Antony Sava v Leather Inside Out & Ors

A natural person may be a data controller under the UK GDPR, either alone or jointly with a legal person. The fact that an individual is a trustee, consultant, director or senior officer does not automatically make that person a controller, but neither does acting for an organisation confer blanket immunity. The question is whether the individual determined the purposes and means of processing in the relevant circumstances.

For strike out, the court must consider whether the pleading discloses any legally recognisable claim and whether an identified defect might be cured by amendment. A claim alleging that natural defendants are additional controllers must plead facts explaining how their processing decisions were made outside the ordinary agency relationship or otherwise made them controllers. A summary judgment application requires credible evidence addressing the factual basis of the proposed disposition.

The claimant brought proceedings concerning repeated subject access requests for personal data arising from his employment and subsequent reports to probation and other organisations. He alleged that the charity, its founder, and trustees were jointly responsible as data controllers under the UK GDPR.

The second and fourth defendants applied for strike out or summary judgment, arguing that only the charitable incorporated organisation could be a controller and that the pleading disclosed no sufficient factual basis for personal liability. The court also considered whether the claim against the third defendant should be struck out of its own motion.

1. Data-controller capacity. The definition in Article 4(7) of the UK GDPR expressly includes a natural person and permits joint controllers. It was therefore legally wrong to contend that only the charitable incorporated organisation could ever be a controller. Southern Pacific Loans Ltd [2013] EWHC 2485 (Ch) did not establish blanket immunity for directors, trustees or other officers. It established only that office or authority does not, without more, automatically make an individual a controller.
2. Strike out. The claim could not be struck out on the abstract proposition that natural defendants were incapable of being controllers. However, the pleaded facts did not explain how the natural defendants had determined the purposes or means of processing outside their agency for the organisation. Alleging that the report was false, that trustees were legally responsible for important decisions, or that individuals failed to investigate allegations or answer subject access requests did not supply that factual basis.
3. The pleading contained no factual case explaining why the employment contract, employee file, P45, P60 or the disputed report was data over which the natural defendants were additional controllers. The defect was fundamental, and there was no reason to believe it could be cured by amendment. The claims against the natural defendants were therefore struck out under Rule 3.4(2)(a) of the Civil Procedure Rules 1998.
4. The claim against the third defendant was struck out of the court’s own motion. The summary judgment application was dismissed because the supporting witness statements did not identify a sufficient factual basis for deciding that the applicants could not be controllers. The application was accordingly inadequate on the evidence, although the strike-out application succeeded. Consequential matters and costs were adjourned.