Aven & Ors v Orbis Business Intelligence Ltd

This is a claim for the correction of the record and other remedies in relation to one component of the so-called “Steele Dossier”. That is the name that has been given to a set of memoranda produced by the defendant (“Orbis”) in 2016, on the instructions of a Washington DC consultancy. Orbis’ instructions were to provide intelligence memoranda concerning any links which might exist between Russia, its President, Vladimir Putin, and Donald Trump.

The claimants are three businessmen of Russian or Ukrainian origin. They are all among the ultimate beneficial owners of the Alfa Group Consortium (“Alfa Group”), a Russian financial-investment conglomerate which includes Alfa Bank JSC (“Alfa Bank”). (These are Anglicisations of the Russian, Альфа.Although Alfa Bank itself favours this spelling, the name sometimes appears in English as “Alpha”).

Orbis is an English company, incorporated in 2009, which holds itself out as providing strategic insight, intelligence and investigative services to clients around the world. Orbis was established by two British former public officials, Christopher Steele and Christopher Burrows. Mr Steele is a director and principal of Orbis, and in that capacity he was the main if not sole author of the “Steele Dossier”.

On 10 January 2017, BuzzFeed News published an online article headed “These

The Buzzfeed Article went on:-

“Now BuzzFeed News is publishing the full document so that Americans can make up their own minds about allegations about the president-elect that have circulated at the highest levels of the US government.”

Sixteen memoranda were made accessible via a link in the article. This is how the claimants came to know about “Memorandum 112”, a document contained in the Dossier, which made reference to the claimants.

Memorandum 112 is dated 14 September 2016. Its full title is “COMPANY INTELLIGENCE REPORT 2016/112 - RUSSIA/US PRESIDENTIAL ELECTION:

On 4 May 2018, the claimants began this action seeking remedies under the Data Protection Act 1998 (“the DPA”). The claimants’ case is that Orbis has acted in breach of its duties under s 4(4) of the DPA, in that Memorandum 112 contains personal data relating to the claimants, some of it sensitive personal data, which are inaccurate, contrary to the Fourth Data Protection Principle (“the Fourth Principle”), and which have been processed by Orbis in ways that are unfair, unlawful or otherwise non-compliant with the First Data Protection Principle (“the First Principle”). The claim form seeks four remedies: a declaration that the personal data are inaccurate; an order for blocking, erasure, destruction and rectification of the personal data; an order that the defendant inform those to whom it disclosed Memorandum 112 of the inaccuracies; and compensation.

Orbis denies liability. It has not disputed the applicability of the DPA to the activities that are the subject of the claim. It does not dispute that it processed information relating to the first and second claimants. But its case is that not all of the information in Memorandum 112 is personal data, and none of it relates to the third claimant; the personal data do not include any that are sensitive personal data; the data are not inaccurate; and there is no breach of the Fourth Principle. Orbis further maintains that its processing of the data complied with the First Principle. Further and alternatively, Orbis relies on provisions that exempt processing where the processing is necessary for the purpose of prospective legal proceedings, or obtaining legal advice, or establishing, exercising or defending legal rights (DPA s 35(2) (“the Legal Purposes

I heard evidence and argument over four days in March 2020. This was the week before the Prime Minister’s announcement on 23 March 2020 of what has become known as “lockdown” and the enactment, on 25 March 2020, of the Coronavirus Act 2020 and, on 26 March 2020, of the Health Protection (Coronavirus, Restrictions)

Each of the claimants made a witness statement, gave oral evidence and was crossexamined by Mr Millar QC, on behalf of Orbis. The claimants also relied on a written expert report from Eleonora Sergeeva, a partner in the Russian law firm of Padva and Partners, who specialises in criminal law relating to business offences, and anticorruption regulations. The only witness for Orbis was Mr Steele, who made three

Data protection has been part of our domestic legal landscape for over 20 years now. The regime with which I am concerned in this case is the one introduced by the Data Protection Directive (95/46/EC) and transposed into English law by the DPA, which came into force on 1 March 2000. This is complex and technical legislation which has been likened to a “thicket”, (Footnote: ¹) but the general principles have become familiar.

The provisions that are relevant for present purposes are to be found in Part I (ss 1, 2, 4, 13 and 14), Part IV (ss 27, 28, 35) and Part VI (s 70) of the DPA, and Schedules 1, 2 and 3. Their effect, so far as is relevant to this case, can be quite shortly summarised. It is convenient to do that before I come to the issues, and the more detailed examination of the law that is required in order to resolve them.

“Data” refers, in essence, to computerised information. “Personal data” is a broad term, covering most computerised information about an identifiable living individual (the “data subject”). “Processing” is a term that covers almost anything that can be done with personal data, including holding it and disclosing it to others. A person who determines how and why personal data are processed (a “data controller”) owes a statutory duty to the data subject, to ensure the processing complies with the Data Protection Principles. There are eight such principles. As will be clear already, only the First and Fourth Principles are material in this case.

The First Principle requires that the processing of all personal data should be fair, lawful and satisfy at least one condition in DPA Schedule 2. Some kinds of data are classed as “sensitive”. Processing of such data must also satisfy at least one Schedule 3 condition. The categories of sensitive personal data include information about a person’s actual or alleged criminality. The Fourth Principle requires data to be accurate, although – as will be seen – it can be enough that the data controller has taken reasonable care to ensure they accurately record what a third party has told the data controller.

The duty to process data in compliance with the Data Protection Principles is subject to a variety of exemptions, set out in DPA Part IV and subordinate legislation. One category of exemption, where it applies, ousts the Fourth Principle altogether, and ousts the First Principle “except to the extent to which it requires compliance with the conditions in Schedules 2 and 3”. The Legal Purposes Exemption belongs in this category. Other exemptions, where they apply, can oust all the Data Protection Principles. The National Security Exemption is one of these.

A data subject who suffers distress or damage as a result of a data controller’s contravention of the requirements of the DPA is entitled to recover compensation. But the DPA provides the Court with a range of additional or alternative remedies, including all those claimed by the claimants in this case, as mentioned in paragraph 8 above.

The disputes between the parties can be reduced to five main issues:

The majority of the claimants’ evidence went to the Accuracy Issue. Most of Mr Steele’s evidence-in-chief went to the Legal Purposes and National Security Issues. He also gave evidence, and was cross-examined quite extensively, in relation to the Accuracy Issue.

This is a matter that turns purely on the application of the law to the contents of Memorandum 112.

The claimants’ case is set out in paragraph 6 of the Particulars of Claim. This identifies five propositions as “personal data of which the claimants are the data subjects”, contained in Memorandum 112:

Orbis accepts that Memorandum 112 contains information to the effect set out in paragraphs (b), (c), (d) and (e) above, which is “to varying extents” the personal data of the first and/or second claimants. There are two points of dispute:

It will be clear that the claimants’ proposition (a) reflects the wording of the second sentence of the Summary of Memorandum 112, and the third sentence of numbered paragraph 1 of the “Details” section. But it goes beyond the literal meaning of those sentences, which do not mention any of the claimants by name. The claimants’ case is that proposition (a) reflects the natural and ordinary meaning of the words used, in their context within numbered paragraph 1 of the Memorandum, and the document as a whole. Any ordinary reader of the words, in their context, would understand them to refer to the three individuals identified by name as the leaders of the Alfa Group, and to mean that the significant favours were being done by and for those individuals.

Orbis contends that this approach is wrong in principle. Mr Millar points out that this is not a defamation case, but a claim brought under the DPA. In that context, he submits, one needs to focus on the items of information – and specifically, the items of data – rather than on documents in the round. In Memorandum 112, Mr Steele clearly distinguishes who he is talking about in each paragraph and each sentence. Each item of information must be assessed discretely by reference to the definition of “personal data” in DPA s 1(1). For that purpose, information about an individual must be distinguished from information about a company, which is not personal data: see Smith v Lloyds TSB [2005] EWHC 246 (Ch) [32]. An individual can only show that information is his personal data if he is identifiable from the sentence in question, and it “relates to” him in the sense explained by the Court of Appeal in Durant v Financial Services Authority [2003] EWCA Civ 1746 [2004] FSR 28 [28] (Auld LJ) and Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd [2017] EWCA Civ 121 [2018] QB 256 [61-66] (Lewison LJ).

Assessed in this way, it is submitted, the passages in Memorandum 112 that refer to “significant favours” contain no personal data about any of the claimants. They contain information about Alfa Group, a corporate entity, and are “plainly not a reference to any living individual”. The claimants are not identifiable from the sentences in question, and even if they were that would not be enough to make the information personal data that “relates to them”. As the claimants’ other propositions all refer to the first and/or second claimants only, it follows that Orbis’ case is that the Memorandum contains no personal data of the third claimant.

The outcome of this aspect of the case turns on the right approach to the ascertainment of whether information contains the personal data of an individual. The rival approaches contended for can be broadly characterised as holistic and atomised. In my judgment, the holistic approach is consistent with principle and authority, and the right approach to the facts of this case.

It is fair for Mr Millar to submit that the claim is one that calls for the faithful interpretation and application of a statutory code (construed in the light of the Directive). But the statutory definition of personal data, on which he relies, does not provide the answer to the question. I quote the relevant parts of s 1(1):

“data” means information which –

(a)

is being processed by means of equipment operating automatically in response to instructions given for that purpose

…

“personal data” means data which relate to a living individual who can be identified— (a) from those data, or

(b)

from those data and other information which is in the

possession of, or is likely to come into the possession of, the data controller

…

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;”

This wording identifies some criteria, such as “relate to”, and “can be identified from …”, but it contains nothing that assists on the question of how to approach the identification of the “data” to which those criteria are to be applied. It certainly does not demonstrate or indicate that where a claimant complains of a document, an itemby-item approach to the contents of that document must be adopted. In those circumstances, the Court must look to the DPA and Directive as a whole for guidance, and may also look to extraneous sources for approaches that have been adopted in other, related contexts. That is what I did when a similar issue arose in the “delisting” case, NT1 v Google LLC [2018] EWHC 799 (QB) [2019] QB 344. The claimant sought an order requiring the defendant to remove from search results returned by using the claimant’s name information contained in newspaper articles and book extracts about an old, rehabilitated criminal conviction. One aspect of the claimant’s case was that the information was inaccurate, contrary to the Fourth Principle. Mr Tomlinson QC, appearing for the claimant, initially argued that for this purpose that the Court should look, not at the natural and ordinary meaning of a document, but rather at each discrete “item of information”. He moved away from that position in the course of the trial, and I rejected it.

I concluded that the right approach was to look at the articles and book extracts as a whole, and interpret any element of them by reference to the meaning that the ordinary reader would take from that element, read in its full context. My reasons were set out in detail at [80-84]. It is unnecessary to set them out here. In summary I concluded, and it remains my view, that support for this approach can be found in aspects of the DPA itself, the work of the Article 29 Working Party, domestic authority on the application of the DPA and its predecessor (the Act of 1984), and the logic and common sense to be found in the law of meaning in defamation.

Another, overarching, factor that counts in favour of this approach is the overall purpose of data protection law, namely to give practical effect to the fundamental right of individual privacy guaranteed by Article 8 of the European Convention on Human Rights: see Article 1.1 of the Directive. As Judge Jacobs observed in Farrand v Information Commissioner & Anor [2014] UKUT 310 (AAC) [18]:

“To ignore context would render the legislation ineffective in numerous circumstances to which it is clearly intended to apply, thereby reducing its effectiveness”.

