[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	England and Wales High Court (King's Bench Division) Decisions
You are here: BAILII >> Databases >> England and Wales High Court (King's Bench Division) Decisions >> Trump v Orbis Business Intelligence Ltd [2024] EWHC 173 (KB) (01 February 2024) URL: http://www.bailii.org/ew/cases/EWHC/KB/2024/173.html Cite as: [2024] EWHC 173 (KB)

[New search] [Printable PDF version] [Help]

IN THE HIGH COURT OF JUSTICE
KING'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST

		Royal Courts of Justice Strand, London, WC2A 2LL
		01/02/2024

This judgment was handed down remotely at 10.00am on 1 February 2024 by circulation to the parties or their representatives by e-mail and by release to the National Archives. ............................. THE HON. MRS JUSTICE STEYN DBE

Mrs Justice Steyn :

A. Introduction

1. This is the third case to come before this court concerning the so-called "Steele Dossier" ('the Dossier') which was published by BuzzFeed Inc ('BuzzFeed') on its news website on 10 January 2017, under the headline "These Reports Allege Trump has Deep Ties to Russia" ('the BuzzFeed Article'). The first case was Aven v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB), where the claims brought against Orbis Business Intelligence Ltd ('Orbis') were, as in this case, for inaccuracy under data protection law. The second case was Gubarev v Orbis Business Intelligence Ltd [2021] EWHC 2912 (QB), [2021] EMLR 5, a claim for libel brought against both Orbis and Christopher Steele.
2. The Dossier comprised 17 intelligence memoranda, of which all but one were prepared prior to the United States presidential election on 8 November 2016. Aven concerned one of the pre-election memoranda (memorandum 112, dated 14 September 2016), whereas Gubarev concerned the final memorandum (memorandum 166, referred to in Gubarev as "the December Memorandum"). In this data protection claim, the Claimant complains about the processing of his personal data in two of the pre-election memoranda, namely:

i) "Company Intelligence Report 2016/080: US Presidential Election: Republican Candidate Donald Trump's activities in Russia and compromising relationship with the Kremlin", dated 20 June 2016 ('Memorandum 080'); and

ii) "Company Intelligence Report 2016/113: Russia/US Presidential Election - Republican Candidate Trump's prior activities in St Petersburg", dated 14 September 2016 ('Memorandum 113').

References in this judgment to 'the Memoranda' are to these two memoranda: 080 and 113.

3. This judgment resolves two applications. The Claimant applies to amend his Claim Form pursuant to the Civil Procedure Rules ('CPR') 17.1(2)(b) or 17.4(2) ('the Amendment Application'). In essence, he seeks to add reference to a claim under the Data Protection Act 1998 ('the DPA 1998') to the existing details identifying a claim for breach of the UK General Data Protection Regulation ('the UK GDPR') and seeking remedies pursuant to the UK GDPR and the Data Protection Act 2018 ('the DPA 2018'). The Defendant contests the Amendment Application, relying on the expiry of the relevant limitation period.
4. The Claimant's application notice also included an application to remove Mr Steele as a party to these proceedings, pursuant to CPR 19.4(1), in circumstances where he was named in the Claim Form (but not the Particulars of Claim) as the Second Defendant. That application was uncontentious, and it is unnecessary to address it further: I have granted the permission sought. Accordingly, the sole Defendant is Orbis.
5. The Defendant applies for an order striking out the Claim Form and Particulars of Claim on the grounds that they disclose no reasonable grounds for bringing the claim and/or they are an abuse of the court's process (pursuant to CPR 3.4(2)(a) and/or (b)), and/or for summary judgment on the grounds that the claimant has no real prospect of succeeding on the claim and there is no other compelling reason why the case should be disposed of at trial (pursuant to CPR 24.2(a)(i) and (b)). For convenience, I will refer to this as 'the Strike Out Application'.
6. I have concluded, for the reasons explained below, that the Amendment Application should be refused, and the claim should be summarily dismissed. It is important to emphasise that the Defendant has not contended that the Claimant would have no real prospect of establishing at trial that the personal data complained of (identified in paragraph 25 below) is inaccurate. The Claimant's evidence is that the allegations are "wholly untrue" (Trump 1 §14-15). I have not considered, or made any determination, as to the accuracy or inaccuracy of the Memoranda.

B. The parties, background, and procedural history

The parties

7. The Claimant served as the President of the United States from 20 January 2017 until 20 January 2021. When Memorandum 080 was created he was the presumptive Republican nominee for the presidency and by the time Memorandum 113 was prepared he had formally secured the Republication Party nomination.
8. Orbis is an English company, incorporated in 2009, which holds itself out as providing strategic insight, intelligence, and investigative services to clients around the world. Orbis was established by two British former public officials, Mr Steele and Christopher Burrows. Mr Steele is a director and principal of Orbis, and in that capacity he was the main if not sole author of the Dossier.

Creation and dissemination of the Dossier

9. In June 2016, the Defendant was engaged by Fusion GPS ('Fusion'), a consultancy based in Washington DC, acting on behalf of US law firm Perkins Coie, to collect and provide intelligence concerning any Russian efforts to influence the 2016 US Presidential election and any links that might exist between Russia and the Claimant.
10. Pursuant to Fusion's instructions, Orbis produced 16 pre-election memoranda. Memorandum 080 was the first memorandum to be produced. It was provided to Fusion on or around the day it was prepared, that is, 20 June 2016. Memorandum 113 was produced, and provided to Fusion, on or around 14 September 2016. Mr Steele provided these two memoranda to the Federal Bureau of Intelligence ('the FBI') in early July 2016 and in September 2016, respectively (together with other memoranda that formed part of the Dossier).
11. Both memoranda (amongst others) were disclosed by Mr Steele on various dates in November 2016 to (i) Strobe Talbott, a former US Deputy Secretary of State who was, at the time, the President of the Brookings Institute in Washington DC and a member of the Council on Foreign Relations; (ii) a UK national security official; and (iii) David Kramer, an aide to Senator John McCain who was at the time Chair of the US Senate Armed Services Committee and a member of the Senate Committee on Intelligence.
12. The Claimant states, in a witness statement dated 27 July 2023, that he was first made aware of the existence of the Dossier by then FBI Director James Comey on 6 January 2018, at a meeting that took place during the transition period following his election.

Publication of the Dossier by BuzzFeed

13. BuzzFeed published the Dossier, including the two memoranda relied on in this claim, on 10 January 2017. The Dossier has been accessible by the world at large since then. In Aven, Warby J (as he then was) found that Mr Kramer gave BuzzFeed access to the Dossier between late November 2016 and 10 January 2017, thereby causing or contributing to the publication of the BuzzFeed Article (Aven, [52]). In both Aven and Gubarev, following trials, Warby J held that Orbis was not responsible for publication of the BuzzFeed Article. In this claim, the Claimant accepts that the Defendant is not responsible in law for the publication of the Memoranda by BuzzFeed.

The RICO case

14. On 24 March 2022, the Claimant brought proceedings against Orbis and Mr Steele (and about 30 other defendants) in the US District Court for the Southern District of Florida. The claim against both Orbis and Mr Steele alleged conspiracy under the Racketeer Influence and Corrupt Organizations Act ('RICO') and conspiracy to commit injurious falsehood. In addition, the claim against Orbis alleged respondeat superior/vicarious liability, while the claim against Mr Steele alleged injurious falsehood and conspiracy to commit malicious prosecution. I shall refer to this, as the parties have done, as 'the RICO case'. The US District Court dismissed the claim in its entirety against all defendants on 8 September 2022. The Claimant is appealing that decision.

Claim Form (protectively) issued

15. On 26 October 2022, without first engaging in pre-action correspondence, the Claimant issued, and the court sealed, a claim form ('the Claim Form'). Mr Lowles, the Claimant's solicitor, has explained that:

"At the point at which my firm was instructed by the Claimant, it was understood that the processing of the Claimant's personal data by the Defendants was ongoing. Despite this, it was recognised that it was possible that the Defendants would seek to raise issues relating to limitation given it was known that the Defendants were first commissioned to compile the intelligence reports that would become known as the Steele Dossier in or around June 2016 and the Steele Dossier became known to the world at large when published on the BuzzFeed website on 10 January 2017.

In these circumstances, a protective claim form was issued and sealed on 26 October 2022…

Having issued the Original Claim Form, the Claimant was required to serve his claim on the Defendant by 25 February 2023."

16. The Claim Form gave the following "Brief details of claim":

"This is a claim for breach of Article 5(1)(d) of the UK General Data Protection Regulation ('UK GDPR') arising from the processing of inaccurate personal data of which the Claimant is the data subject:

(1) Compensation pursuant to Article 82 of the UK GDPR and s.168 and 169 of the Data Protection Act 2018.

(2) An Order pursuant to Article 16 of the UK GDPR that the Defendants rectify the inaccurate Personal Data and/or an order under Article 17 of the UK GDPR that the Personal Data is erased.

…"

17. Article 5(1)(d) of the UK GDPR provides that:

"Personal data shall be:

…

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy')".

18. Article 82 of the UK GDPR provides that:

"Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered."

Section 168(1) of the DPA 2018 provides that in article 82 "non-material damage" includes distress. Section 169 of the DPA 2018 provides for compensation for damage suffered by reason of a contravention of a requirement of the data protection legislation other than the UK GDPR.

19. Article 16 of the UK GDPR gives a data subject the right to obtain rectification of inaccurate personal data concerning him, including in some circumstances by means of providing a supplementary statement. Article 17 makes detailed provision for the right to erasure of personal data (also referred to as the "right to be forgotten") where one of the grounds specified in article 17(1) applies, save that it does not apply to the extent that processing is necessary for one of the purposes identified in article 17(3), including "for the establishment, exercise or defence of legal claims" (article 17(3)(e)).

Letter of claim

20. On 22 December 2022, the Claimant's solicitors sent a letter of claim to the Defendant and Mr Steele, expressing the Claimant's intention "to pursue a claim against Mr Steele and Orbis based on breaches of the UK GDPR and DPA 2018". The letter of claim alleged that Orbis and Mr Steele had processed the Claimant's personal data (including "personal data relating to criminal convictions and offences" within the meaning of article 10 of the UK GDPR), for the purposes of article 4 of the UK GDPR, by "providing copies" to, at least, Fusion, the FBI and UK national security officials. The letter of claim alleged the processing was in breach of article 5(1)(a) ("lawfulness, fairness and transparency") in that "it is unfair to process inaccurate and defamatory data about our client"; the processing did not meet any of the conditions in article 6 of the UK GDPR or in Part 1, 2 or 3 of Schedule 1 to the DPA 2018; and the processing breached article 5(1)(d) ("accuracy"). No reference was made to any intention to pursue a claim pursuant to the DPA 1998. The letter of claim attached copies of the Memoranda.
21. In the letter of claim, the Claimant's solicitors expressed the view that the proposed claim was similar to that brought by the claimants in Aven (a claim brought pursuant to the DPA 1998) in which the court granted an order for rectification and awarded compensation for distress caused and damage to the claimants' reputation. The letter stated:

"Whilst we acknowledge that the relevant legislation has changed since the above claim was brought, the underlying principles remain the same and we believe our client's claims will result in the same outcome."

Response to letter of claim

22. Orbis responded on 12 January 2023. They stated that only Orbis, not Mr Steele, was a data controller of the Claimant's personal data. They stated that they had "processed your client's personal data fairly, lawfully and accurately at the relevant time". Orbis contended that the proposed claim was time barred as the DPA 2018 and UK GDPR came into force on 25 May 2018, "long after" they had ceased processing a copy of the Memoranda. They stated "we had not processed a copy of [the Memoranda] after around early/mid December 2016 (except with respect to the ensuing litigation and US governmental and congressional investigations)", and that they "did not hold a copy" of the Memoranda on and after 25 May 2018, until sent a copy annexed to the letter of claim. They asked the Claimant's solicitor to provide "details of the relevant alleged factual inaccuracies" to enable them to consider the request for rectification.

