Civil Law
¶Introduction to privacy law
¶3.1 The concept of privacy is one which divides opinion, both in relation to the scope of its protection and the manner in which it should be protected. This debate invariably requires reflection upon the fundamental right of freedom of expression and the extent to which the media are entitled to exercise this freedom without unjustifiably impinging upon the rights of private individuals.
1863¶3.2 The common law has historically taken a conservative approach to the protection of privacy and the courts have demonstrated reluctance to develop a general cause of action for the protection of privacy rights. The courts have previously adopted the stance that a specific right to privacy could only be recognised by Parliament and therefore individuals seeking to protect private information or restrain publication turned to the creative application of existing causes of action.103 For example, the law of confidentiality was invoked to restrain the publication of material with a personal or private dimension.104 Some concern was expressed at the implementation of Article 8 through the less than satisfactory means of requiring the Court to "shoehorn" within the cause of action of breach of confidence claims for misuse of private information, and it is right to observe that the tort of breach of confidence is not necessarily a good fit for complaints which focus on the intrusive nature of the publication, as opposed to the exposure of 'secret' information through publication.105
¶3.3 However, in the period 1997-1998 Parliament enacted three statutes which shape the law providing protection against interference with privacy. First, the Protection from Harassment Act 1997 (PHA) provides a remedy for invasion of privacy which involves a course of conduct which the defendant knows or ought to know amounts to harassment, including conduct causing alarm or distress.106 The PHA protects against both publication of information and the conduct of the press in obtaining information; for example door-stepping and intrusive investigations. Secondly, the Data Protection Act 1998 (DPA) sets out a comprehensive regime for the processing of personal data and provides a remedy where privacy is invaded, both through publication or other methods of processing data.107 Thirdly, Parliament enacted the Human Rights Act 1998 (HRA). From 2 October 2000, when the HRA came into force, Articles 8 and 10 were incorporated in the law of England and Wales as substantive and enforceable rights.
¶3.4 The enactment of the HRA did not result in automatic recognition of a general tort of invasion of privacy, as the House of Lords clarified in Wainwright v Home Office.108 However the HRA represented an important stepping-stone in the path to the development of the law to protect unjustified invasion of privacy, provoking lively discussion of the impact that the Act would have on the development of a law protecting privacy.109
¶3.5 Despite these three Acts of Parliament signalling recognition of the need to bolster privacy rights, the Government made clear that it anticipated that the Courts would bear the responsibility of developing the law of privacy appropriately, having regard to the Convention.110 This task was taken up by the House of Lords in the seminal case of Campbell v MGN Ltd in which the House recognised a new cause of action, namely misuse of private information, as distinct from breach of confidence.111
1864¶3.6 This cause of action is now the closest thing to a free-standing right to protection from invasion of privacy in English law. The core element of privacy in this context is whether the person in question had a reasonable expectation of privacy in respect of the information and whether interference with that expectation is justified. The law after Campbell therefore recognised two distinct causes of action, protecting two different interests: privacy (misuse of private information) and secrecy (breach of confidence).112
¶3.7 The cause of action recognised in Campbell is the product of three features of the law. Firstly, the rights enshrined in Articles 8 and 10 of the Convention are incorporated into domestic law and individuals have a right to bring a claim for infringements of these rights. Secondly, the State is obliged to protect an individual from unjustified invasion of their private life by another individual.113 Thirdly, the Courts are subject to a duty to avoid acting incompatibly with Convention Rights, and so must, in determining claims, give effect to Convention rights.114 It is unsurprising, given these features, that the law relating to misuse of private information requires a rights-based analysis and that the jurisprudence of the ECtHR has shaped domestic law in this area.115
¶3.8 Since the landmark decision in Campbell, the law relating to misuse of private information has evolved on a case by case basis, both through the decisions of the ECtHR in this area which are absorbed into domestic law, and through the body of domestic case law that has built up over the years as the Courts deal with interim applications seeking to restrain publication of material and the smaller number of final hearings, or trials of alleged misuse of private information. The Court of Appeal has recently described the law in this field as "well travelled (if fast moving)" and the principles applicable are considered in detail below.116
¶3.9 A significant proportion of claims brought to restrain publication on the basis that the proposed publication unjustifiably interferes with an individual's privacy involve a claim for misuse of private information. However, the legal framework which has the potential to protect privacy interests is broader and it is through a combination of the common law of misuse of private information and breach of confidence, and actions based on the PHA and DPA, that the law has established a comprehensive framework for the protection of privacy rights. The framework is overlapping in some respects, and it is not unusual for cases to pursued based on more than one cause of action.117
¶Human Rights Act 1998
¶3.10 The HRA has had a significant impact on the development of the law to protect privacy in two material respects. Firstly, s6 of the HRA requires the courts (as a public authority) to act compatibly with Convention rights. In this context the key Convention rights are Article
1865¶8 (respect for private life) and Article 10 (freedom of expression and the right of the general public to receive information). Secondly, by s2(1) a court is also required to take into account judgments of the European Court of Human Rights, and by virtue of this provision the ECtHR's case law has informed the development of domestic law. For this reason it is necessary to dwell briefly on the scope of Articles 8 and 10 in this context.
¶3.11 Article 8 provides as follows:
"Article 8: Right to Respect for Private and Family Life 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."
¶3.12 The scope of Article 8 and the meaning of "private and family life" has been analysed extensively in case law. The ECtHR has stated that private life is a broad term not susceptible to exhaustive definition, but includes elements such as gender identification, name and sexual orientation, sexual life, mental health, the right to identity and personal development and to establish and develop relationships: Bensaid v United Kingdom.118
¶3.13 The House of Lords in R (Countryside Alliance) v A-G addressed the scope of private life within the meaning of Article 8. Baroness Hale observed that Article 8 protects a "private space" and the "personal and psychological space within which each individual develops his or her own sense of self and relationship with other people".119
¶3.14 However, it is now well established that protection of reputation is a right which is covered by the right to respect for private life under Article 8.120
¶3.15 Article 8 does not confer an absolute right to privacy: Article 8(1) provides for a right to "respect" for privacy and therefore is inherently qualified. The right is further qualified by Article 8(2). The purposes of the qualifications are to ensure that the core of Article 8 is not read so widely that its claims became unreal and unreasonable.121 Safeguards against a overly broad reading of Article 8 include the parameters that the threat to a person's Article 8 rights must attain a certain level of seriousness, that absent an expectation of privacy there will be no interference with personal autonomy and that the breadth of Article 8(1) may be curtailed by the scope of the justifications in Article 8(2): see Laws LJ in R (Wood) v Commissioner of Police for the Metropolis.122
¶3.16 It is clear that the words "the right to respect for ... private ... life" which appear in Article 8 require not only that the State refrain from interfering with private life but also entail certain positive obligations on the State to ensure effective enjoyment of this right by those within its jurisdiction.123 Such an obligation may require the adoption of positive measures designed to secure effective respect for private life even in the sphere of the relations between individuals.124
1866¶3.17 Article 10 is dealt with in some detail at paragraph 2.10 onwards above. In short, Article 10 protects the right to freedom of expression, which encompasses the right to hold and impart opinions and ideas and the right to receive information and ideas. In general terms Article 10 protects the freedom of the press and the plurality of the media, although the degree of protection extended to particular types of expression will vary depending on the content. Reporting on matters of public interest will invariably attract a greater degree of protection than gossip about an individual's private life.125
¶3.18 Article 10(2) expressly acknowledges that interference with Article 10 rights may be justified in order to protect the rights and the reputation of others. Article 10(2) permits a wide range of interests to be invoked as a justification for imposing restrictions on freedom of expression. Those most commonly invoked are the right to reputation or protection of privacy, often referred to as the tort of misuse of private information in domestic law.
¶3.19 It is the interplay between Article 8 and Article 10 rights that shapes the cause of action of misuse of private information.
¶Breach of confidence
¶3.20 Whilst misuse of private information will be the most relevant cause of action for individuals seeking to protect their privacy, the principles that relate to breach of confidence remain relevant, as it may be easier for a claimant to establish on the particular facts that a breach of confidence is actionable, and the existence of a relationship of confidence may support a claim for misuse of private information, or may be determinative of the claim.126
¶3.21 The starting point is to determine whether there is a relationship or duty of confidence. This may be by reason of express terms in a contract (for example an employment contract), or by reason of an implied term (for example an implied term that an employee will not use or disclose for the duration of his employment confidential information gained in the course of that employment). An obligation of confidence may also arise through the common law, and the courts have recognised that there are three elements to an action for breach of confidence. First, the information must have the quality of confidence. Secondly, the information must have been imparted in circumstances of confidence. Thirdly, there has been an unauthorised use of the information.127
¶3.22 In order to satisfy the first element, namely that the information has the quality of confidence, the information must not be widely available in the public domain. The courts have developed a comprehensive set of principles through case law, which assist in defining when personal information may have a quality of confidence. Many of these factors overlap with the first stage of a misuse of private information claim; namely whether there is a reasonable expectation of privacy. These factors include whether the subject matter is of an intimate nature, whether the information is either believed or expressly stated to be confidential, the extent to which access to the information is controlled or protected and the form of the information. Generally material will not have the necessary quality of confidence if the information is trivial tittle-tattle.128 For example, in Mills v News Group Newspapers Ltd, on the particular facts of the case the court considered that the triviality of the claimant's address was a factor against granting an injunction.129 The courts have also sought to distinguish the levels of detail which may attract a duty of confidence, for example in Theakston v MGN Ltd, Ouseley J drew a distinction between that fact that a television presenter had visited a brothel, from the details of what had occurred there.130
1867¶3.23 In terms of the second element, it needs to be demonstrated that confidential information comes to the knowledge of a person in circumstances where he is on notice, or has agreed, that the information is confidential.131 The element of unauthorised use of the information requires an analysis of the confidant's conscience and whether the person would, or should, be troubled by the disclosure of the information.132
¶3.24 Where a third party acquires information from a person who himself is subject to a duty of confidence, the third party receiving the information may be restrained by an injunction from further disclosure of the information on the basis that the third party assumes a duty of confidence to the original confider. However, the extent of any relief will depend on the circumstances of the case. In order not to subvert an order of the court, a duty of confidence has been crafted that is binding on media organisations even where there has been no breach of confidence: see Venables v News Group Newspapers Ltd where the court imposed a duty of confidence on defendant news organisations and persons not party to the litigation with knowledge of the whereabouts and appearances of the killers of Jamie Bulger who, at the time of the killing, were 10 years of age.133
¶3.25 There are a number of possible defences to claims for breach of confidence, including consent to disclosure, waiver of the duty of confidence, or where the party seeking to restrain disclosure is relying on an unlawful restricting provision. Further, where the information is false there is generally no duty of confidence, although careful enquiry will be necessary to establish whether the information merely has a number of minor inaccuracies or can be said to be completely false before this principle is applied.
¶Remedies
¶3.26 Most commonly a party will seek an injunction to prevent disclosure of the confidential information. Often an injunction will be sought on an interim basis to prevent disclosure once the alleged breach of confidence comes to light. An interim injunction is unlikely to be granted where either the material will be published in the near future in any event, or where there is a lack of particularity as to the material that is confidential. A final injunction may be granted in relation to an actual or threatened breach of confidence. The courts more readily grant injunctions in respect of personal information than trade secrets, the latter being more readily assessed in monetary terms suitable for an award of damages.134
¶3.27 An injunction will bind the party to whom the injunction is addressed although third parties may be liable for contempt if they act in a manner which is contrary to the terms of an interim injunction of which they have notice so as to frustrate the purpose of the judge in making the order; this is known as the 'Spycatcher principle'.135 Further, the test for the grant of an injunction in defamation cases is higher than for an interim injunction in breach of confidence claims and the courts will not allow parties to seek an interim injunction on the basis of a claim for breach of confidence where in reality what is sought to be protected is material that is said to be untrue and damaging to reputation.
1868¶3.28 The courts also have discretion to order the delivery up of and destruction of documents, articles or machinery obtained or made in breach of confidence.
¶3.29 Damages may be sought in addition to, or instead of an injunction and can be sought for both past and future losses. There is some uncertainty as to the extent of damages that may be awarded for breach of personal confidence and doubt has been expressed as to whether shock and distress caused by the unauthorised disclosure of confidential information can properly be reflected in an award of damages, however given that the courts have recognised that damages can be awarded for injury to feelings in cases of misuse of private information it may be that a parallel approach will be taken in breach of confidence matters.136 An alternative remedy which may be sought by the claimant is an account of profits, namely depriving the defendant of the profits resulting from the misuse of confidential information and awarding these profits to the claimant.
¶Misuse of private information Establishment of cause of action
¶3.30 In A v B plc Lord Woolf CJ explained that the court, as a public authority, was able to fulfil its duty under section 6 of the Human Rights Act 1998 Act "by absorbing the rights which Articles 8 and 10 protect into the long‐established action for breach of confidence".137
¶3.31 The leading domestic case remains the decision of the House of Lords in Campbell v MGN Ltd, which recognised a cause of action for misuse of personal information.138 This claim is quite distinct from the claim of breach of confidence, with its foundations in Article 8 and 10 of the ECHR. Lord Nicholls observed that:139
"The time has come to recognise that the values enshrined in Articles 8 and 10 are now part of the cause of action for breach of confidence … and are as much applicable in disputes between individuals or between an individual and a non‐governmental body such as a newspaper as they are in disputes between individuals and a public authority".
¶3.32 On the basis that information about an individual's private life is more naturally described as private than confidential, Lord Nicholls said that "the essence of the tort is better encapsulated now as misuse of private information".140
¶3.33 The elements of the cause of action were defined in the following way by the House of Lords:141
1869¶(1) The information at issue engages Article 8 of the Convention by being within the scope of the claimant's private or family life, home or correspondence; and (2) The conduct or threatened conduct of the defendant is such that, upon analysis of
the proportionality of interfering with the competing rights under Article 10, it is determined that the protection of the rights of others makes it necessary for freedom of expression to give way.
¶3.34 The threshold test for whether Article 8 is engaged by the publication, or threatened publication, of information in any given case is "whether in respect of the disclosed fact the person in question had a reasonable expectation of privacy".142 Lord Hope defined the question as "whether the information that was disclosed was private and not public", noting that:143
"in some cases … the answer to the question whether the information is public or private will be obvious. Where it is not, the broad test is whether disclosure of the information about the individual ("A") would give substantial offence to A, assuming that A was placed in similar circumstances and was a person of ordinary sensibilities".
¶3.35 The court will then proceed to determine whether the interference is proportionate. Where both Articles 8 and 10 are engaged, a balance must be struck, or the competing requirements of the Articles reconciled, by the application of the principle of proportionality.144 This requires a focused and penetrating consideration of the proposed interference with the Article 8 right if publication occurs without remedy, and the value and proposed interference with the Article 10 right if a remedy is granted. There are different degrees of privacy, just as there are different orders of expression ranging in importance from political expression through educational or artistic expression to commercial expression.145 The key issue is the weight to be given to each of the rights at stake in any particular case. As Lady Hale put it, the proportionality of interfering with one right has to be balanced against the proportionality of restricting the other.146
¶3.36 The Court of Appeal in Murray v Express Newspapers summarised the principles set out in Campbell in the following way:147
¶(1) The right to freedom of expression enshrined in Article 10 of the Convention and the
right to respect for a person's privacy enshrined in Article 8 are vitally important rights. Both lie at the heart of liberty in a modern state and neither has precedence over the other.
