MR JUSTICE WARBY Approved Judgment NT1 & NT2 v Google LLC Some key points of data protection law 22. The DP Directive and the DPA impose duties on “data controllers”, that is to say those who make decisions about how and why “personal data” relating to “data subjects” is “processed”. “Personal data” is a broad notion, comprising a wide range of information which relates to an individual and is processed by computer. “Processing” is a very widely defined concept, encompassing almost any dealings with personal data, including holding the data and disclosing it or the information in it: see DPA s 1(1). The statutory duty imposed on a data controller by DPA s 4(4) is, subject to section 27(1), “… to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.” 23. The data protection principles are listed in DPA Schedule 1. The principles relied on by the claimants are the First, Second, Third, Fourth, Fifth and Sixth (of eight): “1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless— (a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met. 2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. 3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. 4. Personal data shall be accurate and, where necessary, kept up to date 5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. 6. Personal data shall be processed in accordance with the rights of data subjects under this Act.” 24. The term “sensitive personal data”, which appears in the First Principle, is defined by DPA s 2 and includes:“… personal data consisting of information as to ... the data subject [‘s] — … (e) … physical or mental health or condition … …