Service of the claim and delivery of the (unsealed) Amended Claim Form

23. By a letter dated 22 February 2023, the Claimant's solicitor sent the Defendant, by way of service the sealed Claim Form, together with Particulars of Claim dated 21 February 2023. Those documents are deemed to have been served on the Defendant on 24 February 2023: CPR 6.14. The letter also purported to "enclose by way of service … (b) Amended Claim Form pursuant to CPR 17.1(1) to take into account your position regarding the DPA 1998 and Mr Steele". On behalf of the Claimant, Mr Hugh Tomlinson KC acknowledges that did not, and could not, constitute valid service of the unsealed Amended Claim Form.
24. In addition to removing Mr Steele as a defendant, the proposed amendments to the "Brief details of claim" (see paragraph 16 above) delete the words "Article 5(1)(d) of" and "arising from the processing of inaccurate personal data of which the Claimant is the data subject" and insert the words shown underlined below, so that it reads:

"This is a claim for breach of the UK General Data Protection Regulation ('UK GDPR') and/or the Data Protection Act 1998. The Claimant claims:

(1) Compensation pursuant to Article 82 of the UK GDPR and s.168 and 169 of the Data Protection Act 2018.

(2) Compensation pursuant to s.13 of the Data Protection Act 1998[._]

(3) An Order pursuant to Article 16 of the UK GDPR and/or s.167 of the Data Protection Act 1998 that the Defendants rectify the inaccurate Personal Data and/or an order under Article 17 of the UK GDPR that the Personal Data is erased.

…"

The Particulars of Claim

25. The Particulars of Claim ('POC') identified Orbis as the sole defendant. Paragraphs 9 and 10 identify the personal data complained of ('the Personal Data'):

"9. Memorandum 2016/080 contains the following personal data of which the Claimant is the data subject:

(a) The Claimant has engaged in perverted sexual behaviour including the hiring of prostitutes to engage in 'golden showers' in the presidential suite of a hotel in Moscow.

(b) The Claimant engaged in such perverted behaviour in order to defile the bed in which President and Mrs Obama had slept; and

(c) By his unorthodox behaviour in Russia the Claimant had provided the Russian authorities with sufficient material to blackmail him.

10. Memorandum 2016/113 contains the following personal data of which the Claimant is the data subject:

(a) The Claimant paid bribes to Russian officials in order to further his business interests.

(b) The Claimant took part in 'sex parties' when in St Petersburg;

(c) The Claimant arranged for or conspired in the silencing of all direct witnesses to his impropriety by coercion or bribery."

26. Subparagraphs 10(a) and (c) are alleged to constitute "sensitive personal data" for the purposes of the DPA 1998 and "criminal offence data" for the purposes of the UK GDPR. Subparagraphs 9(a) and 10(b) are alleged to constitute "special category data" for the purposes of the UK GDPR (POC §12).
27. The Claimant pleads that by "preparing", "disseminating" and "retaining and storing" the Memoranda, the Defendant has "continued to process" the Personal Data (POC §13). The processing of which he complains is confined to the processing of the Memoranda themselves (POC §13). The "delivery" of the Memoranda to Fusion on 20 June 2016 and 14 September 2016 is pleaded (POC §§6 and 7). The "dissemination" is identified as being to (i) Strobe Talbott in early November 2016; (ii) to "an unknown UK government national security official on or around 15 November 2016"; and (iii) to David Kramer on or around 28 November 2016 (POC §8). The provision of various memoranda comprising the Dossier to the FBI was in the public domain (see e.g. Aven [51], [113], Gubarev [90(i)])^[1], but no reliance is placed on disclosure of the Memoranda to the FBI in the Particulars of Claim.
28. Paragraphs 14 to 16 of the Particulars of Claim address the processing of the Claimant's data "up until 25 May 2018". The Claimant has pleaded breaches of the First and Fourth Data Protection Principles, set out in Schedule 1 to the DPA 1998. Specifically, he contends (POC §16) that (i) the Defendant's processing does not meet any of the requirements of Schedule 2 to the DPA 1998; (ii) the Defendant's processing of the Claimant's sensitive personal data does not meet any of the requirements of Schedule 3 to the DPA 1998; (iii) the processing was "not fair in that the processing includes the dissemination of data to third parties in circumstances in which the Claimants were given no notice of the processing nor opportunity to comment on the accuracy of the data"; and (iv) the Personal Data was not accurate in that:

"(i) The Claimant did not engage in perverted sexual behaviour and did not hire of [sic] prostitutes to engage in 'golden showers' in the presidential suite of a hotel in Moscow;

(ii) The Claimant did not take any steps to defile the bed in which President and Mrs Obama had slept;

(iii) The Claimant did not engage in unorthodox behaviour in Russia and did not act in which a way [sic] that Russian authorities were provided with material to blackmail him;

(iv) The Claimant did not pay paid [sic] bribes to Russian officials in order to further his business interests;

(v) The Claimant did not take part in 'sex parties' when in St Petersburg; and

(vi) The Claimant did not arrange for or conspire in the silencing of all direct witnesses to his impropriety by coercion or bribery."

29. Paragraphs 17 to 20 of the POC address the "continued processing" after 25 May 2018. The pleaded claim is that in breach of article 5(1) of the UK GDPR (i) none of the conditions of article 6(1) are met; (ii) in relation to criminal offence data, none of the conditions listed in Schedule 1 to the DPA 2018 are met; (iii) in relation to special category data, none of the conditions in article 9 are met; and (iv) the Personal Data is not accurate (POC §20).
30. The Prayer at the end of the Particulars of Claim states that the Claimant claims:

"(1) Damages including aggravated damages pursuant to section 13 of the DPA 1998.

(2) Compensation pursuant to Article 82 of the UK GDPR and section 168 of the DPA 2018_[._]

(3) A Compliance Order under s.167 of the DPA 2018 requiring the Defendant to erase and/or restrict further processing of the Personal Data.

(4) Further or other relief."

31. In respect of the claim for "damages" or "compensation" the pleading states that "the Claimant has suffered personal and reputational damage and distress" (POC §21). He relies on the following (POC §22):

"(a) The processing of false, intrusive and damaging allegations about the Claimant's personal life.

(b) The Claimant was compelled to explain to his family, friends and colleagues that the embarrassing allegations about his private life were untrue. This was extremely distressing for the Claimant.

(c) The Defendant's dissemination of the Personal Data in the Memoranda to Fusion and other third parties, the scope of which remains unknown to the Claimant at this time.

(d) The processing of false allegations about the Claimant's private life, which were presented in sensationalist manner and calculated to cause tremendous embarrassment to the Claimant, who is a well-known figure in the public eye.

(e) The Claimant had suffered damage to his reputation as a consequence of the Defendant's processing of the Personal Data by disclosure to the individuals set out at paragraph 8 above [i.e. Mr Talbott, Mr Kramer and a UK government national security official]."

The Applications

32. Following the letter of 22 February 2023, the Claimant's and Defendant's solicitors engaged in correspondence. In short, the Claimant sought the Defendant's consent to amend the Claim Form pursuant to CPR 17.1(2)(a). As I have indicated, the Defendant has agreed to removal of Mr Steele as a defendant, but the Court's permission was required (and has now been given) to make that amendment (CPR 17.1(3) and 19.4(1)). The Defendant has refused to consent to the other proposed amendments.
33. On 3 April 2023, the Claimant submitted the Amendment Application, supported by the first witness statement of Timothy Lowles, the Claimant's solicitor ('Lowles 1'). On 26 May 2023, the Defendant filed the Strike Out Application, supported by the first witness statements of Alex Keenlyside, the Defendant's solicitor ('Keenlyside 1'), and of Mr Steele ('Steele 1'). Mr Keenlyside filed a further short, clarificatory statement a few days later ('Keenlyside 2').
34. Nicklin J made directions on 9 June 2023 for the listing of the hearing together of both applications. Pursuant to that order, the parties each filed responsive evidence in the form of the Claimant's first statement dated 27 July 2023 ('Trump 1'); Mr Lowles' second statement dated 28 July 2023 ('Lowles 2'); and, for the Defendant, the third statement of Mr Keenlyside ('Keenlyside 3'), second statement of Mr Steele ('Steele 2') and the first statement of Luke Davis of Pen Test Partners, an IT company ('Davis 1'), all dated 15 September 2023.
35. In accordance with CPR 3.4(7), pending determination of the Strike Out Application, the Defendant has not filed a defence.

C. The Amendment Application

The relevant provisions

36. CPR 17.1 provides, as far as material:

"(1) A party may amend their statement of case, including by removing, adding or substituting a party, at any time before it has been served on any other party.

(2) If his statement of case has been served, a party may amend it only –

(a) with the written consent of all the other parties; or

(b) with the permission of the court."

(The meaning of the term "statement of case" includes "a claim form": CPR 2.3(1).)

37. CPR 17.2 provides:

"(1) If a party has amended their statement of case where permission of the court was not required, the court may disallow the amendment.

(2) A party may apply to the court for an order under paragraph (1) within 14 days of service of a copy of the amended statement of case on them."

38. CPR 17.4 provides, as far as material:

"(1) This rule applies where –

(a) a party applies to amend their statement of case in one of the ways mentioned in this rule; and

(b) a period of limitation has expired under –

(i) the Limitation Act 1980; or

(ii) the Foreign Limitation Periods Act 1984; or

(iii) any other enactment which allows such an amendment, or under which such an amendment is allowed.

(2) The court may allow an amendment whose effect will be to add or substitute a new claim, but only if the new claim arises out of the same facts or substantially the same facts as are already in issue on a claim in respect of which the party applying for permission has already claimed a remedy in the proceedings."

Is the Defendant's objection a technical one?

39. Mr Tomlinson accepts that the Defendant is entitled to take a technical point if it wishes. Nonetheless, he submits that the Court's consideration of the Defendant's objection to the Amendment Application should be informed by an understanding that there is no reason of substance to object: the point taken is wholly technical. In support of this contention Mr Tomlinson relies on the fact that the Claimant could have amended the Claim Form without permission before it was served pursuant to CPR 17.1(1).
40. Mr Tomlinson informs me that the Claimant had electronically filed the Amended Claim Form on 22 February 2023. If the court had immediately sealed and returned the Amended Claim Form the same day, then the Claimant would have served it on the Defendant. However, the deadline for service of particulars of claim was due to expire imminently: see CPR 7.5(1) and paragraph 15 above. In those circumstances, the Claimant could not delay service of proceedings and so served the original Claim form.
41. Mr Antony White KC resists the characterisation of the Defendant's objection as merely technical. The objection is based on the expiry of the limitation period. The Defendant would have taken the same objection, even if the Claimant had acted in time to serve the Amended Claim Form pursuant to CPR 17.1(1), albeit the Defendant would have had to apply pursuant to CPR 17.2 for the amendment to be disallowed.
42. An objection based on the expiry of a limitation period can always be described as technical, but such characterisation does not alter its effectiveness. It is true that if the Claimant had filed the Amended Claim Form a day or two earlier, he would have been able to serve the sealed version without permission, and the onus would have been on the Defendant to apply to have the amendment disallowed. But the court would undertake essentially the same exercise if the amendment had been made and challenged under CPR 17.2, of considering whether the amendment would have been permitted under CPR 17.4(2): see Libyan Investment Authority v King [2020] EWCA Civ 1690 [2021], 1 WLR 2659, Nugee LJ, [62]. The Claimant only has his own delay to blame for the fact that he has had to apply for permission to amend. Whether the Amendment Application should be allowed depends on the application of the relevant rules of the CPR.

Does CPR 17.4 apply?

43. The first question is whether the proposed amendment is one to which CPR 17.4 applies. The Claimant's primary submission is that the proposed amendment clarifies an internal inconsistency between the Claim Form and POC and, as a result, does not raise a new claim after the expiry of the limitation period. In support of this submission the Claimant relies on Evans v Cig Mon Cymru [2008] 1 WLR 2675, and the statement in paragraph 17.4.4.2 of the White Book 2023, relying on Evans, that:

"Amending a claim form to specify a cause of action not previously mentioned therein does not raise a new cause of action if the amendment is made simply to resolve an obvious inconsistency between the claim form and the particulars of claim served with it. In deciding whether the amendment raises a new cause of action the court should consider the proposed amendment in the context of the statements of case as a whole, not just the claim form by itself."

