Aven & Ors v Orbis Business Intelligence Ltd

Under the Data Protection Act 1998, whether information is personal data is assessed in its proper narrative context, by reference to the ordinary reader, rather than by mechanically atomising a document. Information may be sensitive personal data where that context conveys alleged criminal conduct; a claimant need identify the conduct, not a particular offence provision. Legal-purpose and national-security exemptions are purpose-specific. The former may apply where obtaining legal advice or investigating legal rights is one purpose and disclosure is reasonably necessary. The latter requires exemption to be indispensable and does not generally displace lawful processing or accuracy safeguards. The Fourth Principle permits reasonable, context-sensitive verification of third-party intelligence, but grave criminal allegations demand enhanced checking. Limited disclosure can be lawful and exempt from notice, while inaccurate data may still justify rectification and compensation.

Three businessmen brought claims under the Data Protection Act 1998 concerning personal data contained in Memorandum 112, one component of the Steele Dossier. They alleged breaches of the First and Fourth Data Protection Principles and sought rectification, notification, a declaration and compensation. Orbis relied on the Legal Purposes Exemption and the National Security Exemption, and disputed whether the information was personal data, sensitive personal data, inaccurate or misleading. The central issues were the scope of the data, the application of the exemptions, fairness, accuracy, responsibility for later disclosures and remedies.

The claim succeeded in part. The court found that Memorandum 112 contained personal data concerning all three claimants. The statements about significant favours, informal foreign-policy advice, a recent direct meeting, delivery of illicit cash and political bidding were factual in nature. The allegation concerning delivery of illicit cash amounted to sensitive personal data about alleged criminality.

1. Personal data must be identified holistically where the material is a coherent report or narrative. The court applied the ordinary reasonable reader's understanding of the document in context. It rejected an artificially atomised approach, while recognising that more granular data sets may require individual assessment.
2. The Legal Purposes Exemption applied to the Fusion Disclosure. A legal purpose could be one purpose among several, and could include obtaining legal advice and investigating whether legal rights existed. The disclosure was reasonably necessary and proportionate. Litigation was too remote to qualify as prospective proceedings. The exemption removed the notice requirements, but not the Fourth Principle, sections 14(1)–(3), or the need to satisfy Schedule 2 and Schedule 3 conditions.
3. The National Security Exemption applied to the notice requirements for the National Security Disclosures. Section 28 required an objective, data-specific assessment. The word required imposed a stricter, indispensable standard than reasonably necessary. National security included protection of democracy and constitutional systems. The exemption did not displace the lawful-basis requirements or the Fourth Principle. The court applied the principles in Secretary of State for the Home Department v Rehman [2001] UKHL 47 and Baker v Information Commissioner and the Cabinet Office EA/2006/0045.
4. The claimants proved that all five items of data were inaccurate or misleading in meaning. Orbis had accurately recorded information received from its source, but the verification steps were reasonable for four broad allegations and inadequate for the grave allegation of serial criminal wrongdoing concerning illicit cash. The court applied the contextual approach to fact and opinion in Koutsogiannis v The Random House Group Ltd [2019] EWHC 48 (QB).
5. A limited rectification order was appropriate. Wider notification and declaratory relief were refused as unnecessary or inappropriate. The first and second claimants each received £18,000 compensation for the Fourth Principle breach, distress, loss of control over personal data and reputational harm.