Claim Form
(CPR Part 8)
Claimant
David Richard Carroll
29 Tiffany Place, Apartment IK, Brooklyn, New York, NY 11231
Defendant(s)
(1) Cambridge Analytica Ltd
(2) Cambridge Analytica (UK) Ltd
(3) SCL Elections Ltd
(4) SCL Group Ltd
Does your claim include any issues under the Human Rights Act 1998? Q Yes [x] No
Details of claim (see also overleaf)
The Claimant seeks an Order under section 7 of the Data Protection Act 1998 that the Defendants
be required to comply in full with his subject access request of January 2017.
Please find enclosed the Particulars of Claim (as well as an application made for pre-action
disclosure in respect of other causes of action).
Defendant's ^ ^ > i
name and Defendants names as above
address 55 New Oxford Street
London
WC1A IBS
For further details of the courts www.gov.uk/find-court-tribunal.
When corresponding with the Court, please address forms or letters to the Manager and always quote the claim number.
N208 Claim form (CPR Part 8) (06.16) © Crown copyright 2016 Laserform International 6/16
A001
Claim no.
Details of claim (continued)
Statement of Truth
*)0000©mThe Claimant believes) that the facts stated in these particulars of claim are true.
* I am duly authorised by the claimant to sign this statement.
Full name Ravi Naik _
Name of claimant’s legal representative’s firm Irvine Thanvi Natas
signed
mocomoooooooooooocK
(Legal representative's solicitor)
position or office held Partner
(if signing on behalf of firm or company)
*delete as appropriate
Irvine Thanvi Natas
36 Whitefriars Street
London
EC4Y 8BQ
DX: 5430 Stratford
Fax: 020 8522 7708
Claimant’s or claimant’s legal representative’s
address to which documents should be sent if
different from overleaf. If you are prepared to
accept service by DX, fax or e-mail, please add
details.
A002
N244
Application notice
For help in completing this form please read the
notes for guidance form N244Notes.
Name of court
High Court Of Justice
Queen's Bench Division
Royal Courts of Justice
Claim no.
Fee account no.
(if applicable)
Help with Fees - Ref. no.
(if applicable)
| H |W| F |-| | | |-| 1 1 1
Warrant no.
(if applicable)
Claimant’s name (including ref.)
David Richard Carroll
(Ref: RAN/28325)
Defendant’s name (including ref.)
(1) Cambridge Analytica Ltd (2) Cambridge
Analytica (UK) Ltd (3) SCL Elections Ltd
( 4 ) SCL Group Ltd
(Ref: KK/ 17517 )
Date
16 March 2018
1 . What is your name or, if you are a legal representative, the name of your firm?
Irvine Thanvi Natas
Are you a Q Claimant
Defendant
[~x~| Legal Representative
Other (please specify)
If you are a legal representative whom do you represent?
Claimant / Applicant
What order are you asking the court to make and why?
An order for pre-action disclosure in the
also see the enclosed Application Grounds
terms set out in the draft Order. Please
/ Part 8 Claim.
4. Have you attached a draft of the order you are applying for?
5. How do you want to have this application dealt with?
6. How long do you think the hearing will last?
Is this time estimate agreed by all parties?
7. Give details of any fixed trial date or period
8. What level of Judge does your hearing need?
9. Who should be served with this application?
[~x~| Yes Q No
|~x~| at a hearing Q without a hearing
j | at a telephone hearing
5 Hours
j | Yes
Minutes
|~xj No
Defendants
Laserform International 6/16
A003
N244 Application notice (06.16)
1
© Crown copyright 2016
9a. Please give the service address, (other than details of the
claimant or defendant) of any party named in question 9.
10. What information will you be relying on, in support of your application?
|~x~| the attached witness statement
|~x~| the statement of case
|~x~| the evidence set out in the box below
If necessary, please continue on a separate sheet.
Please refer to enclosed Application Grounds / Part 8 Claim, witness statements,
exhibits and expert reports.
Please note that the hearing estimate at question 6 of this application is provided on
the basis of the section 7 Data Protection Act claim being heard together with this
application .