¶(2) Although the origin of the cause of action relied upon is breach of confidence, since
information about an individual's private life would not, in ordinary usage, be called confidential, the more natural description of the position today is that such information is private and the essence of the tort is better encapsulated now as misuse of private information.
¶(3) The values enshrined in Articles 8 and 10 are now part of the cause of action and
1870should be treated as of general application and as being as much applicable to disputes between individuals as to disputes between individuals and a public authority.
¶(4) Essentially the touchstone of private life is whether in respect of the disclosed facts the person in question had a reasonable expectation of privacy. (5) In deciding whether there is in principle an invasion of privacy, it is important to
distinguish between the first question whether Article 8 is engaged, and the subsequent question whether, if it is, the individual's rights are nevertheless not infringed because of the combined effect of Articles 8(2) and 10.
¶3.37 It is self-evident that Articles 8 and 10 are of the utmost importance in the reasoning process undertaken by the court; they are now "the very content of the domestic cause of action that the English court has to enforce".148
¶Elements of cause of action of misuse of private information
¶3.38 The two-stage test formulated in McKennitt v Ash149 per Buxton LJ frequently cited in the case law, is as follows:
¶(1) First, the court must ask whether the information is private in the sense that it is
in principle protected by Article 8 and, if so, whether the person has a reasonable expectation of privacy in respect of the information. If the answer is no, that is the end of the case.
¶(2) If yes, the second question is whether in all the circumstances, the Article 8 rights of the
claimant must yield to the right to freedom of expression conferred on the defendant by Article 10.
¶3.39 In Hutcheson (formerly known as "KGM") v News Group Newspapers Ltd and others, the Court of Appeal cited the well-established test applied at first instance:150
"First, it is necessary to demonstrate that he has a reasonable expectation of privacy in respect of the subject-matter in question, having regard to article 8 of the European Convention on Human Rights and Fundamental Freedoms. If that hurdle is overcome, it next has to be shown that there is no countervailing public interest sufficient to outweigh his right to protect that information. At the second stage, the court will apply what has been termed 'an intense focus' to the particular circumstances of the case, in order to arrive at a determination of where the balance lies between the competing rights concerned."
¶3.40 This summary encapsulates the test neatly.
¶3.41 The two stage approach is applied to both substantive actions (a trial of the claim) and interim injunctions; although in the latter context the test must be considered in the light of the burden imposed on the claimant to satisfy the Court that there are sufficient prospects to justify an injunction in view of the test in section 12 of the HRA.
¶3.42 It is important to recognise that Article 8 is engaged irrespective of whether the private information sought to be published is true or false.151
1871¶Stage 1 – Is there a reasonable expectation of privacy?
¶3.43 The key issue to be resolved by the court is whether the information sought to be protected is of a private, as distinct from a public, nature and whether the claimant has a reasonable expectation of privacy in respect of that information.
¶3.44 The law does not protect unreasonable demands to keep information out of the public sphere or 'hyper-sensitive' claimants and, for this reason, the question whether there is a reasonable expectation of privacy is an objective test considered in light of the circumstances of the claimant. Lord Hope in Campbell emphasised that the reasonable expectation was that of the person who is affected by the publicity:152
"The question is what a reasonable person of ordinary sensibilities would feel if she was placed in the same position as the claimant and faced with the same publicity".
¶3.45 The Court of Appeal in Murray v Express Newspapers summarised the position as follows:153
"As we see it, the question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case. They include the attributes of the Claimant, the nature of the activity in which the Claimant was engaged, the place at which it was happening, the nature and purpose of the intrusion, the absence of consent and whether it was known or could be inferred, the effect on the Claimant and the circumstances in which and the purposes for which the information came into the hands of the publisher."
¶3.46 The court does not address questions of privacy in terms of generalities. According to the authorities set out above, the question must be whether this particular person has a reasonable expectation of privacy in respect of the particular information at issue.154
¶Factors which guide the Court's decision on the stage 1 analysis
¶3.47 There are a number of matters to which the Court is likely to have regard in determining whether there is a reasonable expectation of privacy. These include, the following factors, which are not necessarily exhaustive:
(a) The nature of the information itself (namely its content) (b) The form of the information (namely the medium in which it is kept) (c) The effect of disclosure on the claimant (and other relevant individuals) (d) The attributes of the claimant (e) The circumstances in which the information came into the hands of the publisher (f) The extent to which information is already in the public domain
¶Nature of the information
¶3.48 The nature of the information itself is likely to be significant in determining whether there is a reasonable expectation of privacy and there are certain types of information which the courts have readily been persuaded to describe as private information.
1872¶3.49 Information relating to physical or mental health has been held to lie at the heart of the protection afforded by Article 8.155 The courts have recognised that personal information about individuals held in medical records, reports or interviews is both confidential and private: Venables v News Group Newspapers Ltd.156 In Campbell the House of Lords recognised that the Claimant's therapy for drug addiction related to treatment directed at her physical and mental health and was akin to the private information contained in medical records, although Lady Hale identified that not every statement about a person's health will carry the "badge of confidentiality".157
¶3.50 Sexual behaviour and sexual orientation are an aspect of private life and are protected by Article 8. For example, the ECtHR in PG and JH v United Kingdom held that elements such as gender identification, name, sexual orientation and sexual life are important elements of the personal sphere protected under Article 8.158
¶3.51 In Mosley v News Group Newspapers Ltd, Eady J considered in some depth the extent to which revelations concerning sexual relations could lawfully be made by the media.159 Among other things, he reasoned as follows:160
"It has now to be recognised that sexual conduct is a significant aspect of human life in respect of which people should be free to choose".
¶3.52 The judge noted that anyone indulging in sexual activity is entitled to a degree of privacy, especially if it is on private property and between consenting adults.161 In articulating the standards expected of the media in this context, Eady J expressed his view that it is not for the state or for the media to expose sexual conduct which does not involve any significant breach of the criminal law, and this is the case whether the motive for such intrusion is merely prurience or a moral crusade:162
"It is not for journalists to undermine human rights, or for judges to refuse to enforce them, merely on grounds of taste or moral disapproval. Everyone is naturally entitled to espouse moral or religious beliefs to the effect that certain types of sexual behaviour are wrong or demeaning to those participating. That does not mean that they are entitled to hound those who practise them or to detract from their right to live life as they choose". "…where the law is not breached ... the private conduct of adults is essentially no-one else's business. The fact that a particular relationship happens to be adulterous, or that someone's tastes are unconventional or "perverted", does not give the media carte blanche".
¶3.53 Whether there is a reasonable expectation of privacy between parties to a sexual relationship depends on the circumstances, and where the sexual conduct amounts to unlawful conduct, or conduct that is grossly immoral, that may prevent the claimant from protecting the information relating to it. The length of the relationship may be relevant. An expectation of privacy may not be reasonable in relation to a fleeting encounter, in contrast to a long term relationship.163
1873¶3.54 It is also important to note that the law more readily protects the details of a sexual relationship than the mere fact of a sexual relationship, or than the fact of sexual orientation per se. In Goodwin v NGN Ltd it was held that the fact that details of a sexual relationship are confidential or private does not necessarily mean that the bare fact of a sexual relationship is private, citing by way of example the case of Ntuli in which the judge at first instance had granted an anonymised Claimant an injunction restraining an anonymised Defendant from publishing, amongst other information "the fact that the Claimant had a relationship with the Defendant".164 The Court of Appeal in that case varied the injunction, and named the parties and the fact of their relationship. Maurice Kay LJ observed that:165
"the material in respect of which Mr Donald has been found to have a reasonable expectation of privacy is not detailed in the judgment. The material in the judgment does not attract a reasonable expectation of privacy."
¶3.55 The approach of the Court to the issue of whether there is a reasonable expectation of privacy in respect of a sexual relationship and sexuality can be further illustrated by Trimingham v Associated Newspapers Ltd. Both cases reveal that the fact of a relationship may, or may not, attract a reasonable expectation of privacy depending on the particular circumstances of each case, although the statement in Goodwin that it is rarely realistic for partners in a relationship to expect that the fact of their relationship will remain confidential between the two of them for a long or indefinite period may signal an approach which tends towards disclosure of the fact of the relationship.166
¶3.56 In Goodwin, the court explained that the circumstances why there might be a reasonable expectation of privacy of the fact of the relationship include when an abusive family will not allow the couple to be together and the fact of the relationship being known could create a risk of harm. By contrast, circumstances why the fact of a relationship may not attract a reasonable expectation of privacy include those where parties to a relationship are proud of, or at least content to disclose, the relationship. The court held there was not a reasonable expectation of privacy of the fact of a relationship between Fred Goodwin, the then Chief Executive of RBS and 'VBN', an employee of RBS, relying on the following reasons. Firstly, if an employee has a sexual relationship with a more senior person in the company there are any number of possible misunderstandings and grievances (whether well founded or not) that can arise if the fact of the relationship is not known, at least to the work colleagues of the more junior of the two partners to the relationship. Secondly, the extent to which men in positions of power benefit from that power in forming relationships with sexual partners who are less senior within the same organisation is also a matter which is of concern to an audience much wider than the work colleagues of either partner in the relationship. The court held that whatever limits there may be to the legal concept of a public figure, or of a person carrying out official functions, Fred Goodwin came within the definition, and distinguished him from sportsmen and celebrities in the world of entertainment, who do not come within it.167
¶3.57 However, the court held that VBN did have a reasonable expectation that her name would not be published by the press. The court permitted disclosure of her job description, even though the court recognised that this might lead some people to identify her, on the basis that she was unlikely to establish that prohibiting publication of her job description was necessary and proportionate for the protection of her rights.168
1874¶3.58 In Trimingham v Associated Newspapers Limited the Court took a robust approach to the expectation of privacy of the claimant's sexuality.169 The Court was asked to consider whether the claimant, a bisexual woman living in a civil partnership who had conducted an affair with a married politician, had a reasonable expectation of privacy in respect of her appearance and her sexuality. Tugendhat J held that in light of the fact that the claimant had i) entered into a civil partnership recently and was actually living with her civil partner, ii) had engaged in a sexual relationship with a man who was a prominent politician, and who had conducted the election campaign the previous month in circumstances where revelation of the affair to the public at large was inevitable and, iii) that even before the revelation of her affair with the politician she had had relationships with other men, and those who knew her knew of her sexuality, it was unarguable that she had a reasonable expectation of privacy as to her sexuality. The court concluded that the claimant was not the purely private figure she claimed to be and that her reasonable expectation of privacy had become limited, mainly by reason of her involvement with a prominent politician, both professionally as his press agent, and personally by way of the sexual relationship, in circumstances where he campaigned with a leaflet to the electorate about how much he valued his family, but also by reason of what she herself had disclosed in the past. Therefore, despite the fact that the Defendant referred to the claimant's sexuality in 65 articles over about 15 months, it only did so (a) when writing about matters of public interest, mainly developments in the politician's personal life which were relevant to his public life, and (b) when the claimant and her conduct (and other information about her) were within the range of what an editor could in good faith regard as relevant to the story.170
¶3.59 The Courts have recognised that home is one of the matters expressly included in Article 8(1) of the Convention as deserving respect. In McKennitt v Ash, the judge at first instance protected the description of a person's home as private and confidential information, noting that to convey such details without permission to the general public is almost as objectionable as spying into the home with a long distance lens and publishing the resulting photographs.171 Another example of this approach can be observed in Beckham v MGN Ltd in which an injunction was obtained restraining the publisher of a tabloid magazine from publishing unauthorised photographs of the interior of a new home on the basis that this would invade the family's privacy and compromise their security.172
¶3.60 It is generally recognised that material obtained under compulsory powers for the purposes of criminal proceedings cannot be used for purposes other than those for which the powers were conferred and the same principle applies where the information has not been obtained through the use of compulsory powers but the threat of them.173 Convictions and acquittals are generally not private, although the High Court has jurisdiction to grant an injunction to prohibit publication of the identities of individuals accused and convicted of criminal offences.174 There may be circumstances in which information about criminal convictions is capable of being protected as private, for example in the case of Venables where court orders have the effect of preventing publication of the present identities of the two claimants who had been provided with new identities having been convicted, as 10 year old children, of murder.
1875¶3.61 It has been held that a person has a reasonable expectation of privacy in relation to his or her financial affairs.175 Information relating to business affairs may also be protected by relationships of confidence. However, once financial affairs have been raised in open court, the information will not always retain its character as private. It is also important to recognise that information relating to the salaries of public figures may not be regarded as part of their private lives.176
¶Form of information
¶3.62 In addition to the content of the information, the source or form of the information is likely to have a significant bearing on whether there is a reasonable expectation of privacy.177 For example, personal diaries, private written communications and private conversations are generally more likely to fall within the sphere of private information than conversations in public places or photographs taken in a private place.
¶3.63 The law relating to the restriction of information about appearance, primarily through the publication of photographs, has developed rapidly and not always consistently. The Courts have recognised that the publication of photographs have the potential to be particularly intrusive. In Douglas v Hello! Ltd the Court of Appeal recognised that:178
"… special considerations attach to photographs in the field of privacy. They are not merely a method of conveying information that is an alternative to verbal description. They enable a person viewing the photograph to act as spectator, in some circumstances voyeur would be a more appropriate noun, of whatever it is that the photograph depicts. As a means of invading privacy, a photograph is particularly intrusive".
¶3.64 The mere taking of a photograph may not involve an interference with privacy but clandestine recording may be regarded in itself as an unacceptable infringement of Article 8 rights.179 pp31-32, lines 25-10, David Perry QC, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript- of-Morning-Hearing-4-April-2012.pdf Well known examples where the publication of a photograph has been held to amount to misuse of personal information include publication of a model leaving a Narcotics Anonymous meeting (Campbell), and the video of the Head of Formula 1 participating in sadomasochistic sexual activities (Mosley). Other examples include injunctions granted to protect the publication of unauthorised photographs of an actress in a private hotel and photographs of a television presenter in a brothel.
¶3.65 In Von Hannover the ECtHR made clear that photographs of ordinary events in a person's life in public may nevertheless engage Article 8.180 However, the domestic courts remain cautious in granting protection to routine activities which are part and parcel of daily life and played out in public. In Campbell, Baroness Hale doubted that to photograph the claimant going out to buy milk would engage Article 8.181 Lord Hope in Campbell drew a distinction between someone who photographed a person by chance in the street, as against where a photo was taken in secret with a view to publication.182 The Court of Appeal in Murray addressed the potential conflict between the positions in Von Hannover and Campbell and concluded that no clear distinction could be drawn between family activities and routine acts, such as a visit to the shops, and that each case depended on its own circumstances.
