disclosed in the future. That interpretation is consistent with DPA s 14(3) and (5), by which the court can order that those to whom data have been disclosed should be notified of rectification blocking, erasure, or destruction. But the information to which the data subject is entitled is “a description”, not “the identity” of recipients. The ICO’s Subject Access Code of Conduct says at p41, “The right to a description of other organisations or people to whom personal information may be given is a right to this information in general terms; it is not a right to receive the names of those organisations or people.” I agree with that interpretation, which fits the statutory wording.

Mr Fairbairn submits that the wording of s 7(1)(b)(iii) gives the data controller the option, in all cases, to do no more than provide a broad description of a class or classes of recipient, whatever the facts or the data controller’s state of knowledge. He argues that the defendants have complied with this aspect of their obligations, by giving descriptions in correspondence and/or the Schedules. I do not believe that can be right. In my view, as Mr Vassall-Adams submits, the wording is apt to cover different kinds of case, so that if disclosure has been or will be made to a class, a description of the class will suffice (eg, “I will or may disclose these data to the readership of the Daily Globe”), but if there is a single recipient, the data controller must describe that recipient (eg, “on 14 October 2017 I told a medical practitioner that I had caught measles from the claimant”).

In the light of these conclusions, I find that the disclosures so far made by the defendants are not in every respect compliant with s 7. All the responses I have quoted above from the First Schedule and the Revised Schedule are non-compliant. There is no indication of the nature or status of the person, firm or company to whom the emails cited were sent. There are other similar responses to be found elsewhere in those Schedules. The Third Schedule contains no description at all of any of the recipients of the information there set out.

But these conclusions would not give the claimant what he really wants, even if I exercise my discretion so as to require a fresh, compliant response. The question remains of whether a right to know the identities of recipients can be spelled out of any other aspect of DPA s 7. The only candidates are the core rights to a description of the personal data and to the provision of the information in such data, in intelligible form.

The case for Dr Rudd is that he is “entitled to know the names of the people with whom the defendants were corresponding”. The primary contention of Mr Fairbairn is that the identities of third parties are wholly outside the scope of the subject access rights. He submits that fundamentally, the names of recipients of emails are never part of the Claimant's personal data; that information does not “relate to” the Claimant. Mr Fairbairn’s further and alternative submission is that, where the disclosure to which a data subject has a prima facie right does include third party personal data, DPA s 7(4)

“makes it clear that the data controller is not obliged to provide information relating to another individual”, which would include the individual’s name and email address.

In support of his first submission, Mr Fairbairn relies on the observation of Auld LJ in

In Durant, the Courtmade clear that information is not an individual’s personal data just because it names them. At [28], Auld LJ identified the approach, and some touchstones:

“Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated. In short, it is information that affects his privacy, whether in his personal or family life, business or professional capacity.”

There is also a useful discussion of the phrase “relating to” in the Article 29 Working Party Opinion 4/2007 on the concept of personal data, at section 2. I refer in particular to example no 9 (Information contained in the minutes of a meeting): the Working Party conclude that where three individuals attend a meeting, the information that T attended the meeting and made certain statements can be considered personal data relating to him;

Applying these criteria, to what extent, if at all, can the identities of those anonymised as XX in the SAR disclosures made in this case be regarded as personal data relating to Dr Rudd? It might be thought that the fact the disclosures include any reference to third parties presents a forensic difficulty for the defendants. If the identities of the recipients are not part of the personal data, why the need to anonymise? But the defendants’ case is that they have gone further than necessary.

Two points are worth noting about the anonymisation process. One is that there is more than one category of anonymised person. Anonymisation is not confined to recipients. The extract from the First Schedule above includes an “Email to XX” (a recipient) containing a reference to the “Rudd/XX conspiracy” (co-conspirator). The extract from the Revised Schedule contains another “email to XX” with a reference to Dr Rudd as “the main XX doctor” (clearly not a recipient). The Third Schedule contains references to “Rudd and XXXX conspiring”, and to “Rudd … helping XX attack you …”, as well as a reference to paying “X to write to Rudd”. There are other references to XX or the like, which plainly are not references to recipients of the data. The other point is that in few if any cases can it be ascertained, on the face of the SAR responses, whether the anonymised person is an individual, firm, company or other entity.