There may be cases involving data sets of a more abstract or more granular kind, where the question of whether the set contains the claimant’s personal data calls for an individualised assessment of each constituent element, read in isolation from other components of the data set. I do not believe that would be inconsistent with the principles I have identified. On the contrary, it would be an application of those principles; it is always necessary to identify what is and is not the proper context for any given statement or item of data. At any rate, I am satisfied that what I have called the holistic approach should be applied to Memorandum 112. The document is a report, not a bare list of separate and discrete propositions. It is a coherent narrative, concerning relationships between Alfa Group and its principals, Mr Putin, and others. It would be artificial to read any individual sentence in isolation from the remainder of the document.

Applying that approach, I find that Memorandum 112 did contain the information in claimants’ proposition (a). The claimants are plainly identifiable from Memorandum 112; they are named. Any ordinary reasonable reader of the Memorandum would understand the statements about the giving and receipt of “significant favours” as referring not only to Alfa Group but also to the three individual claimants. That would be the result of reading the whole document, which an ordinary reader would do; but in order to explain this conclusion, it is not necessary to look beyond the immediate context of the words in numbered paragraph 1. The two immediately preceding sentences identify the claimants by name as leaders of the Alfa Group, and assert that they are on “very good terms” with Putin. The reader of the sentence that follows would naturally take its reference to favours being done “in both directions” as a statement that Putin does favours for the claimants, and they for him. The mention of Alfa at the end of the third sentence would be read as synonymous with the claimants. In my judgment, further, the information is personal data within the meaning of DPA s 1.

The cases relied on by Orbis – Durant, Smith v Lloyds, and Ittihadieh – are consistent with these conclusions. Those cases are authority for the proposition that not all data that refer to an individual necessarily “relate to” him or her within the meaning of DPA s 1(1). In particular, whether information comprises personal data depends on where it falls in a continuum of relevance or proximity to the data subject; and for that purpose it is relevant to consider whether the information is biographical in a significant sense, whether it has the data subject as its focus, and whether it affects his privacy (whether in a personal, business or professional capacity). These propositions have been developed to guide those confronted with claims based on the notion that all information in any document that makes mention of an individual is that individual’s personal data. They are of scant relevance here. The information in the claimants’ proposition (a) is not merely incidental to a report on some larger or separate and distinct topic, about some other person or organisation. The claimants’ behaviour, and their relationships with Mr Putin, are the subject-matter and theme of the Memorandum. This particular information in proposition (a) is focused on them, biographically significant, and impinges on their privacy, albeit in a business context.

“Illicit cash”

It is agreed that the Memorandum conveyed the information in the claimants’ proposition (d). The claimants’ case is that this information contains an allegation of criminal behaviour that falls within the meaning of DPA s 2(g). That defines “sensitive personal data” to include:

“… personal data consisting of information as to -

…

(g)

the commission or alleged commission by [the data subject] of any offence.”

As is common ground, whether information falls within DPA s 2(g) is a question of fact to be resolved in the light of the circumstances of the case, having regard to the immediate context of the information: Information Commissioner v Colenso-Dunne [2015] UKUT 471 (AAC) [37], [46].

In this case, the issue has become complicated by a request for further information about the nature of the offence relied on, the provision of such information and the introduction of expert evidence. I outlined the history in a judgment given at the PreTrial Review, debarring the defendant from adducing an expert report in response:

Mr Tomlinson’s main submission is that an allegation that the claimants committed a criminal offence flows by “obvious and inevitable implication” from the statement in numbered paragraph 2 of the Memorandum that “large amounts of illicit cash” had been passed to a public official by Govorun, acting as the first and second claimants’ driver and bag carrier. The term “illicit” is emphasised by its appearance in the second bullet point in the Summary. The word means improper, irregular or unlawful. It is not necessary, he submits, to specify the criminal offence, giving chapter and verse. In this regard he relies on Gray J’s decision in Lord Ashcroft v Attorney-General [2002] EWHC 1122 (QB), that reference to the claimant’s “laundry arrangements” could be understood as a reference to the offence of money laundering. On the face of it, however, the illicit funds were being paid to a public official, thus indicating bribery. The implication of criminality is bolstered, submits Mr Tomlinson, by the use of quotation marks around the terms used to describe Govorun’s role, suggesting that they are being used euphemistically, and by the context. Mr Tomlinson relies on references in paragraphs 2 and 3 to the “continuing sensitivity” of the Alfa-Putin relationship and “kompromat” on Putin and his “corrupt business activities from the 1990s” held by Alfa.

Mr Millar adopts some observations of mine at [38-39] of the PTR judgment mentioned above, where I commented that the issue is what information, allegation, statement or imputation was conveyed by the Memorandum, and – first of all - “what conduct did the relevant part of Memorandum 112 attribute to the first and second claimants, by what it said about the use of Govorun to convey ‘illicit cash’ to Mr Putin?”. That question must be answered on the basis of the Memorandum alone, as the claimants have not pleaded any extraneous contextual material. Reliance on the expert report of Ms Sergeeva is therefore misplaced. On the face of the Memorandum 112, no clear allegation of criminality can be discerned. Lord Ashcroft v Attorney General, which decided only that it was arguable that an express reference to “laundry arrangements” contained an insinuation of money laundering. This case is not comparable. The reference to “illicit cash” in the Memorandum means no more than cash that was in some way furtive or secret. There may be an implication of some moral judgment, at least by Western standards, but that is not enough to impute the commission of a criminal offence.

The debate about Ms Sergeeva’s evidence, and the contention it goes to support, are further aspects of the argument which contain echoes from defamation law. In slander, it is occasionally necessary to consider what if any criminal offence is imputed by the words complained of. That is because words that impute the commission of a criminal offence for which a person can be imprisoned are one of the exceptions to the general rule that spoken words are actionable as slander only if they cause special damage. Claimants relying on this rule may need to identify a specific offence that is expressly or impliedly imputed by the words complained of: see my discussion of this exception in Umeyor v Ibe [2016] EWHC 862 (QB) [71-77].

In this instance, however, any attempt to read across from defamation would clearly be misleading. In the slander context the reason, or at least the main reason, why a claimant may need to identify a specific offence imputed by the words complained of is to show that it carries a sentence of imprisonment. That is an artificial and, to some extent, arbitrary requirement, but it would seem to follow from a legal policy of establishing some threshold of seriousness. In the absence of any similar restriction in data protection law (and without any rationale for introducing one) it would be artificial and wrong to apply any similar rule.

In my judgment, this issue must be determined by considering only the text of Memorandum 112, identifying the relevant information conveyed by that text, isolating the conduct imputed to the claimants, and deciding whether ordinary readers would conclude that such conduct was prohibited by the criminal law. A claimant relying on s 2(g) may reasonably be asked to identify the conduct he says the words impute to him such as, in this case, the payment of a bribe. But to go further and ask for particularisation of the applicable provisions of the criminal law is to go too far. To this extent, the defendant’s request for information and/or the pleaded response and the introduction of evidence to support it were uncalled for.

The substance of the information is an agreed fact, and the passages of the Memorandum which convey that information are easily identified. In my judgment, the information comprised in the claimants’ proposition (d) is “information as to the commission or alleged commission by [the first and second claimants] of a criminal offence” within the meaning of DPA, s 2(g). I am satisfied that the ordinary reader would understand the suggestion to be one of criminal behaviour on the part of the first two claimants.

I believe that some readers would take the suggestion to be one of bribery, but there is another interpretation. And, if a single meaning has to be attributed to the relevant words, I would not find that the crime implied is bribery. Rather it is one of dealing with the proceeds of corruption, a species of money laundering. That is because the key imputation is one of delivering “illicit cash” via a courier, Govorun, whose true role was disguised. The use of quotation marks around the words “driver” and “bag carrier” suggests these are not Govorun’s real functions but fronts. It suggests conduct that was “furtive” or “secretive”. But those are not connotations of the word “illicit”. That is an adjective that qualifies the noun “cash”, suggesting it has an unlawful or otherwise illegitimate origin. (As it happens, a newspaper report published as I was preparing this judgment supports the point. It referred to HMRC’s new “powers to crack down on illicit finance” by using “account freezing orders” to “block … suspicious funds.”) The use of illicit cash is not a defining feature of bribery, which can be undertaken with “clean” funds.

The Memorandum states that Govorun was delivering the cash to Putin “during the

1990s”. Numbered paragraph 3 tells the reader that in the 1990s Putin was engaged in

“corrupt activities”, to the knowledge of the first and second claimants. The information conveyed by the relevant passages of the Memorandum is, in my judgment, that the claimants were using Govorun, acting under cover of the role of “driver” and “bag carrier”, as a courier to deliver directly to Putin large amounts of cash which was the proceeds of corruption.

I have heard no argument on whether the qualities to be attributed to the reader when deciding this issue are those of readers in this jurisdiction, or those of some other jurisdiction or jurisdictions. Nor do I have any evidence going to that issue. I do not believe it matters, given the nature of the candidate crimes. One would expect an ordinary reader in any civilised country to consider dealing with the proceeds of crime and bribing a public official to be prohibited by the criminal law.

Before addressing the issues arising from the defendant’s reliance on the Legal Purposes and National Security Exemptions, I need to say more about the origins of the Steele Dossier, and what was done with Memorandum 112. The essential points can be identified quite shortly.

In January 2010, at an early stage of its existence, Orbis entered into a relationship with a journalist, Glenn Simpson. Mr Simpson was one of three journalists who founded Fusion GPS (“Fusion”), a consultancy based in Washington DC, to provide research and strategic intelligence services. Mr Simpson signed a Confidentiality Agreement dated 27 January 2010 by which he formally undertook (among other things) that

“during and after the termination of my work with [Orbis] I may not disclose any trade secrets or other information of a confidential nature … relating to the company or its business … except in the proper course of my work hereunder or as required by law.”

Orbis worked with Fusion on a handful of occasions between 2010 and 2016. Sometimes, Orbis would engage Fusion, and on other occasions Fusion would engage Orbis.

In about late May 2016, Mr Simpson, on behalf of Fusion, contacted Mr Steele with instructions to investigate Donald Trump and his alleged links with Russia and Russian officials, specifically President Putin. Mr Trump was then the presumptive Republican candidate for the Presidency. Fusion was acting on the instructions of a Washington DC law firm called Perkins Coie, which in turn was acting on the instructions of one or more persons or bodies at the top of the Democratic Party (“the Ultimate Client”).

Pursuant to Fusion’s instructions, between June 2016 and the Presidential Election on 8 November 2016, Orbis produced the 16 memoranda that were eventually published in the Buzzfeed Article. The first memorandum was dated 20 June 2016. Four more were prepared in July, four in August, three in September, and four in October 2016.

Orbis, through Mr Steele, admit or maintain that they made or authorised disclosures of memoranda from the Steele Dossier on the following occasions:

At some point between late November 2016 and 10 January 2017, Mr Kramer gave Buzzfeed access to the Steele Dossier, thereby causing or contributing to the publication of the Buzzfeed Article.

In December 2016, Mr Kramer asked Mr Steele to agree to him discussing the Steele Dossier with a senior US national security official, Celeste Wallander. Mr Steele maintains that he did not give or withhold consent, but in any event did not authorise the disclosure of Memorandum 112 by Mr Kramer to Ms Wallander. That has not been challenged, so I do not need to address any disclosure that may have been made by Mr Kramer to Ms Wallander.

Orbis has given a collective label to four disclosures of Memorandum 112: Mr

Orbis accepts responsibility for the Fusion Disclosure and the National Security Disclosures. The only issue in dispute about those disclosures is whether Orbis did in fact disclose Memorandum 112 to the FBI in September 2016.

Orbis denies responsibility for any other disclosures, or any other processing activities of other controllers. That includes any disclosures to or publications by Buzzfeed, or other media organisations, which Orbis maintains are the responsibility of the media or of other individuals.