1876¶3.66 In the recent case of Von Hannover (No.2) the ECtHR recognised that in the absence of evidence of harassment or illegal activity on the occasion that a photo complained of was taken, the restriction on publication of a photo taken in a public place which is innocuous and inoffensive will generally not outweigh Article 10 considerations.183 The Von Hannover cases are considered further below.
¶3.67 Correspondence is specifically protected by Article 8. The ECtHR in Copland v UK held that personal emails are included within private life for the purpose of Article 8.184
¶3.68 The ECtHR has been prepared to treat telephone conversations as within the scope of "correspondence" in Article 8 and has held that telephone-tapping of private conversations may breach Article 8.185
¶3.69 The courts have held on numerous occasions that private journals and diaries are confidential documents.186 However, it does not invariably follow that all the information contained in private journals will be protected, in particular in circumstances where details disclose misconduct that falls outside the scope of a reasonable expectation of privacy, or where details contained in the diary do not relate to the applicant.187
¶Effect on applicant and other affected persons
¶3.70 In Campbell a number of their Lordships considered that the extent of harm to the claimant was a significant factor in determining whether her rights had been infringed by the disclosures at issue. This follows from the fact that the tort of misuse of private information seeks to give effect to human dignity and autonomy and, as Lady Hale identified, damage to private life and to physical or moral integrity are key elements in determining whether a reasonable expectation of privacy existed.188
¶3.71 It is not just the effect on the applicant that must be considered but others that may be affected by publication, including family members. This point was underlined in ETK v News Group Newspapers Ltd, where particular weight was placed on the interests of the children, the court observing that the purpose of the injunction is both to preserve the stability of the family and to save the children the ordeal of playground ridicule that would inevitably follow publicity.189
1877¶Attributes of the claimant
¶3.72 A number of cases have tended to draw a distinction between a public and a private figure and suggest that individuals who can properly be described as public figures may enjoy a lesser degree of protection than others, although the extent of this distinction has not been consistently applied in case law. The jurisprudence in this area is not always straightforward to follow and the courts, initially inclined to adopt the concept of involuntary role models, appear to have retreated from this approach.
¶3.73 In A v B plc a married professional footballer failed in his attempt to restrain a national newspaper from publishing details of his sexual relationships with two women who wished to sell their stories. The Court of Appeal held that:190
"Even trivial facts relating to a public figure can be of great interest to readers and other observers of the media. Conduct which in the case of a private individual would not be the appropriate subject of comment can be the proper subject of comment in the case of a public figure. The public figure may hold a position where higher standards of conduct can be rightly expected by the public. The public figure may be a role model whose conduct could well be emulated by others. He may set the fashion. The higher the profile of the individual concerned the more likely that this will be the position. Whether you have courted publicity or not you may be a legitimate subject of public attention. If you have courted public attention then you have less ground to object the intrusion which follows. In many of these situations it would be overstating the position to say that there is a public interest in the information being published. It would be more accurate to say that the public have an understandable and so legitimate interest in being told the information. If this is the situation then it can be appropriately taken into account by a Court when deciding on which side of the line a case falls."
¶3.74 This decision represents a high water mark from which the courts have since retreated. Recent case law suggests that the courts have refrained from making findings that a person is a role model, however where a person's professional life or job description carries an expectation of high standards of behaviour the courts will take this into account.191 Thus, the concept of some public figures being involuntary role models having a lesser entitlement to privacy was questioned in Campbell v MGN Ltd.192 Lord Phillips MR noted that "the fact that an individual has achieved prominence on the public stage does not mean that his private life can be laid bare by the media", and similarly the mere fact that a person is a public figure who has a relationship with the media does not disentitle them from a right to privacy.193
¶3.75 These latter sentiments were echoed in Strasbourg authority which demonstrated some reluctance to accept that prominent public figures are effectively stripped of their protection by virtue of their position. For example, in Craxi (No.2) v Italy the Court found that the rights of a former Italian Prime Minister had been violated by the playing in a domestic court of his covertly recorded private telephone conversations during the course of his prosecution for corruption, and held that public figures (even politicians of the highest order) are entitled to the enjoyment of the guarantees in Article 8 on the same basis as every other person.194 Similarly, in Tammer v Estonia, the Court held that the sexual life of senior politicians can be wholly protected from publicity, finding that the penalties imposed by the national authority upon the press reporting of an affair between the Prime Minister and a former political aide were not a violation of Article 10.195
1878¶3.76 Having made the point that A v B might represent one high water mark, Craxi and Tammer might be thought of as the high water mark for protecting public figures. The seminal case of Von Hannover v Germany196 adopts a less protective approach, namely that the public right's right to know about the lives of public figures can in certain circumstances extend to the private life of public figures, particularly where politicians are concerned, but this will depend on the particular facts and circumstances of the individual's role and duties. In this case Princess Caroline of Monaco complained about pictures of her engaging in ordinary activities in public places. The ECtHR held that, in balancing the Article 8 and 10 rights, "a fundamental distinction" had to be made between reporting facts capable of contributing to a debate in a democratic society relating to, for example, politicians in the exercise of their functions, and reporting details of the private life of an individual who, as in Princess Caroline's case, does not exercise official functions. The court held that:197
"…the decisive factor in balancing the protection of private life against freedom of expression should lie in the contribution that the published photos and articles make to a debate of general interest. It is clear in the instant case that they made no such contribution since the Applicant exercises no official function and the photos and articles related exclusively to details of her private life."
¶3.77 Significantly, and no doubt correctly, in McKennitt v Ash it was suggested that A v B was inconsistent with the decision of the European Court of Human Rights in Von Hannover.198
¶3.78 More recently in Von Hannover (No.2)199 the Court was concerned again with a complaint of Princess Caroline of Monaco that photographs taken during a family holiday had been published with articles commenting on the Price's poor health. The Court upheld the finding of the domestic court that the health of the reigning Prince of Monaco was a matter of general interest and press were entitled to report on how the Prince's children reconciled their family obligations with legitimate needs of their private life, including holidaying. The Court accepted that the photos, considered in the light of the accompanying articles, did contribute to a debate of general interest.200
¶3.79 In Murray v Express Newspapers it was held that the law should protect children from intrusive media attention, at any rate to the extent of holding that a child has a reasonable expectation that he or she will not be targeted in order to obtain photographs in a public place for publication which the person who took or procured the taking of the photographs knew would be objected to on behalf of the child.201
¶Circumstances in which information comes into the hands of the publisher
¶3.80 Whilst breach of confidence is a distinct cause of action and misuse of private information may arise without there being any confidential relationship, the existence of a confidential relationship can be an important consideration as to whether there is a reasonable expectation of privacy. Where the proposed publication is set against a backdrop of a pre-existing relationship of confidence between the parties, the need for protection is greater.
1879¶3.81 The test for breach of a confidence was set out by the House of Lords in Douglas v Hello! Ltd as follows. First, the information itself must have the necessary quality of confidence about it. Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it.202
¶3.82 In the case of Lord Browne of Madingley v Associated Newspapers Ltd the Court of Appeal accepted the principle that a pre-existing relationship between the relevant persons or parties is of enormous importance in answering in the affirmative Lord Nicholls' question (as set out in Campbell) about whether the subject of the disclosure has a reasonable expectation of privacy in the information to be published.203 However it is important to recognise that the existence of a prior relationship of confidence is not determinative.204
¶Information in the public domain
¶3.83 The expectation of privacy in some circumstances may be limited by the extent to which information has already entered the public domain. The law will not restrain publication where this would serve no useful purpose, in other words where the re-publication of information would not have a significant effect. Consideration of this issue is relevant both to the Stage 1 question of reasonable expectation of privacy and to conducting the balancing exercise at Stage 2.205
¶3.84 The "public domain" is not always easy to define. In this regard there is potentially an important distinction between information which is made available to a person's circle of friends or work colleagues and information which is widely published in a newspaper.206 Whether information is known to the public at large is a matter of fact and degree for determination in each case depending on its specific circumstances.
¶3.85 The position can be summarised in a nutshell by reference to the remarks in Douglas v Hello!, that once intimate personal information about a celebrity's private life has been widely published, it may serve no useful purpose to prohibit further publication.207 However, the Courts have been slow to conclude that no useful purpose would be served by injunctive relief unless the information has been widely publicised. For example, in CTB v News Group Newspapers Ltd, Tugendhat J continued an injunction in favour of protecting the identity of a professional footballer in spite of wide publicity revealing his identity on the grounds that continuing publicity would constitute unwarranted harassment.208
1880¶3.86 It will be relevant to consider whether repeated publication is likely to engage Article 8 and further invade privacy. For example, in Douglas v Hello! Ltd (No.3) all members of the House of Lords accepted that privacy could be invaded by further publication of information or photographs already available to the public.209
¶3.87 Where information is put into the public domain by claimant themselves, the mere fact that a claimant has made limited disclosures about a particular area of his or her private life will not necessary prevent a claim for further, unauthorised publication of material in the same area.210 However, previous disclosure by the claimant may limit the scope of reasonable expectation of privacy in a particular case. In Axel Springer the fact that a well known actor "had actively sought the limelight" in the past, revealing details about his private life in a number of interviews, meant that his "legitimate expectation" that his private life would be effectively protected was thereby reduced.211
¶3.88 In X & Y v Persons Unknown the Court held that there is a real distinction between what is written about an individual on the one hand and what he or she himself puts or agrees to put into the public domain on the other.212 Eady J, in granting an injunction against further dissemination of allegations about the state of the claimants' marriage carefully scrutinised the press cuttings produced by the defendant containing references to or quotations from the claimants, noting that careful attention needed to be paid by the court as to how information had been made public – distinguishing between celebrities being prepared to go along with 'lifestyle' pieces without wishing to cross boundaries into personal relationships and those who took the view that any publicity is good publicity. It is clear there is no hard and fast rule and in each case the court will have to examine the specific evidence and make an evaluation (on which, inevitably, there may be room for differing opinions).
¶3.89 In Ferdinand v MGN Ltd Nicol J did not accept the argument that the Claimant had no reasonable expectation of privacy because explicit details about his sex life were already in the public domain as a result of the publication of previous articles (some of which resulted from disclosures by him, and others where he had not denied them or taken any action).213 Nicol J stated that:214
1881"the Claimant had not, before the article, disclosed anything about his relationship with [a particular woman]. It is not necessary to consider whether in an extreme case there would be some merit in the argument that widespread and extensive discussion by a person of similar aspects of their private life would disentitle them to have a reasonable expectation of privacy. The present case is nowhere near that extreme. In this context, the Claimant was also entitled to say that the articles alleging affairs with other women were not published with his consent and the fact that he had not litigated them could not be taken as his tacit acceptance of another article, let alone another article about a different woman."
¶Place where the conduct occurs
¶3.90 As a general principle a person is entitled to expect that information about their behaviour in their home or another private place is and will remain private. However, protection of activities undertaken in public, in particular photographs or video recordings, has been expanded by the case law. For example, in Campbell the majority of the House of Lords concluded that the publication of photographs taken in a public place was actionable. In Murray the Court of Appeal held that a child of famous parents arguably had a reasonable expectation that photographs would not be taken of him for publication whilst in a pushchair on a public street. The circumstances in which the photographs were taken is also relevant, this issue has been addressed recently in Von Hannover (No 2) in which the Court held that there was not infringement of Article 8 by the publication of photographs taken in public (namely in a street of a skiing resort). The ECtHR held that the domestic court was correct to analyse the circumstances in which the photographs were taken including whether they have been taken surreptitiously or in a climate of harassment, but that there was no evidence to suggest that this was the case.215
¶False information
"that provided the matter complained of is by its nature such as to attract the law of breach of confidence, then the Defendant cannot deprive the claimant of his Article 8 protection simply by demonstrating that the matter is untrue".
¶Latham LJ went further in his concurring judgment, saying that:
"..the truth or falsity of the information is an irrelevant inquiry in deciding whether the information is entitled to be protected and judges should be chary of becoming side-tracked into that irrelevant inquiry."
¶3.92 The rationale for this approach appears to be that the courts are reluctant to require a claimant to spell out which of the allegations are true or false, Eady J observing in Beckham v Gibson that this would defeat the purposes of the injunction.217 This marks a departure from the law relating to breach of confidence where it has long been held that there can be no confidentiality in false information. Therefore in the context of a tort of misuse of private information, the truth or falsity of the information disclosed is of minor relevance, although in Campbell, it was observed by Lord Hope that:218
"there is a vital difference between inaccuracies that deprive the information of its intrusive quality and inaccuracies that do not".
¶Stage 2 – Balancing exercise between Articles 8 and 10
¶3.93 The second stage has been referred to by the Courts as the "ultimate balancing test" and the "parallel analysis" and requires an assessment of the comparative importance of the two rights.
1882¶3.94 The interaction between Articles 8 and 10 was explained by Lord Nicholls in Campbell v MGN Ltd:219
"Article 8(1) recognises the need to respect private and family life. Article 8(2) recognises there are occasions when intrusion into private and family life may be justified. One of these is where the intrusion is necessary for the protection of the rights and freedoms of others. Article 10(1) recognises the importance of freedom of expression. But article 10(2), like article 8(2), recognises there are occasions when protection of the rights of others may make it necessary for freedom of expression to give way. When both these articles are engaged a difficult question of proportionality may arise. This question is distinct from the initial question of whether the published information engaged article 8 at all by being within the sphere of the complainant's private or family life."
¶3.95 Lord Steyn in Re S (A Child) (Identification: Restrictions on publication) noted that neither Article 8 nor Article 10 has precedence over the other and that where the values protected by the two articles are in conflict an intense focus on the comparative importance of the rights being claimed is necessary. Further, the justification for interfering with or restricting each right must be taken into account and finally the proportionality test must be applied to each (also known as the ultimate balancing test). In conducting this balancing exercise, the courts have acknowledged that this process will require an "intense focus on the facts of the individual case".220
¶3.96 On the Article 8 side, the more intimate the aspect of private life that is interfered with the more serious must be the reasons for the interference before the restriction can be legitimate.221 When striking a balance between competing rights the court is not restricted to considering the Article 8 rights of the claimant and the defendant but should take into account the extent to which other individuals would be affected by publication; for example the claimant's family.222 In many cases the claimant's privacy interests will align with those of their family and the rights of family members may have a significant impact in determining these issues.
¶3.97 On the Article 10 side, different types of speech have varying levels of protection. Lady Hale in Campbell explained that political speech is top of the list and that the free exchange of information and ideas on matters relevant to the organisation of the economic, social and political life of the country is crucial to any democracy and that without this, it can scarcely be called a democracy at all. Further, intellectual and educational speech and expression are also important in a democracy, not least because they enable the development of the potential for an individual to play a full part in society, including in democratic life. Artistic speech and expression is important for similar reasons; fostering both individual originality and creativity and the free‐thinking and dynamic society we so much value. Lady Hale doubted whether the political and social life of the community and the intellectual, artistic or personal development of individuals is assisted by poring over the intimate details of a fashion model's private life, for example.223
¶3.98 Thus, as a matter of approach, there is a hierarchy of both privacy interests and of freedom of expression rights. The more intimate the nature of the information and the closer the information is aligned to Article 8, the greater weight the court will accord to the information in the balancing exercise. Similarly the more important the nature of speech being exercised, the more weight will be given to this.