44. While acknowledging that the court in Evans referred to a "clerical error", Mr Tomlinson submits the essence of the ruling is that the statement of case has to be looked at as a whole and the court should resolve obvious inconsistencies. In support of the same argument, the Claimant also relies on Wright v McCormack [2021] EWHC 2671 (QB), [2022] EMLR 10 in which Julian Knowles J applied Evans, and the statement in the White Book of the principle established by that case (quoted in paragraph 43 above), granting permission to amend the claim form: see Wright v McCormack, [107]-[114].
45. In response, the Defendant submits that the Claim Form cannot be interpreted as including the 1998 Act claim. Evans does not assist the Claimant as there is no evidence here of a mistake: Mr Lowles has not said so, even in response to Mr Keenlyside's statement expressly giving him an opportunity to do so (Keenlyside 1 §36). Mr White submits that it is clear, on the authorities relied on by the Claimant, and applying Corelogic Ltd v Bristol City Council [2013] EWHC 2088 (TCC), 149 Con. LR 225 and Libyan Investment Authority, that CPR 17.4 applies.
46. In Evans, the claimant sought to claim damages for personal injuries allegedly caused by an accident at work. A claim form was issued which stated under "Brief details of claim" that it was for "loss and damage arising out of abuse at work". It was not disputed that the claimant's solicitors' "instructions and intention were to issue proceedings in respect of the accident at work" (Evans, Toulson LJ, [10]). The reference to "abuse" rather than an "accident" at work was described by Toulson LJ as a "clerical error", "a purely administrative error" and "an obvious formal error" (Evans, [1], [10], [26]), and by Arden LJ as "an obvious clerical error" (Evans, [30]). The letter serving the claim form, particulars of claim, schedule of loss and a medical report made clear that the claim was intended to be for damages for an accident at work. On realising their mistake, the claimant's solicitors applied to amend the claim for by substituting "an accident" for the word "abuse". A district judge held that CPR 17.4 precluded the court from permitting the amendment as the limitation period had expired. His decision was upheld on appeal to a circuit judge. The Court of Appeal allowed the claimant's appeal.
47. Toulson LJ emphasised that in the CPR the term "statement of case" "refers compendiously to a party's case as set out in its pleadings" (Evans, [19], [25]). Toulson LJ held at [26], in a passage which contains the ratio:

"In my view the just approach is to look at the totality of the documents served. These documents together set out the claimant's pleaded case. There was an obvious mismatch, but in asking whether the proposed amendment was, in truth, an amendment to raise a new cause of action or merely to clarify an internal inconsistency in the pleaded case is, it is proper to look at the pleaded case as a whole. When one does so, it is clear, in my judgment, that what was sought to be done by the subsequent application to amend was not, in substance, to raise any new claim at all, but merely to correct an obvious formal error. I reject the argument that an amendment to correct that clerical error was prohibited by rule 17.4 and, in my judgment, there was nothing to prevent the court from exercising its general discretion to do justice in response to the application to strike out the particulars of claim."

48. Arden LJ agreed with Toulson LJ (Evans, [27]). She emphasised that the claimant's solicitors had sent a pre-action letter setting out the proposed claim, referring to the accident causing an injury to the claimant's hand. She said at [30]:

"In my judgment, on the ordinary rules of interpretation, the court would say that the words 'abuse at work' in a claim form are an obvious clerical error which can been corrected, as a matter of interpretation, to accord with their objective meaning in the context or in the light of the factual matrix – namely, accident at work. The interpretative exercise which is needed is as simple as substituting for the word 'abuse' the word 'accident'."

49. Arden LJ described the decision as "strik[ing] a blow in favour of the more cooperative approach to matters of procedure which was, surely, one of the purposes of the new procedural code contained in the Civil Procedure Rules" ([33]). Laws LJ agreed with both judgments. Mr Tomlinson submits his observation, at [35], is pertinent:

"The decisions below represent a stark surrender of substance to form. We should not allow such a thing unless irresistibly driven to do so. For the reasons given by Toulson and Arden LJJ, we are not so driven."

50. In my judgment, the fact that the inconsistency in Evans arose as a result of an obvious clerical or administrative error was clearly central to the court's decision (cf the passage of the White Book cited in paragraph 43 above). Although Julian Knowles J cited that passage in Wright v McCormack, he did not take from it, or from Evans itself – as Mr Tomlinson urges me to do – that it is enough that there is an obvious inconsistency, even if there was no obvious clerical error. On the contrary, the Evans principle applied in Wright v McCormack because the judge accepted the evidence that it was "a case of inadvertent administrative oversight by the Claimant's legal team" which could "properly be described as 'an obvious formal error" ([110]). In Wright v McCormack, in his amended particulars of claim, the claimant had pleaded his claim in respect of four publications that had been published after the claim form had been issued, in addition to the ten publications referred to in the claim form. The defendant had consented to the amendment which was made well before the limitation period for bringing a claim in respect of those additional publications was due to expire. The claimant's representatives had inadvertently omitted to apply to amend the claim form at the same time, but in the circumstances Julian Knowles J observed that "no-one has ever been in any doubt about the scope of the Claimant's case" ([108]).
51. The Court of Appeal considered Evans in Libyan Investment Authority at [65]-[66] where Nugee LJ observed:

"… The reasoning is found in the judgments of Toulson LJ at para 26 and Arden LJ at paras 30-32 and is to the effect that the claim form, when read with the benefit of the particulars of claim served with it, contained an obvious clerical error. That meant it could be corrected as a matter of interpretation and hence that to substitute 'an accident' for 'abuse' in the claim form was not in truth to raise a new claim at all but to correct an error in expression of the claim that had been brought all along.

That seems to me to be a particular application of two well established principles applicable to the interpretation of documents, namely (i) that documents intended to be read together can be read together, and (ii) obvious mistakes can be corrected as a matter of interpretation. I have no difficulty with either proposition, or their application to the circumstances of that case, but they do not seem to me to establish Mr Onslow's proposition or have any direct bearing on the present case. There is here no difficulty in interpreting the amended claim form. It is clearly worded and no one has suggested that it is ambiguous, let alone that it contains a clerical error that can and should be corrected by reference to the particulars of claim."

52. In Corelogic the claimant relied on Evans in support of its application to amend its public procurement claim to add a new claim, outside the permitted time limit. Akenhead J refused the application. At [29] he said:

"There are significant differences between the current case and Evans' case. The first is that the particulars of claim were not served with the claim. The second is that no explanation is provided by either solicitor for Corelogic as to whether there was any error (clerical or formal) as such. Although service of the particulars of claim was deferred by agreement, it is absolutely clear that this pleading was to a significant degree informed by the contents of Bristol's letter of 30 April 2013 and the thought process which had gone into the response of 9 May 2013. It is rather difficult, on ordinary interpretation rules, therefore to say that the claim form drafted some ten weeks before can be interpreted by reference to the later document. For instance, statutes and contracts are not interpreted by reference to what was said or done after the contract was entered into or after the statute was enacted and there is no reason to think that a claim form can sensibly or properly be interpreted by reference to a later document and particularly one which has been drafted by reference to what has been said or has emerged after the claim form was drafted and issued in the first place. There was no doubt in Evans' case that there had obviously been some clerical or formal error in the drafting of the claim form. However that is not the case here."

53. I agree with Mr White that the key distinctions identified by Akenhead J in Corelogic are also present in this case. First, there is no explanation in evidence for the absence of any cause of action based on the DPA 1998 in the Claim Form. There is nothing to support any contention a clerical or administrative error was made in this case. On the contrary, the letter before claim indicates, unsurprisingly, the Claimant's solicitors were well aware of the 1998 Act, and of Aven, and intentionally brought the claim only under the DPA 2018 and the UK GDPR (see paragraphs 20-21 above).
54. Secondly, although the Particulars of Claim were served with the Claim Form, they were obviously not drafted contemporaneously. The Claim Form is dated 26 October 2022 whereas the Particulars of Claim are dated 21 February 2023. As in Corelogic, it is clear that the contents of the Particulars of Claim were informed to a significant degree by correspondence which followed the issuing of the Claim Form, specifically, Orbis' letter of 12 January 2023 (see paragraph 22 above). It was in light of that letter that the Claimant included in the Particulars of Claim a cause of action brought pursuant to the 1998 Act (and ceased to pursue the claim against Mr Steele).
55. Mr Tomlinson emphasises that in this case, unlike in Corelogic, the Particulars of Claim were served with the Claim Form. I recognise that contemporaneous service of the claim form and particulars of claim was part of the factual context on which the Court of Appeal placed reliance in Evans. However, the key context in Evans was that the obvious clerical error in the claim form was undisputed, and the error was apparent from correspondence sent prior to the claim form being issued. There was no suggestion in Evans that information acquired by the claimant following the issuing of the claim form had an impact on the contents of the particulars of claim. On the contrary, in Libyan Investment Authority Nugee LJ described them as "documents intended to be read together" (paragraph 51 above). Moreover, the modification of the words of the Claim Form required in this case is far more extensive than in Evans (where the inconsistency could be resolved by changing a single word).
56. I respectfully agree with Akenhead J that on ordinary rules of interpretation a claim form cannot be interpreted by reference to particulars of claim which were drafted months later, at least where the contents of the later document were informed to a significant degree by correspondence received after the claim form was issued. That was the case here, as it was in Corelogic.
57. In my judgment, this case does not fall within the principle established in Evans. There is no ambiguity in the Claim Form. The inconsistency between the Claim Form and the Particulars of Claim clearly arose because the Claimant reconsidered the scope of the claim that he wished to bring in light of the Defendant's response to the letter before claim. The inconsistency between the two documents was introduced as a result of intentional decisions first, when drafting the Claim Form, to rely only on the DPA 2018 and the UK GDPR and second, when later drafting the Particulars of Claim to also rely on the DPA 1998. In those circumstances, it cannot be said that differences between these documents should be resolved by interpreting the Claim Form, by reference to the Particulars of Claim, as including a claim under the DPA 1998. The inconsistency did not arise as a consequence of an obvious (or indeed any) clerical or administrative error and, in the circumstances, it cannot be said that these two non-contemporaneous documents were intended to be read together. Accordingly, I turn to the application of CPR 17.4.

Application of CPR 17.4: the four-stage test

58. It is common ground that when considering CPR 17.4 the court should apply the four-stage test approved by the Court of Appeal in Mullaley & Co Ltd v Martlet Homes Ltd [2022] EWCA Civ 32, [2022] 200 Con LR 1 at [38]:

"(i) Is it reasonably arguable that the opposed amendments are outside the applicable limitation period?

(ii) Did the proposed amendments seek to add or substitute a new cause of action?

(iii) Does the new cause of action arise out of the same or substantially the same facts as are already in issue in the existing claim?

(iv) Should the Court exercise its discretion to allow the amendment?"

59. If the answer to the first question is 'yes', the Court proceeds to consider the next question, and so on, until the final question is reached. If the answer to question (i) or (ii) is 'no', the amendments fall to be considered under the usual provision for amendment (CPR 17.1(2)(b)). If the answer to question (iii) is 'no' the court has no discretion to allow the amendment.

Question (i): Is it reasonably arguable that the opposed amendments are outside the applicable limitation period?

