Chirkunov v Persons Unknown

Hearing date: 21 November 2024

Further written submissions: 29 November 2024

Approved Judgment

This judgment was handed down remotely at 10.00am on 11 December 2024 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

This is a data protection claim. The Claimant alleges several breaches of the UK General Data Protection Regulation (“UK GDPR”) arising from the original and continued publication of the following articles, on separate websites:

(1) an article, under the headline “ Free Wheely: How the former governor of the Perm Territory Chirkunov gave his son a dream job”, published from 13 January 2021 (“the First Article”) on the website rucriminal.info (“the rucriminal Website”); and

(2) an article, under the headline “ Anton Chirkunov, Daria Tarasenkova and Wheely company: an expensive toy for children of oligarchy”, published from 19 June 2023 (“the Second Article”) on the website www.talk-finance.co.uk (“the Talk Finance Website”).

The Claimant's case is that, save for minor details, substantially the First and Second Articles are in the same terms. It is not necessary, nor is it appropriate, to set out the terms of the two Articles in this judgment.

A: The Claim

(1) Claim Form

The Claim Form was issued on 29 August 2024. The Defendants were identified as follows:

(1) The First Defendant:

“Person(s) Unknown (being the person or persons responsible for the publication of a webpage referring to the Claimant on the website www.rucriminal.info (sic))”.

(2) The Second Defendant:

“Person(s) Unknown (being the person or persons responsible for the publication of a webpage referring to the Claimant on the website http://www.talk-finance.co.uk)”.

The Claim Form did not state the address of either Defendant. Instead, an email address for each Defendant was provided in the box on the Claim Form where the Defendants' addresses for service were required to be provided. Pursuant to CPR PD16 §2.2, the Claim Form is required to include the address at which each Defendant lives or carries on business, together with a postcode.

The address is important, not least because the domicile of a defendant is relevant to jurisdiction. Where a defendant is domiciled outside England & Wales, a claimant may require the Court's permission to serve the Claim Form outside the jurisdiction. If the address of the defendant stated on the Claim Form is outside the jurisdiction, it will be stamped to indicate that it is not to be served out of the jurisdiction.

If a Claim Form does not include the full address (including postcode) for all parties to the claim, then the Claim Form will be issued but will be retained by the Court (and not served) until the claimant has supplied a full address, including postcode, or the Court has dispensed with the requirement to do so: CPR PD16 §2.3. If the claimant cannot provide the address, as required, an application for alternative service of the Claim Form under CPR 6.15 will also usually be required.

In this case, the Court did not retain the Claim Form; it was provided to the Claimant. That should not have happened, but no harm has been caused because the Claimant has not purported to serve the Claim Form on either Defendant.

(2) Particulars of Claim

Particulars of Claim, dated 20 August 2024, were filed with the Court on 29 August 2024. They erroneously state that they were “ served” on 20 August 2024. They have not been served.

In the Particulars of Claim, the Claimant is described as the founder and Chief Executive Officer of Wheely Ltd, which operates a “ luxury ride-hailing service”. The Claimant is a Swiss national who has lived in London since April 2020. He is a resident of the UK and has “ pre-settled status”.

The Particulars of Claim contain no more, by way of identifying material about the Defendants, beyond that contained in the Claim Form. As to the Websites, on which the Articles appear, the Claimant states:

“The Websites are published anonymously, and the identity of the Defendants is unknown to the Claimant. Each of the Defendants appears to have taken steps to conceal their identity and has failed to identify themselves when requested to do so by the Claimant's solicitors in correspondence… To the best of the Claimant's knowledge, there is no registered data controller in respect of either Website on the register maintained by the Information Commissioner's Office”.

The Claimant contends that the First and Second Articles contain his personal data within the terms of Article 4(1) of the UK GDPR and/or the Data Protection Act 2018. The Claimant alleges that, in material respects, the data are inaccurate, and that the Defendants have been processing this data by making it available via the published Articles on the two Websites. It is alleged – but without particulars – that, in respect of this processing, the Defendants “ were and are the data controllers for the purposes of [the Data Protection Act 2018] and Article 4(7) of the UK GDPR”. I would note that not everyone who falls within the current definition of ‘Persons Unknown’ in the Claim Form would necessarily be a data controller for data protection purposes (see further [79] below).

Reference is made to, and reliance placed upon, letters of complaint sent to the Defendants, in early January 2024, in which the Claimant sought erasure of the personal data from the two Articles that was alleged to be inaccurate.

The Claimant contends that “ the wrongful processing of [his personal data] by the Defendants has caused the Claimant serious distress and anxiety and damaged his autonomy and reputation”. No particulars are given. Insofar as the Claimant complains of harm to his reputation, he has not brought any claim for defamation. The 1-year limitation period for defamation claims (s.4A Limitation Act 1980) would now stand as a likely impediment to such a claim.

The Particulars of Claim state that, on 3 May 2023, the Claimant used an intermediary to contact the First Defendant to seek the removal of the First Article. In response, it is alleged, “ the First Defendant refused to remove the First Article unless the Claimant paid the sum of US$30,000. This demand was tantamount to blackmail and rejected by the Claimant” (see further [38]–[39] and [40.(6)] below).

The principal remedies sought by the Claimant against each Defendant are:

(1) compensation pursuant to Article 82 of the UK GDPR and/or s.168 Data Protection Act 2018;

(2) a compliance order pursuant to s.167 Data Protection Act 2018 requiring;

a) the erasure of the personal data “ and any similar data”; and

b) the Defendants to take the steps set out in Article 17(2) and Article 19 of the UK GDPR; and

(3) a declaration that the personal data in issue are inaccurate.

The relevant provisions of the UK GDPR relied upon by the Claimant in relation to his claim for remedies are as follows:

Article 17(2)

“Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.”

Article 19

“The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.”

Absent a Defendant's agreement to do so voluntarily, an order for erasure of data, and remedies under Articles 17(2) and 19, if granted, could only be effected by mandatory injunction.

It might be thought that, unless the First and Second Defendants can be properly identified, none of these remedies is likely to have any practical value beyond, perhaps, the declaration sought. I deal with the separate issue of enforcement below.

In evidence filed for the hearing, it was claimed that the Claimant was “ entitled” to a declaration, if his claim were successful. That is not correct. There is no such entitlement to a declaration. As Mr Helme accepted in his skeleton argument, declarations are not remedies provided under the data protection legislation, and they are not generally granted in this type of litigation (even after contested inter partes litigation): Cleary v Marston (Holdings) Ltd [2021] EWHC 3809 (QB) [29]–[30].

In Aven v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB), Warby J explained:

[191] … The [Data Protection Act] does not provide for declarations, and no case has been identified in which the issue has been examined. My findings are analogous to a finding of liability for libel. But this is not a libel action. Anyway, English law and procedure do not permit the court to make a...