1883¶3.99 In Von Hannover v Germany (No 2), various factors were identified by the Court as being relevant to the consideration of how the competing Convention Articles could be balanced. These included: the status of the person concerned (distinguishing between private individuals and persons acting in an official or public context such as politicians), the subject matter of the report (distinguishing between the press as a public watchdog and as a reporter of private facts about well known people), the prior conduct of the person concerned (noting that simply because an individual has co-operated with the press does not deprive them of privacy) and the form or content of the publication and its consequences.224 The ECtHR in Axel Springer, identified similar factors as relevant to the "criteria for the balancing exercise": (1) contribution to a debate of general interest, (2) how well known the person concerned was and what was the subject matter of the report, (3) the prior conduct of the person concerned, (4) the method used to obtain the information and its veracity, (5) the content form and consequences of the publication, and (6) the severity of the sanction imposed.225
¶Public interest in publication
¶3.100 The most significant factor in the balancing exercise is the extent to which the information sought to be disclosed can truly be said to make a contribution to a debate of general interest. For example, the contribution that the published information would make to a debate of general interest was treated as the decisive factor in ETK v NGN Ltd.226
¶3.101 Two key issues need to be considered in this context, namely what is meant by "public interest" and who the arbiter of the meaning of public interest is.
¶3.102 The meaning of "public interest" is hard to pin down. The courts have drawn a distinction between matters which contribute to a debate on matters in the public interest and matters which are simply of interest to some members of the public. A striking and oft-quoted aphorism in this context is the observation of Lord Wilberforce in British Steel v Granada Television, that "there is a wide difference between what is interesting to the public and what is in the public interest to make known".227 A statement to a similar effect is that of Stephenson LJ explained in Lion Laboratories v Evans, "the public are interested in many private matters which are no real concerns of theirs and which the public have no pressing need to know".228
¶3.103 In Goodwin v NGN Ltd the Court found there to be a public interest in disclosure, not because the publication would expose serious impropriety or crime but because it is in the public interest that there should be public discussion of the issues raised by the publication, namely the circumstances in which it is proper for a person holding public office or exercising official functions to carry on a sexual relationship with an employee in the same organisation.229 It was held that:230
1884"it is in the public interest that newspapers should be able to report upon cases which raise a question as to what should or should not be a standard in public life. The law, and standards in public life, must develop to meet changing needs. The public interest cannot be confined to exposing matters which are improper only by existing standards and laws, and not by standards as they ought to be, or which people can reasonably contend that they ought to be."
¶However, the Court emphasised that:
"[As a] matter of principle, the right to respect for private life of persons holding responsible positions cannot be overridden in the interests of freedom of expression simply because a newspaper alleges that they might have a worry that might distract them from doing their jobs. It cannot be right that the press should be free to interfere with a person's private and family life by exposing confidential information, and then seek to justify that by speculating that the information might have distracted him from doing his job."
¶3.104 In Mosley v UK, the ECtHR recognised the distinction between reporting facts, even if controversial, capable of contributing to a debate of general public interest in a democratic society, and making tawdry allegations about an individual's private life.231 In respect of the former, the pre-eminent role of the press in a democracy and its duty to act as a "public watchdog" are important considerations in favour of a narrow construction of any limitations on freedom of expression. However, different considerations apply to press reports concentrating on sensational and, at times, lurid news, intended to titillate and entertain, and which are aimed at satisfying the curiosity of a particular readership regarding aspects of a person's strictly private life. Such reporting does not attract the robust protection of Article 10 afforded to the press. Critically, the court confirmed the Article 10 right of members of the public to have access to a wide range of publications covering a variety of fields, but stressed that in assessing whether there is a public interest which justifies an interference with the right to respect for private life, the focus must be on whether the publication is in the interests of the public and not whether the public might be interested in reading it.
¶3.106 In considering the public interest in any publication it is important for the court to focus on the precise nature of the proposed publication and on the facts of an individual case, rather than reciting considerations of a generalised nature. In McKennitt, Eady J emphasised that:233
"[it is] necessary to scrutinise with care any claims to public interest – which are sometimes made by the media and their representatives on a rather formulaic basis".
¶3.107 This does not sit easily with the submission advanced by some media groups, for example News International, that it is a common misconception that the media must justify any publication which involves private information of any kind by pointing to a specific public interest in the publication of the particular information in question.234 Although the point may be well made in instances where the alleged infringement of privacy is at too low a level as to engage Article 8 and whilst the Court in A v B plc stated that any inference with the press has to be justified irrespective of whether a particular publication is desirable in the public interest, the case law over the past decade has revealed that in any case where Article 8 is clearly engaged the courts will require the media to demonstrate the public interest in the particular publication and this will be highly material in the balancing exercise.235
1885¶3.108 The issue of who should be the arbiter of public interest has been the subject of analysis in recent authority. The case law suggests that it is for the court to determine whether the proposed publication would be in the public interest, although this position is not without its difficulties. In Mosley v News Group Newspapers Limited, Eady J held that on the current state of the authorities it is for the court to decide whether a particular publication was or was not in the public interest, and that there was little if any scope for considering the defendant's state of mind "because it is only the court's decision which counts on the central issue of public interest".236
¶3.109 However, this position in respect of misuse of private information can be contrasted with the provisions of the DPA in which the exemption available to the media in section 32 is dependent upon the data controller reasonably believing that publication would be in the public interest and therefore the enquiry pursued by the Court is into the state of mind of the data controller and whether their belief was a reasonable one.237 Similarly, Parliament has amended the data protection legislation to provide for a public interest defence to the criminal offence in section 55 (although this section has not been brought into force), and the terms of this defence focus on whether the media defendant acted in the reasonable belief that its processing of data was in the public interest, and not on whether it actually was in the public interest.
¶3.110 These provisions were considered by Tugendhat J in Terry v Persons Unknown, where it was observed that there was uncertainty in the existing law as to the extent to which, if at all, the belief of a person threatening to make a publication in the media is relevant to the issue of public interest. After citing from the judgment of Eady J in Mosley v News Group Newspapers Limited and referring to the provisions of s32 of the Data Protection Act 1998, he observed that:238
"The Data Protection Act might well apply to a newspaper publication, and in particular to an online publication. If that Act did apply, it would be anomalous if the public interest defence under Section 32 required the Court to have regard to the reasonable belief of the journalist, but that the same defence under the general law did not. I cannot decide that any reasonable belief on the part of a journalist or editor would be irrelevant without hearing argument for that proposition, if it is to be advanced."
¶3.111 However, the position was set out in more robust terms in Goodwin v NGN Ltd where Tugendhat J held that whilst newspaper editors have the final decision on what is of interest to the public: judges have the final decision what it is in the public interest to publish.239
1886¶3.112 The correct approach based on present authority is that in conducting the balancing exercise between Article 8 and Article 10 and determining the public interest in publication, the Court is the ultimate arbiter of the public interest in the proposed/actual publication. It is for the Court to conduct a detailed and focussed analysis of the public interest in the publication and not simply enquire as to whether the journalist or editor had a reasonable belief that the publication was in the public interest. However, this is not to say that the state of mind of the journalist or editor is necessarily irrelevant to the balancing exercise under stage 2. As set out below, the defendant's motive is relevant to the strength of the Article 10 right: take the hypothetical case of a defendant making threats to publish, or blackmailing an individual. This may well weaken his or her Article 10 claim. In contrast, a defendant acting in good faith and in the reasonable belief that publication is in the public interest may well find himself in a stronger position as regards his or her Article 10 right.
¶Factors of relevance to the balancing exercise
¶3.113 Whilst not intended to be an exhaustive collection of the factors which may be relevant to the balancing exercise under stage 2, the following issues have been considered in the case law in undertaking the balancing exercise between Article 8 and Article 10.
¶Correcting false image
¶3.114 An example of the application of this principle can be identified in Ferdinand v MGN Ltd. Whilst Nicol J held in relation to a "kiss and tell" story about footballer Rio Ferdinand that the first stage test was satisfied, there was a public interest in publication on two grounds, one of which was to correct the "false image" created as a result of an interview given by the footballer in which he had portrayed himself as a family man and as a reformed character in a stable relationship. The Court held that while that perception of him continued to exist, there was a public interest in demonstrating that it was untrue. The judge acknowledged that it was an unattractive "kiss and paid for telling" story, but stated that:240
"stories may be in the public interest even if the reasons behind the informant providing the information are less than noble".
¶3.115 In McKennitt v Ash the Court of Appeal suggested that a very high degree of misbehaviour must be demonstrated in order to justify the disclosure of private information on the basis that the information tends to expose hypocrisy or correct a false image.241
¶Affects performance of obligations and duties
¶3.116 In Goodwin v NGN Limited and VBN it was argued that there was a public interest in exposing details of a relationship between Fred Goodwin and a senior employee of the Royal Bank of Scotland on the basis that it had an impact on the financial difficulties of the bank. Whilst this argument was rejected in the absence of evidence, Tugendhat J recognised that there may be circumstances where the private life of a person holding a responsible position so impacted on his or her ability to carry out their role that it would be in the public interest to report it.242 Any assertion that features of a persons' private life have a detrimental effect on the performance of public duties will require proper evidence.
1887¶Comparative value of different sorts of speech
¶3.117 Baroness Hale confirmed in Campbell that there are different types of speech just as there different types of information, some of which are more deserving of protection in a democratic society than others. The courts will therefore be more likely to find in favour of the defendant where the publication relates to political speech rather than gossip.243
¶Debate relating to public figures
¶3.118 The case of Von Hannover v Germany is of particular importance in confirming that disclosure of information about public servants or officials is likely to contribute to a debate of general importance which will weigh heavily in the Article 8 and Article 10 balancing exercise.244 The Court held that "a fundamental distinction" had to be made between reporting facts capable of contributing to a debate in a democratic society relating to, for example, politicians in the exercise of their functions, and reporting details of the private life of an individual who, as in Princess Caroline's case, does not exercise official functions. In the former case, the Press exercises its vital role of "watchdog". In the latter case it does not perform that role, see para 63. Accordingly:245
"…the decisive factor in balancing the protection of private life against freedom of expression should lie in the contribution that the published photos and articles make to a debate of general interest. It is clear in the instant case that they made no such contribution since the Applicant exercises no official function and the photos and articles related exclusively to details of her private life."
¶3.119 A different approach was taken in Axel Springer and Von Hannover (No.2) which confirmed that reports of the private lives of public figures will be acceptable where they contribute to a matter of general interest and there is no evidence of other wrongdoing. In both cases the fact that the individuals involved were not private individuals but could properly be regarded as "public figures" was important. In Axel Springer, the court found that the TV personality had himself revealed details about his private life in a number of interviews and in the court's view had actively sought the limelight and was well known to the public. As a consequence, his legitimate expectation that his private life would be effectively protected was reduced.246 In Von Hannover (No. 2), the court was satisfied that Princess Caroline and her husband were "undeniably very well known", irrespective of the question of the extent to which the Princess assumes official functions on behalf of the Principality of Monaco.247
¶Defendant's motives in threatening to publish private information
¶3.120 To date the court has regarded as a relevant factor the Defendant's intentions in stating their intention to publish private information. Tugendhat J in AMM v HXW held that if a person is making unwarranted demands with threats to publish, that is a factor in deciding whether that person has any Article 10 rights, and, if so then the weight to be accorded to them in balancing them with the Applicant's Article 8 rights.248
1888¶3.121 In another privacy case, Sharp J took into account the defendant's motives when balancing the claimant's Article 8 and the defendant's Article 10 rights when she observed in DFT v TFD that disclosure of the information in that case (whether to the media or generally) would be the fulfilment of a blackmail threat and that the expression rights of blackmailers are extremely weak, if they are engaged at all.249
¶3.122 It is unsurprising that the court will seek to inquire into the motives of the discloser, as this will likely go to the assessment of the strength and integrity of the argument of public interest.
¶Rights of another person to tell their story
¶3.123 In McKennitt v Ash, the defendant, Ms Ash, an author and close friend of Ms McKennitt, sought to resist the order for injunctive relief on the basis that her book was simply an expression of her relationship with the claimant and the role she played in her life and it was therefore argued that it was her right to tell her own story. In rejecting this argument Eady J held, having regard to the decision in Von Hannover, that if a person wishes to reveal information about aspects of his or her relations with other people, which would attract the prima facie protection of privacy rights, any such revelation should be crafted, so far as possible, to protect the other person's privacy. He emphasised that it does not follow, because one can reveal one's private life, that one can also expose confidential matters in respect of which others are entitled to protection if their consent is not forthcoming.250
¶Pre-notification requirement
¶3.124 Prior notification of publication can properly be described as good practice but is not a legal requirement. The law does not require advance notice of publication to be given to the subject of an article and a challenge to this before the ECtHR pursued by Max Mosley was unsuccessful. The Court noted that Article 10 does not prohibit the imposition of prior restraint on publication, any such restrains call for the most careful scrutiny although prior restraint may be more readily justified in cases which demonstrate no pressing need for immediate publication and in which there is no obvious contribution to a debate of general public interest.251 However, the ECtHR held that Article 8 does not require a legal duty to be imposed on the press to notify the subject of a publication in advance in order to allow him the opportunity to seek an interim injunction and thus prevent publication of material which violated his right to respect for his private life. This conclusion was reached on the basis that there was a risk of a chilling effect on the press, and doubts as to effectiveness of a pre-notification requirement and the wide margin of appreciation in this area.252
¶Remedies for misuse of private information
¶3.125 There are three potential remedies for the tort of misuse of private information: an injunction, damages and a declaration.
1889¶Injunctions
¶3.126 An injunction may be sought on an interim or final basis. An injunction is often the most effective remedy for claimants seeking to restrain publication of personal information or pictures.
¶3.127 The Court has recognised that damages may not be an effective remedy in this context. The Court of Appeal in Douglas & Ors v Hello Ltd. & Ors held that:253
"The award of damages eventually made to the Douglases, although unassailable in principle, was not at a level which, when measured against the effect of refusing them an interlocutory injunction, can fairly be characterised as adequate or satisfactory. Only by the grant of an interlocutory injunction could the Douglases' rights have been satisfactorily protected. Further, the interests of Hello! at the interlocutory stage, which were essentially only financial, could have been protected by an appropriate undertaking in damages by the Douglases".
¶3.128 In Mosley v News Group Newspapers Ltd Eady J observed that:254
"whereas reputation can be vindicated by an award of damages, in the sense that the claimant can be restored to the esteem in which he was previously held, that is not possible where embarrassing personal information has been released for general publication".
¶3.129 When an injunction is sought on an interim basis, the court will carefully scrutinise the basis for seeking to restrain publication. The burden for the applicant of establishing the need for restraining pre-publication is a heavy one. The court will consider, applying s12 of the HRA, whether the Claimant is likely to establish at trial that publication is an unlawful interference with their right to privacy and this process will require consideration of the principles set out in detail above.