In his opening submissions, in cross-examination, and in his argument on remedies, Mr Tomlinson raised the question of whether Orbis was responsible for disclosures of Memorandum 112 made by Mr Kramer to the Washington Post and to Buzzfeed, and thereby responsible for media publication of the personal data in Memorandum 112. In cross-examination, Mr Tomlinson showed Mr Steele the transcript of Mr Kramer’s deposition on 13 December 2017 in Gubarev v Buzzfeed Inc., a case brought in the US District Court for the Southern District of Florida. Mr Kramer gave evidence, in those proceedings, that Mr Steele knew that Mr Kramer was going to provide a copy of Memorandum 112 to the Washington Post. As for Buzzfeed, Mr Tomlinson secured an admission that Mr Steele had put Mr Kramer in touch with Ken Bensinger of Buzzfeed. He put it to Mr Steele that he did that when he knew, or should at least

I was a little surprised by this aspect of the claimants’ case, as I had not detected any clear averment to this effect in the Particulars of Claim. There is mention there of disclosure to “third parties” including “the media” but no details, and no allegation that Orbis disclosed to Buzzfeed, or the Washington Post, or that it caused or authorised any such disclosure. The Particulars of Claim state that details of the identity of the recipients of Memorandum 112, other than Fusion, would be added after disclosure and/or the provision of further information by Orbis. But this was never done. Nor am I aware that any notice was given of an intention to rely on the Kramer transcript as hearsay evidence at the trial. In any event, the claimants have not persuaded me that any disclosures of Memorandum 112 by Mr Kramer represented the processing of data by or on behalf of Orbis.

Mr Steele admits briefing journalists about Orbis’ work, and the documentary evidence and cross-examination make it clear that, in and after late September 2016 he was heavily and enthusiastically involved in doing so. His explanation is that he wished to make known what he regarded as “wholescale Russian US election interference project”. But oral disclosures are not caught by the DPA: Scott v LGBT Foundation [2020] EWHC 483 (QB) [55] (Saini J). And encouraging the media to report on a story, and giving them background information about it, are not the same thing as providing or authorising the provision of documents for that purpose. The high point of this aspect of the claimants’ case would seem to be an article in Mother Jones dated 31 October 2016, for which Mr Steele has admitted he was a source. That article states that the authors have reviewed some of the Orbis reports, and appears to quote from them. The OIG report corroborates this, suggesting that a Mother Jones journalist provided one of Mr Steele’s reports to the FBI (footnote 259). Crossexamined, however, Mr Steele insisted that he had not given or read any of his reports to Mother Jones. He has been clear and consistent in his denials that he provided any journalist with a copy of Memorandum 112, or any other part of the Dossier, or authorised others to do so. In paragraph 57 of his revised first witness statement he said he did not disclose or discuss the content of Memorandum 112 with the media, and did not intend, authorise or envisage that the Memorandum “and the information it contains about the First and Second Claimants” would become more widely disseminated. In paragraph 58 he specifically denied giving permission for the provision of a copy of the Dossier to Ken Bensinger. That was not directly challenged.

The deposition of Mr Kramer is not a satisfactory basis for an invitation to reject Mr Steele’s evidence and find Orbis liable for disclosure and publication of Memorandum 112 made by others. Besides the procedural shortcomings I have identified, the deposition is provided to me shorn of its context. I am told nothing else about the Gubarev v Buzzfeed litigation, and very little about Mr Kramer except that (as is obvious) he had a clear motive for tailoring his evidence. In any event, knowledge that a person intends to make a disclosure is not enough to bring home liability. And the substance of Mr Kramer’s evidence, so far as Buzzfeed is concerned, is this. Mr Steele asked him to meet Mr Bensinger, but without asking him to provide a copy of the Dossier; Mr Kramer did not provide Mr Bensinger with a copy, but left him in a room with the memos for 20-30 minutes, on the agreed basis

On the basis of this evidence, I see no room for concluding that Mr Kramer made a disclosure to the Washington Post or Buzzfeed of the personal data contained in Memorandum 112 which amounted to processing of those data by or on behalf of Orbis, still less that the publication of those data by the Washington Post and Buzzfeed represented, or even resulted from, processing by or on behalf of Orbis. A data controller is responsible for persons who process data on his behalf (Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd (Information Comr intervening) [2017] EWCA Civ 121 [2018] QB 256 [70] (Lewison LJ)), but not for processing carried out by independent actors to whom the data controller has transferred a copy of the data (Various Claimants v Wm Morrison Supermarkets plc [2017] EWHC 3113 (QB) [2019] QB [47] (Langstaff J)).

It follows that the disclosures to be considered are the Fusion Disclosure and the National Security Disclosures.

This issue relates only to the Fusion Disclosure. But I use that term to cover the compilation of the disputed information and its inclusion in Memorandum 112. It was not really controversial, and I accept that, for the purposes of this issue at least, the steps of acquisition, compilation, drafting, and disclosure of the information in question should be treated as a single interconnected act of processing.

DPA s 35(2) provides that:

“Personal data are exempt from the non-disclosure provisions where the disclosure is necessary—

(a)

for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), or

(b)

for the purpose of obtaining legal advice, or is otherwise necessary for the purposes of establishing, exercising or defending legal rights.”

“The non-disclosure provisions” is a term defined exhaustively in s 27(3) and (4) as follows:-

“(3)

In this Part “the non-disclosure provisions” means the provisions specified in subsection (4) to the extent to

which they are inconsistent with the disclosure in question.

(4)

The provisions referred to in sub-section (3) are -

(a)

the first data protection principle, except to the extent to which it requires compliance with the conditions in Schedules 2 and 3,

(b)

the second, third, fourth and fifth data protection principles, and

(c)

sections 10 and 14(1) to (3).”

Five uncontroversial points can be made about the Legal Purposes Exemption.

In order to assess whether it would be “inconsistent with” the Fusion Disclosures to apply the Fourth Principle, or the First Principle’s requirements of fairness and lawfulness, it is relevant, if not essential, to consider what the impact of those provisions would be.

The relevant provisions are located in DPA Schedule 1 Part II, which contains provisions as to the interpretation of the Data Protection Principles. Paragraph 2 contains these provisions about the First Principle, which I shall call “the Notice

Paragraph 2(2) also requires notification of the information in paragraph 2(3) within “a reasonable period”. This is either the time at which the data is first processed or when disclosure is first made to a third party.

The Fourth Principle, so far as relevant, states simply that “Personal data shall be accurate ….”. DPA s 70(2) contains a "supplementary definition" which explains that

“For the purposes of this Act, data are inaccurate if they are incorrect or misleading as to any matter of fact.”

It is implicit in this wording that information may be “accurate” or “correct”, and yet misleading. These provisions, as any lawyer would swiftly appreciate, beg the question of what exactly is the information contained in the data or, putting it another way, what the data mean. I have discussed this issue already, in reaching my decision on the scope and content of the personal data.

There is a distinction, familiar to media and communications lawyers, between the literal meaning of a statement and a meaning that may be implied rather than spelled out, and will often be more serious. Any court tasked with deciding whether personal

This may save the data controller from having to pay compensation for breach of the Fourth Principle. But, even if paragraph 7 applies, the Court has power to grant remedies in relation to personal data that it finds to be inaccurate. These include orders that the data controller rectify, block, erase or destroy the data and (where it considers it reasonably practicable) an order that the data controller inform third parties that this has been done. Those are consequences of DPA s 14(1)-(3), and remedies under those provisions can be granted even if there is no finding that the processing has been carried out in breach of the Fourth Principle: see NT1 v Google [85-86].

These remedies are governed by s 14. They are available in a case where the data subject establishes (a) a right to compensation for breach of any of the requirements of the DPA and (b) a substantial risk of further contravention in respect of those data in such circumstances: see s 14(4) and (5). But the Legal Purposes Exemption is only available in respect of s 14 (1)-(3), which are concerned only with inaccuracy. Those subsections provide as follows: -

“(1)

If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data.

(2)

Subsection (1) applies whether or not the data accurately record information received or obtained by the data controller from the data subject or a third party but where the data accurately record such information, then—

(a)

if the requirements mentioned in paragraph 7 of Part II of

Schedule 1 have been complied with, the court may, instead

of making an order under subsection (1), make an order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve, and

(b)

if all or any of those requirements have not been complied with, the court may, instead of making an order under that subsection, make such order as it thinks fit for securing compliance with those requirements with or without a further order requiring the data to be supplemented by such a statement as is mentioned in paragraph (a).

(3)

Where the court—

(a)

makes an order under subsection (1), or

(b)

is satisfied on the application of a data subject that personal data of which he was the data subject and which have been rectified, blocked, erased or destroyed were inaccurate,

it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.”

Orbis’ case is that the creation of Memorandum 112, and the Fusion Disclosure which followed, were necessary, in the sense I have identified, for the carrying out of instructions Orbis received from Fusion, at the instigation of Perkins Coie, shortly after 29 July 2016. The purpose of those instructions, it is said, was

“to facilitate an understanding of the extent to which Alfa worked with President Putin, given concerns about (i) potential interference by the Russian state in the US Presidential election process and (ii) suspected communications between the servers of Alfa Bank and Trump Tower.”

It is submitted that Mr Steele understood that the intelligence he gathered would be used to advise the Ultimate Client on the prospect of legal proceedings and, if necessary, deployed in such proceedings to challenge the eventual outcome of the Presidential Election. Orbis’ instructions, and thus the Fusion Disclosure, were reasonably necessary to enable such advice to be given and for decisions to be made about the legal implications of those matters and/or to assist the Ultimate Client with those implications. Specifically, it is said that the Fusion Disclosure was necessary as a step towards establishing whether any rights under electoral law might flow from the matters recorded in the memoranda. That brings the case within the concept of “establishing legal rights” in s 35(2).

This has the following consequences, submits Mr Millar:-

Mr Tomlinson argues that the defendants have failed to show (a) that the claimants’ personal data was processed for any of the specified purposes, (b) that, if it was, such processing was “necessary” for such purposes, or (c) that, if it was, compliance with the Fourth Principle would be inconsistent with those purposes. It is said that Orbis’ submissions are based on a legal misconception, have no evidential foundation, and are at odds with the evidence as a whole.

Mr Tomlinson makes the following main points: -

My first task is to consider the period of about 3 ½ months between Orbis’ instructions and the Fusion Disclosure, to identify the purpose or purposes for which Memorandum 112 was created and disclosed to Fusion. Mr Tomlinson is right to say that the answer does not depend on any beliefs or “assumptions” of Mr Steele. Nor is the answer dictated by the fact that Fusion were instructed by a law firm. But the process does involve drawing inferences from facts that are agreed, and other evidence that I accept.

A purpose is an aim or goal or end in view, or the reason why something is done. In the light of Counsel’s submissions, I need to make an assessment of the purposes of different participants in the process.

This task faces some obstacles. There were a number of participants who were directly involved, and could have shed light on the questions for determination, but I have evidence from only one of them: Mr Steele. He has given two very different versions of events, which are mutually inconsistent in a number of respects. This was, on any view, an intelligence-gathering exercise, inherently unlikely to be heavily documented. Mr Steele kept few records, and most of these he did keep have been lost or destroyed. One contemporaneous record of relevance has survived: the FBI Note, recording the substance of a meeting on 5 July 2016. But this only helps with some relatively minor aspects of the story. There is little other documentation that throws any light on the facts. Much of what there is consists of press cuttings, from several months after the events to which they relate, containing hearsay from anonymous or unidentified sources. Against that background I take a cautious approach, but find the following relevant facts.

Orbis’ engagement by Fusion was first mooted at a meeting between Mr Simpson and

Mr Steele’s evidence is that he now believes the Ultimate Client was the Democratic National Committee. Mr Millar submits that the Ultimate Client was the Clinton election campaign, “Hillary for America”. This is in line with the FBI Note of 5 July 2016, which records Mr Steele telling the FBI that Orbis had been instructed by Mr Simpson of Fusion and “Democratic Party Associates” but that “the ultimate client were (sic) the leadership of the Clinton presidential campaign”. The FBI Note also indicates that Mr Steele had been told by that stage that Mrs Clinton herself was aware of what Orbis had been commissioned to do.