Statement of Truth
The applicant believes that the facts stated in this section (and any continuation sheets) are true.
Signed _ Dated 16 March 2018
Applicant’s legal representative
Full name Ravi Naik _
Name of applicant’s legal representative’s firm Irvine Thanvi Natas _
Position or office held Partner / Solicitor _
(if signing on behalf of firm or company)
11. Signature and address details
Signed _ Dated 16 March 2018 _
Applicant’s legal representative
Position or office held Partner / Solicitor _
(if signing on behalf of firm or company)
2
A004
Applicant’s address to which documents about this application should be sent
3
A005
Claim No.:
IN THE HIGH COURT OF JUSTICE
QUEEN’S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
BETWEEN:
DAVID CARROLL
Claimant / Applicant
- and -
(1) CAMBRIDGE ANALYTICA LTD
(2) CAMBRIDGE ANALYTICA (UK) LTD
(3) SCL ELECTIONS LTD
(4) SCL GROUP LTD
Defendants / Respondents
PART 8 CPR CLAIM UNDER S 7(9) DATA PROTECTION ACT 1998 and
APPLICATION FOR PRE-ACTION DISCLOSURE
SUMMARY
1 . The Claimant / Applicant Professor David Carroll (“the Claimant”), applies for an order
requiring the Defendants / Respondents (“the Defendants”) to:
a. Comply fully with his subject access request made under s 7 Data Protection Act
1998 (“DP A”) - that claim is brought under Part 8 CPR (“the s 7 DPA claim”);
and/or
b. Provide him with pre-action disclosure pursuant to s 33(2) Senior Courts Act 1981
and Part 31.16 CPR (“the disclosure application”).
2. The Defendants are commercial entities that create detailed profiles of individuals which
they sell to advertisers, political campaigns and other entities, so as to assist them in
[1]
A006
targeting their efforts to influence the behaviour of profiled individuals. The subject of
these detailed profiles is not informed that they have been generated or sold to third
parties. For individuals to confirm whether they have been profiled, what information is
held on them, and how it has been used, they need to rely on subject access requests
under the DP A.
3. The Claimant made such a request. In response, the Defendants confirmed that the
Claimant has, without his knowledge, been the subject of their profiling activities. The
Claimant was provided with some of that information as to the data held on him although
this appears to be materially incomplete.
4. In order to be provided with the full infonnation he is entitled to under the DP A, the
Claimant brings the present s 7 DPA claim. In pre-action correspondence, the Claimant
has also sought further information which is essential for him to detennine the legality
of the Defendants’ processing of his data. The Defendants have failed to provide this and
the Claimant therefore also makes the disclosure application.
FACTS
The parties
5. The Claimant is an Associate Professor of media design at the Parsons School of Design
in New York, USA and has particular experience in the field of online behavioural
advertising technologies. The Claimant’s work encompasses research into how the digital
media and marketing industry is able to track user behaviours and how companies can
use technology to “re-identify” an individual from supposedly anonymous data.
6. The Defendants are UK-registered companies which, by their own description, engage
in the business of “behavioural microtargeting ” - the collating and/or creating and then
selling of data profiles of individuals which are used for, inter alia, targeted advertising
and political campaigning.
7. The personal data used to create such individual profiles consists of infonnation relating
to people’s personality traits, political beliefs and other deeply held personal habits and
[2]
A007
decisions. The profiles prepared by Cambridge Analytica are said to use “ up to 5,000 data
points on over 230 million American voters ... [to] build your custom target audience,
then use this crucial information to engage, persuade, and motivate them to act.” 1
8. There are two companies registered on Companies House with the name “Cambridge
Analytica”: Cambridge Analytica Ltd (Co. number: 09154503) and Cambridge Analytica
(UK) Ltd (Co. number: 09375920). It is unclear whether / how these companies operate
together. SCL Elections Limited (Co. number: 08256225) is Cambridge Analytica (UK)
Ltd’s parent company.2 The ultimate parent company is SCL Group Ltd, also registered
in the UK (Co. number 055 14098).
9. Cambridge Analytica (as a single entity) and SCL Elections Ltd are registered with the
Information Commissioner’s Office as data controllers. SCL Group is not so registered.