¶3.130 The courts have repeatedly recognised the need for restraint in interfering with publication and the need for such interference to be justified.255
¶3.131 If a party proceeds to trial and is successful in establishing a cause of action in respect of the future publication or disclosure of information, the court may grant an injunction. Where a claimant has established his claim for misuse of private information at trial then, unless the grant of an injunction would be an exercise in futility because, for example, the private information is so widely in the public domain that there would be no point in restraining publication of it, he or she is very likely obtain an injunction restraining a defendant from further misuse.
¶3.132 In this area of the law that have recently been concerns regarding a number of procedural aspects of injunction, in particular the anonymity of claimants and publication of the mere fact of an injunction having been granted being prohibited, commonly referred to as a super injunction.
¶3.133 As a general principle, the names of parties to an action are included in the orders and judgments of the court. This is a corollary of the general rule that hearings are carried out in and judgments and orders are public and there is no general exception where cases concern private matters: JIH v News Group Newspapers Ltd.256 Article 6 provides for a public hearing and for a judgment to be pronounced publicly, although this right is subject to the need to protect the private life of the parties, or to the extent strictly necessary in the opinion of the court in special circumstances where publicity would prejudice the interests of justice.
1890¶3.134 However, parties seeking an injunction to restrain publication often wish to preserve their anonymity to prevent further reporting of the circumstances giving rise to, and the claim for, an injunction.
¶3.135 The Court has jurisdiction to make an order for anonymity in accordance with section 11 of the Contempt of Court Act 1981 and CPR 39.2(4). Such an order is often sought together with a substantive injunction seeking, (a) the protection of private information and, (b) prevention of publicity concerning the existence of the proceedings and the claimant's interest in them (sought on the basis that to allow such publicity would encourage speculation about the subject matter of the action, which would be intrusive in itself and may well alight on the very class of secret which exists). If anonymity is not ordered, the fact that the claimant has had to seek relief against the defendants may become a story in its own right.
¶3.136 Derogations from the general principle of open justice can only be justified in exceptional circumstances. However, it is fair to observe that by 2010 claimants were frequently seeking interim injunctions against the media which had some or most or all of the following features: the applications were heard in private, the proceedings were brought in an anonymised form, there was no public judgment, they were sought without notice to anyone (for example, because the defendants were "persons unknown", or because the defendant media organisation was thought to be likely to frustrate the order if given notice), and the injunctions were served on media third parties with the intention of binding them in accordance with the "Spycatcher" principle.
¶3.137 Claimants often sought such orders on the grounds that if they were not granted these procedural protections they would be deterred from seeking any relief at all. Prior to the decision in Terry, such arguments tended to be successful.257 However, the Terry decision marked an important check on the growing practice of the courts to entertain proceedings effectively shrouded in secrecy. Tugendhat J emphasised that these protections were only to be granted if necessary and a number of subsequent cases made clear that public judgment would be required, even if some material facts were omitted from the judgment and set out in a confidential schedule attached to the order. The concerns raised by Tugendhat J in Terry fed into the Report of the Committee on Super‐Injunctions at para 2.35258:
"It is true that, until early 2010, there were justifiable concerns that a form of permanent secret justice was beginning to develop. However, that concern should be dispelled by the decision in the Terry case."
¶3.138 Another feature of the practice in relation to obtaining injunctions which gave rise to legitimate concern was that interim injunctions were kept in place for long periods and potentially indefinitely, either because the initial orders granting interim relief did not contain a return date or because the substantive claims were not progressed by the claimant towards trial, in many cases because for a claimant once an interim injunction was granted no better result could be achieved at full trial and for the defendant the grant of an injunction on an interim basis was effectively determinative of the issue as the story may not be worth publishing months later. In Giggs v News Group Newspapers Ltd Tugendhat J noted the incentive for claimants to abuse the process, to avoid the need to prove their cases at trial.259 Having obtained an interim non‐disclosure order it may appear to be in interests of the claimant to hold on to it as long as possible and to proceed to trial as slowly as possible, if at all.260
1891¶3.139 During this period the media expressed concern against orders, in particular, super injunctions, which restrain a person from: publishing information which relates to the applicant and is said to be confidential or private, and, publicising or informing others of the existence of the order and the proceedings.
¶3.140 The Committee on Super‐Injunctions chaired by the Master of the Rolls, Lord Neuberger, was set up in April 2010 in response to these concerns and the Report dated 20 May 2011 and accompanying "Practice Guidance: Interim Non‐Disclosure Orders" issued by Lord Neuberger MR with effect from 1 August 2011 entrenched the developments towards open justice recognised in the case law and emphasised free speech and open justice.261
¶Damages
¶3.141 Where a claim for misuse of personal information is successful the claimant is likely to be compensated for any non pecuniary losses by an award of damages and the courts have tended to award damages for distress, hurt feelings and loss of dignity in privacy cases. Initially these awards have tended to be in the region of £2,000 – £10,000, with the Mosley case signalling a departure from these lower sums to an award of £60,000. In Cooper v Turrell Tugendhat J accepted the submission that the measure of damages in Mosley, in which the court took into account sums awarded in defamation cases, was the more appropriate guide to take than awards in earlier cases.262 There are a number of reported settlements in the region of £30,000. In determining quantum the Court will have regard to all the circumstances of the unlawful disclosures that are relevant, including the seriousness and scale of the intrusion, the circumstances in which the information was obtained and the defendant's knowledge at to potential harm to the claimant. Particularly intrusive disclosure, for example photographs, may affect the severity of the conduct. The claimant's own conduct will also be scrutinised for the purposes of assessing damages and to the extent that the claimant's conduct has contributed to the nature and scale of the distress this is likely to be material.
¶3.142 Aggravated damages have been awarded in some privacy cases. For example, £1,000 aggravated damages were awarded in Campbell v MGN on the basis of the post-publication conduct of the newspapers. Whilst there had been some judicial movement towards recognising a claim for exemplary damages in this context, it has now been established that exemplary damages are not awardable in claims for misuse of private information, until such a course is sanctioned by Parliament or the Supreme Court.263 p18, lines 22-25, Richard Wallace, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Transcript-of- Morning-Hearing-16-January-2012.pdf In Mosley v NGN Eady J adopted a restrictive approach to the extension of exemplary damage, holding that it was not clear that misuse of private information was a tort to which the possibility of exemplary damages should necessarily extend.
1892¶Protection from Harassment Act 1997
¶3.143 The Protection from Harassment Act 1997 (PHA) has potential application both to the conduct of journalists, for example news-gathering activities by journalists and photographers, and also in relation to the actual content of publications.
¶3.144 The PHA provides that a person must not pursue "a course of conduct" which amounts to harassment of another and which he knows or ought to know amounts to harassment of that other.264 A person "ought to know" conduct amounts to harassment if a reasonable person in possession of the same information would think the course of conduct amounted to or involved harassment of the other.265 A course of conduct must involve conduct on at least two occasions.266
¶3.145 "Harassment" is not exhaustively defined in the Act, although the Act provides that harassment includes alarming another person or causing that person distress.267 However, the Act does not require alarm or distress to be caused; harassment may be demonstrated by other means, for example, the use by the press of offensive or insulting words about a person's appearance or repeated mocking by a newspaper of a person's sexual orientation, or in relation to other characteristics protected by the Equality Act 2010. The lack of an exhaustive definition of harassment gives the courts scope to interpret the Act so as to give effect to the rights under Article 8 and Article 10 of the ECHR.268
¶3.146 Section 1(3) sets out the defences to a claim for harassment, and these include that the course of conduct was pursued for the purpose of preventing or detecting crime, was pursued under any enactment or rule of law or to comply with any condition or requirement imposed by any person under any enactment, or in the particular circumstances the pursuit of the course of conduct was reasonable. In the context of the press seeking to rely on a reasonableness defence it has been held that the defence:269
"requires the publisher to consider whether a proposed series of articles, which is likely to cause distress to an individual, will constitute an abuse of the freedom of press which the pressing social needs of a democratic society require should be curbed".
¶3.147 Section 2 of the PHA provides that the course of conduct pursued in breach of section 1 will be a criminal offence. This is discussed in more detail at paragraph 4.129 of the Annex. Section 3 provides that an actual or apprehended breach of section 1 may be the subject of a claim in civil proceedings by the person who is or may be the victim of the course of conduct in question. This has the effect that a civil claim can be brought to restrain an apprehended breach of section 1, by way of an injunction; or a claim can be brought after the conduct has occurred to seek damages for (among other things) any anxiety caused by the harassment and any financial loss resulting from the harassment.270 If a court grants an injunction restraining a person from pursuing any conduct which amounts to harassment and the claimant considers that the defendant has breached the injunction, he or she may apply for the issue of a warrant for the arrest of the defendant.271
¶264 s1(1)265 pp11-12, paras 44-46, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Witness-Statement-of-Tina- Weaver.pdf s1(2)266 p31, para 64, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Witness-Statement-of-DCS-Keith- Surtees.pdf s7(3)(a)
1893¶3.148 A limited number of claims have been brought against the press under the PHA on the basis that actual publication amounts to harassment, although the case law thus far suggest that claimants have enjoyed limited success in relation to claims that publication amounts to harassment.
¶3.149 The principle of such a claim being brought was first addressed in Thomas v News Group Newspapers Ltd in which News Group sought to strike out (as being unarguable) a claim for harassment based upon the publication of a series of articles in which the claimant, described as a "black clerk" was criticised for her involvement in a dispute over a racist comment at her place of work, and hate mail was subsequently received by the claimant in response to the article (the newspaper having published the claimant's name and address). The court stated that:272
"In general, press criticism, even if robust, does not constitute unreasonable conduct and does not fall within the natural meaning of harassment".
¶However, the Court of Appeal held that it was at least arguable that it was foreseeable that the publication of the articles complained of would lead Sun readers to address hostile letters to the claimant, causing her additional distress.
¶3.150 Recently, in Trimingham v Associated Newspapers Limited the claimant, who had worked with and had an extra-marital affair with a well known politician, pursued a claim under the PHA.273 The basis of the claim was that the newspaper had engaged in a course of conduct which included publication of comments about the claimant's personal appearance as well as her sexuality, which she regarded as offensive, both in the articles complained of and in the readers' comments. The claimant sought damages, including aggravated damages, and an injunction against the newspaper ordering them to refrain from further publication which made reference to the claimant's sexual orientation unless relevant in a particular context distinct from her relationship with the politician and that the newspaper refrain from harassing the claimant.
¶3.151 Tugendhat J outlined that the correct approach was for the court to ask the following questions: (1) was the distress that the claimant suffered the result of the course of conduct, in the form of speech? (2) if so, ought the defendant to have known that that course of conduct amounted to harassment? (3) if so, has the defendant shown that the pursuit of that course of conduct was reasonable? To both questions (1) and (2) the Court noted there are subsidiary questions: namely was the claimant a purely private figure or not and, either way, was she in other respects a person with a personality known to the defendant such that it ought not to have known that the course of conduct amounted to harassment?
¶3.152 Tugendhat J also set out guidance in relation to the interpretation of a course of conduct consisting of speech which is alleged to be pejorative of a claimant: he did so by adopting the guidance provided by the Court of Appeal in Jeynes v News Magazines Ltd dealing with the meaning of words alleged to be defamatory:274
1894"The governing principles relevant to meaning … may be summarised in this way: (1) The governing principle is reasonableness. (2) The hypothetical reasonable [person] is not naïve but he is not unduly suspicious. He can read between the lines. He can read in an implication more readily than a lawyer and may indulge in a certain amount of
loose thinking but he must be treated as being a man who is not avid for scandal and someone who does not, and should not, select one bad meaning where other non- [pejorative] meanings are available. (3) Over-elaborate analysis is best avoided… (5) The article must be read as a whole, ..."
¶3.153 In relation to the defence of reasonableness, Tugendhat J noted in interpreting the decision in Thomas that:
"for the court to comply with HRA s.3, it must hold that a course of conduct in the form of journalistic speech is reasonable under PHA s.1(3)(c) unless, in the particular circumstances of the case, the course of conduct is so unreasonable that it is necessary (in the sense of a pressing social need) and proportionate to prohibit or sanction the speech in pursuit of one of the aims listed in Art 10(2), including, in particular, for the protection of the rights of others under Art 8."
¶3.154 Although the decision is subject to challenge in the Court of Appeal, in Trimingham a narrow view was taken of the meaning of a private individual; and the Court concluded that the claimant was not a private person by reason of the fact that: 1) in her professional capacity she undertook to work for one of leading politicians in country, and 2) in her private capacity she conducted a sexual relationship with a politician which would lead to him leaving his wife. Ultimately, the Judge accepted that whilst the claimant was upset about the insulting and offensive language about her appearance, he did not accept that the defendant ought to have known that its conduct in relation to that language would be sufficiently distressing to be considered oppressive or amount to harassment and he did not accept that in fact it was so considered by the claimant.275 The Court found that discussion or criticism of sexual relations which arise within a pre-existing professional relationship, or of sexual relationships which involve the deception of a spouse, or a civil partner, or of others with a right not to be deceived, are matters which a reasonable person would not think would be conduct amounting to harassment, and would think was reasonable, unless there are some other circumstances which make it unreasonable. One circumstance which may make such a course of conduct unreasonable is if it interferes with the Article 8 rights of the claimant. However the Judge found that the claimant's Article 8 rights had become very limited because she was not a purely private figure.
¶3.155 The Trimingham decision illustrates the approach that will be adopted by the courts in assessing whether the publication of an article amounts to harassment. It appears that a key hurdle for any claimant is the need to establish that the journalist would have known that the course of conduct amounted to harassment, which appears from the decision to be a relatively high hurdle.
¶3.156 In addition to the content of publications, methods of news gathering may also amount to harassment. For example, there are a number of cases where interim injunctions have been granted against journalists and photographers to prohibit them from door stepping, or besetting the home of a person they wished to photograph or interview. In AM v News Group Newspapers Ltd & Ors an application for an injunction was made by a person who had become subject to media interest solely by reason of the fact that he was the landlord of a property rented by the cleric Abu Qatada.276 The applicant's home had been visited by journalists who were calling his phone, knocking at his door, and taking photographs of him when he went outside. His children could not go outside. Tugendhat J noted that Article 8 of the ECHR and s.6 of the HRA require measures to be put in place to ensure respect for a person's home and family life, and therefore made an order imposing publishing restrictions prohibiting the publishing or broadcasting of: the claimant's name and address; or any photograph, film, video or image that identified the claimant's address or showed any occupier or invitee within the house or garden of the claimant's address; and also imposed a restraint on harassment in relation to the contacting the claimant or approaching the claimant's address.277 The Judge noted that the order, in so far as it prohibited disclosure of information, was made with a view to preventing interference with the right to respect of one's home and family and not to preventing disclosure of information which is sensitive.