60. The first question reflects the principle that it is only appropriate to deprive a defendant of a limitation defence at the interlocutory stage if the claimant can demonstrate that the defence is not reasonably arguable: see Welsh Development Agency v Redpath Dorman Long Ltd [1994] 1 WLR 1409, 1425G-H and Ballinger v Mercer Ltd [2014] EWCA Civ 996 [2014] 1 WLR 3597, Tomlinson LJ, [27].
61. In this case, it is not in dispute that the answer to question (i) is 'yes'. That is plainly right. The limitation period applicable to claims under the DPA 1998 is six years: s.9 Limitation Act 1980. The Particulars of Claim make clear that the claim for breach of the DPA 1998 concerns:

i) Preparing the Memoranda, which was done by 20 June 2016 for Memorandum 080 and by 14 September 2016 for Memorandum 113. More than six years from preparation of the Memoranda had passed before the Claimant indicated any intention to bring a claim pursuant to the DPA 1998, by serving the Particulars of Claim on 24 February 2023 (and even before the original claim was issued), and a still longer period had passed before the application to amend was issued on 3 April 2023.

ii) Disseminating the Memoranda to Mr Talbott, Mr Kramer and "an unknown UK government national security official", which the Claimant has pleaded occurred on various dates in November 2016. Again, more than six years had passed from these acts of dissemination before the Claimant first indicated any intention to bring a claim pursuant to the DPA 1998, and still longer before the application to amend was issued.

iii) Retaining and storing the Memoranda which, on the Claimant's case, continued under the DPA 1998 from the dates on which the Memoranda were prepared until 24 May 2018, the day before the DPA 1998 was repealed. Part of this period is, on any view, out of time, while the six-year period has not expired in respect of the later part.

62. The Defendant contends that the limitation period is one year rather than six years. While it is not necessary to determine this contention for the purposes of answering question (i), the Defendant relies on it as showing that the delay is greater than the Claimant accepts, and time had expired before this claim was issued in respect of any processing under the DPA 2018, including any retention or storage prior to 25 May 2018.
63. In support of the contention that a one-year limitation period applies, Mr White relies on the observations of Warby J (as he then was) in Rudd v Bridle [2019] EWHC 893 (QB) and, more importantly, in Sicri v Associated Newspapers Ltd [2020] EWHC 3541 (QB), [2021] 4 WLR 9.
64. Rudd was a data protection claim. At the outset of the hearing, Warby J had expressed the clear, albeit provisional view that the issue of whether the processing was unwarranted was not squarely raised on the claimant's pleadings, and was not fit for trial; and the claimant then decided to proceed only with the claim under s.7: Rudd, [60(4)-(7)] and [61]. The statement relied on by Mr White is at [60(5)] where Warby J said:

"In this case, a decision under s.10 would surely require at least some consideration of the issues that would arise if the claim had been framed as a libel action… Otherwise, the law would lack coherence."

65. That statement should be read in the context of his earlier observation that if the claimant wished the court to grant him a remedy on the basis that the defendant had processed or was processing personal data which were inaccurate, it was incumbent on him to state his case with proper particularity and to prove it; and that the same must be true of any other basis for alleging that the processing was "unwarranted". Warby J made no reference in Rudd to the applicable limitation period for data protection claims: see, too, Sicri at [160] where Warby J summarised what he had said in this passage of Rudd, describing it as obiter, and again making no reference to limitation.
66. The judgment in Sicri concerned the tort of misuse of private information. It was not a data protection claim. The Defendant relies on a passage in [161] of Sicri where Warby J held:

"If the claim for reputational loss had been pursued by means of a claim in libel it would have been time-barred, and it is clear the defendant would have taken the point. An application to disapply the limitation period might have been made, but the claimant would have had to overcome the strong rule in the authorities, that such applications should only rarely succeed. He would also have had to persuade the court that it was just and equitable to make an order that would negate the 'single publication rule' in section 8 of the 2013 Act, by which Parliament sought to protect publishers from rolling liability for online content. To allow the same loss to be claimed by reliance on a different tort would remove any such obstacles, and so far from being necessary in a democratic society would seem to be inconsistent with the manifest intention of Parliament."

67. Mr White submits that in referring at [165(4)] to "the shadow limitation defence" Warby J was identifying the one-year limitation period that would apply to a claim for misuse of private information which sought to recover damages for reputational harm. The Defendant contends that it follows that the Claimant's claim for compensation for reputational damage must be subject to a one-year limitation period.
68. In my judgment, the Defendant's argument misunderstands Warby J's judgment in Sicri and is wrong in principle. Warby J was addressing the question whether the claimant could recover damages for injury to his reputation, in the context of a misuse of private information claim: [145] et seq. He observed that there was no authority that an individual can recover, in a misuse claim, damages for reputational injury caused by the publication of information that is defamatory but substantially true; and said, "I see no principled justification for allowing any such claim to be maintained in the newly discovered tort of misuse of private information" ([Sicri, [154]). He expressed the view that "there remains a good deal to be said today for the principle … that reputational damages are only available in defamation and limited other torts which are premised on the falsity of the information", observing:

"there would in my opinion be merit in a general rule that a claimant who seeks to clear his name of a defamatory imputation arising from a wrongful disclosure of private information, and to recover damages for reputational harm, should be required to bring a claim in defamation."

69. In Sicri at [161] Warby J held, first, that damages for reputational injury should not be awarded in misuse "without regard to the defences that would or might have been available had the claim been brought in defamation". A specific illustration of why that was so was provided in the passage quoted above (paragraph 66), noting that if the claim had been brought in libel it would have been time-barred. Secondly, Warby J decided that there was "no sufficiently compelling justification" for importing "the defamation principles" into the tort of misuse. Allowing what he described as "shadow libel actions" would be "a recipe for legal and procedural chaos (Sicri, [162]). Warby J's key holding was that: "damages for injury to reputation are not available in a claim for misuse of private information" (Sicri, [163]). His narrower basis for reaching the same result was "it would not be just, in all the circumstances, to award compensation for reputational harm" (Sicri, [164]). One of the factors in reaching the latter determination was that if the claim had been brought in defamation, the defendant would have relied on limitation (the primary limitation period having expired) (Sicri, [165(3)-(4)]).
70. It is clear that Warby J did not decide that ss.4A and 32A of the Limitation Act 1980 could or should be interpreted as extending to claims for reputational damage brought in misuse. Rather, he took into account the limitation provisions that would have applied if the claim had been brought in defamation (but did not apply to the misuse claim) in determining that damages for injury to reputation should not be made available in the "newly discovered tort of misuse of private information"; and in determining that, if reputational damages were available in principle, it would not be just to award them in the particular case.
71. In my judgment the limitation period set by Parliament for data protection claims is six years. There may be room for argument about whether that period applies pursuant to s.2 or s.9 of the Limitation Act 1980 (see Limitation Periods, McGee, 9^th ed. (2022), 11.003 and 11.006), but that has no impact on the period. As a matter of interpretation, it is clear that the one-year limitation period set for claims for "(a) libel or slander, or (b) slander of title, slander of goods or other malicious falsehood" by s.4A of the Limitation Act 1980 does not apply to data protection claims. Accordingly, I reject the Defendant's contention that the limitation period for this claim is one year.
72. However, that does not preclude the Court from considering the limitation period that would have applied if this claim had been brought in defamation, as Warby J did in Sicri. I consider this further below.

Question (ii): Did the proposed amendments seek to add or substitute a new cause of action?

73. As the answer to question (i) is 'yes', I proceed to the next question. Mr Tomlinson accepted (subject to the argument based on Evans, which I have rejected above), that the claim pursuant to the DPA 1998 which he seeks to add is a new cause of action. A claim brought under the DPA 1998 is brought under a different statutory regime to a claim under the UK GDPR or the DPA 2018. A claim under the DPA 1998 can only relate to processing of personal data which occurred before 25 May 2018, whereas a claim under the UK GDPR and/or the DPA 2018 can only relate to processing which occurred on or after that date. The mutually exclusive periods of processing to which the different claims relate, and the different statutory duties that apply under the different regimes, are reflected in the Particulars of Claim. Accordingly, there is no dispute that the answer to question (ii) is 'yes'.

Question (iii): Does the new cause of action arise out of the same or substantially the same facts as are already in issue in the existing claim?

74. The answer to question (iii) is in dispute. The Claimant contends that the new cause of action arises out of the same or substantially the same facts as are already in issue in the existing claim. The Defendant disagrees.
75. The approach the court should take in determining the answer to question (iii) has been considered in a number of authorities. It is established that "the same or substantially the same" is not synonymous with "similar" (Mullaley, Coulson LJ, [49] and [50]; Ballinger v Mercer Ltd [2014] EWCA Civ 996 [2014], 1 WLR 3597, Tomlinson LJ, [37]).
76. In Society of Lloyds v Henderson [2007] EWCA Civ 930, [2008] 1 WLR 2255, Buxton LJ (with whom Smith and Moore-Bick LJJ agreed) observed:

"53 Before us, it was argued that a new claim sufficiently 'arises out of' the same facts as an existing claim if there is a sufficient nexus between the old and the new claim, in the sense that some or a substantial part of the facts relied on to promote the new claim were relied on to promote the old claim. That takes far too broad an approach to the rule, which it effectively rewrites. The new claim does not arise out of the facts on which the old claim was based if, in order to prove it, new facts have to be added. That is why this court has said that the basic test is whether the plea introduces new facts: Goode v Martin [2002] 1 WLR 1828, para 42.

54 The additional possibility that the new facts are substantially the same as those already relied on is limited P & O Nedlloyd BV v Arab Metals Co [2005] 1 WLR 3733, para 42, per Colman J, to:

'something going no further than minor differences likely to be the subject of inquiry but not involving any major investigation and/or differences merely collateral to the main substance of the new claim, proof of which would not necessarily be essential to its success.'"

77. Whether one factual basis is "substantially the same" as another factual basis "must be a question of analysis" (Ballinger, Tomlinson LJ, [36], citing Paragon Finance plc v DB Thakerar & Co [1991] 1 All ER 400), albeit it may involve a "value judgment" (Ballinger, Tomlinson LJ, [34], citing BP Plc v Aon Ltd [2006] 1 Lloyd's Rep, [52]), and in a borderline case may be "substantially a matter of impression" (Ballinger, Tomlinson LJ, [35]-[36], citing Welsh Development Agency, 1418 and Paragon).
78. Judicial observations as to the policy underlying s.35 of the Limitation Act 1980 and CPR 17.4 are no substitute for applying the wording of those provisions: Libyan Investment Authority, Nugee LJ, [49]. Nonetheless, it can be inferred that in prohibiting an amendment to add or substitute a new claim, after the expiry of the limitation period, unless it arises out of the same or substantially the same facts as are already in issue in the existing claim, the intention was, as Colman J put it in Goode v Martin,

"to avoid placing a defendant in the position where if the amendment is allowed he will be obliged after expiration of the limitation period to investigate facts and obtain evidence of matters which are completely outside the ambit of, and unrelated to those facts which he could reasonably be assumed to have investigated for the purpose of defending the unamended claim."

See Libyan Investment Authority [47]-[49], Mullaley [50], and Lokhova v Longmuir [2016] EWHC 2579 (QB), [2017] EMLR 7, Warby J, [48].

