Boris Karpichkov v The National Crime Agency

An application to strike out or obtain summary judgment should be refused where the claim is legally recognisable and has a realistic prospect of success. In assessing whether personal-data disclosure is lawful, the specific European Arrest Warrant and Schengen Information System regime must be read consistently with fundamental rights and data-protection principles.

The statutory restriction on limiting exchanges required by European Union or Member State law does not apply automatically. If disclosure would breach fundamental rights, it is arguable that the disclosure is not truly required by law, leaving the domestic data-protection principles applicable. Compliance with European Arrest Warrant and SIRENE procedures does not itself establish necessity, adequacy, relevance, non-excessiveness or appropriate security. A misuse of private information claim may likewise proceed where disclosure may have created or increased a serious risk of harm.

The claimant, a British citizen living under a protected identity, alleged that the National Crime Agency disclosed his new identity to the Latvian SIRENE Bureau in July 2018 and his UK address in May 2019 during European Arrest Warrant proceedings.

He claimed damages for breaches of the first, third and sixth data-protection principles under Part 3 of the Data Protection Act 2018, and for misuse of private information. The Agency admitted the disclosures but maintained that the European Arrest Warrant, SIS II and SIRENE regimes required them and provided a complete defence.

The application concerned whether the claim disclosed reasonable grounds and whether the claimant had a real prospect of success. The central issue was whether the specialist European data-sharing regime left any arguable obligation to consider fundamental rights and the safety of the disclosed information.

1. Application dismissed. The claim was neither incoherent nor bound to fail. The pleaded facts had to be assumed for strike-out purposes, and the evidence reasonably available at trial had to be considered on summary judgment. The claim therefore disclosed reasonable grounds and had a realistic, rather than fanciful, prospect of success.
2. The Framework Decision and SIS II regime pursued a high degree of mutual recognition and made execution of a European Arrest Warrant generally mandatory. Nevertheless, the Framework Decision required personal-data processing to respect the principles of adequacy, relevance and non-excessiveness, and was to be interpreted consistently with fundamental rights.
3. The SIS II Decision and SIRENE Manual formed a specific regime governing alerts and supplementary information. The requirement to use Form G and provide as much information as possible did not clearly establish that every item of available information had to be disclosed regardless of its relevance, accuracy, safety or effect on fundamental rights.
4. Articles 1(2)(b) and 60 of the LED, together with section 80 of the Data Protection Act 2018, ordinarily prevented domestic data-protection rules from restricting an exchange required by EU or Member State law. That conclusion did not resolve whether a particular transfer was legally required where disclosure would arguably breach fundamental rights. If it would, the transfer arguably fell outside the statutory carve-out and the domestic data-protection principles could apply.
5. It was arguable that the Agency should have considered the claimant’s Article 3 risks, Article 8 rights and Charter rights before making the disclosures. Whether disclosure was necessary, adequate, relevant, excessive or secure was fact-sensitive and unsuitable for summary disposal. The pleaded evidence could support a case that the disclosures increased the risk of serious harm.
6. The misuse of private information claim engaged the two-stage test identified in McKennitt v Ash: reasonable expectation of privacy, followed by a balance between that expectation and countervailing interests. The first stage was assumed for the application. The second depended on whether the European legal regime truly required disclosure notwithstanding the claimant’s fundamental rights.