1895¶3.157 Another example is the case of Ting Lan Hong and KLM v Persons Unknown where Tugendhat J granted an injunction prohibiting harassment of the mother of the child of actor Hugh Grant, following prolonged harassing conduct from photographers.278 The Court noted that Ms Hong had received numerous calls and messages from journalists, had been regularly followed and photographed without her consent when pregnant, had photographers outside her home every day for a period, and that photographers persisted in attending at her property despite a warning from the PCC to desist from such conduct. The order was granted prohibiting the harassment of the claimant.
¶3.158 These two cases are illustrative of the utility of the PHA in seeking to restrain the conduct of journalists and photographers where their conduct amounts to harassment within the meaning of the Act. It seems likely that where an individual is faced on more than one occasion with a number of journalists or photographers present at their home, telephoning or attempting to communicate with them in circumstances where distress and alarm is caused, this is likely to justify the grant of an injunction requiring the ceasing of such conduct, provided the relevant threshold of severity is established.
¶Defamation
¶3.159 In broad terms, the law of defamation protects a person's reputation. Unlike misuse of private information, defamation is not concerned with protecting a person from publication of private information but protects a person from the publication of untruths which have the effect of damaging their reputation.
¶3.160 The principles of the law of defamation are mostly contained in the common law with some overlay of statutory provisions, namely the Defamation Acts 1952 and 1996. The law is currently the subject of debate and likely reform. The Defamation Bill was presented to Parliament on 10 May 2012 and seeks to clarify and reform aspects of the law of defamation.
¶3.161 There are two varieties of each of the torts of libel and slander: personal defamation, where there are imputations as to the attributes or character of an individual; and business or professional defamation, where the imputation goes to an attribute of an individual, a business, or a charity, and that imputation is as to the way the profession or business is conducted. These varieties are not mutually exclusive: the same words may carry both varieties of imputation.
¶3.162 A person or organisation may bring a claim for defamation where they can be identified from the publication, for example by name or by their title, or where the material would lead people acquainted with the person to believe that he or she was the person referred to. There is no statutory definition of what is defamatory, however the test adopted by the courts is whether a statement "lowers a person in the estimation of right-thinking members of society generally".279 Whether the words in fact convey a defamatory meaning is a question of fact applying the standard of the ordinary reasonable person.
1896¶3.163 The principles applied in determining the meaning of the words were summarised in Jeynes v News Magazines Ltd (to which reference is made above) where Sir Anthony Clarke MR identified principles which bear repetition: (1) the governing principle is reasonableness; (2) the hypothetical reasonable reader is not naïve but he is not unduly suspicious, he can read between the lines, he can read in an implication more readily than a lawyer and may indulge in a certain amount of loose thinking but he must be treated as being a man who is not avid for scandal and someone who does not, and should not, select one bad meaning where other non-defamatory meanings are available; (3) over-elaborate analysis is best avoided; (4) the intention of the publisher is irrelevant; (5) the article must be read as a whole, and any "bane and antidote" taken together; (6) the hypothetical reader is taken to be representative of those who would read the publication in question; (7) in delimiting the range of permissible defamatory meanings, the court should rule out any meaning which, "can only emerge as the produce of some strained, or forced, or utterly unreasonable interpretation"; (8) it follows that "it is not enough to say that by some person or another, the words might be understood in a defamatory sense".280
¶3.164 There was previously some uncertainty as to whether the existing law imposes a "seriousness threshold", although the recent case of Thornton v Telegraph Media Group Limited surveyed the authorities and concluded that defamation must include a qualification or threshold of seriousness, so as to exclude trivial claims.281
¶3.165 As a general principle the claimant will need to establish that the material has been read, heard or seen by at least one other person and in some circumstances the courts may be prepared to draw an inference that material has been widely published in the absence of concrete evidence of receipt of the information by others, for example, where information is generally accessible (for example on the website of a mainstream newspaper).
¶3.166 The extent of publication is important, as proceedings may be stayed on the basis that where publication is very limited, the cost of proceedings may be disproportionate to the likely benefit in the event the claimant succeeds: see for example Jameel v Dow Jones & Co Inc.282 It was recently observed by Tugendhat J that recent cases demonstrate that each of the three judges who are currently hearing most of the defamation cases are applying the principle of Jameel v Dow Jones with some frequency, and in a number of different, but related, contexts in defamation actions.283
¶3.167 Each separate publication of a statement (or re-publication) may give rise to a cause of action. For example, each transmission of a television or radio broadcast, and each copy of a newspaper sold is a separate publication. This issue is mainly of significant where some publications would otherwise be statute barred and in cases where publications are in different jurisdictions and where common law qualified privilege is a defence.284 Further publication by a different party of the same material may also give rise to a cause of action, this being known as the "repetition rule".285 In some circumstances the original publisher will be liable for the subsequent re-publication if this was both caused by the original publication and a foreseeable consequence.286 Some concern has been expressed whether this rule should be of equal application to the Internet, however the courts have to date rejected a "single publication" rule and held, for example, that each separate bulletin board posting, or display of content of a web page (for as long as that web page remains accessible) gives rise to a cause of action.287 pp3-4, para 8, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Witness-Statement-of-Finbarr- Ronayne1.pdf Publication will occur where a person intentionally or negligently takes part in, or authorises, the communication of material. Each person who publishes the defamatory material is in principle liable. Liability will not ordinarily attach to accidental publication of defamatory material.288
1897¶Defences
¶3.168 There are a number of defences available to publishers of defamatory material, including defences of justification, fair comment, absolute privilege, qualified privilege and innocent dissemination. These are considered below.
¶3.169 A defence of justification will be open to a publisher where the defamatory statement is substantially true.289 This must be proven on the balance of probabilities and is an objective test: it is not sufficient for a publisher to show that they genuinely believed the statement was true.
¶3.170 A defence of fair comment protects expressions of opinion or comments (as distinction from assertions of fact), where the comment relates to a matter of public interest, the comment is based on facts which are true or absolutely privileged and the comment is fair.290
¶3.171 In certain limited circumstances the law recognises that defamatory statements will be immune from challenge, even where no other defence applies. These exceptions, known as absolute privilege, include statements made in the House by Members of Parliament,291 statements made in the course of judicial and quasi-judicial proceedings by the judge, counsel, parties, witnesses and jurors,292 and statements made to the police and investigatory agencies in the course of an inquiry into illegality or wrongdoing.293 Fair and accurate reports of proceedings before various courts attract absolute privilege if published contemporaneously.294
¶3.172 The law also recognises certain forms of qualified privilege where publication of defamatory statements attract privilege if the statement was made in the performance of a legal, social or moral duty or to protect an interest and the statement was made to a person with a corresponding duty or interest in receiving that material.295 One aspect of qualified privilege of particular relevance is the application of the duty and interest argument to publication of material in the public interest, as articulated by the House of Lords in Reynolds v Times Newspapers Ltd.296
1898¶3.173 The defence of Reynolds privilege has recently been comprehensively analysed by the Supreme Court in Flood v Times Newspapers Limited.297 This defence will protect publication of a defamatory matter where i) it is in the public interest that the information should be published and ii) the publisher has acted responsibly in publishing information.298 This defence is accurately described as a public interest defence.299
¶3.174 In respect of the first element, the courts have recognised that this is not a black and white test, but rather it is necessary to consider "the extent to which the subject matter is a matter of public concern". The publisher must show that the publication was in the public interest, and this must go further than merely showing that the subject matter was of public interest.300 The test adopted by Lady Hale in Jameel that "there must be some real public interest in having this information in the public domain" was supported by Lord Phillips in Flood.301 The Reynolds privilege requires a balancing exercise between the importance of the public interest in receiving the relevant information and the public interest in preventing the dissemination of defamatory allegations with the injury to reputation that results.302 Ultimately each case will turn on its own facts, however the seriousness of the allegation is a significant factor in assessing where the balance should be struck between the public interest in receiving information and the potential harm caused if an individual is defamed.303 In respect of the public interest in publishing allegations made and being investigated against a senior police officer, the Supreme Court placed weight on the fact that the publication was with a view to ensuring that the allegations were properly investigated by the police in circumstances where the journalist had reason to believe they were not being so investigated.304 Lord Mance explained that journalistic judgement carried weight in considering how much detail should be published, although any journalist must carefully consider the public interest in publishing allegations that have not been fully investigated or their accuracy determined.305
¶3.175 In Flood the Supreme Court addressed the extent of verification required before a journalist can rely on the defence. The Court emphasised that the privilege will attach only if the journalist has acted honestly and reasonably believed the published facts to be true, although no hard and fast principles can be applied. Where a journalist alleges there are grounds for suspecting a person to be guilty of misconduct the responsible journalist should satisfy himself that grounds for suspicion exist (these can be derived from reliable sources or inferred from the fact of a police investigation), but he need not know what the grounds are.306
1899¶3.176 The law also recognises, through common law and statute, a defence of innocent dissemination. Section 1 of the Defamation Act 1996 sets out a defence for a person who was not the author, editor or publisher of the statement, who took reasonable care in relation to the publication of the statement and did not know and had no reason to believe, that what he did caused or contributed to the publication of a defamatory statement. The common law defence protects defendants who did not know a publication contained a libel, or that the publication was of such a character that it was likely to contain a libel and the absence of such knowledge was not by reason of negligence.307
¶Remedies
¶3.177 Whilst the primary objective for persons upon being defamed (or threatened with defamation) is to restrain publication, it is only in exceptional circumstances that the court will be content to grant an interim injunction restraining publication. Interim relief will be refused if the there is any proper basis for a believing a defence will be successful or that the claimant is only likely to recover nominal damages. Section 12 of the HRA will apply to an interim injunction sought in defamation claims and it has been held that nothing in this section weakens the common law rule that interim relief will only be granted if the material complained of is so clearly actionable that if a jury were to find for the defendant an appeal court would be obliged to set aside the jury's conclusion as unreasonable.308
¶3.178 Where a claimant is successful in a defamation trial, a permanent injunction restraining the defendant from further publication of the defamatory material will be granted if it can be established that future publication is likely and would constitute an actionable wrong.
¶3.179 The principal mechanism for vindicating damage to reputation is an award of damages. The law presumes that a defamatory publication has damaged the reputation of the claimant. Compensatory damages are awarded to compensate the damage to reputation and include damages for monetary loss occasioned by the attitude adopted by other persons towards the claimant (special damages) and damages for distress, hurt and humiliation. Aggravated damages may be awarded where the conduct of the defendant has increased the claimant's injury or where the defendant has acted improperly. Exemplary damages may be awarded in some cases to punish the defendant for particularly disgraceful conduct and where compensatory damages are inadequate in all the circumstances. A defendant who has given an apology prior to the commencement of the action may be able to mitigate the extent of an award of damages.
¶Application of the law of defamation to the internet
¶3.180 In an era where the internet has displaced nearly every other form of communication in terms of its scope, use and geographical reach, the extent to which claims of defamation can be pursued against statements published on the internet is a pressing concern. The internet facilitates the communication of information and opinion to a global audience of billions of people on an instantaneous basis. Freedom of expression demands that regulation should not interfere with the potential of this source of information, however the internet poses a significance potential for abuse and unregulated activity, including defamatory statements, to be widely published.
1900¶3.181 The desirability and practicality of regulating internet content is a hotly contested subject and the existing legal position is complex, both as a result of the fact that there is no comprehensive framework at a domestic level which establishes a mechanism for regulation of the internet and secondly because of the extent to which the courts have tried, not always successfully, to apply the traditional principles of defamation to the Internet.
¶3.182 The distinction between libel and slander is not straightforward in the context of the internet, where the medium through which the information is published may resemble television programmes (with video), radio programmes (with audio), or notice-boards or text akin to newspaper articles. In short, the internet may involve transient or permanent publication and may comprise spoken and/or written word. Section 166(1) of the Broadcasting Act 1990 has the effect of deeming a number of internet communications and internet services to be published in permanent form, and this is actionable as libel.309
¶3.183 Websites that host user generated content pose a particular difficulty in this context. The general position appeared to be that the websites were to be regarded as publishers of the material posted on their websites, although they would not be liable for the initial publication if they did not participate in the publication (for example by editing or approving the post). However, upon notice of a complaint as to the content of a post, if steps were not taken to remove the content, liability could be established, subject to defences, for example section 1(1) of the Defamation Act 1996 and Regulation 19 of the Electronic Commerce Regulations 2002.310 The notice given to the website must disclose the facts or circumstances which form the basis of the allegation.311 In Davison v Habeeb, the court determined that Google, as host of Blogger.com, was arguably a publisher under the common law of content hosted on the blog and that liability would follow notification of a complaint.312 However, the recent decision of Tamiz v Google casts some doubt on this approach.313 Eady J found that Google Inc was not a publisher even when on notice as to the offending blogs, even though it had the technical capabilities to take down the post. Google was not a publisher within the well recognised common law principles of defamation as its role as a platform provider was a purely passive one.314
1901¶3.184 The Electronic Commerce Regulations set out the circumstances in which Internet intermediaries are responsible for material which is not created by them, but which is hosted, cached or carried by them.315 The Regulations draw a distinction between intermediaries who are mere conduits (regulation 17), who cache information (regulation 18), and who host information (regulation 19). Regulation 19 provides a defence where the service provider does not have actual knowledge of unlawful information or is not aware of facts and circumstances from which it would have been apparent to the service provider that the information hosted was unlawful.316 Section 1(1) of the Defamation Act 1996 is regularly invoked by websites as a defence on the basis that they are not the author, editor or commercial publisher of a statement.
¶3.185 The courts have struggled to apply traditional defamation principles to the internet and the case law has thrown up a number of interesting issues of unique application to the internet. For example, a special feature of chatrooms, message boards or blogs is that the text can continually evolve with new comments being added which may affect the context and meaning of previous and subsequent post. It has been decided that the final thread must be treated as a single publication for the exercise of determining meaning.317 Further, the meaning of the words must be considered in light of the purpose and role of chat rooms and message boards, where casual, emotive and imprecise speech are all common features. As Eady J explained in Smith v ADVFN people who participate in bulletin boards expect a certain amount of repartee or give and take.318,319 p3, para 6, ibid
¶3.186 The application of the defamation principles to the internet remains an area of considerable uncertainty. Whilst the courts have attempted to fashion principles that are workable in the short term, the law in this area is far from clear and this has given rise to conflicting decisions. Other jurisdictions have similarly struggled to grasp the complexities of the operation of the internet and recognised the need for the courts to view libel allegations within the unique context of the internet. A comprehensive framework of coherent rules and regulation remains lacking and it is likely that the law will be subject to further development in this area.
¶Defamation Bill
¶3.187 The Bill proposes a number of amendments to the law of defamation, including codification of matters which have been established in case law as well as proposing some changes to the existing law. The key features of the Bill in its present form can be summarised as follows.320
¶3.188 Clause 1 provides that a statement is not defamatory unless its publication has caused or is likely to cause serious harm to reputation. This clause builds upon recognition by the courts that there is a threshold of seriousness and sets a relatively high bar for bringing a claim.