79. Mr Tomlinson submits that the factual issues that are going to be litigated in the existing DPA 2018/UK GDPR claim are in substance the same as the issues arising in relation to the proposed DPA 1998 claim. The primary factual issue is whether the Personal Data was accurate. The pleaded facts in relation to the inaccuracy claim under DPA 1998 and DPA 2018/UK GDPR are identical (POC paragraphs 16c and 20(d)). The processing alleged in the DPA 1998 claim was earlier in time, but the Claimant submits there is no difference between the earlier and later processing. The pleaded factual basis on which the remedies are sought under the two statutory regimes is the same (POC §22).
80. Mr White submits that the existing claim can only be based on retention and storage of the Memoranda (since 25 May 2018), whereas the new compensation claim is based on the dissemination of the Memoranda in November 2016. The processing periods relied on in the existing claim and the proposed new claim are mutually exclusive. Mr White relies on Corelogic and Hoechst UK Ltd v Inland Revenue Commissioners [2003] EWHC 1002 (Ch) [2004] STC 1486 as showing that the stage (iii) test is unlikely to be met where the amendment is concerned with a different period. The accuracy issue is analogous, Mr White submits, to the legal basis of claim in Hoechst. While the legal basis was the same, and the background to the existing and proposed new causes of action was the same, the existing claim concerned the payment of a specific dividend and a consequential payment to the Revenue calculated by reference to that dividend, whereas the proposed amendments concerned the payment of other dividends on different dates, and in different amounts, resulting in different consequential payments to the Revenue. Those were not substantially the same facts (Hoechst, Park J, [34]).
81. I am not persuaded that the DPA 1998 claim which the Claimant seeks permission to add arises out of the same or substantially the same facts as are already in issue in the existing claim brought pursuant to the DPA 2018 and the UK GDPR.
82. I accept that the claims concern the same two Memoranda, and the Claimant's complaint of inaccuracy is identical. But the acts of data processing on which the claims for remedies are based are entirely different. First, the claim in respect of "preparing the Memoranda" (POC §13) could only be brought pursuant to the DPA 1998 because the Memoranda must have been prepared prior to 20 June 2016 and 14 September 2016, respectively, when the Claimant has pleaded that they were first delivered to Fusion. Indeed, Mr Tomlinson acknowledged during oral argument that a claim in respect of preparation of the Memoranda in June and September 2016 is not maintainable (describing it as "exuberance on the part of the pleader"). That concession was plainly right given that the six-year limitation period had already expired in respect of those processing acts before the original claim form was issued.
83. Secondly, at the heart of the DPA 1998 claim are the acts of dissemination of the Memoranda in November 2016 to the three recipients identified in paragraph 8 of the Particulars of Claim. Allegations of data breaches in respect of those data processing acts were not, and could not have been, brought within the existing claim because the UK GDPR and DPA 2018 are only concerned with data processing on or after 25 May 2018. The allegations of breach include the entirely new allegation that the processing of the Personal Data was not fair, and so breached the First Data Protection Principle, because the Memoranda were disseminated to third parties in circumstances in which the Claimant was given no notice of the processing nor opportunity to comment on the accuracy of the data. That is not an allegation that arises in respect of the existing claim which is necessarily only concerned with storage and retention of the Memoranda on or after 25 May 2018.
84. Thirdly, the time periods which are the subject of the existing claim, and of the proposed new claim, are mutually exclusive. So even the claim in respect of storage and retention which spans the period before and after 25 May 2018 necessarily concerns a different period of time in the existing claim compared to the proposed new claim.
85. Although paragraph 22 of the Particulars of Claim claims "damages" pursuant to both the DPA 1998 and the UK GDPR/DPA 2018 (albeit the term used in s.13 of the DPA 1998 and article 82 of the UK GDPR is "compensation"), the matters relied on concern the acts of processing in respect of which no claim was or could have been brought under the UK GDPR/DPA 2018. This is made plain by the particulars given in paragraph 22. Those at 22(c) and (e) are expressly based on the "dissemination" of the Memoranda, while 22(d) is concerned with their preparation (alleging false allegations were "presented in [a] sensationalist manner and calculated to cause tremendous embarrassment to the Claimant"). Paragraph 22(b) alleges the Claimant was "compelled to explain to his family, friends and colleagues that the embarrassing allegations about his private life were untrue", and that this was "extremely distressing for the Claimant". This must necessarily be based on processing that is said to have brought the Memoranda to the attention of family, friends and colleagues, and not on the existing allegation of retention and storage on or after 25 May 2018 which is the sole form of data processing of which complaint is made in the existing proceedings.
86. The new claim does not arise out of the facts on which the old claim was based. To prove it, new facts have clearly had to be added and would need to be investigated if permission were to be granted. For example, the details of the dissemination of the Memoranda in November 2016 are not relevant to the existing claim. Evidence would be required to address the reasons for dissemination to the identified individuals without giving notice or an opportunity to comment (or otherwise addressing that allegation), and the fairness of doing so, which would not be an issue in the existing claim. It would also be necessary to investigate the allegation of damage to the Claimant's reputation as a result of the pleaded dissemination of the Memoranda, a matter which is not in issue in the existing claim.
87. Accordingly, I conclude that the new claim pursuant to the DPA 1998 does not arise out of the same facts or substantially the same facts as are already in issue in the existing claim. In the circumstances, the power contained in CPR 17.4(2) does not apply. I have no discretion to exercise with respect to the Amendment Application which must be dismissed.

Question (iv): Should the Court exercise its discretion to allow the amendment?

88. As the answer to question (iii) is 'no', question (iv) does not arise. Nevertheless, in case I am wrong, I shall briefly address the question of discretion. I would have declined to grant permission to add the DPA 1998 claim as a matter of discretion for these reasons:

i) The claim in respect of preparation of the Memoranda was out of time before even the original claim form was issued. As Mr Tomlinson acknowledged, that part of the proposed new claim is not maintainable (paragraph 82 above).

ii) The core of the new claim is based on the pleaded acts of dissemination in November 2016, and alleged consequential damage to the Claimant's reputation. It is not merely "reasonably arguable" that the proposed new cause of action based on dissemination is outside the applicable limitation period. It is plain that it is. The first indication that the Claimant had any intention to bring a claim pursuant to the DPA 1998 was given in the Particulars of Claim which were served on 24 February 2023 (paragraph 23 above), at least three months after the six year limitation period had expired, and the Amendment Application was issued over five weeks later, on 3 April 2023 (paragraph 33 above).

iii) The Claimant has given no explanation for the delay. The only response to this issue given by the Claimant is that between January 2017 and January 2021, he served as President of the United States. He states that during this period he was "focused on serving the American people and dealing with a number of major national and international issues such as economic growth, domestic and foreign policies, immigration and the Covid-19 pandemic to name but a few" (Trump 1, §36). The Defendant points out that the Claimant did pursue other litigation during his presidency. But in any event an obstacle which, at its highest, was only present until January 2021 is no answer. If a DPA 1998 claim in respect of the preparation and dissemination of the Memoranda had been brought at any time in the 16 months after the Claimant's term as President of the United States ended, it would have been within time. As Mr Tomlinson candidly acknowledged, the Claimant only chose to bring the claim at the last possible moment. That is true of the existing claim: he has sought to bring the proposed new claim after the last possible moment, and has to take the consequences.

iv) At its heart, the new claim is one by which the Claimant seeks to vindicate his reputation. The rationale underlying the basic one-year limitation period for a defamation claim is that a person whose reputation has been traduced should pursue legal redress with vigour: Gatley on Libel and Slander 13^th ed (2022), §20.009. In Sicri, at [159], Warby J described "the unique limitation regime provided for in defamation and malicious falsehood" as being among the "wider safeguards for freedom of expression" contained in defamation law. As explained above, I have rejected the Defendant's contention that the one-year limitation period that would have applied if the Claimant had brought a defamation claim in respect of the Memoranda applies to this data protection claim. Nonetheless, it seems to me that in exercising any discretion to allow an amendment to add a new cause of action after the expiry of the applicable six year limitation period, where the new claim seeks damages for harm to reputation, it is appropriate to have regard to the policy of the law that a person who wishes to vindicate their reputation should proceed expeditiously. If, as in this case, there is no or no adequate explanation for a long delay in taking such action, that may be – and is in this case – a weighty factor in the court's assessment of whether, as a matter of discretion, to allow the new claim to be pursued by amendment.

v) I do not accept the Claimant's submission that the Defendant would not be prejudiced by the delay if I were to grant the Amendment Application. The effect would be to deprive the Defendant of an accrued limitation defence. That is particularly pertinent in circumstances where the Defendant and Mr Steele have already had to shoulder the burden of dealing with litigation arising from the Dossier which was brought in time in this jurisdiction (Aven and Gubarev), as well as litigation in the United States (the RICO case).

vi) Bearing in mind that the DPA 1998 claim based on storage and retention of the Memoranda is partially in time, I have considered whether to grant permission on the Mastercard basis, that is that for limitation purposes the amendments should be deemed not to date back to the issue of the claim form but to the date of the application to amend: Mastercard Inc v Deutsche Bahn AG [2017] EWCA Civ 272 [2017] CP Rep 26, Libyan Investment Authority, [22]). However, I would not have done so given that is not a course that the Claimant submitted I should take (even in the alternative). The retention and storage claim brought pursuant to the DPA 1998 appears to add little to the existing claim, but in any event refusal of the Amendment Application would not prevent the Claimant bringing such a claim.

89. In view of my conclusion that I have no discretion, and if I did I would not have exercised it for the reasons given above, I consider it unnecessary to address the further bases on which the Defendant sought to oppose the application (that is, alleged lack of a reasonable prospect of success and improper purpose in bringing the claim).
90. For the reasons I have given, the Amendment Application is dismissed.

D. The Strike Out Application

91. CPR 3.4(2) provides that the court may strike out a statement of case, or part of one:

"… if it appears to the court –

(a) that the statement of case discloses no reasonable grounds for bringing or defending the claim;

(b) that the statement of case is an abuse of the court's process or is otherwise likely to obstruct the just disposal of the proceedings; or

(c) that there has been a failure to comply with a rule, practice direction or court order."

92. CPR 24.3 allows the court to give summary judgment against a claimant on the whole of a claim, or on a particular issue, if it considers:

"(a)… that the party has no real prospect of succeeding on the claim, defence or issue; and (b) there is no other compelling reason why the case or issue should be disposed of at a trial."

The legal principles

93. In Duchess of Sussex v Associated Newspapers Limited [2020] EWHC 1058 (Ch), [2020] EMLR 21 ("Sussex (1)"), at [33], Warby J addressed the core principles to be applied when considering an application to strike out under CPR r.3.4(2). As in this case, the application was brought by a defendant, relying on sub-rules (a) and (b), seeking to strike out part of the particulars of claim (albeit, in this case, the Defendant seeks to strike out the whole statement of case). The relevant principles are:

"(2) An application under CPR 3.4(2)(a) calls for analysis of the statement of case, without reference to evidence. The primary facts alleged are assumed to be true. The Court should not be deterred from deciding a point of law; if it has all the necessary materials it should 'grasp the nettle': ICI Chemicals & Polymers Ltd v TTE Training Ltd [2007] EWCA Civ 725, but it should not strike out under this sub-rule unless it is 'certain' that the statement of case, or the part under attack discloses no reasonable grounds of claim: Richards (t/a Colin Richards & Co) v Hughes [2004] EWCA Civ 266 [2004] PNLR 35 [22]. Even then, the Court has a discretion; it should consider whether the defect might be cured by amendment; if so, it may refrain from striking out and give an opportunity to make such an amendment.

(3) Rule 3.4(2)(b) is broad in scope, and evidence is in principle admissible. The wording of the rule makes clear that the governing principle is that a statement of case must not be 'likely to obstruct the just disposal of the proceedings'. Like all parts of the rules, that phrase must be interpreted and applied in the light of the overriding objective of dealing with a case 'justly and at proportionate cost'. The previous rules, the Rules of the Supreme Court, allowed the court to strike out all or part of a statement of case if it was 'scandalous', a term which covered allegations of dishonesty or other wrongdoing that were irrelevant to the claim. The language is outmoded, but I agree with [Counsel for the Defendant] that the power to exclude such material remains. Allegations of that kind can easily be regarded as 'likely to obstruct the just disposal' of proceedings.

(4) 'Abuse of process' is a sub-set of category (b). An abuse of process is a significant or substantial misuse of the process. It may take a variety of forms. Typical examples are proceedings which are vexatious, or attempts to re-litigate issues decided before, or claims which are 'not worth the candle' (Jameel v Dow Jones & Co Inc [2005] EWCA Civ 75 [2005] QB 946). But the categories are not closed."