The Claimant’s subject access request under s 7 DPA (“the SAR”)
10. On in or around 10 January 2017, Professor Carroll submitted the SAR to Cambridge
Analytica (“the SAR”). In doing so, he was motivated by both academic and personal
interest in ascertaining what data the Defendants held on him and how it was being
processed. The SAR was submitted through the following website:
https://datarequests.cambridgeanalytica.org.
11. In response to that request, the Claimant received an email from a “data compliance”
email address associated with SCL group. This infonned the Claimant that he was
“ required to submit the £10 fee and proof of ID directly to SCL Elections who is
Cambridge Analytica ’s agent for the purposes of DPA requests.”
12. A substantive response was then provided on 27 March 20 17, under cover of a letter from
“Cambridge Analytica”. That letter was signed by Julian Wheatland, “Group COO”. At
1 Carole Cadwalladr, Robert Mercer: the big data billionaire waging war on mainstream media, the Guardian, 26
February 2017, available at:
https://www.theguardian.com/politics/2017/feb/26/robert-mercer-breitbart-war-on-
media-steve-bannon-donald-trump-nigel-farage
2 SCL Elections Limited are registered with Companies House as the Company with “significant control” over
Cambridge Analytica (UK) Limited.
[3]
A008
the time, Mr Wheatland was a director of SCL Group Limited. Based on publicly
available infonnation, Mr Wheatland did not hold a position at Cambridge Analytica.
13. On 27 February 2018, Alexander Nix, Cambridge Analytical chief executive, gave oral
evidence before the Digital, Culture, Media and Sport Committee. He confirmed that the
Defendants share data, stating that they: “ transfer data from Cambridge Analytica to
SCL”3
14. In light of the above, the SAR appears to have been processed by the Defendants
collectively.
The Defendants’ response to the SAR (‘‘the SAR Response”)
15. The SAR Response confirmed that the Defendants are data controllers for the purposes
of s 5 DPA, including in respect of the Claimant, who is / was a data subject within the
meaning of s 1 DPA.
16. The SAR Response purported to provide the Claimant with “a// of the data to which you
are entitled under the DPA, in a Microsoft Excel Spreadsheet (xls).” The enclosed file
contained:
a. A summary of the Claimant’s profile;
b. Background data on the Claimant, including his name, address, date of birth, and
US voter identification numbers;
c. Data relating to the Claimant’s election returns for both primary and general
elections from 2000 - 20 14, including a category titled “result” indicating the party
voted for; and
d. A political profile stating the Claimant’s political views on key issues, ranking
them by order of importance to him, and identifying his political and party
affiliation (registered and unregistered) as well as his likelihood of voting.
3 AtQ688 -Q689
[4]
A009
17. Having considered the response, based on his knowledge and experience, the Claimant
was concerned that it appeared to be incomplete and did not comply with s 7 DPA in a
number of material respects.
18. First, the underpinning personal data provided was insufficient to support the ‘headline’
personal profile of the Claimant. The political profile of the Claimant provided appeared
to be based on further information about him (whether derived from open or private
sources) that was not provided as part of the SAR Response. The limited factual
information disclosed did not provide sufficient information to give rise to the “models”
profiling the Claimant’s political views. For instance, the profile (correctly) identified
gun control as a key political issue for the Claimant. Yet, given his public profile and
general background, this is an unusual priority issue. There was nothing in the underlying
data that would have permitted the Defendants to identify this private political view as a
priority for the Claimant.
19. Further, compared to the Defendants’ public claims about the nature and scope of their
profiling activities, the data provided appeared to be very limited. For instance, speaking
to the Financial Times in January 2017, Alexander Nix, Cambridge Analytical chief
executive stated: “We have a massive database of 4-5,000 data points on every adult in
America”.4 As outlined above, the First Defendant’s website gives a similar indication of
the scale of the data held, stating that they have “up to 5,000 data points on over 230
million American voters.”5 The SAR Response did not contain anywhere near this
number of data points on the Claimant.