I have little reliable evidence as to who exactly was the Ultimate Client, but I have enough to find that Perkins Coie were instructed by one or more people or organisations within the upper echelons of the Democratic Party, concerned to ensure Hillary Clinton’s election as President. I also find that Mr Steele knew this much from early June 2016, at least. I do not believe it is necessary, or relevant, to go further. I shall continue to refer to the Ultimate Client, without identifying who they were.

It would be naïve and unreal to suppose that the Ultimate Client, when instructing Perkins Coie, did not have political aims. The role and position of the Ultimate Client, the relationship in which that client stood to Mr Trump, and the nature of the instructions, make it obvious that they did. But it does not follow that there was no legal purpose. In my judgment, on the evidence before me at this trial, there was one, and it applied to the commissioning of the Dossier as a whole, including the creation and delivery of Memorandum 112. The purpose was obtaining legal advice.

The Ultimate Client’s instructions were not given to Orbis or to Fusion. They were given to a law firm, and passed on by that firm to the investigative organisations. The plan from the outset was that the output of the investigative activities that Perkins Coie commissioned would then (to use Mr Steele’s words) be “fed back” to the law firm. This raises the question of why a law firm was involved at all. In crossexamination, Mr Tomlinson put it to Mr Steele that Perkins Coie were effectively the

“legal arm” of the Democratic Party. He accepted that, but I cannot give any real weight to this rather vague proposition. Nor can I uphold the further proposition about the firm that was put by Mr Tomlinson to Mr Steele:

“they instruct investigators to obtain material about political opponents in a privileged setting so it can then be used for campaigning by the Democratic Party”.

There is no evidence before me that could sustain that suggestion.

My conclusion is that Perkins Coie were approached by the Ultimate Client and given the instructions they were with a view to obtaining information for the purpose (though not the exclusive purpose) of taking legal advice on its legal implications and what, if any, legal steps could be taken as a result. On the balance of probabilities, Perkins Coie’s sole or dominant purpose in commissioning the Dossier was to obtain information for the purpose of providing legal advice. These are not mere assumptions nor are they speculation, as suggested by Mr Tomlinson. They are reasonable inferences from the fact that a law firm was instructed at all, and from such of the evidence as I accept about the nature of the firm, its dealings with Fusion and Orbis, and the individual lawyers who were involved.

These findings represent an acceptance of evidence given by Mr Steele in his second witness statement dated 15 March 2020, and on oath at the trial. They mean that the account given in first witness statement was significantly mistaken. That statement said that Mr Steele had one meeting with the lawyers in late July, then another which took place on 11 September 2016, which is when he was instructed to produce Memorandum 112. This is a big change of story, and that obviously casts doubt on the revised account. The new account comes several years after the events.

I have given careful thought to this, but I accept Mr Steele’s revised account. It is coherent, more probable than the original one, and there is an explanation, supported by documents. Mr Steele says that when preparing to give evidence he was prompted to reconsider his original account by noting something in the December 2019 Report of the Office of the Inspector General (“OIG”). This recorded that Mr Steele had met a Department of Justice official on 23 September 2016. Examination of his passport shows that he entered the USA on 29 July and 21 September 2016. A credit card statement shows he flew out of London on 21 September, and on 24 September paid for a stay at the Hilton Hotel in Washington DC. All this was at odds with a meeting on 11 September.

As for the late July meeting, I have taken account of Mr Tomlinson’s challenge to the suggestion that Perkins Coie briefed Mr Steele on suspicious server activity at that time. Mr Tomlinson relied on two media articles, one by Franklin Foer in Slate, dated

As for the prospect of taking legal action, Mr Tomlinson is right: there is no evidence of any legal action being taken, or of any thought being given to it, or as to what might have been done, legally. I can however draw inferences. My conclusion is that the possibility of litigation may well have been in the minds of the Ultimate Client and Perkins Coie at the outset, in the sense that it would have been devoutly hoped for, and would have been pursued if favourable advice had been given. By the time of the election, I infer that any thought of litigation had been abandoned. It is likely that this came about much earlier, by the time of the media briefings in which Mr Steele was involved, in late September. By that time political purposes had come very much to the fore. As Mr Millar reminded me, it would be dangerous to read purposes back from the period of the pre-election media campaign to the position at and before the time of the Fusion Disclosure. But I cannot find that litigation was at any time up to the delivery of Memorandum 112 anything more than a speculative, remote and unlikely prospect.

I have dealt with the purposes of the Ultimate Client and Perkins Coie. What of Fusion and, most importantly, Orbis? They knew the information would be passed to Perkins Coie, and they knew or believed that Perkins Coie would use it for legal purposes. But at least in a narrow sense, Mr Tomlinson is right: their purposes were to perform the tasks they had been engaged to undertake: to collect and report back on intelligence from sources on Trump-Russia issues and interference in the US Presidential campaign. They were not interested in obtaining legal advice, or establishing legal rights.

In the light of the findings I have made there are four main questions to consider: (1) whose purpose matters, (2) what if a legal purpose is accompanied by another, (3) what is the scope of “establishing legal rights”, in this context, and (4) is a disclosure made “for the purposes of or in connection with … prospective legal proceedings” within s 35(2)(a), if the prospect of any such proceedings is remote and unlikely?

Different parties concerned with a disclosure may have different aims in view, and different motives. In my judgment it is too narrow to say that it is only the data controller’s purpose that matters, for the purposes of s 35(2).

In my judgment, if a lawyer obtains information with the aim of using it for the purpose of formulating legal advice to a client on a matter within the scope of the lawyer’s instructions, the disclosure of that information to the lawyer is made for the purpose of obtaining such advice.

Turning to the second question, the argument proceeded largely on the unstated twin assumptions that (in this context at least) a disclosure of data can only have one purpose or, at any rate, that the Fusion Disclosure had only one, and the task is to search for and identify that single purpose. I am not convinced that either assumption is correct. They do not reflect the ordinary experience of life or the experience of the law. As everyone knows, actions are often undertaken for more than one reason, and with more than one aim in view. This is a well-known feature of politics. It is also reflected in the established English law on legal professional privilege, which is conferred on a communication only where its “dominant purpose” is pending or contemplated litigation or obtaining legal advice.

Section 35(2) speaks of a disclosure for “the purpose of … legal proceedings” and “the purpose of obtaining legal advice”, using the singular. The wording is not dictated by the Directive, which permits but does not prescribe this exemption or define its scope. So, it seems to me that the words of s 35(2) must be given their ordinary meaning. I see no reason to read in the word “dominant” (which comes from a different legal context) or any similar qualifier. There seem to be two candidate interpretations: either the exemption is available only if the legal purpose is the sole purpose, or it is sufficient if it is a purpose. The latter is the more natural interpretation. If one of the purposes of a disclosure is to obtain legal advice it is fair to say that it is made for that purpose, even if there is a collateral political aim. This approach does not give too free a rein to the exemption, as the exemption will only apply if the data controller makes out the requirement of necessity.

As to the third question, authority shows that the concept of “establishing legal rights” is a broad one, encompassing investigations to establish whether such rights exist.

On the fourth question, it is enough to say that it would be artificial to speak of a disclosure as “made for the purpose of or in connection with” prospective legal proceedings, when no proceedings are yet contemplated, the prospect of any being brought is remote, and the disclosure is made for the purpose of obtaining legal advice on whether there is any arguable basis in law for such proceedings.

It has not been shown that the Fusion Disclosure was made for the purpose of or in connection with any prospective legal proceedings; the evidence does not reveal any realistic prospect of proceedings at or before the time of the disclosure. However, in

In my judgment, the Fusion Disclosure was necessary for the purposes of obtaining legal advice and establishing legal rights. Mr Tomlinson’s approach is unduly narrow, on the facts and as a matter of law.

It is tolerably clear on the evidence that the reason why Alfa, and its connections with Mr Putin, were investigated was that Perkins Coie were in possession of information that there had been server activity linking Alfa Bank with Trump Tower in New York, where Mr Trump’s organisation was based. On the evidence, the source of that information is unclear. But there were media reports to this effect later on. And by 29 July 2016 Mr Steele was told about this, and Perkins Coie suggested to him that the links were suspicious: see [87(2)] above. I accept Mr Steele’s evidence that his instructions in respect of Memorandum 112 resulted from this information. Orbis was, on the law firm’s instructions, looking for evidence as to whether Alfa and its principals might represent a Trump/Putin link.

It was, in my judgment, well within the margin of appreciation to conclude that, in order for the Ultimate Client to obtain legal advice on possible Russian interference in the Presidential election, it was reasonably necessary and proportionate for Orbis to obtain and pass to Fusion, for onward disclosure to Perkins Coie, information about links between Alfa, its principals, and President Putin.

The question is whether the application of the Notice Requirements, Fourth Principle and/or ss 14(1)-(3) would be inconsistent with “the disclosure in question”. The answer must depend on the particular facts of the case.

DPA s 28(1) provides that

“Personal data are exempt from any of the provisions of -

(a)

the data protection principles,

(b)

Parts II, III and V, and

(c)

section 55, if the exemption from that provision is required for the purpose of safeguarding national security.”

Typically, the data controller relying on this provision will be a Government department or other public body. The authorities on this exemption are all concerned with cases of that kind. It is however common ground, and I agree, that this exemption is available to any data controller.

“National security” is not defined by the DPA, but it plainly means the security of the United Kingdom as opposed to any other nation. Safeguarding national security involves affording protection against some threat or risk to the security or well-being of the nation and its people, but this must not be looked at too narrowly; actions which are targeted at other nations may indirectly threaten the national security of the UK: Secretary of State for the Home Department v Rehman [2001] UKHL 47 [2003] 1 AC 153 [16-17] (Lord Slynn), [50] (Lord Hoffmann). National security encompasses not only military defence but also the protection of democracy and the legal and constitutional systems of the state: Baker v Information Commissioner and the Cabinet Office (EA/2006/0045, 4 April 2007) [26] (a decision on the similarlyworded provisions of s 24 of the Freedom of Information Act 2000 (“FoIA”)).

Provision is made by s 28(2) for a Minister of the Crown to issue a certificate that the exemption is “required”. Sections 28(2)-(12) provide for such a certificate to be conclusive subject to certain specified rights of appeal. The authorities are largely concerned with the scope and application of those provisions, and the validity of certificates issued thereunder. No case has been cited in which the exemption has been tested on facts such as those of this case, in the absence of any certificate. Nonetheless, I accept that it is in principle open to a private body, such as Orbis, to

The organs of the State are likely to be best placed to assess whether an exemption is required for the purpose of safeguarding national security. One reason for that is that this is a matter of evaluation and judgment, which must take into account not only the likelihood and degree of any prejudice to national security, but also the importance of the security interest at stake and the consequences for others of the judgment made; c.f. Rehman [17] (Lord Slynn) and [56] (Lord Hoffmann). Another is that the state is likely to have access to more relevant information than a private body or individual. The state does not have exclusive competence in this area; evidence from a state official is not a legal pre-requisite of a finding that a s 28 exemption is required. But any litigant asserting before a Court or tribunal that personal data are required to be exempt from a provision of the DPA for the purpose of safeguarding national security must put forward a cogent basis for such a conclusion.

The parties are at odds about the meaning to be given to the term “required”. Mr Millar submits that the word has the same meaning as “necessary” in s 35(2). He submits that if the Court accepts Orbis’ contention that the National Security Disclosures were reasonably necessary for the purposes of safeguarding the national security of the US and/or the UK then it should also agree that exemption from the First and Fourth Principles was and is “required” within the meaning of s 28(1). Mr Tomlinson submits that the difference in wording reflects a legislative intention to impose a more exacting test. Personal data are only exempt if such an exemption is “required”, in the sense that it is “essential”. As will become apparent, I do not consider the answer is decisive in this case, but I prefer Mr Tomlinson’s submission.