In my judgment, the identities of those who, within the personal data disclosed, are alleged to have conspired with or assisted or collaborated with Dr Rudd in the alleged fraud qualify as part of his personal data. So do the identities of those whom he is alleged to have helped to attack others, and those referred to as “victims of Rudd” (see another extract in the Third Schedule). It is integral to the information about him that is contained in the data that he has conspired with one or more identified or identifiable natural or legal persons, or attacked some identifiable person, or that such a person is his “victim”. That is information that focuses on him and is biographically significant. The same is true of those who, within the personal data, are identified as persons to whom allegations of fraud have been made. Within the documents there is personal data to the effect that “I have made an accusation to the GMC that Dr Rudd is guilty of fraud”. That is all information which relates to Dr Rudd. But applying the criteria in Durant and the ICO Code the identities of those to whom these personal data have been communicated are not personal data relating to Dr Rudd. It is not information relating to him. It is perfectly easy to understand what is being written about Dr Rudd in the extracts provided, without knowing to whom it is being written.

This makes it relatively simple to deal with the alternative submission of Mr Fairbairn. The identities of third parties who are presented in the personal data as collaborators or partners in, or victims of Dr Rudd’s alleged fraud form an integral part of Dr Rudd’s personal data. The next question, in relation to any such third party, is whether we are concerned with an individual. If not, s 7(4) cannot apply. To the extent that the third parties are individuals, then the defendants’ reliance on s 7(4) must be examined. Mr Fairbairn submits, and he is right, to this is not an exercise in simply second-guessing the data controller’s decision-making; the court’s task is one of review, with anxious scrutiny applied to the decision under examination: Durant [59].

Even making such allowances, the defendants have failed to justify reliance on s 7(4) as a basis for withholding third party identities. I must work on the basis that there is no third-party consent to disclosure. Mr Fairbairn submits that the question then is one of discretion for the data controller. I do not think that is right. In any event, it is clear from the correspondence and some of Mr Fairbairn’s other submissions that the defendants took the view, having been advised on the matter, that they were entitled to withhold all third-party data. That was and is misconceived. The ICO’s Code of Practice rightly states (p37) that decisions on disclosure of third-party data must be made on a case-by-case basis; “you must not apply a blanket policy of withholding it.” The Code contains a lengthy section on the application of s 7(4)-(6), in the course of which it is made clear (for example) that confidentiality is not of itself a bar to disclosure. Here, I do not believe that the defendants have made any or any detailed assessment of this issue. There is no evidence, nor is there any indication, that they conducted any of the analysis envisaged by s 7(6). It seems improbable in the extreme that they raised with the other alleged wrongdoers the question of whether they consented to the disclosure of that personal data to Dr Rudd.

The further and alternative argument has been that the third parties need or deserve protection from “harassment” by Dr Rudd. These proceedings are said to furnish evidence of his propensity to harass. I reject that characterisation of this litigation, and would not have upheld this argument, so far as recipients are concerned. Dr Rudd has unquestionably been denounced as a fraudulent expert. In argument Mr Fairbairn held back from imputing an intention to harass. I do not consider the charge of harassment to be objectively justified. To seek the identities of those responsible, and the extent of the denunciation, cannot fairly be described as harassment. But in any event, this line of reasoning cannot possibly apply to those who are on Dr Rudd’s side of the argument, whom the personal data place metaphorically in the dock with him. He is entitled to know who his co-accused are. The same applies to the identities of others, whom he is said to have helped, or to have victimised, or the like. That is information that is integral to and indistinguishable from the allegations against him. It is unreasonable to withhold it from him.

It is, I think, theoretically possible that a data controller could find itself unable to comply with the s 7(1)(b)(iii) duty to provide a description of recipients, without implicitly disclosing personal data of a third party (eg “On 1 December 2019 I told a monarch that the claimant was unfit to be awarded an OBE”). In such a case, the data controller would have to consider the issues arising under s 7(4)-(6). But on the facts of this case that seems to me to remain a purely theoretical issue. If that is wrong, the defendants will have to address the matter when complying with the order I shall be making for compliance with s 7(1)(b)(iii).

