In the High Court Of Justice Claim Form (CPR Part 8) Queen's Bench Division Royal Courts of Justice Claim no. Fee Account no. Help with Fees Ref no. (if applicable) H W F - - Claimant David Richard Carroll 29 Tiffany Place, Apartment 1K, Brooklyn, New York, NY 11231 SEAL Defendant(s) (1) Cambridge Analytica Ltd (2) Cambridge Analytica (UK) Ltd (3) SCL Elections Ltd (4) SCL Group Ltd Does your claim include any issues under the Human Rights Act 1998? Yes X No Details of claim (see also overleaf) The Claimant seeks an Order under section 7 of the Data Protection Act 1998 that the Defendants be required to comply in full with his subject access request of January 2017. Please find enclosed the Particulars of Claim (as well as an application made for pre-action disclosure in respect of other causes of action). Defendant's name and address £ Defendants' names as above 55 New Oxford Street London WC1A 1BS Court fee 528.00 Legal representative’s costs Issue date For further details of the courts www.gov.uk/find-court-tribunal. When corresponding with the Court, please address forms or letters to the Manager and always quote the claim number. N208 Claim form (CPR Part 8) (06.16) © Crown copyright 2016 Laserform International 6/16 A001 Claim no. Details of claim (continued) Statement of Truth *(I believe)(The Claimant believes) that the facts stated in these particulars of claim are true. XXXXXXXX * I am duly authorised by the claimant to sign this statement. Full name Ravi Naik Name of claimant’s legal representative’s firm Irvine Thanvi Natas signed *(Claimant)(Litigation friend) XXXXXXXX XXXXXXXXXXXXX (Legal representative's solicitor) Irvine Thanvi Natas 36 Whitefriars Street London EC4Y 8BQ DX: 5430 Stratford Fax: 020 8522 7708 position or office held Partner (if signing on behalf of firm or company) *delete as appropriate Claimant’s or claimant’s legal representative’s address to which documents should be sent if different from overleaf. If you are prepared to accept service by DX, fax or e-mail, please add details. A002 N244 Name of court Claim no. High Court Of Justice Application notice Queen's Bench Division Royal Courts of Justice For help in completing this form please read the notes for guidance form N244Notes. Fee account no. Help with Fees – Ref. no. (if applicable) (if applicable) H W F - - Warrant no. (if applicable) Claimant’s name (including ref.) David Richard Carroll (Ref: RAN/28325) Defendant’s name (including ref.) (1) Cambridge Analytica Ltd (2) Cambridge Analytica (UK) Ltd (3) SCL Elections Ltd (4) SCL Group Ltd (Ref: KK/17517) 16 March 2018 Date 1. What is your name or, if you are a legal representative, the name of your firm? Irvine Thanvi Natas 2. Are you a Claimant Defendant X Legal Representative Other (please specify) If you are a legal representative whom do you represent? Claimant / Applicant 3. What order are you asking the court to make and why? An order for pre-action disclosure in the terms set out in the draft Order. Please also see the enclosed Application Grounds / Part 8 Claim. 4. Have you attached a draft of the order you are applying for? X Yes No 5. How do you want to have this application dealt with? X at a hearing without a hearing at a telephone hearing 6. How long do you think the hearing will last? 5 Is this time estimate agreed by all parties? Hours Yes Minutes X No 7. Give details of any fixed trial date or period 8. What level of Judge does your hearing need? 9. Who should be served with this application? N244 Application notice (06.16) Defendants 1 © Crown copyright 2016 Laserform International 6/16 A003 9a. Please give the service address, (other than details of the claimant or defendant) of any party named in question 9. 10. What information will you be relying on, in support of your application? X the attached witness statement X the statement of case X the evidence set out in the box below If necessary, please continue on a separate sheet. Please refer to enclosed Application Grounds / Part 8 Claim, witness statements, exhibits and expert reports. Please note that the hearing estimate at question 6 of this application is provided on the basis of the section 7 Data Protection Act claim being heard together with this application. Statement of Truth The applicant believes that the facts stated in this section (and any continuation sheets) are true. Signed Dated 16 March 2018 Applicant’s legal representative Full name Ravi Naik Name of applicant’s legal representative’s firm Irvine Thanvi Natas Position or office held Partner / Solicitor (if signing on behalf of firm or company) 11. Signature and address details Signed Dated 16 March 2018 Applicant’s legal representative Position or office held Partner / Solicitor (if signing on behalf of firm or company) 2 A004 Applicant’s address to which documents about this application should be sent If applicable Irvine Thanvi Natas 36 Whitefiars Street London Postcode E C 4 Y 8 B Q Phone no. 020 8522 7707 Fax no. 020 8522 7708 DX no. 5430 Stratford Ref no. RAN/28325 E-mail address rnaik@itnsolicitors.com 3 A005 Claim No.: IN THE HIGH COURT OF JUSTICE QUEEN’S BENCH DIVISION MEDIA AND COMMUNICATIONS LIST BETWEEN: DAVID CARROLL Claimant / Applicant - and (1) CAMBRIDGE ANALYTICA LTD (2) CAMBRIDGE ANALYTICA (UK) LTD (3) SCL ELECTIONS LTD (4) SCL GROUP LTD Defendants / Respondents ___________________________________________________________________________ PART 8 CPR CLAIM UNDER S 7(9) DATA PROTECTION ACT 1998 and APPLICATION FOR PRE-ACTION DISCLOSURE ___________________________________________________________________________ SUMMARY 1. The Claimant / Applicant Professor David Carroll (“the Claimant”), applies for an order requiring the Defendants / Respondents (“the Defendants”) to: a. Comply fully with his subject access request made under s 7 Data Protection Act 1998 (“DPA”) – that claim is brought under Part 8 CPR (“the s 7 DPA claim”); and/or b. Provide him with pre-action disclosure pursuant to s 33(2) Senior Courts Act 1981 and Part 31.16 CPR (“the disclosure application”). 