20. Second, the SAR Response provided inadequate information on the purposes for which
the Claimant’s data was being processed. It contained only a broad summary of the
purposes for which that personal data is processed, including, for example, “audience
opinion/behaviour research and polling’’ and “predictive algorithm development’’ . This
was insufficient for the Claimant to understand the actual purposes for which the
Defendants are processing his data.
4 Gillian Tett, Donald Trump ’s campaign shifted odds by making big data personal. Financial Times, 26 January
2017, available at:
https://www.ft.com/content/bee3298c-e304-l le6-9645-c9357a75844a
5
https://ca-political.com/ca-advantage
[5]
A010
2 1 . Third, the S AR Response failed to provide information on the recipients to whom the
Claimant’s personal data was or may be disclosed. The Defendants provided a high-level
summary of the types of “clients” to which they might disclose data (e.g. “ political
campaigns ” and “ commercial entities ”) but failed to indicate the actual organisations
with which his data had been shared / would be shared.
22. Fourth, the SAR Response did not provide the requisite information regarding the
source(s) of the personal data. It stated only that the Defendants had obtained the data
from “ reputable data vendors ” or “ research partners ” without identifying these entities.
23. In light of the above concerns, the Claimant commissioned two expert reports by
Professor Phil Howard and Dr David Stillwell. Both experts independently concluded
that the SAR Response was likely to be incomplete.6
24. In summary:
a. Professor Howard, of Oxford University, is a leading expert on the impact of new
information technologies on public life. His report addresses in particular how
profiling techniques such as those employed by the Defendants are used in political
campaigning. Having analysed the material disclosed by the Defendants in
response to the Claimant’s SAR, Professor Howard concludes that “this profile
provides limited information on what the Defendants were doing, and is
incomplete.’’'
b. Dr Stillwell, of Cambridge University, is an expert in big data analysis and has
particular experience in the prediction of psychological traits from social media
data. His report deals with the way in which (i) models can predict an individual’s
behaviour and preferences on the basis of a range of data points pertaining to that
individual, (ii) such models are created / operated, and (iii) the resulting profile
information can then be used to influence the relevant individual’s behaviour. Dr
Stillwell also considered the infonnation the Defendants provided in response to
6 In the alternative, the Defendants marketing claims would be significantly inflated and at least some of the
predictions made in their profiling of the Claimant would amount to very lucky guesswork.
[6]
A01 1
the Claimant’s SAR (along with another similar response7). Analysing it in light of
his particular expertise, he reaches the same conclusion as Professor Howard,
namely that the information provided is likely to be incomplete. In particular, he
considers that some of the Defendants’ key model predictions in respect of the
Claimant are counter-intuitive and “ difficult to explain from the generic
demographic data given in the subject access request ”, suggesting that further data
was used in creating them.
Pre-action correspondence / the proposed claim
25. The Defendants’ failure to provide an adequate SAR Response was in breach of s 7 DPA
(see paras 40 ff. , below).
26. Further, even the (incomplete) SAR Response indicated that the Claimant has a claim
against the Defendants for breaches of the DPA, misuse of private information and/or
breach of confidence.8
27. In light of the above, on 12 April 2017 the Claimant sent the Defendants a letter of claim.
In essence, the proposed claim comprises the following:
a. The profile of the Claimant prepared and distributed by the Defendants relates to
his political opinions and thus constitutes sensitive personal information for the
purposes of s 2 DPA. To process sensitive personal data, at least one of the
conditions in Schedule 3 DPA would have to be met - this is not the case and no
exemptions apply.
b. The Claimant’s non-public political views are his private information. The
Defendants’ use of this information took place without his consent and cannot be
justified. It therefore amounts to misuse of private information.
7 Dr Stillwell was provided with the subject access response received by Professor David Columbia to assist him
in preparing his report. Professor David Golumbia has also provided his own statement supporting the Claimant’s
claim and application in the light of his own on-going pre-action correspondence with the Defendants. The subject
access response received by Professor Golumbia gives rise to the same or similar concerns to those raised by that
received by the Claimant.
