Trushin v National Crime Agency

A claim concerning the processing of personal data should not be struck out or summarily determined where the lawfulness of the processing depends on fact-sensitive questions about statutory exemptions, Article 8 rights, risks arising from disclosure and the adequacy of the data controller’s assessment. An agency acting as a national central bureau for INTERPOL remains subject to domestic data-protection and human-rights obligations. Its role as an intermediary does not necessarily make it a mere conduit or remove the need for an individualised assessment before disclosure. Questions of causation, substantial damage or distress, and the availability of compensation generally require investigation at trial where they are genuinely arguable.

The claimant, a Russian national granted political asylum in the United Kingdom, alleged that the Serious Organised Crime Agency and subsequently the National Crime Agency unlawfully processed and disclosed his personal and sensitive personal data in connection with Russian extradition proceedings and INTERPOL requests.

He relied on sections 10, 13 and 14 of the Data Protection Act 1998, section 8 of the Human Rights Act 1998, and Article 8 of the EU Charter. He sought compensation and orders requiring the data to be rectified, blocked, erased or destroyed and requiring processing to cease. The NCA applied to strike out the claim and for summary judgment under CPR 3.4 and CPR 24.2.

1. Applications dismissed. The claim disclosed an arguable case and raised a compelling reason for a trial. Nothing in the judgment bound the judge at the substantive trial.
2. The NCA was a data controller and a public authority. Even when acting as the United Kingdom’s INTERPOL National Central Bureau, it remained required to consider its obligations under the Data Protection Act 1998, the Human Rights Act 1998 and the EU Charter. The assertion that it acted merely as a conduit did not resolve those obligations.
3. The statutory provisions concerning crime-related processing and disclosure, including sections 27 and 29 of the Data Protection Act 1998, were complex. They did not establish at this stage a complete or absolute defence. The extent to which disclosure would be likely to prejudice crime-prevention purposes, and whether the relevant statutory conditions were satisfied, required determination on the facts.
4. The material disclosed by the NCA indicated that risk assessments were not routinely undertaken in cases of this kind and that no Form C assessment or 5X5X5 grading had been recorded for the claimant’s data. This arguably conflicted with the NCA’s description of itself as a mere conduit and raised a triable question whether the claimant’s Article 8 rights and the applicable criteria had been adequately assessed before processing or disclosure.
5. The claims for damages could not be rejected summarily. Causation was quintessentially factual, and whether damage or distress was substantial also required factual assessment. Although the claim for reputational loss appeared weak, it had a logical connection with the central claim and could properly be left for the trial judge.
6. The unsuccessful application to the Commission for the Control of INTERPOL Files did not make the domestic proceedings abusive. The CCF’s assessment did not determine the United Kingdom’s assessment of the claimant’s refugee status, and relief against the NCA in the United Kingdom was not negated by the continuing existence of INTERPOL notices.

This was a first-instance decision on the NCA’s applications to strike out the claim and obtain summary judgment. The applications were dismissed.