For reasons similar to those already given in respect of recipients, I would uphold Mr Fairbairn’s submission, that information as to the identity of the source of the personal data relating to Dr Rudd which is held or otherwise processed by the defendants is not part of those personal data. This is information that does not relate to him. The information about him which has been disclosed is comprehensible without such information. But that is not the end of the matter. As with recipients, there is a specific provision that requires the provision of information about sources, to the extent the data controller has such information, and which must be complied with, whether or not that information counts as personal data: s 7(1)(c)(ii).

I have dealt with sources separately from recipients because this provision is not just separate from s 7(1)(b)(iii), it is not the mirror of that provision. It does not call for the data controller to provide a “description of” the source but rather “any information available” as to the source. Neither party has made any detailed legal submissions on this provision, nor am I aware of authority as to its scope. The ICO’s Code of Conduct is silent on the extent of the obligation. Consulting the textbooks, I find no consensus. Jay, Data Protection, 4^th ed (2012) points out at 11-22, “The DPA does not specify the level of detail at which such information must be given”, and Ms Jay expresses the view that “it may be acceptable to provide it in general terms”. Carey, Data Protection – A Practical Guide to UK and EU Law (4^th ed, 2015), observes (at p171) that the right to information as to sources “is one that data controllers can sometimes overlook”. Mr Carey suggests that “If information relating to a source is held by the organization then it must be disclosed”.

In my judgment, Mr Carey’s interpretation is to be preferred. The DPA was enacted to implement the Directive (95/46/EC), and must be construed in conformity with that instrument. The relevant provisions are in Article 12(a), which requires Members States to “guarantee every data subject the right to obtain from the data controller … communication to him in an intelligible form of the data undergoing processing and of any available information as to their source”. As in the DPA, therefore, the rights to communication of the data and source disclosure are to be found in the same subparagraph. The wording used in the Directive (“any available information”) is broad and indistinguishable from the domestic wording.

The Third Schedule contains no information as to sources. Otherwise, the defendants have provided only the broadest and most general indication of the sources of the personal data they have held and processed. It is clear enough on the face of the disclosure that has been provided, and the defendants’ own evidence, that they have information as to the sources of the personal data they have been processing, which they have not disclosed. On Mr Bridle’s own case, he has been provided by lawyers with copies of Dr Rudd’s reports, prepared for the purposes of litigation. He must know who those lawyers are. There are clearly numerous other pieces of information about sources which are available to the defendants, but have not been provided.

I have rejected the contention that these communications are exempt from the subject access provisions. The remaining issue is whether the information can properly be withheld under s 7(4)-(6). Again, I reject this contention. The defendants have taken a blanket approach to the identification of third parties. As I have pointed out, these provisions cannot be relied on to withhold the identities of any firm, company or other legal entity. I am confident, therefore, that there is much source information available to the defendants which is incapable of engaging s 7(4), including but not necessarily limited to the names of the solicitors’ firms involved. As to personal information about sources, there is no evidence that anybody has been asked for their consent. On the evidence before me, I can see no reason to doubt that disclosure would be reasonable. Section 7(4) does not justify the withholding of this information. I conclude, therefore, that the SAR responses to date fall short of providing source disclosure, to which the claimant is entitled.

This issue has not featured as prominently as other issues in this case. It was advanced by Mr Vassall-Adams in a general fashion, rather than by reference to any list of specific instances of alleged inadequacies in the disclosure. In opening, Mr Vassall-Adams’ submission was that the extracts provided in all three Schedules were very short and, in most cases, in incomplete sentences; whereas his client was entitled to know “the full contents of the documents in the Schedule, so that he can understand the context of the references to him”. His closing argument was less ambitious. He argued that, shorn of their context, the passages which have been disclosed are unintelligible and that, “given the gravity of the allegations made about him”, the whole of the relevant paragraph should be included.