The structure and the language of s 28 are both different from those of the Legal Purposes Exemption. It might be said that the differences are more semantic and apparent than real. There are however two points about the language which are, in my judgment, significant for present purposes.

The concept of necessity is a familiar one, much used, much litigated and well understood in the context of human rights and data protection law. “Necessary” is the term used in the “parent” of s 28(1), namely Article 13(1)(a) of the Directive which provides that

“Member States may adopt legislative measures to restrict the scope of the obligations … provided for in Article… 6(1) … when such a restriction constitutes a necessary measure to safeguard: (a) national security

…”

It would have been easy, indeed natural, to use the same word in s 28(1), but Parliament chose a different term. The Court should treat that choice as significant. It cannot denote a broader concept than the word “necessary”. The intention I attribute to Parliament is to impose a more exacting test, limiting the scope of this broad exemption to cases where it is judged to be indispensable to the safety and well-being of the nation that certain personal data be exempt from a Data Protection Principle or other DPA provision. If this analysis is correct, it follows that there may be cases in which a disclosure of personal data is “reasonably necessary” for the purposes of national security but the purpose of safeguarding national security does not require that the personal data be exempt from any of the specified DPA provisions.

I have set out Orbis’ case on the facts at 51(2)-(3), (4) and (5) above. Mr Steele has given evidence supporting that case. For the most part, he was not challenged about what took place. On the one disputed issue, namely whether Mr Steele provided the FBI with a copy of Memorandum 112 in September 2016, within a few days of the Fusion Disclosure, I find in favour of Orbis.

Steele volunteered disclosures to the FBI. It records that the FBI officials were

“generally impressed with the reporting”, “stunned” by one aspect, and asked when there might be follow-up opportunities. One of the officers said he would circulate the reporting to “a small group of senior managers and analysis at FBI HQ”. The note was made on 8 July 2016, apparently for internal purposes. It reflects Mr Steele’s state of mind at that time, and I consider it likely to be an accurate reflection of what actually happened.

This means that there are four National Security Disclosures for consideration. My findings, about those disclosures are as follows.

The memorandum was volunteered by Mr Steele, rather than requisitioned or demanded by the FBI. He did this because he felt “duty bound” to make the disclosure. He probably did it by secure email, this being the method he used to provide the FBI with other Dossier reports. The State Department note indicates that a record was made at that department. The evidence does not suggest, however, that the FBI or the State Department took any particular interest in the claimants, or Alfa, or Memorandum 112. The best explanation for the footnotes to the OIG report may be that the FBI did not regard the contents of Memorandum 112 as of high importance.

In early November, Mr Steele personally provided a copy of the Dossier, including Memorandum 112, to Mr Talbott. The background, as explained in Mr Steele’s first witness statement, is this. Mr Talbott, who was at the time the President of the Brookings Institution and a member of the Council on Foreign Relations, approached Mr Steele. He said that he was due to meet a group of individuals at the State Department, and asked Mr Steele to “share a copy of the Dossier with him, with a view to him being able to discuss the national security issues raised with these individuals”. Mr Steele agreed. He did so on the understanding that Mr Talbott had been speaking to the US Secretary of State John Kerry, and Ms Nuland, who knew of the Dossier and its broad content; and that the individuals whom Mr Talbott was due to meet included the then US Deputy Secretary of State, Tony Blinken.

By mid-November, Mr Steele had come to the view that the intelligence he was receiving had national security implications for the UK, which he thought “could be exposed to similar risks as those apparently arising in the US”. He considered he owed a continuing duty to report to his former employer on “any matter pertinent to UK national security”. On or about 15 November 2016, he conferred with a former colleague, without providing copies of his memoranda or discussing the content. They agreed he should report to “the national security apparatus of the UK government”, for the purpose of helping safeguard UK national security. He therefore contacted “a senior UK government national security official”, who indicated agreement with Mr Steele’s assessment that he should report the relevant intelligence. The official requested and Mr Steele provided copies of the memoranda, including Memorandum 112.

On 28 November 2016, Mr Steele met Mr Kramer. Shortly afterwards, Mr Steele arranged for Fusion, in the person of Mr Simpson, to print copies of his memoranda

Orbis’ case is that each of the National Security Disclosures was reasonably necessary for the purposes of national security, and hence exemption from the First and Fourth Principles was required. Mr Millar submits that in these circumstances:

In short, Mr Millar submits, if a national security incident has arisen, the Data Protection Principles cannot be allowed to prevent or slow down the necessary disclosures. That would be contrary to the very interests which the exemption is there to protect. That is why this exemption is cast in such wide terms, in contrast to the other exemptions under the DPA. The evidence is that all the disclosures were made to people who asked for them, when they were concerned in national security matters.

Mr Tomlinson submits that on a proper analysis, none of the National Security Disclosures resulted from any official demand. The FBI disclosure (if made) was volunteered. The disclosure to Mr Talbott was requested by him, but not in any official capacity. He had no national security responsibilities; he was a retired politician who had heard about the memoranda and wanted to show them to others. The other two disclosures were also requested, but only after Mr Steele had taken the initiative to prompt the request. Mr Kramer, like Mr Talbott, lacked any official status. He was approached at Mr Steele’s instigation by a retired British diplomat.

Mr Tomlinson accepts that Mr Steele believed his reports had national security implications, but submits that it is difficult to say that any of these disclosures was “for the purpose” of safeguarding national security. In any event, the relevant question is whether exemption from the Data Protection Principles is or was required for that purpose. He submits that there is no evidence whatever that this is so. This was not a “ticking bomb” case – the disclosures in question were in November 2016, two months after Memorandum 112 was prepared. There was no obstacle whatever to compliance with the data protection principles.

The application of this exemption does not turn on whether the party claiming it was motivated by a desire to protect the realm, or believed that the processing in question was necessary for national security purposes. The purpose of the person making the disclosure is relevant but not decisive. Nor can the issue be dealt with in a blanket fashion. The Court must look at the personal data in question, consider each relevant principle or provision, and make an objective assessment of whether the purpose of safeguarding national security requires those data to be exempt from that provision.

Ideally, that assessment will be informed by a reasoned official evaluation, and based on some evidence. There is however scant evidence before me of any official assessment of the need for Memorandum 112, or any other element of the Dossier, to be provided by Mr Steele to those responsible for national security in the US, or the UK. Almost the only evidence comes from Mr Steele, in the form of hearsay. Even that has its limits. Orbis’ best case is that in August 2016 the FBI asked Mr Steele to provide all his intelligence, and in November the unidentified UK official took the view, following a discussion, that disclosure to him of the Dossier was appropriate. It is not said that Sir Andrew Wood formed any view on this issue, and, in any event, he was a retired diplomat, not a serving official with current awareness of the overall national security picture. As Mr Tomlinson points out, Messrs Talbott and Kramer were not in Government or the executive. Nor, for that matter, was Senator McCain, however distinguished and exalted his position in the Senate hierarchy. There is no evidence that, in either country, anyone with Government or executive responsibility for national security has ever reached a conclusion that it was necessary for any of this material to be provided to Mr Talbott or Mr Kramer, or Senator McCain. There is no evidence that any such person has ever made, or even considered making, an assessment of whether and, if so, why exemption from the First or Fourth Principle was required to any extent.

I have concluded nonetheless that the purpose of safeguarding national security required the personal data of the claimants that were contained in the National Security Disclosures to be exempt from the Notice Requirements. The provision of information in confidence is an essential part of the national security process. As a rule, it is essential for that purpose that there should be no fetter on the provision to those responsible for ensuring national security, and with a view to protecting or enhancing national security, of unpublished intelligence. As a rule, it is inimical to national security for the subject of such unpublished intelligence to be forewarned of or alerted to its disclosure to officials, or notified of its intended use for official purposes. It will normally be for those who have official duties to protect national security to assess the intelligence, and determine the extent to which it is consistent with national security for the data subject to be informed of any further processing of the data. I accept that these considerations applied to these disclosures of these data.

That conclusion is quite easily reached in relation to the disclosure to the UK official. Mr Steele’s evidence is that the responsibilities of that official encompassed

“… monitoring and giving early warning of the development of direct and indirect threats and opportunities to British interests or policies and to the international community as a whole in the fields of external affairs, defence, terrorism, major international criminal activity, scientific, technical and international economic matters and other transnational issues, and to keep under review threats to security at home and overseas and to deal with such security problems as may be referred to them.”

I have not been persuaded, however, that the process of safeguarding national security required any further exemption from the First Principle. I have no evidence to explain, and see no reason why, generally, a disclosure made for such a purpose must or should be exempt from the need to have a lawful basis (that is, to satisfy a condition in Schedule 3 and/or Schedule 2), or from the overall requirement of lawfulness. The fact that these disclosures were made with national security in view is not of itself enough to displace these general principles. The other requirements of fairness will always depend on the particular context, allowing the particular facts of any case to be considered.

Nor am I persuaded that national security requires that the personal data of the claimants, contained in the National Security Disclosures, should be exempt from the Fourth Principle. Accuracy is important to that purpose. Perhaps it would be harmful

In reaching those conclusions I have applied the interpretation of the word “require” discussed above. I have however noted that the Information Commissioner has argued, and the Information Tribunal has accepted, that the word “required” in s 24 of FoIA means “reasonably necessary” (see Kalman v Information Commissioner and the Department of Transport (EA/2009/0111 8 July 2010) [33]). That was not a decision on the issue before me now. The point made to, and accepted by, the Tribunal was that it is “not sufficient that the information sought simply relates to national security”, which is plainly correct. But in case I am wrong in my interpretation of the word “required” in DPA, s 28 I have assessed the position by reference to this less demanding standard. I would reach the same conclusions.

The claimants’ case is twofold:

The lawful bases for the Fusion Disclosure lay in condition 6(1) of Schedule 2 and conditions 6 (b) and (c) of Schedule 3.

I have already set out the terms of Schedule 3, condition 6, and noted that it is materially identical to the Legal Purposes Exemption: [95] above. I have explained my reasons for finding that the Legal Purposes Exemption applied to the Fusion Disclosure: [100-104] above. Those reasons also explain my conclusion that paragraphs (b) and (c) of condition 6 were satisfied.

Schedule 2 condition 6(1) is that:

“The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”

This condition calls for a determination of whether the processing interferes with the data subject’s rights, freedoms or legitimate interests in a way that is necessary for, and proportionate to the legitimate interests of the data controller or the recipient(s) of the data, giving due weight to any rights, freedoms or legitimate interests of the data subject that are engaged. As already noted, “necessary” in this context means reasonably necessary, and involves the concept of proportionality: Cooper v National Crime Agency [89-93].

The pursuit of a legitimate business is a legitimate interest: Murray v Express Newspapers [2007] EMLR 22 [76]. The Fusion Disclosure was reasonably necessary for the pursuit by Orbis of the legitimate interest of fulfilling its contractual duties to Fusion. Fusion had a legitimate interest in receiving that disclosure, and it was reasonably necessary for it to receive it, for onward transmission to Perkins Coie and the Ultimate client, whose own interests in the giving and receiving of legal advice based upon the contents of the Dossier were also legitimate.