¶3.189 The Bill also includes a number of provisions that operate as defences to a claim for defamation, codifying much of the common law with some amendments. Clause 2 abolishes the common law defence of justification to provide for a statutory defence of truth, namely a defence where the statement complained of its substantially true. Clause 3 abolishes the common law defence of fair comment and provides for a defence of honest opinion which is applicable where i) the statement was a statement of opinion, ii) the statement indicated, either generally or specifically, the basis of the opinion, and iii) an honest person could have held the opinion on the basis of any fact which existed at the time the statement was published or anything asserted to be a fact in a privileged statement published before the statement complained of.321 Clause 3(6) contemplates the scenario where the defendant is not the author of the statement (i.e. the defendant is the newspaper title, and the statement of opinion is written by a particular journalist), and provides that the defence is not available if the defendant knew or ought to have known the author did not hold the opinion that the statement was based on the relevant facts. There is no requirement for the opinion to be held on a matter of public interest.
1902¶3.190 Clause 4 abolishes the common law defence known as Reynolds privilege and sets out a defence of "responsible publication on matters of public interest" which is intended to broadly reflect the current law. The defence applies to statements of fact and opinion and has two components; namely that the statement complained of was or formed part of a statement on a matter of public interest, and that the defendant acted responsibly in publishing the statement. Clause 4(2) sets out the matters to which the court may have regard in determining whether the defendant acted responsibly. These factors, which are illustrative and not exhaustive, broadly reflect the current case law and include a) the nature of the publication and its context, b) the seriousness of the imputation conveyed by the statement, c) the relevance of the imputation conveyed by the statement to the matter of public interest concerned, d) the importance of the matter of public interest concerned, e) the information the defendant had before publishing the statement and what the defendant knew about the reliability of that information, f) whether the defendant sought the claimant's views on the statement before publishing it and whether an account of any views the claimant expressed was published with the statement, g) whether the defendant took any other steps to verify the truth of the imputation conveyed by the statement, h) the timing of the statement's publication, and i) the tone of the statement. Clauses 4(3) and (4) reproduce the common law doctrine of "reportage", namely where allegations are reported neutrally rather than adopted by the newspaper no verification of the truth is required.
¶3.191 Clause 6 provides for a new defence of qualified privilege relating to peer-reviewed material in scientific or academic journals. Clause 7 amends the Defamation Act 1996 which contains defences of absolute and qualified privilege to extend the circumstances in which such defences can be used.
¶3.192 Clause 8 sets out a single publication rule, which has the effect that the one year limitation period starts to run from the date of the first publication of the material to the public or section of the public. This will represent a substantive change to the law which previously had a "multiple publication" rule, namely that each publication of defamatory material gives rise to a separate cause of action subject to its own limitation period. The single publication rule bites provided that any subsequent publication is the same or substantially the same publication, and provided that the publication is not materially different from the manner of the first publication.322
¶3.193 The Bill also contains some provisions targeted at new media and in particular the internet. Clause 5 creates a new defence for operators of websites where a claim for defamation is brought in respect of a statement posted on the website if the operator did not post the statement. The defence will not be available however if the claimant could not identify the person who posted the statement, the operator was given notice of the complaint and failed to respond to that notice in accordance with the provisions to be set out in regulations to be made by the Secretary of State. The details of this clause, including what needs to be included in the notice and the steps required of the website operator are to be set out in regulations, and this gives rise to some uncertainty as to how this part of the new regime may operate.
1903¶3.194 Two clauses in the Bill seek to address practical considerations and costs concerns that have arisen in the context of defamation claims, namely the cost of jury trials and the volume of defamation cases issued in the courts of England and Wales where there are tenuous links to this jurisdiction. Clause 11 removes the right to trial by jury and any presumption in favour of a jury trial with the effect that defamation cases will be tried by a judge unless the court orders otherwise. The other clause of significance is clause 9 which seeks to address the problem of 'libel tourism' and sets a relatively high threshold for parties seeking to bring a claim against a defendant not domiciled in the UK, an EU member state or state which is party to the Lugano Convention: namely that the courts do not have jurisdiction unless it can be shown that England and Wales is clearly the most appropriate place to bring an action.
- Regulatory law – legal framework relating to the Information Commissioner Legislative background to the protection of personal data
¶4.1 A right to privacy, as distinct from specific protection of personal data, has been explicitly recognised at an international level since 1948 when the Universal Declaration of Human Rights incorporated in Article 12 a right to be protected against arbitrary or unlawful interference with privacy. Article 12 was reproduced in Article 17 of the International Covenant on Civil and Political Rights in 1966. Subsequently, the Organisation for Economic Co-operation and Development recognised the inherent link between protection of privacy and restrictions on processing personal information, and adopted guidelines seeking to restrain the cross border flow of information.323
¶4.2 The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of the Council of Europe (the Convention) was opened for signature in 1981. This was the first legally binding international instrument with the specific objective of data protection. Its purpose was:
"to secure [...] for every individual [...] respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data."
¶4.3 Chapter II of the Convention sets out the basic principles of data protection, rights of data subjects and requires parties to the Convention to take steps to ensure that domestic law gives effect to the basic principles set out in the Convention.
1904¶4.4 Two particular provisions are worthy of note. Article 5 sets out the conditions for the automatic processing of personal data including the requirement that personal data is obtained and processed fairly and lawfully, stored for legitimate purposes, is adequate and relevant for its purpose, is accurate and up to date and preserved in a form which permits identification of the data subject for no longer than required for its purposes. Article 8 grants rights to data subjects, including the right to establish the existence of an automated personal data file, to confirm whether personal data are stored in the automated data file, to receive communication of such data in an intelligible form, to obtain rectification or erasure of such data if these have been processed contrary to the provisions of domestic law and to have a remedy if a request for confirmation, rectification or erasure is not complied with.
¶4.5 Chapter III restricts the cross border flow of personal data in certain circumstances and Chapter IV contemplates mutual assistance between the parties to the Convention in order to implement the Convention. Article 13 requires the parties to the Convention to designate one or more authorities to have responsibility for assisting other parties to the Convention and to furnish information on the law and administrative practice in the field of data protection.
¶Data Protection Act 1984
¶4.6 The Data Protection Act 1984 (the 1984 Act) implemented the United Kingdom's obligations under the Convention and sought to regulate the use of automatically processed information relating to individuals and the provision of services in respect of such information.
¶4.7 The 1984 Act established the position of Data Protection Registrar and also a Data Protection Tribunal.324 It obliged organisations holding personal data to register with the Data Protection Registrar and thereafter to abide by the principles of data protection outlined in the Act. These principles mirrored those set out in the Convention and were replicated in Schedule 1 of the 1984 Act.
¶4.8 The Data Protection Registrar had responsibility for maintaining a register of data users who held and provided services in respect of personal data and a register of accepted applications for registration made by such users and for, determining applications to be a registered data user.325 The Data Protection Registrar was given powers to take enforcement action against registered users who had contravened the data protection principles including the power to de-register a data user for breach of the data protection principles and to issue a notice prohibiting the transfer of personal data outside the United Kingdom.326
¶4.9 The 1984 Act made no special provision in relation to the press.
¶Data Protection Directive
¶4.10 Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the Data Protection Directive) was adopted on 24 October 1995 and required implementation by October 1998. The Directive itself was a response to the Organisation for Economic Co-operation and Development guidelines and adopts a number of the same principles.
1905¶4.11 The Data Protection Directive requires that each member state must set up a supervisory authority, which acts as an independent body that will monitor the data protection level in that member state, give advice to the government about administrative measures and regulations, and start legal proceedings when data protection regulation has been violated.327 In the United Kingdom, this authority is the Information Commissioner.
¶4.12 The objective of the Data Protection Directive is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.328 The Data Protection Directive sought to harmonise data protection legislation throughout the European Union by requiring member states to determine the conditions under which the processing of personal data is lawful, in accordance with the criteria and principles set out in the Directive.329 It is a harmonisation measure and operates by setting a minimum standard to be adopted by member states.
¶4.13 The Data Protection Directive has been supplemented by other legal instruments, such as the e-Privacy Directive and specific rules for the protection of personal data in police and judicial cooperation in criminal matters.330
¶4.14 The Data Protection Directive defines a number of core terms which are replicated in the Data Protection Act 1998.331 These terms are explored in detail below.
¶4.15 The general rules on the lawfulness of processing personal data are set out in Chapter II to the Data Protection Directive. Article 6 provides that the data controller is responsible for ensuring that personal data is processed in accordance with particular criteria, including fairly and lawfully. Article 7 of the Directive sets out the specific criteria for legitimate data processing and this is subject to the provisions of Article 8 which sets out categories of processing for which specific restrictions apply.
¶4.16 By recital 37, the European Parliament and the Council recognised that the processing of personal data:"for purposes of journalism or for purposes of literary or artistic expression" engaged the "right to receive and impart information, as guaranteed in particular in art 10 of the ECHR" and should therefore be exempt from the Directive's requirements to the extent necessary for the reconciliation of such conflicting rights. The Data Protection Directive requires Member States to provide exemptions or derogations from these provisions for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.332 It also gives data subjects a prima facie right to obtain from the data controller data relating to herself or himself, although this right to data may be overridden by defined exceptions.333
1906¶4.17 The European Parliament adopted the Directive on 24 October 1995 and in March 1996 the Home Office issued a consultation paper on the Directive. The Secretary of State for the Home Department subsequently presented proposals for new data protection legislation, which took the form of the Data Protection Act 1998.
¶Data Protection Act 1998 Introduction
¶4.18 The Data Protection Act 1998 (the DPA) replaced the Data Protection Act 1984 and sought to implement the provisions of the Data Protection Directive by establishing a system of data protection controls for manual data as well as computerised data. Lord Williams of Mostyn commenced his second reading speech for the Data Protection Bill on 2 February 1998 with the following comments:334
"The Bill will improve the position of citizens of his country by enabling them to rely on a wide range of civil and political rights contained in the European Convention on Human Rights. Those rights include the right to respect for private and family life. The Data Protection Bill also concerns privacy, albeit a specific form of privacy; personal information privacy."
¶Key concepts and structure of the Data Protection Act 1998
¶4.19 In broad terms, the DPA seeks to ensure that personal data is used in accordance with the data protection principles, attaches certain conditions to the processing of personal data and adds extra safeguards where the personal data is sensitive. The DPA also establishes certain rights for a data subject and establishes a framework of enforcement. The legislation responds to the requirement to protect the privacy of recorded information relating to an individual.
¶4.20 At the heart of the DPA are a number of defined terms used throughout the Act. It is important to understand these. "Data" means information processed by automatic equipment, information recorded with the intention of being processed by such equipment, information held in relevant filing systems and recorded information held by a public authority.335 "Personal data" means data which relate to a living individual.336 "Processing" encompasses a wide range of uses of data including obtaining, recording, holding, organising, altering, adapting, retrieving, using and disclosing data.337 Processing also includes putting data into print, namely publication.338 "Data controller" means the person or organisation who determines the purpose for which and the manner in which any personal data are processed, i.e who decides what is to be done with the information.339 The definition of data controller includes the press and media organisations. "Data processor" is the person who processes the data on behalf of the data controller.340
1907¶4.21 Certain types of personal data are defined as sensitive personal data.341 This includes information as to (a) the racial or ethnic origin of the data subject, (b) political opinions, (c) religious beliefs or other beliefs of a similar nature, (d) membership of a trade union, (e) physical or mental health or condition342, (f) sexual life, and (g) the commission or alleged commission of any offence, proceedings relating to this or disposal of such proceedings.
¶4.22 The DPA applies to a data controller in respect of any data where the data controller is established in the UK and the data is processed in the context of that establishment or the data controller uses equipment in the UK for the processing of data other than for the purpose of transit through the UK.343 p57, lines 9-14, Chris Elliott, ibid
¶4.23 The DPA further sets out that it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he or she is the data controller.344 This duty is subject to section 27, which introduces the exemptions in Part IV of the Act. Breach of this statutory duty to comply with the data protection principles gives rise to a private law cause of action, allowing the data subject to make a claim against the data controller.
¶4.24 The data protection principles define the manner in which all personal data must be processed. These principles are set out in Part 1 of Schedule 1 of the Act:
-
¶
- Principle 1 – Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless (a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.345
- Principle 2 – Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
- Principle 3 – Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
- Principle 4 – Personal data shall be accurate and, where necessary, kept up to date.
- Principle 5 – Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
-
¶
- Principle 6 – Personal data shall be processed in accordance with the rights of data subjects under this Act.
- Principle 7 – Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
- Principle 8 – Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
¶4.25 Attention is usually focused on the first data protection principle which imposes a three fold obligation on the data controller: fairness, lawfulness and compliance with one of six specified conditions in Schedule 2.346 Schedule 2 introduces concepts such as consent of the data subject and necessity in order to fulfill a legitimate aim; for example, compliance with a contract, a legal obligation, to protect the vital interests of the data subject, to promote the administration of justice, or the exercise of public functions in the public interest. Special conditions apply for the purposes of the first data protection principle if the relevant data is "sensitive" personal data.347 These requirements are set out in Schedule 3 to the Act and include: explicit consent to processing, processing to be necessary for exercising or performing any right or obligation conferred or imposed by law in connection with employment, processing to be necessary to protect vital interests of the data subject or another person, or information having been made public by steps deliberately taken by the data subject.
¶Rights of a data subject
¶4.26 The Act confers a number of rights on data subjects.348 These rights include:
(a) the right to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller; (b) if that is the case, to be given by the data controller a description of the personal data, the purposes for which they are being processed and the recipients or classes of recipients to whom they are or may be disclosed; (c) to have communicated the personal data to him or her in an intelligible form. Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he or she is not obliged to comply with the request unless (a) the other individual has consented to the disclosure of the information to the person making the request, or (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.349
¶4.27 The Act also confers on a data subject a number of further rights to require data processing to cease, or not to begin where that processing is likely to cause distress or damage, or where the processing is for the purposes of direct marketing of personal data in respect of which a person is the data subject, and to require the data controller to ensure that no decision taken by or on behalf of the data controller which significantly affects that individual is based solely on the processing by automatic means of personal data.350
1909¶4.28 Section 13 provides that an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of the Act is entitled to compensation from the data controller for that damage. Further, an individual who suffers distress by reason of any contravention by a data controller of any of the requirements of the Act is entitled to compensation from the data controller for that damage if the individual also suffers damage by reason of the contravention or the contravention relates to the processing of personal data for the special purposes.351 In practice relatively small sums have been award by way of damages, namely in the region of £50 to £5000.352 In April 2010 the Commissioner acquired the power under s55A to impose a monetary penalty if the Commissioner is satisfied that; (a) there has been a serious contravention of s4(4) by the data controller, (b) the contravention was of a kind likely to cause substantial damage or substantial distress, and (c) the contravention was deliberate or the data controller knew or ought to have known of the risk of contravention, likelihood of causing substantial damage or distress and failed to take reasonable steps to prevent the contravention.