8 See Claimant’s letter of claim of 12 April 2017.
[7]
AO 12
c. The Defendants were or ought to have been aware that at least some of the
information they held on the Claimant was / is confidential to him and they had no
right to pass this on to third parties, giving rise to a claim for breach of confidence.
28. The Claimant requested that the Defendants disclose to him his entire file in full,
including the information specified in para 39.1-39. 1 1 of the letter of claim. Further, para
40 the Claimant’s letter of claim requested clarification of the following
1. Our client requests clarification of how his data has been used to create the
profile. For example, do you re-identify our client ’s data from de-identified /
anonymised data sets? Further, do you use probabilistic and / or deterministic
methods in performing the re-identification of the data?
2. Please clarify the source of the information that gave rise to our client ’s entry
onto your database.
3. Whether our client is currently the subject of a profile on an SCL / Cambridge
Analytica database (in any format).
4. If our client is not the subject of a current profile, whether he has ever been
and, if so, for what period of time?
5. Who has accessed the profile for our client (in any format) and when.
6. Whether our client has ever been subject to any form of bespoke request.
29. The Defendants failed to provide any admissible response to the letter of claim or to
address the shortcomings of the SAR Response. This means that the Claimant lacks
essential information to assess the legality of all relevant aspects of the processing of his
data.
30. In the light of the Claimant’s concerns about the processing of his data, he also needs to
understand the methodologies used by the Defendants in obtaining the data it holds on
him and then how it is used to profile him. Accordingly, he also seeks disclosure of:
a. Internal documents or policies which outline the Defendants’ data collection
practices;
b. Internal documents or policies which explain the methodologies used to process
the data and / or generate models or profiles on individuals.
[8]
A013
31. Therefore, before pursuing his proposed claim, the Claimant seeks an order (i)
compelling the Defendants to comply with their duties under s 7 DPA by providing a full
response to his SAR; and (ii) requiring them to provide advance disclosure.
LAW
The DPA
32. The DPA gave domestic effect to the provisions of Directive 95/46/EC on the protection
of individuals with regard to the processing of personal data and the free movement of
such data (“the Directive”). Recital 2 of the Directive states that data processing systems
"must, whatever the nationality or residence of natural persons, respect their
fundamental rights and freedoms, notably the right to privacy..." .
33. SI DPA contains the basic interpretative positions. “ Data subject ” is defined as the
“ individual who is the subject of the data." “ Personal data ” means:
data which relate to a living individual who can be identified —
(a) from those data, or
(b) from those data and other information which is in the possession of, or
is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any
indication of the intentions of the data controller or any other person in
respect of the individual ...
34. S2 DPA defines the term “ sensitive personal data ” as including data consisting of
information as to a data subject’s " political opinions”, his ‘‘religious beliefs or other
beliefs of a similar nature .”
35. S 5 DPA establishes the scope of the DPA’s application. It provides, inter alia, that:9
9 Emphasis added
[9]
AO 14
(1) Except as otherwise provided by or under section 54, this Act applies to a data
controller in respect of any data only if—
(a) the data controller is established in the United Kingdom and the data are
processed in the context of that establishment, or
(b) the data controller is established neither in the United Kingdom nor in
any other EEA State but uses equipment in the United Kingdom for
processing the data other-wise than for the purposes of transit through the
United Kingdom.
(1A) ...
(2) A data controller falling within subsection (l)(b) must nominate for the
purposes of this Act a representative established in the United Kingdom.
(3) For the purposes of subsections (1) and (2), each of the following is to be treated
as established in the United Kingdom —
(a) ...,
(b) a body incorporated under the law of, or of any part of, the United
Kingdom,
(c) ...
(d) any person who does not fall within paragraph (a), (b) or (c) but
maintains in the United Kingdom —
(i) an office, branch or agency through which he carries on any
activity, or
(ii) a regular practice;
and the reference to establishment in any other EEA State has a
corresponding meaning.