94. In Higinbotham (formerly BWK) v Teekhungam [2018] EWHC 1880 (QB), at [41], Nicklin J summarised the principles that apply where a party seeks to establish abuse of process on the ground of improper or collateral purpose:

"i) Court proceedings may not be used or threatened for the purpose of obtaining for the person so using or threatening them some collateral advantage to himself, and not for the purpose for which such proceedings are properly designed and exist (JSC BTA Bank v Ablyazov (No.6) [2011] 1 WLR 2996 [3] quoting Lord Evershed MR in In re Marjory; ex p The Debtor v FA Dumont Ltd [1955] Ch 600, 623-624);

ii) Legal process is used properly when it is invoked for the vindication of a person's rights or the enforcement of just claims. It is abused when it is diverted from its true course so as to serve extortion or oppression: or to exert pressure so as to achieve an improper end (Ablyazov [4]; Goldsmith v Sperrings Ltd [1977] 1 WLR 478, 489 per Lord Denning MR).

iii) A claimant's motive and intention as such are irrelevant: the fact that a party who asserts a legal right is activated by feelings of personal animosity, vindictiveness or general antagonism towards his opponent is nothing to the point: Ablyazov [10]; Broxton v McClelland [1995] EMLR 485, 497-498 per Simon Brown LJ;

iv) Accordingly, the institution of proceedings with an ulterior motive is not of itself enough to constitute an abuse: an action is only that if the court's processes are being misused to achieve something not properly available to the plaintiff in the course of properly conducted proceedings: Broxton v McClelland, supra.

v) The cases appear to suggest two distinct categories of such misuse of process:

a) achievement of a collateral advantage beyond the proper scope of the action. In such cases, the difficulty is deciding where precisely falls the boundary of such impermissible collateral advantage (see Bridge LJ's judgment in Goldsmith v Sperrings Ltd (at p.503D-H); and/or

b) conduct of the proceedings themselves, not to vindicate a right, but to cause the defendant problems of expense, harassment, commercial prejudice or the like beyond those ordinarily encountered during properly conducted litigation (cf Wallis v Valentine [2003] EMLR 8 [28] and [34] per Sir Murray Stuart-Smith.

Broxton v McClelland, supra.

vi) The test of the claimant's motive is objective: Wallis v Valentine [32] per Sir Murray Stuart-Smith;

vii) The merits of the claims sought to be brought are relevant where it is suggested that a claim is brought for mixed purposes. A good arguable claim may indicate that the proceedings were brought, at least in part, for a legitimate purpose: Ablyazov [24].

viii) Only in the most clear and obvious case will it be appropriate, upon preliminary application, to strike out proceedings as an abuse of process so as to prevent a claimant from bringing an apparently proper cause of action to trial: Broxton v McClelland, supra."

95. In the context of an application for summary judgment, there is no assumption that what is asserted in the Particulars of Claim is true; evidence to the contrary is admissible, and is commonly adduced by the applicant and by the respondent: HRH The Duchess of Sussex v Associated Newspapers Ltd [2021] EWHC 273 (Ch), [2021] 4 WLR 35 ('Sussex (2)'), Warby J, [12].
96. The classic exposition of the right approach to summary judgment was given by Lewison J (as he then was) in Easyair Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch) at [15] (approved by the Court of Appeal in AC Ward & Son Ltd v Catlin (Five) Ltd [2009] EWCA Civ 1098; [2010] Lloyd's Rep IR 301; and see Sussex (2), [13]) (citations omitted):

"i) The court must consider whether the claimant has a 'realistic' as opposed to a 'fanciful' prospect of success …

ii) A 'realistic' claim is one that carries some degree of conviction. This means a claim that is more than merely arguable …

iii) In reaching its conclusion the court must not conduct a 'mini-trial'…

iv) This does not mean that the court must take at face value and without analysis everything that a claimant says in his statements before the court. In some cases it may be clear that there is no real substance in factual assertions made, particularly if contradicted by contemporaneous documents …

v) However, in reaching its conclusion the court must take into account not only the evidence actually placed before it on the application for summary judgment, but also the evidence that can reasonably be expected to be available at trial …

vi) Although a case may turn out at trial not to be really complicated, it does not follow that it should be decided without the fuller investigation into the facts at trial than is possible or permissible on summary judgment. Thus the court should hesitate about making a final decision without a trial, even where there is no obvious conflict of fact at the time of the application, where reasonable grounds exist for believing that a fuller investigation into the facts of the case would add to or alter the evidence available to a trial judge and so affect the outcome of the case …

vii) On the other hand, it is not uncommon for an application under Part 24 to give rise to a short point of law or construction and, if the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and that the parties have had an adequate opportunity to address it in argument, it should grasp the nettle and decide it. The reason is quite simple: if the respondent's case is bad in law, he will in truth have no real prospect of succeeding on his claim … Similarly, if the applicant's case is bad in law, the sooner that is determined, the better. If it is possible to show by evidence that although material in the form of documents or oral evidence that would put the documents in another light is not currently before the court, such material is likely to exist and can be expected to be available at trial, it would be wrong to give summary judgment because there would be a real, as opposed to a fanciful, prospect of success. However, it is not enough simply to argue that the case should be allowed to go to trial because something may turn up which would have a bearing on the question of construction …"

DPA 1998 claim

97. The cause of action under the DPA 1998 pleaded in the Particulars of Claim falls outside the scope of the causes of action and remedies pleaded in the Claim Form. As I have refused the application to amend the Claim Form to add a claim under the DPA 1998, applying CPR 17.4, it inevitably follows that the cause of action and remedies claimed pursuant to that statute in the Particulars of Claim must be struck out. The decision to strike out perhaps most naturally falls within CPR 3.4(2)(a) as the statement of case (which term includes the claim form) discloses no reasonable grounds for bringing the DPA 1998 claim; but it may also be regarded as falling within sub-rule (c) as the Claim Form does not contain, with respect to the proposed DPA 1998 claim, the information required by CPR 16.2(1)(a) or (b).
98. The compensation claim is based on the allegation that the Claimant has suffered "personal and reputational damage" and "distress" (POC §21, see paragraph 31 above). The Claimant accepts that the Defendant is not responsible in law for the publication of the Memoranda by BuzzFeed (both through Counsel and in his own evidence: Trump 1 §§13 and 39). The Claimant acknowledges that the reputational damage claim is confined to the three disclosures in November 2016 (POC §8), and therefore the claim for damages for reputational harm is "only maintainable if the amendment application is successful". It follows that insofar as the claim is for compensation for reputational harm, it falls to be struck out pursuant to my decision refusing the Amendment Application.
99. Irrespective of the merits of the application to strike out or for summary judgment on the whole statement of case, the following parts of the Particulars of Claim must, in any event, be removed:

i) POC §1: "and was, for the purposes of processing which occurred up to 25 May 2018, a data subject within the meaning of s.1(1) of the Data Protection Act 1998 ("the DPA 1998")."

ii) POC §3: "s.1(1) of the DPA 1998 and/or".

iii) POC §8. The whole of this paragraph addresses dissemination of the Dossier, including the Memoranda, which is of no relevance to the UK GDPR / DPA 2018 claim.

iv) POC §12: "is sensitive personal data for the purposes of the DPA 1998. It further constitutes".

v) POC §13: "preparing the Memoranda, disseminating copies of them to third parties,".

vi) The subheading above POC §14 "Personal Data Processed up until 25 May 2018".

vii) POC §§14-15. These paragraphs address duties under the DPA 1998.

viii) POC §16. This paragraph alleges breaches of duties arising under the DPA 1998. Subject to the Strike Out Application, §20(d), which repeats §16(c) in the context of the claim for breach of the UK GDPR, would need to be amended to incorporate particulars regarding inaccuracy currently pleaded in §16(c).

ix) POC §21: "personal and reputational damage and"

x) POC §22: "the DPA 1998 and/or"

xi) POC §§22(b), (c), (d) and (e). Although these subparagraphs appear in a paragraph that is addressing the existing claim, as well as the DPA 1998 claim, each is obviously dependent on the existence of a claim in respect of preparation and/or dissemination of the Personal Data. Subparagraph (b) alleges the Claimant was "compelled to explain to his family, friends and colleagues that the embarrassing allegations about his private life were untrue". That allegation is necessarily dependent on processing that resulted in the Personal Data coming to the attention of family, friends and colleagues. It cannot be based on retention and storage from May 2018, in circumstances where the Memoranda have been publicly accessible on the internet since their publication by BuzzFeed on 10 January 2017. Subparagraphs (c) and (e) are expressly concerned with dissemination. Subparagraph (d) addresses the manner of presentation of the "false allegations about the Claimant's private life", and so can only be based on the acts of preparation and/or dissemination, not retention and storage from May 2018.

xii) POC Prayer § (1): "Damages including aggravated damages pursuant to section 13 of the DPA 1998."

UK GDPR / DPA 2018 claim

100. In light of my conclusion on the Amendment Application, the next question is whether, in respect of the remaining part of the pleaded claim, the Claimant has reasonable grounds for claiming, or a real prospect of obtaining, either of the remedies sought (namely, compensation or a compliance order). The Defendant submits that he does not and so the claim should be struck out pursuant to CPR 3.4(2)(a) and/or summary judgment granted. In addition, or alternatively, the Defendant contends the claim is an abuse of process and should be struck out pursuant to CPR 3.4(2)(b).

Compensation

101. The Claimant seeks compensation pursuant to article 82 of the UK GDPR and s.168 of the DPA 2018 which provide as far as relevant:

"Article 82

1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered."

Section 168

"(1) In Article 82 of the UK GDPR (right to compensation for material or non-material damage), 'non-material damage' includes distress."

102. As the DPA 1998 claim, and the claim for compensation for reputational harm, have fallen away, what is left of the pleaded claim for compensation reads:

"21. By reason of the Defendant's breaches of his data protection rights, and in particular, the Defendant's processing of his inaccurate personal data, the Claimant has suffered … distress.

22. In support of his claim for damages under … the UK GDPR and/or the DPA 2018 the Claimant will rely on the following:

(a) The processing of false, intrusive and damaging allegations about the Claimant's personal life."

103. The Defendant submits that the Claimant has no prospect of obtaining compensation for alleged embarrassment or distress. Even if the DPA 1998 claim had stood, the Defendant's submission was that the only pleaded particulars of embarrassment and distress (POC §22(b) and (d)) – alleging embarrassment and distress as a consequence of the Memoranda becoming known to the Claimant's family, friends and colleagues, and to the public at large – could logically only be consequences of Buzzfeed's publication of the Memoranda to the world at large, rather than the Defendant's dissemination of them to the three individuals pleaded at paragraph 8 of the Particulars of Claim. But the claim based on dissemination has been struck out.
104. The only processing that remains is retention and storage from 25 May 2018. There are no particulars alleging that mere retention and storage of the Memoranda by the Defendant has caused the Claimant distress or embarrassment, and that is not the effect of his evidence. In his witness statement, under the heading "Damage", the Claimant states (Trump 1 §§39-40):

"The inaccurate personal data in the Dossier has, and continues, to cause me significant damage and distress. As I have indicated, although the Defendant is not, in law, responsible for the media publication of the Dossier to the world at large, it recorded and circulated the data in this document. If the Dossier had not been created by the Defendant, the inaccurate personal data would never have entered the public domain. I believe that as the creator of the Dossier the Defendant bears, at the very least, moral responsibility for its content and should therefore, correct the inaccurate data it contains. Such a correction would make the true position clear.

It is now clear to me that the only way that I can fully demonstrate the total inaccuracies of the personal data in the Dossier is to bring these proceedings and to prove, by evidence at trial, that the data are false. A judgment of the English Court on this issue will be an immense relief to me as it will completely confirm the position to the public at large. Until there is such a judgment, I continue to suffer damage and distress as a result of people wrongfully believing that the data in the Dossier is accurate." (Emphasis added.)