The claimant has no right to documents, nor does he have a right to know the full contents of documents. His right is to the information in personal data, which is to be identified using the touchstones I have mentioned. Information can be presented in intelligible form without the need to provide its full context, or even the whole of the sentence in which it appears. It is to some extent a matter of judgment, and here the Court should pay some deference to the judgment of those who have studied the documents and made the initial assessment. I note that no complaint of unintelligibility was made in correspondence, nor was this a fault identified in the Particulars of Claim. I have indicated my conclusion on this issue when dealing with recipients and sources. Having studied the disclosure provided, I am not persuaded that the claimant has established a breach. I find that the information disclosed is sufficiently intelligible.

Dr Rudd’s Reply complains that the defendants have failed to give him a description of the purposes for which his data have been processed. I uphold that complaint, so far as the Third Schedule is concerned. The Schedule itself contains no information about the purposes of the processing. The defendants have contended, in correspondence and in evidence, that the information disclosed in that Schedule was processed (a) for the purposes of journalism, with a view to publication, in the reasonable belief that publication would be in the public interest and compliance incompatible with the special purposes; or (b) for regulatory purposes, in circumstances where disclosure would be prejudicial to those purposes. I have rejected that account of things, and the claim for exemption that was based on it. It does not follow that none of the processing was for journalistic, or regulatory purposes; but I have concluded that on the balance of probabilities at least some of it was not.

Turning to the Revised Schedule, Mr Fairbairn concedes that the complaint is justified if that Schedule is taken in isolation, but submits that it is incorrect in the light of the correspondence. The key part of this correspondence is paragraph 7 of the letter of 26 June 2018, which identifies four broad purposes. Three of these coincide with the claims for Exemption. The fourth category is “correspondence and documents passing between our clients and a network of confidential informants, supporters, investigative journalists, politicians and officials for the purposes of investigating, campaigning and reporting on asbestos related issues”. This is similar, though not identical, to the formula set out in the Schedule. Certainly, the correspondence does not specify the purposes of the processing in an individualised way.

This is another topic on which no authority has been cited, and on which the ICO’s publications and the textbooks offer little guidance. My conclusion is that the obligation to provide a “description” of the purposes of the processing is not so onerous as Mr Vassall-Adams suggests, either generally or (if that is wrong) in this case. It seems to me that the term “description” must be interpreted and applied consistently, wherever it appears. It is also important to keep in mind the principle of proportionality, and the wide range of contexts in which data subjects may impose these obligations on data controllers. The essence of the right is to know what the data controller is doing or intends to do with personal data relating to the data subject. The legislation does not, in my judgment, impose an obligation to provide that information on a document-by-document (or item by item) basis.

The only Remedies Issue which survives my decision to restrict the issues for trial is the question of how to exercise the discretion under s 7(9) of the Act.

The claimant’s revised draft order after trial seeks orders for the identification by name of the recipients of documents which have been disclosed. The draft order also seeks orders for the provision of an amended version of the Revised Schedule containing “An Information section containing, in the case of letters or emails, the full paragraph or paragraphs of the letter or email that either (a) contain the Claimant’s personal data or (b) that identify the sources of the Claimant’s personal data” and a “Purpose section, the purpose of the email or letter in terms specific to the email or letter in question.”

My firm conclusion, contrary to the submissions of Mr Fairbairn, is that I should exercise my discretion to order a further SAR response. This may omit all personal data in respect of which the data controller asserts a claim to legal advice privilege, but it may not exclude data which was formerly said to be protected by litigation privilege. The response need not identify any individual recipient of the personal data, (that is to say, the recipient of the email or other communication containing the data), but it must include (i) descriptions of the recipients, actual or intended, of the personal data; (ii) the identifying details of any person, firm or company other than a recipient of the personal data, which are currently redacted in the Revised and Third Schedules by the use of “XX”; (iii) any information available to the data controller as to the sources of the information set out as personal data in the Revised and Third Schedules; and (iv) a description of the purposes of the processing of the personal data in the Third Schedule (though not a description specific to individual emails or letters). I will also order the data controller to provide the dates of the documents from which the data contained in the Third Schedule are drawn.