2. The Defendants are commercial entities that create detailed profiles of individuals which they sell to advertisers, political campaigns and other entities, so as to assist them in [1] A006 targeting their efforts to influence the behaviour of profiled individuals. The subject of these detailed profiles is not informed that they have been generated or sold to third parties. For individuals to confirm whether they have been profiled, what information is held on them, and how it has been used, they need to rely on subject access requests under the DPA. 3. The Claimant made such a request. In response, the Defendants confirmed that the Claimant has, without his knowledge, been the subject of their profiling activities. The Claimant was provided with some of that information as to the data held on him although this appears to be materially incomplete. 4. In order to be provided with the full information he is entitled to under the DPA, the Claimant brings the present s 7 DPA claim. In pre-action correspondence, the Claimant has also sought further information which is essential for him to determine the legality of the Defendants’ processing of his data. The Defendants have failed to provide this and the Claimant therefore also makes the disclosure application. FACTS The parties 5. The Claimant is an Associate Professor of media design at the Parsons School of Design in New York, USA and has particular experience in the field of online behavioural advertising technologies. The Claimant’s work encompasses research into how the digital media and marketing industry is able to track user behaviours and how companies can use technology to “re-identify” an individual from supposedly anonymous data. 6. The Defendants are UK-registered companies which, by their own description, engage in the business of “behavioural microtargeting” – the collating and/or creating and then selling of data profiles of individuals which are used for, inter alia, targeted advertising and political campaigning. 7. The personal data used to create such individual profiles consists of information relating to people’s personality traits, political beliefs and other deeply held personal habits and [2] A007 decisions. The profiles prepared by Cambridge Analytica are said to use “up to 5,000 data points on over 230 million American voters … [to] build your custom target audience, then use this crucial information to engage, persuade, and motivate them to act.” 1 8. There are two companies registered on Companies House with the name “Cambridge Analytica”: Cambridge Analytica Ltd (Co. number: 09154503) and Cambridge Analytica (UK) Ltd (Co. number: 09375920). It is unclear whether / how these companies operate together. SCL Elections Limited (Co. number: 08256225) is Cambridge Analytica (UK) Ltd’s parent company.2 The ultimate parent company is SCL Group Ltd, also registered in the UK (Co. number 05514098). 9. Cambridge Analytica (as a single entity) and SCL Elections Ltd are registered with the Information Commissioner’s Office as data controllers. SCL Group is not so registered. The Claimant’s subject access request under s 7 DPA (“the SAR”) 10. On in or around 10 January 2017, Professor Carroll submitted the SAR to Cambridge Analytica (“the SAR”). In doing so, he was motivated by both academic and personal interest in ascertaining what data the Defendants held on him and how it was being processed. The SAR was submitted through the following website: https://datarequests.cambridgeanalytica.org. 11. In response to that request, the Claimant received an email from a “data compliance” email address associated with SCL group. This informed the Claimant that he was “required to submit the £10 fee and proof of ID directly to SCL Elections who is Cambridge Analytica’s agent for the purposes of DPA requests.” 12. A substantive response was then provided on 27 March 2017, under cover of a letter from “Cambridge Analytica”. That letter was signed by Julian Wheatland, “Group COO”. At 1 Carole Cadwalladr, Robert Mercer: the big data billionaire waging war on mainstream media, the Guardian, 26 February 2017, available at: https://www.theguardian.com/politics/2017/feb/26/robert-mercer-breitbart-war-onmedia-steve-bannon-donald-trump-nigel-farage 2 SCL Elections Limited are registered with Companies House as the Company with “significant control” over Cambridge Analytica (UK) Limited. [3] A008 the time, Mr Wheatland was a director of SCL Group Limited. Based on publicly available information, Mr Wheatland did not hold a position at Cambridge Analytica. 