Aven & Ors v Orbis Business Intelligence Ltd

This case was about an intelligence memorandum, not a customer database or marketing list. But the court treated the report as a data protection problem because it contained information about identifiable individuals and had been processed and disclosed by a business.

Orbis prepared Memorandum 112 as part of a wider intelligence exercise. The memorandum referred to three businessmen connected with Alfa Group and made a series of allegations about their relationship with President Putin. After the dossier became public through BuzzFeed, the individuals named in the memorandum brought a claim under the Data Protection Act 1998.

The claim focused on whether the memorandum contained their personal data, whether some of that data were sensitive because they alleged criminality, whether Orbis had processed the data fairly and lawfully, and whether the allegations were accurate or had been checked properly before disclosure.

The court identified five main issues. First, what parts of the memorandum were actually personal data about the claimants. Secondly, whether Orbis could rely on the legal purposes exemption for processing connected with prospective legal proceedings, legal advice or legal rights. Thirdly, whether a national security exemption applied to certain disclosures.

Fourthly, the court had to decide whether the processing breached the fairness requirements under the first data protection principle. Fifthly, it had to decide whether the data were inaccurate or misleading under the fourth principle, and if so whether Orbis could still avoid breach by showing that it had accurately recorded third-party information and taken reasonable steps to check it.

That final point was central. The case was not simply about whether allegations were true or false. It was also about what level of verification was reasonable for an intelligence business in the circumstances.

The court took a contextual, practical approach to the memorandum. It rejected an overly atomised reading of the report and treated it as a coherent narrative when deciding whether it contained personal data about the claimants. It also held that the allegation about delivering illicit cash amounted to sensitive personal data because it alleged criminality.

On exemptions, the court accepted that the disclosure to the Washington consultancy fell within the legal purposes exemption. It also accepted that the purpose of national security required exemption from the notice requirement for the national security disclosures. But those findings did not end the case.

The court found that the claimants had proved the personal data complained of were inaccurate or misleading as matters of fact. Even so, Orbis avoided breach of the accuracy principle for most of the allegations because it had accurately recorded third-party information and had taken reasonable steps to verify those points in light of the limited purposes of the report. The exception was the illicit cash allegation. For that allegation, the court held that Orbis had not taken reasonable enough steps to verify it.

The court drew a clear distinction between different kinds of statements in the memorandum. It considered the allegations about favours, foreign policy advice, a recent meeting and political bidding to be broad, factual propositions that were less grave and more credible on their face in the context of the report. For those, the court accepted that Orbis had taken reasonable steps for the purposes in question.

The allegation about using an intermediary to deliver large amounts of illicit cash to Putin in the 1990s was different. The court described it as an allegation of serial criminal wrongdoing over a prolonged period. It was older, more specific and much more serious than the other points. Because of that gravity, the court expected closer attention, more energetic checking and a more enquiring approach.

On the evidence, Orbis had not done enough. The judge was not persuaded that the verification effort for that allegation met the required standard. That failure meant a breach of the fourth data protection principle was established for that allegation, even though other parts of the memorandum survived challenge.

This decision matters if your business gathers, writes, stores or shares allegations about people as part of due diligence, investigations, disputes, fraud reviews, sanctions screening, workplace investigations or political risk work. The court did not say that intelligence businesses cannot handle uncertain information. It did say that purpose and context do not excuse weak checking of serious allegations.

In practice, the standard of checking should rise with the seriousness of the claim, the age of the events, the specificity of the allegation and the likely harm if the information is wrong. If you are handling allegations of bribery, fraud, money laundering or other criminal conduct, you should expect a much more disciplined process than for lower-level background intelligence.

The case also shows the value of documenting why a disclosure was necessary, who received it and what verification was done. If your business cannot later explain those steps, it may struggle to defend the processing even where the overall project had a legitimate purpose.

If your business uses investigators or prepares sensitive reports, build a process that can withstand later scrutiny. This case is a reminder that courts look closely at what was actually done, not just at the label attached to the project.

A practical workflow should separate ordinary background intelligence from serious allegations, especially allegations of criminal conduct. It should also make clear who signs off on disclosure and what evidence supports the most damaging statements.