High Court rules on scope of UK GDPR in landscape gardener case
The case has attracted some publicity already in the specialist property press and two national newspapers, The Times and The Daily Mail.
The case arose out of the recording of two telephone conversations between Mr Cameron and a former customer of his gardening business called Mark Harrison. Mr Harrison, whose business is in property development, had engaged Alasdair Cameron Limited to redesign and landscape the gardens at his home in Kingston-upon-Thames but terminated his contract with the company towards the end of the project.
During the telephone calls, Mr Harrison said (amongst other things):-
“… you try and take anything offsite, and you will have a visit from two of my friends from Manchester, you try and take any materials off this site … and I will send some people to pay you a visit you will never forget, you and your family will never forget …”
“I’m going to administer an education, that’s what I’m going to do”
“Yeah, now listen go away I will see you in a couple of hours and then we will thrash it out, THRASH being the operative word, in a couple hours, bye bye”
As the judge found:-
“Mr Harrison’s behaviour during those calls … [was] seriously and persistently menacing. It is true, as Mr Harrison asserted, that he wanted Mr Cameron to “go away”. But it is manifest that to achieve that object Mr Harrison resorted to serious and ugly threats of violence to intimidate Mr Cameron into compliance”.
Mr Cameron shared the recordings he had made with a limited circle of friends, family and colleagues, but copies found their way to other people connected with the property industry and Mr Harrison alleged that a substantial property deal involving the Grosvenor Estate had been derailed by the dissemination of the recordings.
But he did not sue for damages, instead making claims under the Data Protection Act 2018 and the UK General Data Protection Regulation. He alleged that Mr Cameron was a data controller in his personal capacity and had refused to answer a data subject access request in breach of his legal obligations. He further alleged that Alasdair Cameron Limited had not complied with a data subject access request properly by refusing to give the names of those persons with whom the recordings had been shared.
These claims failed. The Court found that Mr Cameron was acting as a director of his company and was not a data controller and that Alasdair Cameron Limited had responded within its rights by refusing to name third parties who (it was reasonable to suppose) might be subject to intimidating conduct.
The full judgment is available here.
The case raised a number of important legal issues including the scope of the so-called “household exemption” and the circumstances in which a director of a company can be a data controller in a personal capacity (following the judgments of Richards J In re Southern Pacific Personal Loans Ltd [2014] Ch 426 at [19] and Lewison LJ in Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd [2017] EWCA Civ 121 at [70]-[71]). The judgment also examined the post-Brexit decision of the European Court of Justice in the Austrian Post case and the “rights of others” exemption in Article 15 of the UK GDPR and Schedule 2, paragraph 16 of the Data Protection Act 2018.
Charles Fussell & Co LLP instructed Kate Wilson of 5RB and later Robin Hopkins of 11KBW, who appeared at the trial. The Claimant was represented by Rosenblatt who instructed Sara Mansoori KC of Matrix Chambers.