13. On 27 February 2018, Alexander Nix, Cambridge Analytica’s chief executive, gave oral evidence before the Digital, Culture, Media and Sport Committee. He confirmed that the Defendants share data, stating that they: “transfer data from Cambridge Analytica to SCL.”3 14. In light of the above, the SAR appears to have been processed by the Defendants collectively. The Defendants’ response to the SAR (“the SAR Response”) 15. The SAR Response confirmed that the Defendants are data controllers for the purposes of s 5 DPA, including in respect of the Claimant, who is / was a data subject within the meaning of s 1 DPA. 16. The SAR Response purported to provide the Claimant with “all of the data to which you are entitled under the DPA, in a Microsoft Excel Spreadsheet (.xls).” The enclosed file contained: a. A summary of the Claimant’s profile; b. Background data on the Claimant, including his name, address, date of birth, and US voter identification numbers; c. Data relating to the Claimant’s election returns for both primary and general elections from 2000 – 2014, including a category titled “result” indicating the party voted for; and d. A political profile stating the Claimant’s political views on key issues, ranking them by order of importance to him, and identifying his political and party affiliation (registered and unregistered) as well as his likelihood of voting. 3 At Q688 – Q689 [4] A009 17. Having considered the response, based on his knowledge and experience, the Claimant was concerned that it appeared to be incomplete and did not comply with s 7 DPA in a number of material respects. 18. First, the underpinning personal data provided was insufficient to support the ‘headline’ personal profile of the Claimant. The political profile of the Claimant provided appeared to be based on further information about him (whether derived from open or private sources) that was not provided as part of the SAR Response. The limited factual information disclosed did not provide sufficient information to give rise to the “models” profiling the Claimant’s political views. For instance, the profile (correctly) identified gun control as a key political issue for the Claimant. Yet, given his public profile and general background, this is an unusual priority issue. There was nothing in the underlying data that would have permitted the Defendants to identify this private political view as a priority for the Claimant. 19. Further, compared to the Defendants’ public claims about the nature and scope of their profiling activities, the data provided appeared to be very limited. For instance, speaking to the Financial Times in January 2017, Alexander Nix, Cambridge Analytica’s chief executive stated: “We have a massive database of 4-5,000 data points on every adult in America”.4 As outlined above, the First Defendant’s website gives a similar indication of the scale of the data held, stating that they have “up to 5,000 data points on over 230 million American voters.” 5 The SAR Response did not contain anywhere near this number of data points on the Claimant. 20. Second, the SAR Response provided inadequate information on the purposes for which the Claimant’s data was being processed. It contained only a broad summary of the purposes for which that personal data is processed, including, for example, “audience opinion/behaviour research and polling” and “predictive algorithm development”. This was insufficient for the Claimant to understand the actual purposes for which the Defendants are processing his data. 4 Gillian Tett, Donald Trump’s campaign shifted odds by making big data personal, Financial Times, 26 January 2017, available at: https://www.ft.com/content/bee3298c-e304-11e6-9645-c9357a75844a 5 https://ca-political.com/ca-advantage [5] A010 21. Third, the SAR Response failed to provide information on the recipients to whom the Claimant’s personal data was or may be disclosed. The Defendants provided a high-level summary of the types of “clients” to which they might disclose data (e.g. “political campaigns” and “commercial entities”) but failed to indicate the actual organisations with which his data had been shared / would be shared. 22. Fourth, the SAR Response did not provide the requisite information regarding the source(s) of the personal data. It stated only that the Defendants had obtained the data from “reputable data vendors” or “research partners” without identifying these entities. 23. In light of the above concerns, the Claimant commissioned two expert reports by Professor Phil Howard and Dr David Stillwell. Both experts independently concluded that the SAR Response was likely to be incomplete.6 24. In summary: a. Professor Howard, of Oxford University, is a leading expert on the impact of new information technologies on public life. His report addresses in particular how profiling techniques such as those employed by the Defendants are used in political campaigning. Having analysed the material disclosed by the Defendants in response to the Claimant’s SAR, Professor Howard concludes that “this profile provides limited information on what the Defendants were doing, and is incomplete.” b. Dr Stillwell, of Cambridge University, is an expert in big data analysis and has particular experience in the prediction of psychological traits from social media data. His report deals with the way in which (i) models can predict an individual’s behaviour and preferences on the basis of a range of data points pertaining to that individual, (ii) such models are created / operated, and (iii) the resulting profile information can then be used to influence the relevant individual’s behaviour. Dr Stillwell also considered the information the Defendants provided in response to 6 In the alternative, the Defendants marketing claims would be significantly inflated and at least some of the predictions made in their profiling of the Claimant would amount to very lucky guesswork. [6] A011 the Claimant’s SAR (along with another similar response7). Analysing it in light of his particular expertise, he reaches the same conclusion as Professor Howard, namely that the information provided is likely to be incomplete. In particular, he considers that some of the Defendants’ key model predictions in respect of the Claimant are counter-intuitive and “difficult to explain from the generic demographic data given in the subject access request”, suggesting that further data was used in creating them. Pre-action correspondence / the proposed claim 25. The Defendants’ failure to provide an adequate SAR Response was in breach of s 7 DPA (see paras 40 ff., below). 26. Further, even the (incomplete) SAR Response indicated that the Claimant has a claim against the Defendants for breaches of the DPA, misuse of private information and/or breach of confidence.8 27. In light of the above, on 12 April 2017 the Claimant sent the Defendants a letter of claim. In essence, the proposed claim comprises the following: a. The profile of the Claimant prepared and distributed by the Defendants relates to his political opinions and thus constitutes sensitive personal information for the purposes of s 2 DPA. To process sensitive personal data, at least one of the conditions in Schedule 3 DPA would have to be met – this is not the case and no exemptions apply. b. The Claimant’s non-public political views are his private information. The Defendants’ use of this information took place without his consent and cannot be justified. It therefore amounts to misuse of private information. 7 Dr Stillwell was provided with the subject access response received by Professor David Golumbia to assist him in preparing his report. Professor David Golumbia has also provided his own statement supporting the Claimant’s claim and application in the light of his own on-going pre-action correspondence with the Defendants. The subject access response received by Professor Golumbia gives rise to the same or similar concerns to those raised by that received by the Claimant. 8 See Claimant’s letter of claim of 12 April 2017. [7] A012 c. The Defendants were or ought to have been aware that at least some of the information they held on the Claimant was / is confidential to him and they had no right to pass this on to third parties, giving rise to a claim for breach of confidence. 28. The Claimant requested that the Defendants disclose to him his entire file in full, including the information specified in para 39.1-39.11 of the letter of claim. Further, para 40 the Claimant’s letter of claim requested clarification of the following 1. Our client requests clarification of how his data has been used to create the profile. For example, do you re-identify our client’s data from de-identified / anonymised data sets? Further, do you use probabilistic and / or deterministic methods in performing the re-identification of the data? 2. Please clarify the source of the information that gave rise to our client’s entry onto your database. 3. Whether our client is currently the subject of a profile on an SCL / Cambridge Analytica database (in any format). 4. If our client is not the subject of a current profile, whether he has ever been and, if so, for what period of time? 5. Who has accessed the profile for our client (in any format) and when. 6. Whether our client has ever been subject to any form of bespoke request. 29. The Defendants failed to provide any admissible response to the letter of claim or to address the shortcomings of the SAR Response. This means that the Claimant lacks essential information to assess the legality of all relevant aspects of the processing of his data. 30. In the light of the Claimant’s concerns about the processing of his data, he also needs to understand the methodologies used by the Defendants in obtaining the data it holds on him and then how it is used to profile him. Accordingly, he also seeks disclosure of: a. Internal documents or policies which outline the Defendants’ data collection practices; b. Internal documents or policies which explain the methodologies used to process the data and / or generate models or profiles on individuals. [8] A013 31. Therefore, before pursuing his proposed claim, the Claimant seeks an order (i) compelling the Defendants to comply with their duties under s 7 DPA by providing a full response to his SAR; and (ii) requiring them to provide advance disclosure. LAW The DPA 32. The DPA gave domestic effect to the provisions of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and the free movement of such data (“the Directive”). Recital 2 of the Directive states that data processing systems "must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy…". 