36. S 7( 1) DPA provides for the right of access to personal data in the following manner: 10
Subject to the following provisions of this section and to sections 8, 9 and 9A, an
individual is entitled —
10 Emphasis added.
[10]
AO 15
(a) to be informed by any data controller whether personal data of which that
individual is the data subject are being processed by or on behalf of that data
controller,
(b) if that is the case, to be given by the data controller a description of—
(i) the personal data of which that individual is the data subject,
(ii) the purposes for which they are beins or are to be processed, and
(iii) the recipients or classes of recipients to whom they are or may be
disclosed,
(c) to have communicated to him in an intelligible form —
(i) the information constituting any personal data of which that individual is
the data subject, and
(ii) any information available to the data controller as to the source of those
data, and
(d) where the processing by automatic means of personal data of which that
individual is the data subject for the purpose of evaluating matters relating
to him such as, for example, his performance at work, his credit worthiness,
his reliability or his conduct, has constituted or is likely to constitute the sole
basis for any decision significantly affecting him, to be informed by the data
controller of the logic involved in that decision-taking.
37. This provision implements Article 12 of the Directive, which is headed “ Right of
access’’. S 7(9) DPA provides that: “If a court is satisfied on the application of any
person who has made a request under the foregoing provisions of this section that the
data controller in question has failed to comply with the request in contravention of those
provisions, the court may order him to comply with the request. ’’
Pre-action disclosure
38. Under s 33(2) Senior Courts Act 1981 the High Court has the power to order disclosure
in the context of preliminary proceedings. It states:
Powers of High Court exercisable before commencement of action
(2) On the application, in accordance with rules of court, of a person who appears
to the High Court to be likely to be a party to subsequent proceedings in that court
[11]
AO 16
[...] - the High Court shall, in such circumstances as may be specified in the rules,
have power to order a person who appears to the court to be likely to be a party to
the proceedings and to be likely to have or to have had in his possession , custody
or power any documents which are relevant to an issue arising or likely to arise
out of that claim —
(a) to disclose whether those documents are in his possession, custody or power;
and
(b) to produce such of those documents as are in his possession, custody or power
to the applicant or, on such conditions as may be specified in the order —
(i) to the applicant's legal advisers; or
(ii) to the applicant's legal advisers and any medical or other professional adviser
of the applicant; or
(iii) if the applicant has no legal adviser, to any medical or other professional
adviser of the applicant.
39. Part 31.16 CPR states:
Disclosure before proceedings start
(1) This rule applies where an application is made to the court under any Act for
disclosure before proceedings have started.
(2) The application must be supported by evidence.
(3) The court may make an order under this rule only where—
(a) the respondent is likely to be a party to subsequent proceedings;
(b) the applicant is also likely to be a party to those proceedings;
(c) if proceedings had started, the respondent’s duty by way of standard
disclosure, set out in rule 31.6, would extend to the documents or classes of
documents of which the applicant seeks disclosure; and
(d) disclosure before proceedings have started is desirable in order to -
(i) dispose fairly of the anticipated proceedings ;
[12]
AO 17
(ii) assist the dispute to be resolved without proceedings; or
(Hi) save costs.
(4) An order under this rule must -
(a) specify the documents or the classes of documents which the respondent
must disclose; and
(b) require him, when making disclosure, to specify any of those documen ts -
(i) which are no longer in his control; or
(ii) in respect of which he claims a right or duty to withhold inspection.
(5) Such an order may -
(a) require the respondent to indicate what has happened to any documents
which are no longer in his control; and
(b) specify the time and place for disclosure and inspection.
THE S 7 DPA CLAIM
40. The Defendants (or at least some of the Defendants) are and were at all material times
data controllers within the meaning of s 5 DPA. The Defendants processed and/or
continue to process the Claimant’s personal data, including sensitive personal data,
within the meaning of s 1 and 2 DPA.
41. The Claimant is and was at all material times a data subject within the meaning of s 1
DPA.
42. The Defendants’ failure to comply adequately with the Claimant’s DPA request is
unlawful and in breach of the Claimant’s statutory “right of access to personal data”.