In reaching these decisions, I have applied the established approach to the exercise of this discretion, as set out by the Court of Appeal in Ittihadieh at [110]. It is convenient to set out the 10 criteria listed (non-exhaustively) by the Court, adding paragraph numbering and omitting internal citations:

The main consideration here is the gravity of the allegations which Mr Bridle has seen fit to make about Dr Rudd, to persons and organisations with considerable power to influence or even terminate his professional career. It is just and convenient to enable him to learn as much as the DPA permits about the manner and circumstances in which that has been done. Dr Rudd’s aims are understandable and legitimate. He has served SARs in valid form. I believe that by the end of the trial it was acknowledged by the claimant’s side that documents could not be obtained; they sought no order for the disclosure or production of copy documents. I have found that the data controller has failed to comply with the statutory duty in several respects. I do not regard the deficiencies in compliance as trivial or unimportant. The further information I am ordering the data controller to disclose is significant, so it seems to me. I am not persuaded by Mr Fairbairn’s submission that this dispute could have been dealt with by the ICO. I reject any suggestion that the claim is abusive in nature, or that it has been pursued in an abusive manner. It remains to be decided whether the claim has been conducted in a disproportionate manner. But that, and the taking of bad or unreasonable points, are all matters that could be dealt with by an appropriate costs order, rather than the outright refusal of relief.

Mr Fairbairn’s other points against the exercise of discretion seem to me to be lightweight. It is true that Dr Rudd’s purposes do not include checking the accuracy of personal data, but that is far from being the only legitimate reason for wanting to know what another person “has on you”, in terms of personal data.

I decline, as a matter of jurisdiction and discretion, to grant the full relief sought by paragraph 5 of the claimant’s draft order. This seeks an order for service of a table of all the claimant’s expert reports held by the data controller, containing the names of the parties in the case, and the names of their solicitors, the date of the report and the name and company or organisation of the person who provided the report to the defendants. What I will do, if and to the extent that it is not already covered by the orders I have outlined above, is to order the provision of personal data relating to Dr Rudd which is contained in any such expert report, together with the date, and all information available to the data controller as to the source or sources of those personal data. I do not believe Dr Rudd is entitled to anything more.

I would have refused relief in relation to the purposes of the processing dealt with in the Revised Schedule, even if I was wrong on the issue of principle. I do not believe that any order I could make would achieve any useful purpose, or one commensurate with the significance of this deficiency, or the burden such an order would impose. I would also have refused to grant relief by way of disclosure of documents, as sought by the Amended Particulars of Claim and paragraph 11 of the Reply. As I say, I believe the quest for documents is over. But the contention in the Reply is that the Court has a discretion to require a data controller to produce documents, which should be exercised here “so that the Claimant has the full picture as to how his personal data has been misused, including to whom it has been disclosed.” The argument is unsound.

The Court can only enforce the statutory rights. It has no power to order the disclosure of anything other than a “copy” of the information contained in the personal data. That is not the same thing as the document containing the data: see above. There may, perhaps, be cases in which that is the only practicable way to provide personal data (cf IPSA v Information Commissioner and Leapman UKUT 0033 (ACC), 23 January 2014, [27] cited in the ICO’s guidance on the “right to recorded information and requests for documents”, p6, in the context of Freedom of Information Act). But if so, that must represent the outer limit of the Court’s power to order documentary disclosure under DPA s 7, and there is no reason to think that this is a case of that kind.

It remains to address the question of which of the defendants should be ordered to carry out those steps, as data controller. The issue is important for financial reasons. It may be important only for those reasons. In any case, I must address it on its merits.

It is inherent in the definition of ‘data controller’ ([15] above) that, in relation to any particular body or item of personal data, there may be more than one data controller. A data controller may be an individual or a corporation, a public authority or agency or other body. The key criterion, when considering any candidate for the role, is whether he, she, or it “determines the purposes for which and the manner in which any personal data are, or are to be processed …”

The Article 29 Working Party has elaborated, in its helpful “Opinion 1/2010 on the concepts of ‘controller’ and ‘processor’” (00264/10/EN-WP 169) (adopted on 16 February 2010). It points out that the concept of data controller has functional importance, being designed to allocate responsibility for compliance with the rights of data subjects, in a way that avoids undue reliance on formalities, and places responsibility

“where the factual influence is”, and “in such a way that compliance with data protection rules will be sufficiently ensured in practice”. The search is, therefore, for the person(s) who exercise practical control over the data, and can comply with any order the Court may make. These are questions of fact. The Working Party suggests a method:-

“… one should look at the specific processing operations in question and understand who determines them, by replying in a first stage to the questions "why is this processing taking place? Who initiated it?".