33. S 1 DPA contains the basic interpretative positions. “Data subject” is defined as the “individual who is the subject of the data.” “Personal data” means: data which relate to a living individual who can be identified— (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual… 34. S2 DPA defines the term “sensitive personal data” as including data consisting of information as to a data subject’s “political opinions”, his “religious beliefs or other beliefs of a similar nature.” 35. 9 S 5 DPA establishes the scope of the DPA’s application. It provides, inter alia, that:9 Emphasis added [9] A014 (1) Except as otherwise provided by or under section 54, this Act applies to a data controller in respect of any data only if— (a) the data controller is established in the United Kingdom and the data are processed in the context of that establishment, or (b) the data controller is established neither in the United Kingdom nor in any other EEA State but uses equipment in the United Kingdom for processing the data otherwise than for the purposes of transit through the United Kingdom. (1A) … (2) A data controller falling within subsection (1)(b) must nominate for the purposes of this Act a representative established in the United Kingdom. (3) For the purposes of subsections (1) and (2), each of the following is to be treated as established in the United Kingdom— (a) …, (b) a body incorporated under the law of, or of any part of, the United Kingdom, (c) … (d) any person who does not fall within paragraph (a), (b) or (c) but maintains in the United Kingdom— (i) an office, branch or agency through which he carries on any activity, or (ii) a regular practice; and the reference to establishment in any other EEA State has a corresponding meaning. 36. S 7(1) DPA provides for the right of access to personal data in the following manner:10 Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled— 10 Emphasis added. [10] A015 (a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller, (b) if that is the case, to be given by the data controller a description of— (i) the personal data of which that individual is the data subject, (ii) the purposes for which they are being or are to be processed, and (iii) the recipients or classes of recipients to whom they are or may be disclosed, (c) to have communicated to him in an intelligible form— (i) the information constituting any personal data of which that individual is the data subject, and (ii) any information available to the data controller as to the source of those data, and (d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his credit worthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking. 37. This provision implements Article 12 of the Directive, which is headed “Right of access”. S 7(9) DPA provides that: “If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.” Pre-action disclosure 38. Under s 33(2) Senior Courts Act 1981 the High Court has the power to order disclosure in the context of preliminary proceedings. It states: Powers of High Court exercisable before commencement of action (2) On the application, in accordance with rules of court, of a person who appears to the High Court to be likely to be a party to subsequent proceedings in that court [11] A016 [...] 1 the High Court shall, in such circumstances as may be specified in the rules, have power to order a person who appears to the court to be likely to be a party to the proceedings and to be likely to have or to have had in his possession , custody or power any documents which are relevant to an issue arising or likely to arise out of that claim— (a) to disclose whether those documents are in his possession, custody or power; and (b) to produce such of those documents as are in his possession, custody or power to the applicant or, on such conditions as may be specified in the order— (i) to the applicant's legal advisers; or (ii) to the applicant's legal advisers and any medical or other professional adviser of the applicant; or (iii) if the applicant has no legal adviser, to any medical or other professional adviser of the applicant. 39. Part 31.16 CPR states: Disclosure before proceedings start (1) This rule applies where an application is made to the court under any Act for disclosure before proceedings have started. (2) The application must be supported by evidence. (3) The court may make an order under this rule only where– (a) the respondent is likely to be a party to subsequent proceedings; (b) the applicant is also likely to be a party to those proceedings; (c) if proceedings had started, the respondent’s duty by way of standard disclosure, set out in rule 31.6, would extend to the documents or classes of documents of which the applicant seeks disclosure; and (d) disclosure before proceedings have started is desirable in order to – (i) dispose fairly of the anticipated proceedings; [12] A017 (ii) assist the dispute to be resolved without proceedings; or (iii) save costs. (4) An order under this rule must – (a) specify the documents or the classes of documents which the respondent must disclose; and (b) require him, when making disclosure, to specify any of those documents – (i) which are no longer in his control; or (ii) in respect of which he claims a right or duty to withhold inspection. (5) Such an order may – (a) require the respondent to indicate what has happened to any documents which are no longer in his control; and (b) specify the time and place for disclosure and inspection. THE S 7 DPA CLAIM 40. The Defendants (or at least some of the Defendants) are and were at all material times data controllers within the meaning of s 5 DPA. The Defendants processed and/or continue to process the Claimant’s personal data, including sensitive personal data, within the meaning of s 1 and 2 DPA. 41. The Claimant is and was at all material times a data subject within the meaning of s 1 DPA. 42. The Defendants’ failure to comply adequately with the Claimant’s DPA request is unlawful and in breach of the Claimant’s statutory “right of access to personal data”. 