43. Without prejudice to the generality of the aforesaid, the Claimant avers as follows:
44. The SAR Response provide was inadequate and unlawful in that:
[13]
AO 18
a. It was materially incomplete as further data is likely to have been withheld (see
paras 18-19, above), contrary to s 7(l)(c) DPA;
b. It provided inadequate information on the purposes for which the Claimant’s data
was being processed (see paragraphs 20, above), contrary to s 7(l)(b)(ii) DPA;
c. It failed to provide information on the recipients to whom the Claimant’s personal
data was or may be disclosed (see paragraphs 21, above) contrary to s 7(l)(b)(iii)
DPA; and / or
d. It failed to provide any information available regarding the source(s) of the
personal data (see paragraphs 22, above) contrary to s 7(l)(c)(ii) DPA.
45. The inadequacies of the SAR Response set out above are confirmed by the expert
evidence of Professor Howard and Dr Stillwell (see paras 23-24, above).
46. There is no justification for the Defendants’ failure to provide an adequate and lawful
response to the SAR.
THE DISCLOSURE APPLICATION
47. The Defendants’ failure to comply with the Claimant’s SAR means that the Court will
need to deal with the claim under s 7 DPA in any event. The Disclosure Application
supplements the s 7 DPA claim in that it requests further relevant information which,
while not within the scope of s 7 DPA, is essential for the Claimant to be able to
understand the manner in which the Defendants process his data and the legality thereof.
48. The criteria under Part 3 1 . 16(3)(a)-(c) CPR are established in this case:
a. The Respondents are the intended Defendants in the proposed claim outlined at
para 25 ffi, above.
b. The Applicant is the intended Claimant to those proceedings.
[14]
A019
c. The documents sought would need to be disclosed by the Respondents under
standard disclosure in the event that such a claim goes ahead.
49. Pre-action disclosure is desirable within the meaning of Part 3 1 . 16(3)(d) for the following
reasons.
50. First, the Claimant requires disclosure of any and all information regarding the
processing of his personal data by the Defendants in order to be able to ascertain to true
nature and scope of the proposed claim. The Claimant is also concerned to understand
who the data was provided, to appreciate the full extent of the processing and nature of
the claims arising.
5 1 . Second, providing this disclosure now, at the pre-action stage of that claim, will avoid
the need for multiple costly and unnecessary amendments in due course. The key
information necessary for the complete pleading of the claim is held by the Defendants.
52. Third, it is likely to lead a narrowing of the issues between the parties, saving costs and
time, and allowing informed consideration of alternative dispute resolution options.
53. Together, the above reasons mean that pre-action disclosure is appropriate within the
meaning of Part 31.16 CPR.
CONCLUSION
54. In light of the above, the Court is invited to make the draft order prepared by the Claimant
and require the Defendant to (i) comply fully with his SAR, and (ii) provide the pre¬
action disclosure sought.
DINAH ROSE QC
BEN JAFFEY QC
JULIANNE KERR MORRISON
NIKOLAUS GRUBECK
Date: 16 March 2018
[15]
A020
Claim No.:
IN THE HIGH COURT OF JUSTICE
QUEEN’S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
BETWEEN:
DAVID CARROLL
Claimant / Applicant
- and -
(1) CAMBRIDGE ANALYTICA LTD
(2) CAMBRIDGE ANALYTICA (UK) LTD
(3) SCL ELECTIONS LTD
(4) SCL GROUP LTD
Defendants / Respondents
ORDER
UPON the Claimant’s claim pursuant to section 7(9) of the Data Protection Act 1997 issued on 16
March 20 1 8
AND UPON the Claimant’s application for pre -action disclosure pursuant to section 33(2) Senior
Courts Act 1981 and Part 31.16 CPR
IT IS ORDERED THAT:
1. The Claimant’s claim under section 7(9) of the Data Protection Act 1998 is allowed.
2. The Defendant must comply in full with the Claimant’s subject access request made
under section 7(1) of the Data Protection Act 1998 by no later than [ ] 2018.
3. The Defendant must provide pre-action disclosure of the material specified in paras 28
and 30 of the Part 8 Claim / Application for pre-action disclosure dated 16 March 2018.
That disclosure to be provided by the same deadline as prescribed in para 2 of this Order.
1
A021
4. The Defendant shall pay the Claimant’s costs, such costs to be subject to detailed
assessment on the standard basis if not agreed.
Dated: [ ] 2018
2
A022