The claimants accept that Orbis, Fusion and Fusion’s clients may have had legitimate interests in processing personal data relevant to the investigation that Orbis was contracted to carry out. Mr Tomlinson argues, however, that the claimants’ personal data contained in Memorandum 112 had nothing to do with those legitimate interests and was entirely irrelevant to those interests. It did not concern Russian efforts to influence the 2016 US Presidential campaign or links between Russia and Donald Trump. So, the processing was not needed at all for the legitimate interests which were in play. The flaw in this argument is the one I have dealt with already: see [75(3)] and [98-100] above. It wrongly treats Memorandum 112 in isolation, rather than as part of a package, prepared and produced because of and in the context of suspicions of server activity linking Alfa and Mr Trump.

I do not accept Mr Tomlinson’s further and alternative submission, that the Fusion Disclosure was unwarranted. He relies in particular on the allegations that the first and second claimants used Govorun to deliver “large quantities of illicit cash” to Mr

The allegations contained in the data are unquestionably serious. A person has a legitimate interest in the protection of his reputation and business: Evans v Information Commissioner and the MOD, (Information Tribunal, 23 June 2008) [19].

This was not mass publication but disclosure to a single small company, Fusion. The claimants were not the focus of the overall disclosure. Memorandum 112 was part of a larger package of information, the remainder of which did not engage the claimants’ rights, interests or freedoms. Fusion itself had no particular interest in the detail of the Dossier. Its function was to procure the intelligence and then forward it with a view to its use by a law firm as the (or a) basis for the provision of legal advice to a national political party on a matter of great significance. There is no evidence to suggest that the Fusion Disclosure caused the claimants any material loss, or any serious reputational harm, or that their reputations in the eyes of Fusion (or for that matter Perkins Coie or the Ultimate Client) were a matter of any real significance to them. This was something entirely different from the mass media publication that came later.

Orbis’ primary case is that the lawful bases for these disclosures lay in condition 5(b) of Schedule 2 and condition 7(b) of Schedule 3, which are in identical terms:-

“The processing is necessary—

…

(b)

for the exercise of any functions conferred on any person by or under any enactment…”

Mr Millar points to a range of statutory provisions conferring functions in respect of national security on (among others) the FBI, the State Department, and the Senate Armed Services Committee and, in the UK, the Central Intelligence Machinery and the agencies it tasks. The short submission is that each of the National Security Disclosures was reasonably necessary to enable such functions to be performed.

The claimants do not quarrel with Orbis’ interpretation of the legislation relied on, or challenge Orbis’ approach as a matter of principle. The claimants’ short response is that the statutory provisions are all irrelevant to the processing of the personal data in Memorandum 112, which had nothing to do with the FBI, the State Department, or the Senate Armed Services Committee, or with the intelligence services here, and was certainly not “necessary” for any of their statutory functions.

I have no expert evidence on US law. I have however examined the US legislative materials relied on by Orbis in relation to the functions of the FBI (Footnote: ³), the Armed Services Committee (Footnote: ⁴), and the State Department⁵. The texts appear to justify Orbis’ submissions as to the functions of these institutions and bodies. The Intelligence

In my judgment, all the disclosures at issue here were reasonably necessary for those functions. My conclusions on this issue mirror those I have reached in respect of similar arguments on which the claimants have relied in other contexts. First, the question is not whether the disclosure was essential or indispensable for the due performance of the national security functions in question. It is enough that it was reasonably necessary. Secondly, it is wrong to apply too strict a test of relevance, and to look at Memorandum 112 in isolation, without regard to the overall context in which it was provided. That included at all times suspicions about server links between Alfa and Trump Tower. By November 2016, those suspicions were firmly in the public domain. An assessment of the links between Alfa, the claimants, and Mr Putin was therefore material to the overall question of whether Russia might have been interfering in the election.

It is therefore unnecessary to address the other lawful bases relied on by Orbis. But I would accept Orbis’ case that condition 6(1) of Schedule 2 applied also. The Accuracy Issue

The legal framework is set out and discussed at [70-73] and [104(2)] above. The burden of pleading and proving inaccuracy, and breach of the Fourth Principle, lies on a claimant. That of course does not preclude a defendant from advancing and seeking to prove a positive case of accuracy.

As originally pleaded, Orbis’ Defence put the claimants to proof of inaccuracy, but it also asserted that “none of the personal data” complained of were “incorrect or misleading as to any matter of fact”, and that the data were “not inaccurate”. The claimants applied to strike out parts of Mr Steele’s witness statement, on the basis that although the Defence impliedly pleaded a positive case that the data were accurate, that case was insufficiently pleaded as it lacked the necessary particulars. At the PreTrial Review, three weeks before the trial began, I agreed with this analysis. Orbis withdrew a late application for permission to amend, to plead explicitly that the data were true. I granted the claimants’ application to strike out passages in Mr Steele’s first witness statement that could only be relevant to such a case. Since then, Orbis’ positive case on this issue has involved two main contentions that (a) aspects of the personal data were not factual but expressions of opinion; and (b) the factual elements were not in breach of the Fourth Principle, by reason of paragraph 7 of Schedule 1

The Amended Defence asserts that, of the personal data complained of, propositions (a) and (e) (paragraph [21] above) are matters of opinion. In other words, that it is a matter of opinion, not fact, that the claimants and President Putin do “significant favours” for one another, and that the first and second claimants “do President Putin’s political bidding”.

Paragraphs 6 and 10 of the Amended Defence contain the following, which adequately reflects the terms of Sch 1 Part II paragraph 7:

“6.

…

(g)

The Defendant … relies on paragraph 7 of Part II, Schedule 1 of the DPA. The Defendant accurately recorded information it obtained from a third party. The identity of that third party is confidential. By virtue of section 10 of the Contempt of Court Act 1981, the Defendant is not required to disclose the source of that information. The Defendant’s records have since 8 February 2019 indicated that the Claimants contest the accuracy of some of their personal data as contained in Memorandum 112.

…

10.

… The Defendant took such care as was reasonably required in the circumstances … to establish the accuracy of the personal data complained of.”

The final sentence of paragraph 6(g) is not in dispute. So, there are four sub-issues:

The DPA contains no guidance on this topic. But this is an issue that arises frequently in defamation cases. The principles are very well established, and familiar to this Court. The core points can be summarised in this way: a comment is something in the nature of a deduction, inference, conclusion, criticism, remark, observation, etc.; it must be recognisable as such; and the key question is how the words would strike the ordinary reasonable reader: see Koutsogiannis v The Random House Group Ltd [2019] EWHC 48 (QB) [2020] 4 WLR 25 [16-17] (Nicklin J). For this purpose, as ever, words must be looked at in their context. This, and the subject-matter, may be important indicators of whether they would strike the reader as fact or comment. Other important factors may be whether the statement is capable of verification, and whether the words in question stand by themselves, or accompany others.

I caution myself that this is not a libel action. But these principles are not technical matters, of relevance only to a niche area of the law. They reflect the experience of generations in analysing speech and striking a fair balance between the right to remedies for false factual statements, and the need to safeguard freedom of opinion. I have adopted and applied them in reaching my conclusions, which are these:

In some cases, allegations of inaccuracy and breach of the Fourth Principle may raise quite subtle issues. R (Hussain) v Sandwell MBC [2017] EWHC 1641 (Admin) [2018] PTSR 142 was such a case. The Council commissioned solicitors to conduct an investigation into allegations that the claimant had acted improperly in relation to the sale of Council property at an undervalue to an individual known to him, and other matters. Having received the report (“the Wragge report”) the Council obtained Leading Counsel’s opinion upon it. This was that there was a serious case to be met by the claimant and that the report and the opinion should be published, which was done. Relying on Leading Counsel’s opinion that the Wragge report was “wrong, unfair or suspect in some respects”, the claimant alleged that this meant the report was not accurate, and that it and the Opinion which repeated those errors violated the DPA. At [238] Green J (as he then was) rejected that contention, for the following reasons (among others):

“… I can see that when the personal data in issue relates to matters such as name, address, age, marital status, nationality, etc, that accuracy is achievable. However, the concept of “accuracy” may need to be seen in a different context in relation to data contained in the Wragge report, the opinion and the audit report. These strive to make provisional findings only, not definitive findings. As a matter of logic a document can accurately set out findings which are understood as provisional or prima facie findings even if later those views are not upheld at a full hearing. The subsequent formal findings do not render inaccurate the earlier view inaccurate as provisional or prima facie. The claimant's objection, if valid, would preclude the publication of any report containing provisional findings which by their nature run the risk of later turning out to be inaccurate when tested at a trial or subsequent hearing convened to determine their truth. In my view a document which contains provisional findings and sets out no more than a prima facie case for further investigation cannot for this reason be said to be inherently inaccurate…”

Mr Millar has sought to draw comfort from this decision, submitting that there is a “partial analogy” between Hussain and the present case. He submits that in resolving the issue of inaccuracy, the Court should take into account that Memorandum 112 was “a piece of the mosaic for an ongoing inquiry into unresolved questions” and “did not purport to be a definitive pronouncement”. In my judgment, the submission is misplaced.

In the passage quoted, Green J was striving to identify the true natural and ordinary meaning of a report which was, on its face, provisional. He found that the information in the data was not that the claimant was guilty but something less. A defamation lawyer would see this as a finding that its meaning lay at “Chase” Level 2 or 3: not guilt but reasonable grounds to suspect, or to investigate. No such complexity arises here. It is admitted by Orbis that Memorandum 112 contained the five items of personal data at [21] above. I have held that all five are factual in nature. The question is whether all or any of them have been shown to be inaccurate or misleading. At this stage of the enquiry, it is not a question of whether any of the statements in Memorandum 112 were literally true, or whether the document accurately recorded information provided to Mr Steele by a source. The issue relates to the natural and ordinary meaning of the Memorandum, and is straightforward: have the claimants established the pleaded case, that (for instance) “the Claimants and President Putin do not do ‘significant favours’ for each other” (paragraph 11(c)(i) of the Particulars of Claim) and did not “use Mr Oleg Govorun as a ‘driver’ and ‘bag carrier’ to deliver large amounts of illicit cash to President Putin…” (paragraph 11(c)(iv)).

Cross-examination of the claimants ranged over a wide canvas, exploring the nature and scope of Alfa’s business in the 1990s, its relations with members of the Yeltsin government, the 1996 elections, and a host of other matters collateral to the five factual propositions with which I am concerned. This culminated in a series of propositions advanced in Orbis’ written closing about “the claimants and their links to the Russian government since the 1990s”. Those propositions were largely based on a

Mr Millar was entitled to test, challenge and seek to undermine the claimant’s evidence in these ways. I have kept in mind, however, that this is not a public inquiry into the claimants’ business practices or their relationships with Russian government over the last 30 years. The Court’s role is to resolve the specific issues I have identified, between these parties, on the balance of probabilities, on the basis of the relevant evidence of fact which the parties have introduced at this trial.

I have also kept in mind that the evidence that is directly relevant to those issues is quite limited. It consists largely of the testimony of the claimants, contained in their written witness statements, verified on affirmation, and tested in cross-examination. For the most part the claimants were unable to point to documentary evidence in support of their case. That is common, when a claimant’s task is to prove a negative. On the other hand, Mr Millar did not put it to any of the claimants that any of the items of personal data was true. In the circumstances, he could not do so. That is not Orbis’ pleaded case, and it has adduced no evidence from any witness or any document which is capable of establishing the truth of any of those statements.

I have also noted that not only are the materials relied on by Orbis hearsay in nature, the defendant itself has not felt able to assert the truth of some of the reports contained in those materials. Counsel’s written closing argument included, for instance, the contention that the first and second claimants supported Yeltsin’s 1996 election campaign “reported on certain terms”; that they were “reported to have wielded so much influence … they were ‘running Russia’ in the late 1990s; that the second claimant “is reported as saying” certain things; and that Alfa Group acquired a 50% stake in the TNK oil company from the Russian government “reportedly on very favourable terms”. A number of the other propositions advanced by Orbis in closing take the same form.