105. The Defendant submits that this evidence shows that the distress the Claimant alleges he has suffered stems from the BuzzFeed publication. That is the cause he actively identifies. But in any event, the acts of processing which he has pleaded caused him distress and embarrassment were those pleaded in the DPA 1998 claim, which falls to be struck out. In addition, the Defendant relies on evidence as to the minimal nature of the processing since the UK GDPR and DPA 2018 came into effect in support of the contention that the Claimant has no real prospect of obtaining compensation for distress (see paragraph 111 below).
106. Mr White submits that compensation is only available in a claim under the DPA 2018 and the UK GDPR for damage suffered, relying on Lloyd v Google LLC [2021] UKSC 50 [2022] AC 1217. The damage must be more than de minimis. While the Supreme Court did not address article 82 of the UK GDPR or s.168 of the DPA 2018, Mr White submits that article 82 is the analogue of article 23 of Directive 95/46/EC, as incorporated by s.13 of the DPA 1998. The reasoning in Lloyd v Google should be applied in this context. Mr White submits that insofar as the Claimant contends he would be entitled, if an infringement is established, to "nominal damages to vindicate his rights", that is a claim for vindicatory damages which are not available under the legislation.
107. Mr Tomlinson submits that as distress has been pleaded, the Court should proceed on the basis that distress was caused. The grounds accompanying the Strike Out Application did not raise any issue about distress. In those circumstances, it is unfair for the Defendant to criticise the Claimant for not giving more extensive evidence than he has done regarding the distress he has suffered. While the Claimant's distress was obviously aggravated by the BuzzFeed publication, Mr Tomlinson submits that the Claimant has suffered distress because the Defendant created the Memoranda containing inaccurate personal data. He has been caused distress by knowing it was the Defendant who started the whole process that led to the publication.
108. The Claimant submits that even if the Court ultimately took the view that the Claimant suffered no or de minimis distress, he would still be entitled to a judgment for nominal damages to vindicate his data protection rights. In support of this submission, the Claimant relies on a passage in Clerk & Lindsell on Torts (24^th ed., 2023), §1-16, which states:

"Although an award of damages is the principal remedy in a tort claim, there is no reason to conclude that compensation is its only valid function. The vindication of the claimant's rights, a public acknowledgement that the claimant has suffered a wrong, may be just as important a social value for the law of tort to uphold."

109. Mr Tomlinson submits that as in any tort, if the tort is established then there is an entitlement to (at least) nominal damages. There is a right under the data protection legislation to have data processed in accordance with that legislation. A breach of a person's data protection rights is a statutory tort for which there must be a remedy. Mr Tomlinson accepts that a claim for vindicatory damages would be contrary to Lloyd v Google; and asserts that no such claim is made in this case. But he submits that the Supreme Court decision was concerned with the question whether a claimant could be awarded "substantial damages" for loss of control; there was no discussion as to whether a claimant would be entitled to nominal damages. In support of this submission, Mr Tomlinson relied on Ashley v Chief Constable of Sussex Police [2008] UKHL 25 [2008] 1 AC 961, in which the House of Lords held that the claimant's estate should be permitted to pursue their claim for assault and battery, even though only nominal damages were claimed for the purpose of vindicating the contention that the victim's death had been caused by unlawful battery (in circumstances where all the damages that were claimed had already been paid).
110. The Claimant contends that there is no material difference between the present claim and that brought in Aven, in which Warby J awarded compensation in the sum of £18,000 each to the first and second claimants. Mr Tomlinson emphasises that the Defendant is not saying it would be difficult for the Claimant to establish the inaccuracy of the Personal Data. The Defendant's submission is only that the Claimant has no claim for reputational damage or distress, arguments which were run and lost in Aven.

Evidence regarding retention and storage of the Memoranda

111. The Defendant's evidence regarding the retention and storage of the Memoranda, and related data, is as follows:

i) At the time of their preparation in 2016, the Memoranda were saved onto what is described by Mr Steele as "the standalone computer" in the Defendant's offices, that is, a computer that was not connected to any network (Steele 1 §16).

ii) The electronic copies of the Memoranda held on the standalone computer were deleted shortly after their transmission to Fusion, either on the day of transmission or the following day (Steele 1 §19). This included the deletion of any copies from the Hushmail account, an encrypted web-service which was used to send the pre-election memoranda to Fusion (save for Memorandum 080 which was sent in hard copy by courier, not by Hushmail) (Steele 1 §§17-18 and 34(a)).

iii) To the extent that any electronic copies of the Memoranda, and any other information relating to the Instruction, remained on the standalone computer, any such material was deleted in late October 2016 (Steele 1 §34(c)).

iv) On 5 January 2017, on the Defendant's instruction, an external IT service provider deleted all email traffic relating to the Fusion Instruction, and all other relevant information obtained or created after the conclusion of the Instruction (which formally ended on 8 November 2016) (Steele 1 §34(b)).

v) The Hushmail account "would have been deleted by the end of the first week of January 2017, at the latest", in accordance with the Defendant's standard operational security measures applied in cases involving sensitive information (Steele 1 §34(a)).

vi) The Defendant maintained a hard copy folder containing one copy of each of the memoranda, each being added once it was prepared, having been printed from the standalone computer. The hard copy folder was kept in a locked safe in the Defendant's office to which only Mr Steele and Mr Burrows had access (Steele 1 §19).

vii) In the first week of January 2017, the Defendant destroyed the single hard copy of the Dossier (which included a copy of the Memoranda) which had been stored in the Defendant's safe.

viii) Mr Steele states that "by the end of the first week of January 2017 Orbis no longer held, and was no longer processing, any hard or electronic copy of either of the Memos" (Steele 1 §35).

ix) The Defendant's evidence is that "to the extent that there was any further subsequent processing of the Memos by Orbis" after the end of the first week of January 2017, "this was exclusively in relation to litigation concerning the Dossier (both here and in the US) and US government investigations" (Steele 1 §35). The only instances of processing the Defendant is aware of were:

a) The Dossier was contained in the trial bundles in Aven and Gubarev. In each case, Mr Steele received a hard copy of the trial bundle to assist with preparation for the trial, which took place, respectively, in March 2020 and July 2020. Those hard copies were either destroyed or returned to the Defendant's then solicitors shortly after the end of the respective proceedings. (Steele 1).

b) In May 2020, the Defendant's US lawyers sent a legally privileged email to the Defendant. The email attached two subpoenas in the "Fridman Proceedings" (one addressed to Mr Steele and the other addressed to the Defendant). A copy of the Dossier (including the Memoranda) was exhibited to each of the subpoenas, and so was received by the Defendant as an attachment to the email (Keenlyside 3 §17(b)-(c); Steele 2 §§29-31). The copies of the Memoranda attached to the email are currently held by the Defendant. The Defendant only became aware that it held these copies of the Memoranda as a result of a forensic search conducted by a specialist IT firm (Pen Test Partners) for the purposes of these proceedings (as described in Davis 1 and Keenlyside 3 §§14-18); and the Defendant has undertaken to delete the email and its attachment at the conclusion of these proceedings (Steele 2 §31).

c) On 22 December 2022, the Claimant's solicitors sent an email to the Defendant attaching a 'letter of claim' and an unsolicited copy of the Memoranda. The Defendant forwarded the email and its attachments to the Defendant's solicitors for the purposes of obtaining legal advice in connection with these proceedings. As the proceedings are ongoing, the Defendant has not deleted the letter of claim and attached Memoranda, but nor has it printed or filed the attachments to the letter of claim or saved them to any electronic filing system (Steele 1 §§59-60).

x) Accordingly, the Defendant's evidence is that in the period from 25 May 2018 to date, it has only retained/stored the Memoranda as described in subparagraphs (ix)(b) and (c). In further support of this assertion, Mr Steele has given evidence that:

a) Neither he nor the Defendant ever provided a copy of the Memoranda to any of the Defendant's lawyers (Steele 1 §§40, 43, 45, 51, 53, 55, 56).

b) During Mr Steele's interview with the Mueller Investigation in September 2017, FBI agents brought copies of the Dossier to the interview, and Mr Steele did not retain any of those copies following the interview (Steele 1 §48).

c) Mr Steele does not recall being provided with copies of the Memoranda when he was deposed in US defamation proceedings on 18 June 2018. But if (contrary to his recollection) he was provided with a copy or copies as part of the materials provided for the deposition, his evidence is that these would have been securely destroyed a few days after the deposition (Steele 1 §51).

112. Mr Steele states that he was not provided with a copy of the Memoranda in connection with his questioning by the US Senate Intelligence Committee in summer 2018 or in connection with his interview by the US Department of Justice in June 2019. If he had needed to consult any of the memoranda in the Dossier for the purpose of engaging with those investigations, he would have done this by viewing them online on one of the third party websites on which they have been available ever since the BuzzFeed publication (Steele 1 §§38, 53-55).
113. In relation to paragraph 111 above, Mr Steele acknowledges that in Gubarev his evidence was that a copy of "the intelligence memoranda" was retained on the standalone computer after the deletion of information by the external IT service provider (paragraph 111 above) in January 2017. He now says that "on further reflection" his recollection is that the December Memorandum (which was in issue in Gubarev) "may have been retained" but that the other memoranda (including those in issue in these proceedings) "were deleted from the standalone computer shortly after their transmission to Fusion" (as summarised in paragraph 111 above; Steele 1 §34c).
114. The Claimant points out that:

i) Mr Steele's evidence (given on 26 May 2023) regarding the deletion of the electronic copy of each memorandum held on the standalone computer, following its transmission to Fusion, is inconsistent with his evidence in Gubarev (given on 6 January 2020), as he acknowledges.

ii) In addition, his evidence regarding the deletion of all electronic and hard copies of the memoranda by early January 2017 is inconsistent with the Defendant's pleaded case in Aven. The defence file in Aven (dated 22 June 2018, and verified by a statement of truth) stated, "The Defendant retains a copy of Memorandum 112 only for the purposes of legal proceedings and the defence of its rights" (Lowles 2 §32).

115. Mr Tomlinson submits that it would be surprising if Mr Steele's recollection as to whether a copy of each memorandum was maintained on the standalone computer after January 2017, or deleted before or by then, is better now than it was in June 2018 or January 2020. While copies of the Memoranda, other than those attached to the subpoenas and the letter of claim, were not found during the forensic search undertaken by Pen Test Partners, it was relatively basic. The search would not have identified the keywords in files or directories which were encrypted or password-protected (Davis 1 §10), and Mr Steele's evidence is that when he sent the memoranda, they were password-protected and encrypted (Steele 1 §23). Nor would the search have thrown up the keywords in any non-OCR formatted documents (such as photocopies or images) held on the standalone computer (Davis 1 §16, fn.2). Mr Tomlinson contends that this is a factual issue that requires to be considered at trial.

Decision regarding the claim for compensation

116. On analysis, it is clear that having struck out the DPA 1998 claim, the Claimant has no prospect of obtaining compensation for distress in respect of the UK GDPR / DPA 2018 claim. There is no pleaded processing other than retention and storage in respect of the period from 25 May 2018. Although paragraphs 21 and 22 of the Particulars of Claim purport to give particulars in support of the claim for distress under the UK GDPR and the DPA 2018, as well as under the DPA 1998, there is not in fact any particularisation that bears any relation to the claim in respect of mere holding of the Memoranda.
117. Mr Tomlinson is right to say that the grounds did not expressly take issue with the claim for distress. I have borne in mind the possibility that the Claimant might have adduced further evidence of the distress he claims to have suffered if the issue had been raised in the grounds, albeit the grounds made clear that the Defendant contends that the whole claim should be dismissed as there is no viable claim for any remedy. However, while it might have been possible for the Claimant to adduce further evidence addressing the distress he claims to have suffered as a consequence of the Defendant's creation and dissemination of the Memoranda, it cannot sensibly be claimed – and the Claimant did not seek to assert – that the mere fact that the Defendant held copies of the Memoranda caused him distress.
118. The Particulars of Claim and the Claimant's own evidence make plain that the distress he claims to have suffered was caused by the content of the Memoranda (i.e. preparation) and by the matters that are alleged in the Memoranda coming to the attention of family, friends, colleagues and the public at large (i.e. dissemination / publication). The retention and storage of the Memoranda since 25 May 2018 manifestly has not caused the Memoranda – which have been publicly available throughout the period with which the UK GDPR / DPA 2018 claim is concerned – to come to the attention of anyone.
119. The evidence is that when the claim was issued the only copies of the Memoranda the Defendant held were exhibited to subpoenas attached to a legally privileged email from the Defendant's US lawyers. The Defendant was unaware it held them until after the claim was issued and has undertaken to delete them at the end of these proceedings. Realistically, the Claimant cannot have been aware, still less distressed, that the Defendant received the Memoranda exhibited to those subpoenas. The only other copies of the Memoranda the Defendant has held during the period from 25 May 2018 until the issue of the claim were in the trial bundles for Aven and Gubarev. Those were destroyed long before these proceedings were issued. Even if the Claimant was aware those copies were held, which seems doubtful as he was not involved in that litigation, it would be unreal to suggest that the Defendant's temporary retention of them while defending proceedings caused him any distress.
120. Aside from those copies, the Defendant currently holds a copy of the Memoranda that was sent to it by the Claimant's solicitors, attached to the letter of claim, the continued retention of which, during ongoing proceedings, cannot conceivably found a claim.
121. I accept that in light of the change in Mr Steele's evidence compared to that which he gave in Gubarev and the Defendant's pleaded case in Aven, and the restrictions on the scope of the forensic investigation undertaken by Pen Test Partners, if the matter were allowed to proceed to trial it may be that further investigations would uncover that the Defendant holds more copies of the Memoranda than it is currently aware of holding, in password-protected/encrypted files or in non-OCR format on the standalone computer. But even allowing for the possibility that the Defendant is, unknowingly, holding one or more further copies of the Memoranda, it is impossible to see how that could realistically be alleged to have caused the Claimant distress. Mere storage of the Memoranda by the Defendant cannot sensibly be said to have had any impact on the Claimant – if he was even aware of it – not least in circumstances where the Memoranda are on the internet.
122. In my judgment, the Claimant's alternative contention that he would be entitled, if he establishes the inaccuracy of the Personal Data, to compensation for nominal damages is contrary to Lloyd v Google. The Supreme Court held that there was no entitlement to compensation under s.13 of the DPA 1998 based solely on proof of a (non-trivial) contravention of a requirement of that Act in relation to any personal data of which the claimant was the subject.
123. The Supreme Court was addressing the interpretation of the DPA 1998, not of the DPA 2018 or the UK GDPR. The terms of the analogous provisions under the old and new data protection legislation are similar but not identical to article 82 of the UK GDPR. In particular, Section 13 of the DPA 1998 provided:

"(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage."

