In recent weeks we have noted two defamation injunctions obtained against the operator of the “Solicitors from Hell” website, Mr Rick Kordowski (see here and here).  More recently a solicitor has obtained summary judgment in defamation against him.   However, as far as we are aware, there has to date been no consideration of Mr Kordowski’s position under the Data Protection Act 1998 (“the DPA”).

The relevant terms are defined in sections 1 and 2 of the DPA.  “Data” means information which is being processed by means of equipment operating automatically in response to instructions given for that purpose.  “Personal data” means data which relates to a living individual who can be identified. The information relating to the individual does not have to be true.  A “data subject” is an individual who is the subject of personal data.

“Processing” is given an extremely wide definition, including “obtaining, recording or holding” or carrying out operations with the data.  A “data controller” is a person who (either alone or jointly with others) determines the purposes for which and the manner in which personal data are processed.

There can be no doubt that the website contains personal data of which solicitors mentioned are the “data subjects”.  It is also clear that Mr Kordowski is the “data controller”.   Any solicitor whose personal data is being processed by Mr Kordowski – that is, anyone who is mentioned substantively on the website  – could rely on two provisions of the DPA:

  • The duty to comply with the data protection principles in relation to all personal data with respect to which he is the data controller (section 4(4)).
  • The prohibition on data processing without registration (section 17).

The data protection principles are set out in Schedule 1, Part I of the DPA.  In particular

(1)        Personal data shall be processed fairly and lawfully and in particular, shall not be processed unless (a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met (the first principle);

(2)        Personal data shall be obtained only for one or more specified and lawful purposes (the second principle);

(3)        Personal data shall be accurate (the fourth principle); and

(4)        Personal data shall be processed in accordance with the rights of the data subjects under the DPA (the sixth principle).

By section 10(1) of the DPA, an individual is entitled at any time by notice in writing to a data controller to require the data controller, at the end of a reasonable period, to cease processing any personal data of which he is the data subject on the ground that the processing is causing substantial damage or distress which is unwarranted. By section 10(4):

“If a court is satisfied, on the application of any person who has given a notice under subsection (1) which appears to the court to be justified … that the data controller in question has failed to comply with the notice, the court may order him to take such steps for complying with the notice … as the court thinks fit”

It appears, therefore, that the individual solicitors whose personal information can be found on the “Solicitors from Hell” website could give notice under section 10 and, if this was not complied with, could seek an order under section 10(4).

Furthermore, there is, perhaps, a more direct remedy under the DPA against the website.  It appears that Mr Kordowski is not a registered data controller under the DPA – his name does not appear on the register maintained by the ICO.  He is therefore, in breach of section 17 of the DPA.

A similar point arose in the case of Sunderland Housing Group v Baines [2006] EWHC 2359 (QB). In that case Mr Justice Eady considered a claim relating to a website which contained abusive and defamatory material relating to a number of individuals.  One of the complaints which was made was that the operator of the website was not registered under the DPA.  It was argued that, in those circumstances, it was unlawful for him to continue processing personal data.  The judge agreed and granted an order restraining the defendant from continuing to operate the website whilst not registered under the DPA. [25-26]

In other words, there is an argument that any solicitor whose information appears on the “Solicitors from Hell” website would be able to obtain an injunction restraining Mr Kordowski from continuing to process personal data until he seeks and obtains registration under section 17 of the DPA.  Such an injunction would have the effect of shutting down the entire website until Mr Kordowski registered under the DPA.  Once he registered, then the Information Commissioner could intervene to enforce the provisions of the DPA in relation to the website.