Harrison v Cameron & Anor

Factual and Procedural Background

This claim concerns an application under the UK General Data Protection Regulation ('UK GDPR') and the Data Protection Act 2018 ('DPA 2018') seeking an order that the Defendants comply with the Plaintiff's subject access requests ('SARs') made under article 15 of the UK GDPR. The Plaintiff made two SARs: the first to the First Defendant on 6 July 2022, and the second to the Second Defendant, a company, on 24 August 2022.

The dispute arises from telephone conversations on 7 May 2022 between the Plaintiff, a private individual in the property investment industry and CEO of Company A, and the First Defendant, a director of the Second Defendant, a landscape gardening business. The First Defendant recorded two of these calls during which the Plaintiff threatened him. The First Defendant subsequently shared these recordings with a group of approximately 15 individuals comprising employees, family members, and friends. The Plaintiff contends that these recordings have been further disseminated within his professional industry, causing significant financial loss to Company A, though no compensation claim is made in this proceeding.

The central legal question is whether the Defendants are obliged to disclose to the Plaintiff the identities of those individuals to whom the recordings or transcripts were disseminated in response to his SARs.

Procedurally, the claim was served on the First Defendant on 11 August 2022. The Defendants responded to the SARs but declined to provide the identities of all recipients. An offer was made to disclose certain names subject to the Plaintiff discontinuing the claim and providing undertakings not to threaten or harass those individuals, which the Plaintiff rejected.

Legal Issues Presented

1. Whether the First Defendant's processing of the Plaintiff's personal data in relation to his 'friends and family' falls outside the scope of the UK GDPR/DPA 2018 as it was "in the course of a purely personal or household activity".
2. If not, whether the First Defendant qualifies as a data controller in his personal capacity within the meaning of Article 4(7) UK GDPR.
3. Whether Article 15(1)(c) entitles the Plaintiff to the identities of the recipients of his personal data, and whether the Defendants are entitled to withhold those identities under Article 15(4) UK GDPR or the exemption under Schedule 2, paragraph 16 of the DPA 2018.

Arguments of the Parties

Plaintiff's Arguments

• The Plaintiff contends that the First Defendant and the Second Defendant have breached their obligations under the UK GDPR by failing to disclose the identities of all recipients of the recordings in response to the SARs.
• The Plaintiff relies on the interpretation of Article 15(1)(c) in the Austrian Post case to argue that he is entitled to the actual identities of recipients, not merely categories.
• He denies that the statements made during the recorded calls amount to genuine threats and argues that the Defendants have failed to justify withholding the identities under the 'rights of others' exemption.
• The Plaintiff asserts that he seeks the identities to exercise his data protection rights and to consider other legal remedies, given the alleged financial and reputational damage caused by dissemination of the recordings.

Defendants' Arguments

• The First Defendant argues that his sharing of the recordings with family and friends was a purely personal or household activity exempt from the UK GDPR.
• The Defendants contend that the First Defendant is not a data controller personally, as the processing was conducted in his capacity as director of the Second Defendant, which is the actual controller.
• The Defendants submit that the Second Defendant complied with its obligations by providing categories of recipients rather than specific identities, which they argue is consistent with the meaning of Article 15(1)(c).
• They rely on the exemption under Article 15(4) UK GDPR and Schedule 2, paragraph 16 of the DPA 2018, asserting that disclosure of recipients' identities would adversely affect their rights and freedoms, particularly given the Plaintiff's aggressive and threatening conduct towards recipients.
• The Defendants emphasize the wide margin of discretion afforded to controllers in assessing the reasonableness of disclosure and highlight the Plaintiff’s history of sending intimidating legal correspondence to multiple employees and acquaintances associated with the Defendants.

Table of Precedents Cited

Court's Reasoning and Analysis

The court first considered whether the First Defendant's sharing of the recordings with family and friends was a purely personal or household activity exempt from the UK GDPR. Applying the relevant recitals and case law, including the CJEU’s emphasis on the word "purely," the court found that the First Defendant’s processing was not purely personal because it involved sharing personal data collected and held by the Second Defendant in the context of a business relationship. The recordings related to the contractual dispute and were shared partly for business reasons, thus falling within the scope of the UK GDPR.

Next, the court addressed whether the First Defendant was a data controller personally. Following the authorities In re Southern Pacific Personal Loans and Ittihadieh, the court held that the First Defendant acted as an agent for the Second Defendant, which was the data controller. Despite recording the calls and sharing the recordings, the First Defendant did not determine the purposes and means of processing personally, so he was not a controller in his individual capacity.

The court then turned to whether the Plaintiff was entitled under Article 15(1)(c) to the identities of all recipients of his personal data. The court accepted the reasoning of the CJEU in the Austrian Post case, holding that the data subject has the right to be informed of the specific identities of recipients unless it is impossible or manifestly excessive to do so. The court rejected the Defendants' argument that only categories of recipients need be disclosed and that employees should be treated differently from external recipients.

Finally, the court considered whether the Defendants lawfully withheld the identities under Article 15(4) and Schedule 2, paragraph 16 of the DPA 2018, the 'rights of others' exemption. The court acknowledged the wide margin of discretion afforded to controllers in balancing competing privacy interests. It accepted the Defendants’ evidence that disclosure would expose the recipients to harassment and intimidation, particularly given the Plaintiff’s aggressive conduct and the volume of legal correspondence directed at the recipients. The court found the Defendants’ assessment reasonable and that the exemption applied, justifying the withholding of the identities.

Holding and Implications

The court DISMISSED the claim against the First Defendant on the basis that he was not a data controller personally and thus not liable under the UK GDPR.

The claim against the Second Defendant was also DISMISSED on the grounds that the 'rights of others' exemption applied, permitting the Second Defendant to withhold the identities of recipients of the recordings in response to the Plaintiff’s SARs.

The direct effect of this decision is that the Plaintiff will not obtain the identities of the individuals to whom the recordings were disseminated. The court did not set any new precedent but applied established legal principles regarding the scope of data protection obligations, the definition of data controller, and the balancing of privacy rights under the UK GDPR and DPA 2018.