Mr Millar elicited a few admissions. He established, for instance, that Mr Aven served as Minister for Foreign Economic Relations in the Boris Yeltsin government, between 1991-1992; that he joined the Alfa Group in 1994; that Alfa Group acquired and benefited from the acquisition from the state of a controlling stake in TNK, part of which was sold to BP for billions of dollars; and that Mr Aven acted as Alfa’s channel of communication with the Russian government in the Yeltsin and Putin eras. But there was little that went directly to the issues for decision.

In these circumstances, it is unsurprising that the main thrust of Mr Millar’s closing argument on this issue was that the claimants have failed to discharge the burden of proof. In my judgment, however, they have done so.

The first claimant’s evidence is that he has never given or received such favours. He meets Mr Putin regularly, and does so on a one-to-one basis, and informs Mr Fridman of the topics discussed. But he has a purely professional relationship with President Putin, and that has been the case for many years. He maintains that he and Alfa do not want to be very close to the President. Rather, they want “good formal relations”. In cross-examination it was established that in 1999 Mr Aven hosted a dinner at President Putin’s request. Mr Aven’s evidence was that the only other attendee was Igor Malashenko, a founder of the NTV television channel. That was not challenged. I conclude that this was a favour. Whether or not it was significant is hard to say. But it is an isolated matter in fairly distant history, long before September 2016. It does not go to the accuracy of the specific personal data in question, and does not materially detract from Mr Aven’s uncontradicted evidence. There was no suggestion in crossexamination that there was any pattern of meetings between the two. It is not sufficient for Orbis to draw attention to passages in the Mueller Report, which the witness did not accept.

The evidence of the second claimant, Mr Fridman, is that he is no position to do favours for President Putin and he has not done such favours for him. He does not have a personal relationship with the President. As a board member of the Russian Union of Industrialists and Federalists he, like Mr Aven, meets Mr Putin. But these are formal group meetings. He was cross-examined about his relationship with Mr Yeltsin, and did not accept that he had supported his campaign in the expectation of favours.

Mr Millar questioned Mr Aven, and Mr Fridman, quite extensively about Alfa’s acquisition of TNK, the sale of a stake to BP, and their involvement in a joint venture between TNK and BP. He put it to Mr Fridman, for example, that two public documents in the documentary evidence make Alfa’s acquisition of its TNK shareholding “look like a gigantic sweetheart deal put in your lap by the Kremlin”, under the Yeltsin regime. One of the documents was the US judgment referred to. The other was a media profile. I did not find such lines of questioning persuasive or helpful. I do not think this could be a sufficient basis for a Judge to reject a witness’s evidence of fact. Mr Fridman’s answer was, anyway, that he had not seen the second document, and although that was what has been written it was not true. He denied that the claimants had received “payback for supporting Yeltsin”. He rejected, also, suggestions based on hearsay materials, that President Putin had secured for Alfa the lucrative deal with BP.

The third claimant’s evidence is that he has no personal relationship with President Putin and they do not do each other favours, significant or otherwise. This unchallenged evidence was not significantly affected by the cross-examination.

Both claimants deny giving any such advice, making the point that they are not politicians or diplomats, and suggesting that they had no expertise in such matters. Mr Aven is an economist, and it is economics that he discusses with Mr Putin when they meet. Mr Fridman is a businessman, who has never met Mr Putin on a one-to-one basis. That evidence has not been challenged. The issue between the parties, so far as this proposition is concerned, came down to this: have these claimants taken too narrow a view of what “informal advice on foreign policy” amounts to? Mr Millar submits that any form of advice will do, and that the claimants were wrong to take the position that economics is a different thing from foreign policy. The claimants’ approach is “unrealistically narrow”. I disagree. Foreign policy is a subject area that is distinct from that of economics, and I have been provided with no proper basis on

I accept Mr Tomlinson’s submission that meeting “directly” implies a one-to-one or at least a personal meeting. Mr Fridman’s uncontradicted evidence is that he never had any such meeting with Mr Putin, whom he only saw in formal, public meetings. In any event, he says, he attended no meetings with Mr Putin at all in 2016, before the date of Memorandum 112. Mr Millar has argued that “recently” does not lend itself to any precise test. That may be so, but in its context in Memorandum 112 it certainly does not suggest a meeting more than 9 months earlier. On the evidence, the proposition is inaccurate or misleading.

The claimants have succeeded in demonstrating that this proposition is untrue. Both claimants denied involvement in any such activity. There is documentary evidence that Mr Putin ceased to be Deputy Mayor in June 1996, and that Mr Govorun was first employed by Alfa Bank on 3 March 1997, as a manager in the Department of Communications. Mr Aven recalled no dealings with Govorun, but his evidence is that enquiries he made suggested that he worked for Alfa for 3 years in the late 1990s, and was a Deputy Head of the Department for Communications with State Authorities. He was not Head of Government Relations nor did he hold any other senior position. Mr Fridman’s evidence is that he did not know Govorun at the relevant time.

Mr Steele admitted in cross-examination that Govorun was not working for Alfa before 1997, and that his source had erred in that respect. But he refused to accept that this meant that Memorandum 112 was inaccurate. He cavilled, suggesting that it might be the case that Govorun was used to deliver illicit cash to Mr Putin in the late 1990s, after his stint as Deputy Mayor. There is no evidence to support that. Even if there were, the Memorandum would remain inaccurate and misleading. Mr Millar’s closing submissions on this issue did not contend otherwise. They were focussed on the question of whether Mr Steele took reasonable care.

I have rejected Mr Millar’s submission that this is a matter of opinion. The question is therefore whether either claimant took some step requested of them by Mr Putin, such as supporting a political campaign or policy. Both say not. Mr Aven maintains that his discussions with Mr Putin are limited to business and economics, and they do not discuss politics. Mr Fridman says that he has never been asked by Mr Putin to do anything politically. In the context of his position as a businessman, the idea of doing Mr Putin’s political bidding makes no sense.

There is nothing that casts doubt on Mr Fridman’s evidence on this issue.

Mr Aven was cross-examined about his dealings with Richard Burt, a former US diplomat who has been on the Alfa Bank Supervisory Board. He agreed that he had used Mr Burt to try to make contact with the Trump Transition Team. His explanation was that they spoke about the possibility of sanctions on Alfa. Mr Putin had expressed concern about this, of which there had been rumours. The President had suggested that the Bank would need contacts with the new US administration. Hence Mr Aven’s wish to contact the Transition Team. He raised another matter with Mr Burt, to do with unpaid debts to the Bank, which had nothing to do with Mr Putin. Mr Aven denies knowing at the time of a number of matters set out as fact in the Mueller report, including the role allegedly played by Mr Simes of CNI in lobbying for Mr Burt to be the new ambassador to Russia. Asked about a suggestion from Mr Burt that Mr Aven’s approach to him was made on behalf of the Russian government, Mr Aven says that was a misunderstanding, compounded he suggests by his poor English and heavy accent.

This is another area in which Orbis’ closing submissions seek to revisit the meaning of Memorandum 112. It is submitted that the document “does not state in terms that the Claimants do President Putin’s political bidding” (emphasis in original). That is a very subtle point, given that the document says that Putin is able to “make them do his political bidding”. Further, it is an admitted fact that the meaning or substance of this aspect of the information in Memorandum 112 is as stated at [21(e)] above.

Mr Millar further submits that the Court should conclude that the inaccuracy of this aspect of Memorandum 112 has not been established, having regard in particular to what he calls Mr Aven’s “entirely implausible account of his own evidence to the Mueller Inquiry”. This is a convoluted argument, that I have not found persuasive. I am invited to read and interpret a redacted copy of a section of the Mueller report, conclude that it is at odds with Mr Aven’s evidence to this Court, and reject that evidence. This is a complex process, besides its questionable legitimacy (whilst the Mueller report can be used as a source of hearsay evidence of fact, its secondary findings of fact are not binding, and are arguably not admissible). I have not heard evidence from Mr Burt or Mr Simes. I do not have before me a record of the statements the witnesses made to Mueller, which are summarised in the report. I have extracts from some documents, and summaries of others.

Having reviewed the extract from the Mueller report that is relied on, it does appear that Mr Burt’s account to Mueller was that Mr Aven was trying to help establish a communications channel between Russia and the Trump team, and that Mueller concluded that this was in fact the case. But I do not consider this to be a satisfactory basis on which to reject Mr Aven’s evidence to me.

The evidence on this and the next issue comes of course from Mr Steele. His account is that the Dossier comprised intelligence obtained from 3 sources and approximately 20 sub-sources, all of whose identities were known to him. His contacts were with the sources. He met the sources and, during the meeting, made a manuscript note of what he was told. Within a day or so, he would compile a memorandum. He kept the manuscript notes for as long as necessary for that purpose, then destroyed them. Memorandum 112 was based on intelligence provided by a single source and a single sub-source. Mr Steele had a 2-hour meeting with the source, and wrote up the memorandum shortly after, destroying the manuscript notes.

Mr Tomlinson invites me to find that Orbis has failed to prove that Memorandum 112 accurately records the information provided by the source. He relies on passages in the OIG report, that record that the source told that investigation that Mr Steele had “misstated and exaggerated his statements in multiple sections of his reporting” and that had made it clear that it was “just talk”. The submission is that Mr Steele failed convincingly to counter these criticisms. I do not think that is the right approach. The question, rather, is whether the hearsay passages from the OIG report, summarising aspects of what the source said to the Department of Justice in January and March 2017, undermine the reliability of Mr Steele’s written and oral evidence to me about Memorandum 112. None of the statements goes directly to the content of Memorandum 112. It is clear that the source may have had an axe to grind. I accept Mr Steele’s account and find that the memorandum records accurately what he was told by the source.

Mr Steele describes in his witness statement the steps he took “to ensure as far as possible the reliability” of the content of the memoranda in the Dossier, including Memorandum 112:

“I assessed the intelligence I received having regard to what I knew of the sources and sub-sources and their roles, my knowledge of the structure of the Russian political system and its inter-connections with business, and the credibility of their story. I asked others about the individual source or sub-source and their story, and I cross-referenced the information I received against open source data where possible. I asked myself whether the appearance of the information (for example, whether it seemed sensationalist, had any discrepancies or any seemingly misleading information etc), the access of the individual, and the story itself added up and tallied with the intelligence being received from others, and was consistent with my own knowledge and experience. I did not take what was said at face value but instead looked at the open source data pertaining to the individuals involved, other reporting, including that provided by other sources, and tried to find out whether other government and intelligence institutions internationally had any relevant intelligence to corroborate or contradict the intelligence we received.”

Mr Steele adds that the source and sub-source were established connections of his, whom he trusted. He says he “knew that they were in a position to report to me accurately” and that both “had a very good reporting record”. He explains what this means: that contributions they made on previous occasions had either been corroborated by others or had “turned out to be the case from open source and events on the ground”.

In cross-examination, no evidence emerged of any questions asked of others about the individual source and sub-source for Memorandum 112. The only “open source” internet checks carried out were internet searches conducted by Mr Steele, on Mr Govorun and the Russian Union of Industrialists. Those checks did not include verification of whether there was a time when Mr Putin was in St Petersburg and Mr Govorun was working for Alfa. The date of Mr Putin’s departure for Moscow is a matter of public record, to be found (for instance) in a biography in the trial bundles.

Mr Steele said that his source had told him the sub-source was clear that Mr Fridman and Mr Putin were meeting directly. Mr Steele said that the sub-source had personal knowledge about significant favours being done for and by President Putin. But he conceded, in relation to other aspects of the document, that he had not checked with his source, whether they had confirmed the nature of the information obtained from the sub-source. He imagined so, but did not know. He said that the sub-source would have had access to some of the information by virtue of their job. He accepted that the sub-source had not been there in the 1990s, but “that doesn’t mean that they hadn’t talked to people who were”. Ultimately, he said he made a judgment based on his knowledge of the source and the sub-source, including the sub-source’s job.