On the evidence in this case, the answer to the last question seems to me to be clear: Mr Bridle, the first defendant. He is also, in my view, the only individual who clearly fits the criteria I have identified, in relation to the personal data that are under consideration. Put shortly, at the material times he controlled what was being done with the data and why. In relation to some of the data there may be other individuals who fit the criteria for being data controllers. I refer in particular to those who have collaborated with Mr Bridle, or with whom he has collaborated, in preparing, collating, disseminating and/or receiving information to the effect that Dr Rudd is a fraudulent expert. But the defendants’ decision to maintain the anonymity of such individuals, and the limited amount of evidence and information so far disclosed, mean that I cannot tell. In any event, the possibility that other individuals may also count as data controllers in relation to some of the data in question does nothing to undermine the conclusion that Mr Bridle is a data controller.

The key parts of the evidence, for these purposes, are the following. First, the objects of the Company, incorporated in 2004, are to trade “as a general commercial company”. It carries on business in the provision of asbestos consultancy and asbestos surveys, which is how it derives its income. Examination of its accounts and records indicates that these are its only commercial operations. There is no documentation to suggest that the company is or ever has been in the business of providing expert or any advice to those litigating over asbestos-related injuries, for reward or otherwise. The company’s objects do not include campaigning in relation to asbestos-related issues, nor does the evidence suggest that the Company has derived any income from, or played any significant part in, such activities.

Secondly, Asbestos Watchdog is a name that has been in use separately from that of the Company, and indeed from before the Company existed. There was at one stage a limited company by the name Asbestos Watchdog Limited (“AWL”). On Mr Bridle’s own evidence, Asbestos Watchdog came into being in 2002, which is when AWL appears to have been formed. AWL ceased operations, and was dissolved, in 2010. During its life, AWL operated a website, funded by a third party, providing asbestos-related information to members of the public. This was not done as a commercial enterprise. The functions of AWL, as described by Mr Bridle, include dealing “mostly pro bono” with over 20,000 requests for help from property owners and businesses. It is Mr Bridle’s work in this context that led to the award of the Honorary Professorship, which he describes as “a useful accreditation to add some credibility to the advice we offered”. The “we” here is clearly a reference to Asbestos Watchdog/AWL.

Thirdly, Asbestos Watchdog has continued its operations since 2010 in a way that is almost entirely separate from and independent of those of the Company. The defendants’ case that, since the dissolution of AWL, the activities of Asbestos Watchdog have been carried on by the Company, as a branch of its activities, is not supported by the evidence. Indeed, much of the evidence is at odds with that case.

The clearest instance of this is the GMC Complaint. The SAR disclosures reveal that Mr Bridle proposed or entered into a plan or agreement that “I, as Asbestos Watchdog” should make such a complaint (examples of similar statements appear in [55] above). The original complaint letter used headed Asbestos Watchdog notepaper that contained no reference whatever to the Company. It did not identify Mr Bridle as a director, nor did it use any of the language associated with corporate bodies. Instead, Asbestos Watchdog was presented as an entity of uncertain status, led by Mr Bridle as its “Principal”, with consultants possessing expertise in toxicology and agricultural matters: see [26-28] above. Later email correspondence with the GMC was sent using the title “Prof Bridle” using the Asbestos Watchdog logo, and giving the web address www.asbestoswatchdog.com. An email of 26 November 2015 referred to an individual

In July 2016, Mr Bridle launched an appeal in his own name to the General Regulatory Chamber, complaining about the GMC decision, and a refusal of the ICO to assist. The ICO responded, describing Mr Bridle as someone who “identifies himself as an expert [who] runs a consultancy known as ‘Asbestos Watch UK’”. Mr Bridle did not quarrel with this account. In support of the appeal Mr Bridle submitted a skeleton argument, recording that he and his son were involved with:

“A family-run asbestos surveying and consultancy company who along with other volunteers and scientists formed the UK Asbestos Watchdog in 2002 … to offer free and impartial advice… We represent the interest of the UK public, employers, duty holders, taxpayers, insurance rate payers, and genuine asbestos victims.”