124. Nevertheless, the "distinction between 'damage' suffered by an individual and a 'contravention' of a requirement of the Act by a data controller", and the provision of "a right to compensation 'for that damage' only if the 'damage' occurs 'by reason of' the contravention", on which Lord Leggatt JSC relied ([115]), is replicated in article 82 of the UK GDPR, albeit the term "infringement" is used rather than "contravention". Mr Tomlinson did not seek to persuade me that Lloyd v Google could be distinguished on the basis that the Court only considered the old legislation. The conclusion in Lloyd v Google that a right to compensation only arises if the claimant can establish that he has suffered damage as a result of a contravention or infringement of the data protection legislation is unambiguous.
125. The Claimant's contention is that in respect of this statutory tort he has a right to a remedy that is not in the legislation, namely, a right to nominal damages. That is the wrong approach. Parliament has created both the cause of action and identified the available remedies. It is not for the court to supplement the statutory remedy of compensation with a non-statutory remedy of damages.
126. The assertion that nominal damages are always available in tort is wrong. Nominal damages, of a token sum, are awarded where a tort is actionable per se and the claimant is unable to prove any loss or injury. In Ashley, the claimant's estate was entitled to pursue a claim for nominal damages because the cause of action was actionable per se. Lord Rodger stated the principle at [60]:

"A claimant has no cause of action in negligence unless he has suffered injury or damage. By contrast, battery or trespass to the person is actionable without proof that the victim has suffered anything other than the infringement of his right to bodily integrity: the law vindicates that right by awarding nominal damages."

127. The Claimant placed substantial reliance on the awards made in Aven to show that the claim for compensation in this case should be allowed to go forward. Despite the superficial similarity springing from the fact that both cases concern the same Dossier, the reasons for the award of compensation in Aven are absent in this case. First, the claim under the DPA 1998 was made in time in Aven. Consequently, the data processing with which the court was concerned in Aven was creation and dissemination of Memorandum 112, not mere storage of that document. Given the different nature of the processing in issue, the claimants were able to establish a claim for reputational harm and distress.
128. In addition, Aven was determined following the Court of Appeal's decision in Lloyd v Google, before the Supreme Court overturned it. Consequently, Warby J was bound to assess compensation on the basis that "compensation is recoverable for a contravention that interferes with the data subject's control over his data, even if this does not cause material damage or distress: Lloyd v Google LLC [2019] EWCA Civ 1599 [2020] 2 WLR 484" (Aven [195]). So, the award in Aven provided "redress for the interference with autonomy" (Aven [196]), which it is now established is unavailable, as well as for distress and reputational harm.
129. For the reasons I have given, I agree with the Defendant that the Claimant has no reasonable grounds for bringing a claim for compensation or damages, and no real prospect of successfully obtaining such a remedy. Consequently, in addition to the parts of the Particulars of Claim that I have identified in paragraph 99 above as requiring to be struck out, the whole of paragraphs 21-22 of the Particulars of Claim, and paragraph (2) of the Prayer, fall to be struck out. I also give summary judgment on the claim for compensation and/or damages under the UK GDPR and the DPA 2018.

Compliance Order

130. The only other remedy sought by the Claimant in the Particulars of Claim is a compliance order under s.167 of the DPA 2018 "requiring the Defendant to erase and/or restrict further processing of the Personal Data" (POC §23 and §3 of the Prayer).
131. During the course of argument, Mr Tomlinson acknowledged that there would be no point in erasure (a remedy provided for in article 17 of the UK GDPR: see paragraph 19 above). So that remedy is not pursued. That is an inevitable concession. An order requiring the erasure of copies of the Memoranda held by the Defendant, in circumstances in which the whole Dossier remains freely available on the internet for anybody to access, view, download and disseminate, would achieve nothing. There would be no real prospect of the court making such a pointless order. In addition, it is unnecessary to pursue these proceedings to secure erasure given the undertaking offered by the Defendant on ascertaining that it still held any copies.
132. So, the only form of compliance order sought is one restricting further processing of the Personal Data. The right relied on is contained in article 18 of the UK GDPR which provides so far as relevant:

"1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

(c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;

(d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest." (Emphasis added.)

133. An order restricting processing of the Personal Data pursuant to article 18 of the UK GDPR was not sought in the Claim Form, nor in the proposed Amended Claim Form. However, I would not hold that against the Claimant if he had a real prospect of obtaining such an order, as it could be remedied by an (in time) amendment.
134. It is clear that the right to obtain a restriction on processing only applies where the controller is currently processing the personal data of the data subject, and subject to one of the conditions (a)-(d) being met. A restriction on processing does not prevent the data controller continuing to store the data without any need for the data subject's consent (article 18(2)). Nor does it prevent the data controller engaging in other forms of processing (such as dissemination), without the data subject's consent, if such acts are undertaken for the purpose of defending a legal claim (or any of the other purposes identified in article 18(2)).
135. There is no allegation, nor any evidence, that the Defendant has processed the Memoranda since 25 May 2018, other than by storing them, and by forwarding the copies attached to the Claimant's letter of claim to their solicitors for the purpose of defending this claim. The clear and detailed evidence is that the Defendant has not processed the Memoranda in any other way since 25 May 2018. Mr Tomlinson submits that a trial is required to investigate the facts regarding the processing undertaken by the Defendant but that is based on nothing more than a speculative hope that more significant acts of processing than mere storage of the Memoranda might come to light.
136. There is no real prospect of any further investigation revealing processing that is capable of being restricted pursuant to article 18. The Defendant has made assiduous efforts to avoid processing the Dossier, no doubt in its own self-interest, and the minimal acts of processing that it has undertaken since 25 May 2018 have been for the purpose of defending legal claims or involved unknowing retention of the Memoranda (i.e. storage). Nor has the Defendant threatened to undertake acts of processing of the Memoranda in future which a restriction order would prohibit. On the contrary, it has undertaken to erase the only copies it is aware of holding when the claim was issued. For these reasons, there is no real prospect of the court granting a restriction order.
137. Accordingly, the Defendant has succeeded in his claim for summary judgment insofar as a compliance order is sought seeking an erasure order pursuant to article 17 or a restriction order pursuant to article 18 of the UK GDPR.
138. The Claimant has not pursued any other form of compliance order. Rectification was sought in the Claim Form (see paragraphs 16 and 19 above), but that is not a remedy sought in the Particulars of Claim. The Defendant submits that there is no rectification claim, unlike in Aven: and the decision not to pursue a claim here for rectification was deliberate. That was not disputed, and Mr Tomlinson's submission was that there would be no point ordering rectification.
139. Despite the disavowal of any claim for rectification, the Claimant's submission is that there is a real prospect of him obtaining the form of order that Warby J was prepared to make in Aven (albeit under the DPA 1998), directing that the copy of the relevant memorandum held by the Defendant for legal purposes be "marked up or filed in such a way that the reader will not fail to be aware of this judgment" (Aven, [189]). The Claimant seeks a judgment that the Personal Data are inaccurate as that would become widely known and would serve the same purpose as the judgment in Aven. Mr Tomlinson said that what matters to the Claimant is that such a finding of inaccuracy should be made. That would have a vindicatory effect.
140. Mr Tomlinson submits that in Aven the order that the personal data should be supplemented by a note to say that it has been found to be inaccurate, was made pursuant to s.14(2)(a) of the DPA 1998. He contends that was not an order for rectification, and that what the Claimant seeks is effectively the same, albeit the precise form of order will depend on the court's findings at the end of a trial.
141. Mr White contends that the Claimant cannot use the process of the English court to remedy global publication of the Memoranda, for which the Defendant is, as the Claimant admits, not responsible in law. The Claimant has not sought a rectification order (or a declaration). The compliance order sought would be of no utility given that the Dossier (including the Memoranda) are available to the public on the internet. That being so, there is no real prospect of such an order being granted.
142. In my judgment, it is clear that the order for a supplementary note to be attached to the memorandum in issue in Aven was a form of rectification order, and the court's power to make such an order in respect of processing from 25 May 2018 is contained in article 16 of the UK GDPR. It is not an order that can be made pursuant to articles 17 or 18, which are the only remedies sought by the Claimant.
143. In my view, there are no compelling reasons to allow the claim to proceed to trial in circumstances where (whatever the merits of the allegation that the Personal Data are inaccurate may be):

i) The claim for compensation and/or damages under the UK GDPR and DPA 2018 is bound to fail.

ii) The pleaded claim for a compliance order requiring the restriction or erasure of the Memoranda is bound to fail.

iii) The Claimant has deliberately chosen not to seek an order for rectification, disavowing any claim for such a remedy at the hearing; and there is no application before me to amend the Particulars of Claim to add a claim for rectification pursuant to article 16 of the UK GDPR; and

iv) In reality, the Claimant is seeking court findings to vindicate his reputation in circumstances where has not been able to formulate any viable remedy which he would have a real prospect of obtaining, or which would itself be of any utility; and having chosen to allow many years to elapse – without any attempt to vindicate his reputation in this jurisdiction - since he was first made aware of the Dossier (including the Memoranda) on 6 January 2017 (Trump 1 §9), and since he first knew the identity of the author on 11 January 2017 (Trump 1 §10).

144. As I have concluded that the Defendant should have summary judgment in respect of his claim for compensation/damages and a compliance order, and consequently on the claim as a whole, it is unnecessary to consider the additional and alternative bases on which the Defendant sought to have the claim struck out.

E. Conclusions

145. The Claimant's application to amend the Claim Form is refused. The Defendant is entitled to summary judgment on the claim pursuant to CPR 24.2. In addition, those parts of the Particulars of Claim identified in paragraphs 99 and 129 above are, in any event, struck out pursuant to CPR 3.4(2)(a).

Note 1   There is no express finding that Memorandum 113 (which was not in issue in Aven orGubarev) was provided to the FBI. In Aven there was a dispute as to whether Memorandum 112 was given to the FBI. The Report of the Office of the Inspector General (‘OIG’, December 2019) identified Memorandum 112 as one of four reports which Mr Steele did not furnish to the FBI. Warby J accepted Mr Steele’s evidence that he did provide it to the FBI in September 2016. Memorandum 113 was produced the same day as Memorandum 112. It, too, is identified in the OIG Report as not having been provided to the FBI, but Mr Steele’s evidence in this case is that he did so.    [Back]