43. Without prejudice to the generality of the aforesaid, the Claimant avers as follows: 44. The SAR Response provide was inadequate and unlawful in that: [13] A018 a. It was materially incomplete as further data is likely to have been withheld (see paras 18-19, above), contrary to s 7(1)(c) DPA; b. It provided inadequate information on the purposes for which the Claimant’s data was being processed (see paragraphs 20, above), contrary to s 7(1)(b)(ii) DPA; c. It failed to provide information on the recipients to whom the Claimant’s personal data was or may be disclosed (see paragraphs 21, above) contrary to s 7(1)(b)(iii) DPA; and / or d. It failed to provide any information available regarding the source(s) of the personal data (see paragraphs 22, above) contrary to s 7(1)(c)(ii) DPA. 45. The inadequacies of the SAR Response set out above are confirmed by the expert evidence of Professor Howard and Dr Stillwell (see paras 23-24, above). 46. There is no justification for the Defendants’ failure to provide an adequate and lawful response to the SAR. THE DISCLOSURE APPLICATION 47. The Defendants’ failure to comply with the Claimant’s SAR means that the Court will need to deal with the claim under s 7 DPA in any event. The Disclosure Application supplements the s 7 DPA claim in that it requests further relevant information which, while not within the scope of s 7 DPA, is essential for the Claimant to be able to understand the manner in which the Defendants process his data and the legality thereof. 48. The criteria under Part 31.16(3)(a)-(c) CPR are established in this case: a. The Respondents are the intended Defendants in the proposed claim outlined at para 25 ff., above. b. The Applicant is the intended Claimant to those proceedings. [14] A019 c. The documents sought would need to be disclosed by the Respondents under standard disclosure in the event that such a claim goes ahead. 49. Pre-action disclosure is desirable within the meaning of Part 31.16(3)(d) for the following reasons. 50. First, the Claimant requires disclosure of any and all information regarding the processing of his personal data by the Defendants in order to be able to ascertain to true nature and scope of the proposed claim. The Claimant is also concerned to understand who the data was provided, to appreciate the full extent of the processing and nature of the claims arising. 51. Second, providing this disclosure now, at the pre-action stage of that claim, will avoid the need for multiple costly and unnecessary amendments in due course. The key information necessary for the complete pleading of the claim is held by the Defendants. 52. Third, it is likely to lead a narrowing of the issues between the parties, saving costs and time, and allowing informed consideration of alternative dispute resolution options. 53. Together, the above reasons mean that pre-action disclosure is appropriate within the meaning of Part 31.16 CPR. CONCLUSION 54. In light of the above, the Court is invited to make the draft order prepared by the Claimant and require the Defendant to (i) comply fully with his SAR, and (ii) provide the preaction disclosure sought. DINAH ROSE QC BEN JAFFEY QC JULIANNE KERR MORRISON NIKOLAUS GRUBECK Date: 16 March 2018 [15] A020 Claim No.: IN THE HIGH COURT OF JUSTICE QUEEN’S BENCH DIVISION MEDIA AND COMMUNICATIONS LIST BETWEEN: DAVID CARROLL Claimant / Applicant - and (1) CAMBRIDGE ANALYTICA LTD (2) CAMBRIDGE ANALYTICA (UK) LTD (3) SCL ELECTIONS LTD (4) SCL GROUP LTD Defendants / Respondents ___________________________________________________________________________ ORDER ___________________________________________________________________________ UPON the Claimant’s claim pursuant to section 7(9) of the Data Protection Act 1997 issued on 16 March 2018 AND UPON the Claimant’s application for pre-action disclosure pursuant to section 33(2) Senior Courts Act 1981 and Part 31.16 CPR IT IS ORDERED THAT: 1. The Claimant’s claim under section 7(9) of the Data Protection Act 1998 is allowed. 2. The Defendant must comply in full with the Claimant’s subject access request made under section 7(1) of the Data Protection Act 1998 by no later than [ 3. ] 2018. The Defendant must provide pre-action disclosure of the material specified in paras 28 and 30 of the Part 8 Claim / Application for pre-action disclosure dated 16 March 2018. That disclosure to be provided by the same deadline as prescribed in para 2 of this Order. 1 A021 4. The Defendant shall pay the Claimant’s costs, such costs to be subject to detailed assessment on the standard basis if not agreed. Dated: [ ] 2018 2 A022