This document did not present Asbestos Watchdog as a trading name of the Company but as an unincorporated association, of which the Company was a member, carrying on representative activities in the public interest.

Some of the emails sent by Mr Bridle to the GMC in 2015 had a footer referring to the

One of the defendants’ principal contentions on this issue is that the Asbestos Watchdog website has, since 2011, had a section containing terms and conditions which “clearly shows that Asbestos Watchdog is a trading name of the Company”. This was the evidence of Mr Bridle. It has been shown to be untrue. A copy of the terms in force as at 2011 is in evidence, and shows only that the Company claimed to own the website. It was not until May 2018 that the website included the further and quite different claim that “Asbestos Watchdog is a trading style of J&S Bridle Associated Ltd…”. This, I am satisfied, is not the case. This was an arrangement deliberately designed to support and give colour to the case which by that stage the defendants were advancing in this litigation.

No other document has been identified that presents Asbestos Watchdog as a trading arm, or name or “style” of the company. None of the correspondence with the GMC or the GRC suggested that the Company was the complainant or appellant, prior to 25 January 2017. At that time this litigation was of course well under way. “Prof John Bridle” wrote to the GRC, seemingly in response to some “attendance information” sent in advance of the GRC’s decision. He wrote as “Principal Director” of the Company, professing to point out a “clerical error” with regard to the name of the appellant. He claimed that the appeal had been brought by him “in my capacity as Principal Director” of the Company. No previous or other reference to this novel title has been located. Mr Bridle asked that the “error” be officially noted and accepted by the parties involved. He candidly explained that it could have “serious implications for me personally” if private actions were taken against him rather than “the Company I was acting for”. His request was declined, but he was given an opportunity to pursue the matter with the Tribunal. Evidently, this was not done or if it was it failed. The decision dismissing the appeal, dated 27 February 2017, records Mr Bridle as the appellant and describes him as “an adviser to defendants in litigation relating to asbestos”.

I accept Mr Vassall-Adams’ submission that the activities of Asbestos Watchdog have been a “personal project” of Mr Bridle. Historically, the Asbestos Watchdog name has been used as a banner or label for activities that are, at least in the main, pro bono activities that do not involve any trading activities, and are separate from those of the Company. Initially, those activities were carried on by AWL, a separate corporate entity. Since 2010, Asbestos Watchdog has not had any corporate personality. If, in that period, Asbestos Watchdog has had any legal status other than an alias for Mr Bridle, when conducting non-commercial asbestos-related activity, it is in all probability that of an unincorporated association. In cross-examination, Mr Bridle accepted that Asbestos Watchdog could be described as a loose association of people coming together with a common interest. But Mr Bridle, its self-proclaimed “Principal”, has been the leading organisational and operational figure, controlling all relevant aspects of its operations.

I do not consider that these conclusions are undermined by the fact that Mr Bridle used his company email address or, on some occasions, signed off correspondence as a director. These are at best instances of Mr Bridle borrowing company facilities or characteristics, or lending his corporate role, to further the separate aims of Asbestos Watchdog. The position is similar when it comes to the fact that a single computer was used to record and hold the personal data that is at issue in this case, and the corporate data. The personal data with which I am concerned were not in reality being held by or dealt with by the company, or for the Company’s purposes, at the direction or under the control of Mr Bridle as a director of the Company. They were held, used and disclosed under the control of Mr Bridle acting in a different capacity, for purposes that were not aspects of the company’s commercial activity. Any connection with that activity was tangential and incidental. I do not believe that Mr Bridle can properly be regarded as controlling the data in his capacity as a director of the Company.

For the reasons given in this judgment there will be an order under DPA s 7(9), the details of which remain to be worked out, that Mr Bridle provide the further information I have outlined above. The defendants’ contention that the Company was and/or is the data controller having failed, no substantive remedies will be granted against the Company. The detail of the resulting order, and the costs consequences, will remain to be resolved.