Mr Millar submits that, in assessing the reasonableness of those steps, the Court must take into account the purposes of the processing: the Fusion Disclosure and the National Security Disclosures. Those, he submits, were legitimate and important purposes. Mr Steele carefully assessed their appropriateness based on his own extensive experience. The Court should also take into account the nature of Memorandum 112 and the specific sentences complained of.

Mr Tomlinson submits that Mr Steele took no proper care at all. He simply took the view that the information provided by his source appeared to be accurate and included it in Memorandum 112. Mr Tomlinson takes aim, in particular, at proposition (d), the allegation about “illicit cash”. He describes this as a serious charge in relation to which the sub-source lacked personal knowledge, and “considerable care was required but plainly not exercised”.

Again, assessment is hampered by the nature and limits of the evidence. In this instance, the limits include not only (again) the absence of contemporaneous records, but also the fact that I do not know the identity, or very much else, about Mr Steele’s source or his sub-source. That is a consequence of Mr Steele’s desire to preserve their anonymity. That wish is understandable, but it does mean that his explanation of what he did and did not do, and his justifications for his behaviour, are harder to scrutinise. The same is true of Mr Steele’s assertion that his sources had a reliable track record. What he says is cogent and logical on its face, but in the absence of any detail it is hard to evaluate.

The reasonableness of the steps taken must, however, be assessed “having regard to the purpose or purposes for which the personal data were obtained and further processed”. That means, as Mr Millar submits, that I am asking myself whether what

Reviewed in that context, I have been persuaded that Mr Steele took reasonable steps to ensure the accuracy of propositions (a), (b), (c) and (e) (favours, foreign policy advice, recent direct meeting and political bidding). None of these represents a grave allegation. Apart from the point about the meeting, these are all somewhat broad and generalised propositions. They are all credible on their face. The disclosures with which I am concerned are limited in number and scope. The purposes for which they were made were legitimate. It was inherently unlikely that any significant step, adverse to any of the claimants, would be taken on the basis of any of those propositions, without further enquiry. I accept that Mr Steele knew and trusted his sources, and that he had reasonable grounds to trust them. It was reasonable for Mr Steele to rely on the status and job of his sub-source and a history of proven reliability. It was not necessary for him to make detailed enquiries of his source about the reliability of his sub-source.

The position is different when it comes to proposition (d), concerning “illicit cash”. That is an allegation of serial criminal wrongdoing, over a prolonged period. Even in the limited and specific context of reporting intelligence for the purposes I have mentioned, and despite all the other factors I have listed, the steps taken to verify that proposition fell short of what would have been reasonable. It is of a nature and gravity which are wholly distinct from and far more serious than the other four propositions. It relates to a period of time 15-20 years before the compilation of the memorandum. Mr Steele knew that his source did not have direct personal knowledge of the underlying facts, but could only be relying on hearsay. He has failed to explain how that information would or could have come to the sub-source by virtue of his job. The allegation clearly called for closer attention, a more enquiring approach, and more energetic checking.

It is unclear what efforts Mr Steele made to verify this allegation, other than the one relevant internet search to which he has referred. Mr Steele’s evidence as to the single relevant internet search he undertook was unimpressive. All that he could recall of it was that it turned up the information that Mr Govorun had accompanied President Putin to the funeral of Present Karimov of Uzbekistan. That, however, was in 2016. Hindsight is to be avoided, but the inadequacy of the verification effort is illustrated by the fact that Mr Tomlinson was so easily able to demonstrate, and obtain Mr Steele’s acceptance, that a key element of this allegation was contradicted by information readily available on the internet. Mr Steele does not say that he questioned his source about it or asked the source to revert to the sub-source for details. He evidently did not ask for any details of the hearsay information.

In closing, Mr Tomlinson submits that while the claimants have suffered distress, an award of damages is very much a secondary consideration. The claimants’ primary focus is on correcting the record. The main area of contention is whether the Court should, to any extent, exercise its discretion to grant remedies under DPA ss 14(1)-

I am prepared to direct, if necessary, that the copy of Memorandum 112 which is held by Orbis for legal purposes should be marked up or filed in such a way that a reader will not fail to be aware of this judgment, its findings that the data are inaccurate or misleading, and the formal order that will follow. Otherwise, these seem to me to be somewhat unreal submissions in the context of this case.

True it is that the remedies under ss 14(1)-(3) are available in principle, in respect of all the data that I have found to be inaccurate or misleading. It does not follow that they should be granted. These remedies are doubtless useful and important in cases of large-scale disclosure to recipients whose identities are not known to the claimant, or where it is reasonable for the defendant to undertake the task of communication. But the disclosures complained of here were made privately, to a very limited audience. The content of the Memorandum has become public subsequently, through the Buzzfeed Article and other means including this trial. Insofar as it is an issue in this trial, I have held that Orbis are not responsible for that wider publication. An Order for notification of the inaccuracies to Fusion and the recipients of the National Security Disclosures would be pointless, or at least unnecessary. I am confident that all those to whom Orbis disclosed Memorandum 112 will be, or will be made aware of the outcome of this action, and my findings, soon after judgment has been given. If the claimants are unsure of that, they know the identities of the recipients and can provide them with a copy of the judgment and order. The Court cannot grant a remedy in respect of disclosures for which it has not held Orbis responsible. For those reasons I decline, as a matter of discretion, to grant any additional remedies under s 14.

Mr Tomlinson has submitted that if I decided not to grant remedies under s 14 his clients would wish to press their pleaded claim for a declaration. The DPA does not provide for declarations, and no case has been identified in which the issue has been examined. My findings are analogous to a finding of liability for libel. But this is not a libel action. Anyway, English law and procedure do not permit the court to make a declaration of falsity at the end of a libel action: Jameel v Dow Jones, Inc [2005] EWCA Civ 75 [2005] QB 946 [67] (Lord Phillips MR). It is available, as a discretionary remedy, in limited circumstances, by way of a statutory “anomaly”: see Loutchansky v Times Newspapers Ltd (Nos 2-5) [2002] EWCA Civ 1805 [2002] QB 321 [98-99]. Other jurisdictions have taken different approaches, and there has been academic discussion: see, for instance Gatley on Libel and Slander 12^th ed Chap 9, esp at nn 2-4 and text thereto. But there has been no real exploration of these issues at this trial, and I do not consider it necessary to explore them in this judgment.

Assuming but without deciding that a declaration is available in principle, I would decline to make one. Mr Tomlinson makes clear that he is only seeking a declaration between the parties. But a danger of declarations as between parties is that they may, mistakenly, be seen as binding the rest of the world. This case is not about the media publication of the Dossier; it relates to relatively limited disclosures. This judgment and the order that will follow are a sufficient statement of the position. The Order may contain recitals which record my findings of inaccuracy. I have also taken into account my conclusion on the issue of compensation, which affords some real vindication for the first and second claimants.

The governing provision is DPA s 13, which provides as follows:

I have found that the “illicit cash” allegation ([21(d)] above) was inaccurate and that its disclosure, as part of the Fusion Disclosures and the National Security Disclosures, involved a contravention by Orbis of the Fourth Principle. Orbis has pleaded reliance on the defence provided for by s 13(3), but it follows from my rejection of Orbis’s case under paragraph 7 of Schedule 1 Part II that this defence fails. The first and second claimants are therefore entitled to compensation from Orbis for any damage they have suffered by reason of those contraventions. (For the reasons I have given, no other contravention of the DPA has been established, so none of the claimants is entitled to any compensation for any other act of processing that has been complained of in this case.)

“Damage” for these purposes is not confined to material loss. Compensation for distress is recoverable in any case, even if material loss is not sustained: Vidal-Hall v

That compensation must provide redress for the interference with autonomy, and any distress caused by the breach. What of reputational harm? If, as the authorities make clear, damage is not limited to material loss, it seems hard to exclude this as a matter of principle. And Mr Millar concedes that in principle, the Court can award compensation under s 13 for reputational harm. In a case such as this, where the inaccurate information is seriously defamatory, that seems right. The issue might deserve closer attention in different circumstances.

It seems to me that the Court’s approach to the assessment of damages for reputational harm and distress resulting from inaccurate disclosures of personal data should follow established common law principles. The Directive appears to leave such matters to be determined according to national law. The principles that apply in respect of the identification of recoverable loss, aggravation, mitigation, and the assessment of damages in this area are to be found in the law and practice of defamation. To adopt any other approach would lead to incoherence in the law. I summarised the majority of the principles relevant to this case in Barron v Vines [2016] EWHC 1226 (QB) [20-24]. In Sloutsker v Romanova [2015] EWHC 2053 (QB) [2015] EMLR 27 [80], I summarised and applied the established law on whether and when a reasoned judgment may mitigate damages.

I do not accept Mr Tomlinson’s ambitious submission that Orbis can and should be held responsible for damage caused by third-party republication of the content of Memorandum 112, including media publication consequent on Mr Kramer’s disclosures. A claim for damages of that kind (commonly known as “Slipper” damages) must be pleaded: Slipper v BBC [1991] 1 QB 283. It would be wrong to award any, when the issue has not been ventilated or explored in evidence or argument. Mr Millar’s submission that the remedy should reflect breach by Orbis and not punishment for what others do, is correct.

I accept that the claimants have suffered distress as a result of the disclosures complained of, though the majority of the distress they have been caused will inevitably have flowed from media publications for which Orbis is not responsible in law: the Buzzfeed Article and others. My assessment is that each of the claimants is a robust character, not given to undue self-pity. Mr Tomlinson was right to ask for only “modest” damages for distress.

Mr Millar submits that it is “fanciful” to assert that Memorandum 112 caused any material incremental distress or reputational damage “given what was already in the public domain about them”. In support of that submission, Orbis relies on two main strands of allegation. First, there is a list of allegations about “the claimants and their links to the Russian government since the 1990s” in which proved or admitted facts about the claimants are intermingled with things that the claimants or Alfa have “reportedly” done, citing media reports. This is an unsatisfactory approach which appears to treat hearsay reports as established fact. Secondly, reliance is placed on “a large amount of material in the public domain about the claimants”, containing a number of allegations about them. It is said, for instance that “It has been alleged that the First and Second Claimants were involved in trafficking heroin from Burma to East Germany…”. It is said that the New York Times has “reported on allegations of criminality, including drug dealing/running, corruption and embezzlement”. Reliance is placed on the judgment of Judge Bates, which refers to media reports. Mr Millar

These submissions are contrary to established principle. A defendant can mitigate damages by proving that the claimant had an existing bad reputation, but (1) evidence is only admissible in respect of the “relevant sector” of the claimant’s reputation; proof of a bad reputation for something different is irrelevant; (2) bad reputation in the relevant sector cannot be proved by relying on specific acts of misconduct or third party reports, rumours, newspaper cuttings or media reports of bad behaviour: see Barron v Vines [21(5)-(6)], [23-24]. Those passages show that these rules have been firmly established since 1858, and were reaffirmed by the House of Lords in 1964, and the Court of Appeal in 2001. The rule against mitigation of damages by reliance on other publications was reaffirmed once more by the Supreme Court in 2019: see Lachaux v Independent Print Ltd [2019] UKSC 27 [2020] AC 612 [22], [24] (Lord Sumption).

That said, the “publication” I am concerned with is limited. I have no evidence that the opinion of any of the recipients was of particular concern to these claimants, or that the recipients took any particular steps that led to identifiable harm. This is one of those cases in which the fact and content of a reasoned judgment should have a moderating effect on the sum that is appropriate by way of vindication.

My conclusion is that I should award each of the first and second claimants compensation in the sum of £18,000.

For the reasons given in this judgment I have reached the following main conclusions on the issues identified at [18] above: