Claimants Come Up Trumps In Defamatory Personal Data Breach

• Published date: 13 October 2020
• Subject Matter: Litigation, Mediation & Arbitration, Privacy, Data Protection, Libel & Defamation
• Law Firm: Shepherd and Wedderburn LLP
• Author: Mr John MacKenzie and Ruairidh Leishman

In January 2017, Buzzfeed News published an online article headlined "These Reports Allege Trump Has Deep Ties to Russia". The underlying source material for this article became known as the 'Trump-Russia dossier' or the 'Steele dossier', so-called because Christopher Steele, a former MI6 officer, was understood to be the sole author.

Three individuals named in the dossier subsequently raised a claim for a breach of the data protection legislation against Orbis Business Intelligence Limited, the company that was instructed to prepare the dossier. The dossier alleged that the three individuals did favours for President Putin, gave him informal advice on foreign policy and used a 'driver' and 'bag carrier' to deliver large amounts of illicit cash to President Putin when he was deputy mayor of St Petersburg.

The High Court of England and Wales has recently found in the claimants' favour and awarded them damages for distress (see here for the judgment).

What was unusual about this claim?

The judge noted that the UK's data protection legislation is complex and technical, and that it has been likened to a "thicket". The judgment in this case is equally long and complex and addresses many aspects of the data protection legislation.

Although this claim was brought under the relevant data protection legislation, the subject matter was similar to a claim for defamation. The damages awarded were also higher than those previously awarded for cases involving personal data breaches. Accordingly, the focus of this article is on the judge's adoption and alignment of the principles that apply to the law of defamation and those of data protection law; and the entitlement to, and assessment of, damages.

What is personal data?

The parts of the dossier that the claimants took issue with did not mention them by name. However, their position was that the sentences should not be read literally. Instead, the words should be given their natural and ordinary meaning, read in the proper context of the whole document. Orbis had argued the focus should be on the items of information and, specifically, the items of data, rather than on the document in the round. In other words, each item of personal data should be dealt with and considered discretely. The judge characterised these rival approaches as 'holistic' and 'atomised'.

Rejecting Orbis' atomised approach, the judge said: "In my judgment, the holistic approach is consistent with principle and authority, and the right approach to...