¶Restrictions on data controllers
¶4.29 Part III of the Act imposes certain notification requirements on data controllers. Personal data must not be processed unless an entry in respect of the data controller is included in the register maintained by the Commissioner under s19.353 Failure to comply with this constitutes an offence, subject to a defence that the controller exercised all due diligence to comply with the duty.354 A data controller wishing to be included in the register must notify the Commissioner and the commissioner must maintain a register of persons who have given notification under section 18.355
¶Exemptions
¶4.30 Part IV sets out exemptions from compliance with certain obligations in the Act, where the obligations potentially conflict with other important public interest considerations.356 The exemptions disapply some of the data protection principles and some of the requirements of the Act imposed on data controllers. The relevant exemptions cover national security, crime and taxation, health education and social work, regulatory activity, journalism, literature and art, research history and statistics, manual data held by public authorities, information available to the public under an enactment, disclosures required by law or made in connection with legal proceedings, parliamentary privilege and domestic purposes. Schedule 7 to the Act sets out further miscellaneous exemptions.
1910¶Section 32 – exemption relating to processing of personal data for the purposes of journalism Introduction to s32
¶4.31 The 1984 Act contained no specific exemption for the press, however Article 9 of the Directive required Member States to provide for exemptions or derogations for processing of personal data carried out solely for journalistic, literary or artistic purposes, to the extent that this is necessary to reconcile the right to privacy with the rules governing freedom of expression. The DPA approaches the potential conflict between the obligations imposed on data controllers and the public interest in preserving the right to freedom of expression principally by means of section 32.
¶4.32 As Tugendhat J observed in Commissioner of Police of the Metropolis v Times Newspapers the statute refers to "journalism" and "journalistic material" and not to "journalists" and this is consistent with the Strasbourg jurisprudence that distinguishes between types of speech rather than types of speaker.357
¶4.33 The passage of the DPA through Parliament was not uncontroversial, some concerns were expressed about s32, then clause 31 of the Bill, that the exemption for the press was too wide and undermined the legislation and that the clause failed to protect privacy.358 Lord Lester of Herne Hill warned that the Bill failed to implement the directive in this respect.359
¶Scope of s32
¶4.34 Section 32(1) as enacted provides:
"(1) Personal data which are processed only for the special purposes are exempt from any provision to which this subsection relates if— (a) the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,
(b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and
(c) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes."
¶4.35 Section 32(3) provides that in considering whether the belief of a data controller that publication would be in the public interest was or is a reasonable one, regard may be had to his or her compliance with any code of practice which is relevant to the publication in question and has been designated by order of the Secretary of State.360
¶4.36 The proper scope of section 32(1) has been the subject of consideration in the evidence heard by the Inquiry and written submissions from a number of Core Participants to the Inquiry. These are recorded here for completeness.
1911¶4.37 The issue which has been canvassed before the Inquiry is whether s32(1)(a), properly interpreted, requires the processing of the relevant data to be undertaken with a view to publishing the data that is being processed ("the narrow view"), or whether s32(1)(a) requires only that the relevant data is processed with a view to publication of any journalistic material generally, irrespective of whether there is a view to publish the data ("the wide view"). The difference between these views can be illustrated by taking an example which Leading Counsel to the Inquiry canvassed with a number of witnesses. If a journalist obtained an ex-directory telephone number of the subject of a story they were writing for the purpose of contacting the individual and putting the story to them, does the act of obtaining and processing the telephone number fall within the s32 exemption on the basis that the processing is with a view to publication of an article generally, or does it fall outside the s32 exemption on the basis that the processing of the data is not with a view to publication of the data that is being processed; i.e the telephone number?
¶4.38 Mr Richard Thomas, former Information Commissioner, expressed the view that if the data controller is processing data with a view to contacting someone (for example someone who is about to be subject of a story) that would fall outside s32.361 By contrast, Mr Graham responded that, whilst he agreed the processing was not with a view to publication of the data, the activity is for the preparation of an article for publication and some information may make it into the paper and some may not. Mr Graham stated that if the point is put that s32 covers writing the piece but it doesn't cover the obtaining of the evidence, this would be a challenging distinction about which he would need to think further.362
¶4.39 Guardian News Media have submitted that the broad view should be preferred and that the narrow view is inconsistent with the statutory language and case law. In their submission, in order for s32 to be interpreted in a narrow sense, i.e. where the processing of data must be undertaken with a view to publishing the data itself, this would arguably require the addition of words into s32(1)(a) of the Act, as follows:
"if (a) the processing is undertaken with a view to the publication by any person of [that data in] any journalistic material" (the words added are in square brackets and underlined).
¶4.40 They further rely on the decision of the Court of Appeal in Campbell v MGN as being inconsistent with the narrow view of s32.363
¶4.41 The rationale for the exemption in s32 was expressed by the Court of Appeal in Campbell v MGN Ltd in the following terms:364
1912"The overall scheme of the Directive and the Act appears aimed at the processing and retention of data over a sensible period. Thus the data controller is obliged to inform the data subject that personal data about the subject have been processed and the data subject is given rights, which include applying under s.14 for the rectification,
blocking, erasure or destruction of the data on specified grounds. These provisions are not appropriate for the data processing which will normally be an incident of journalism. This is because the definition of processing is so wide that it embraces the relatively ephemeral operations that will normally be carried out by way of the day-to-day tasks, involving the use of electronic equipment, such as the lap-top and the modern printing press, in translating information into the printed newspaper. The speed with which these operations have to be carried out if a newspaper is to publish news renders it impractical to comply with many of the data processing principles and the conditions in Schedules 2 and 3, including the requirement that the data subject has given his consent to the processing. Furthermore, the requirements of the Act, in the absence of s.32, would impose restrictions on the media which would radically restrict the freedom of the press."
¶4.42 The Court of Appeal in Campbell held that "processing" under the DPA includes publication in print, thus reversing the decision of the High Court and extending the duration of the s32 exemption to including processing for and after publication.365
¶4.43 Guardian News further submitted that the processing of personal data by journalists prior to publication, including the obtaining and use of a telephone number for the purpose of contacting a subject or source for potential comment or corroboration, must fall within the ambit of s32 otherwise the exemption would cease usefully to serve the objective it was designed to protect.366
¶Effect of s32 exemption
¶4.44 Where the conditions in s32(1) are met, there is an exemption from all data protection principles (save for the duty to keep data secure) and the obligation to comply with a number of rights of data subjects, including the right of subject access (s7), the right to prevent processing of personal data (s10), the right to prevent a decision being made on an automated basis (s12) and the rights relating to rectification, blocking, erasure and destruction of data (s14).
¶4.45 Further, s32(4) makes special provision for the conduct of proceedings that have been commenced by a person seeking subject access, the prevention of processing, rectification, blocking or erasing of data, or compensation for breach of the Act where the data is subject to processing for the purposes of journalism. If the data controller claims or it appears to the court that the data in question are being processed only for special purposes and with a view to publication of journalistic material which had not been published by the data controller previously the court must stay the proceedings until either the data controller withdraws their claim or a s45 determination is issued. The evidence of the Information Commissioner is that in many cases the Information Commissioner will not be in a position to make a s45 determination, leaving the proceedings stayed indefinitely.367
1913¶Powers of investigation and enforcement
¶4.46 The duty to enforce the provisions of the DPA lies with the Information Commissioner (the Commissioner) whose powers and duties are set out in Part V of the Act and can be summarised as follows:
(a) If the Commissioner is satisfied that a data controller has contravened or is contravening any of the data protection principles, the Commissioner may serve an enforcement notice requiring him to take such steps or refrain from taking such steps as may be specified and/or to refrain from processing personal data.368 In considering whether to issue an enforcement notice the Commissioner shall consider whether the contravention has caused or is likely to cause any person damage or distress. (b) The Commissioner may serve on a data controller an assessment notice for the purpose of enabling the Commissioner to determine whether the data controller has complied or is complying with the data protection principles.369 An assessment notice facilitates the exercise by the Commissioner of investigatory powers, including entry to premises, obtaining inspection or examination or documents, information or equipment, and requiring persons to be available for interview. Powers of entry and inspection are set out in detail in Schedule 9. (c) If any person who is, or believes themselves to be, directly affected by processing of personal data requests an assessment as to whether it is likely or unlikely that the processing has been or is being carried out in compliance with the provisions of this Act, the Commissioner shall make an assessment in such manner as appears to him to be appropriate.370 (d) The Commissioner may serve on a data controller an information notice requiring a data controller to furnish the Commissioner with specified information relating to the request or compliance with the principles.371
¶4.47 It is an offence to fail to comply with an enforcement notice, an information notice or a special information notice.372 A person on whom an enforcement notice, an assessment notice, an information notice or a special information notice has been served may appeal against the notice to the Information Tribunal.373
¶4.48 Whilst the Commissioner has a broad suite of enforcement powers at his disposal, the balance of evidence before the Inquiry suggests that there has to date been limited use of formal enforcement powers.
¶4.49 Mr Thomas described the power to serve enforcement notices contained in s40 as the main formal power which the Commissioner had in its armoury for occasions when it felt that there had been non-compliance with the requirements of the legislation. He observed that the power was not used frequently, but there was a power to serve an enforcement notice on a data controller and that could be challenged, but if it was not challenged, then in due course it became a criminal matter not to obey the terms of an enforcement order.374 In terms
¶368 s40 369 s41A 370 s42 371 s43 372 of numbers of enforcement notices served, Mr Thomas estimated this was probably only two or three in a year, and they were normally preceded by a draft of a notice which was served before the Commissioner entered the actual notice as a matter of good regulation.375 Mr Thomas agreed that in principle this power would apply to media organisations but this is subject to exemptions in s32.376
1914¶Enforcement powers in relation to the press
¶4.50 The enforcement powers set out in the Act are modified where the data processing is for the purposes of journalism.
¶4.51 The first step is for the Information Commissioner to establish whether processing is for the purposes of journalism linked to the publication of journalistic material. Section 44 of the Act empowers the Information Commissioner to serve a "special information notice" to instigate an investigation of the data controller where; i) he receives a request for an assessment by an affected person, or ii) court proceedings have been stayed on the basis that a data controller claims or it appears to the court that the processing under consideration is for the purposes of journalism and the Information Commission has reasonable grounds for suspecting that the personal data are not being processed only for the purposes of journalism or with a view to publication of journalistic material. As a consequence of these provisions the Information Commissioner is not able to issue a special information notice to initiate an investigation if it appears to him that information was gathered for journalism purposes with a view to publication (even if the gathering of the data was unlawful), unless a complaint is made by an affected person.
¶4.52 The extent of an investigation under s44 is limited to resolving the question of whether personal data are being processed for the purposes of journalism and to ascertain if they are processed with a view to future publication of material. There is no power to investigate under a special information notice whether the data controller has committed any other offence under the Act.
¶4.53 The second step is a determination. If it appears to the Commissioner (whether as a result of the service of a special information notice or otherwise) that any personal data are not being processed only for the special purposes, or are not being processed with a view to the publication by any person of any journalistic material which has not previously been published by the data controller, he or she may make a determination in writing to that effect.377
¶4.54 Until a determination is made under s45, the Information Commissioner may not issue an information notice requiring the data controller to provide him with other information, issue an enforcement notice or exercise their powers of entry and inspection provided under Schedule 9 of the Act where the data processing is for the purposes of journalism.378 Thus the Commissioner's investigatory powers are restricted in these circumstances.
¶4.55 Section 46 imposes a procedural restriction on use of enforcement powers in respect of processing of data for journalistic purposes even if it appears to the Information Commissioner that enforcement action is justified. It prohibits the Commissioner from serving an enforcement notice on a data controller in respect of processing personal data for journalistic purposes unless a determination under s45(1) has been made and the court has granted leave for the notice to be served. It is noteworthy that as at September 2011, no enforcement notices have been issued by the Information Commissioner in any cases where s32 is relevant.379
1915¶4.56 The court may not grant leave to serve the notice unless it is satisfied that the Commissioner has reason to suspect a contravention of the data protection principles which is of substantial public importance and, except where the case is one of urgency, that the data controller has been given notice of the application for leave in accordance with rules of court.
¶4.57 The Inquiry heard evidence that the investigative and enforcement powers at the Commissioner's disposal exist to ascertain whether personal data are being processed for purposes other than journalism and to act in relation to those other purposes, rather than to enable it to regulate the actual processing of personal data for journalistic purposes.380
¶4.58 Since April 2010 the Information Commissioner has had the power to impose a civil monetary penalty of up to £500,000 for serious breaches of data protection. Mr Graham observed that this power is beginning to have a very salutary effect, both on public authorities and on commercial companies who realise that the Information Commissioner has teeth.381 However, he noted in relation to the media that, given the limitations on the investigatory powers available to the Information Commissioner, in practice it would be difficult for the Commissioner to establish whether the processing was in breach of the data principles or whether the exemption at s32 of Act applied such that the processing was exempt from compliance with data protection principles.382
¶Section 55 offence Scope of s55(1)
¶4.59 Section 55(1) makes it a criminal offence to knowingly or recklessly, without the consent of the data controller (a) obtain or disclose personal data or the information contained in personal data, or (b) procure the disclosure to another person of the information contained in personal data, subject to specified defences in section 55(2). An offence can therefore be committed by three different types of activity: obtaining information, disclosing information, and procuring the disclosure of information.
¶4.60 This section of the Act is significant because, whilst the DPA primarily regulates data controllers, any person can commit an offence under s55. There may be effectively two victims when an s55 offence is committed: the data controller (i.e the organisation holding personal information) from whom the data is wrongfully obtained and the person to whom the data relates.383
1916¶4.61 Mr Thomas described s55 of the DPA 1998 as "an entirely self-contained part of the Act".384 He also regarded a s55 offence as one of the utmost severity, noting that "a section 55 offence is often as least as serious as phone hacking and may be even more serious".385
¶4.62 In discussing the scope of the s55 offence, Mr Thomas expressed the view that "obtain" meant more than just receive. He said that it meant to seek out and obtain, but stated that the issue as to whether "obtain" could include the use of an agent or third party had not been considered by the ICO.386 Mr Thomas was asked whether a journalist who asked a private investigator to obtain personal data, and subsequently received it through the agency of the private investigator would commit an offence under s55. Mr Thomas would not commit to a view as to whether this would fall within s55387 although he noted that there is a greater challenge in bringing a successful prosecution under s55(1)(b), which relates to procuring the disclosure of information, than under s55(1)(a).
¶4.63 Commenting on the scope of s55 and whether position of a journalist could fall within ss55(1) (a) and (b), Mr Aldhouse, former Deputy Information Commissioner, stated that he was inclined to the view that the fact that you use an intermediary to obtain the information doesn't mean that you have not yourself obtained it and therefore the action of a journalist could either be "obtaining" within subsection (a) or "procuring" within subsection (b), and probably falls within both subsections.388 http://www.pearson.com/media/files/annual-reports/Pearson_AR10.pdf
¶Public interest defence in s55(2)
¶4.64 There is an express public interest defence set out in s55(2), namely that an offence will not be committed where in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest.389 The defence set out in s55(2)(d) was described by Mr Thomas as an objective test.390 He noted that "public interest" is not defined in the DPA and whilst the Information Commissioner has drafted some guidance on the meaning of public interest during his tenure this was never published.391 The concept of public interest is one that is familiar to the courts and is regularly considered in the context of claims for misuse of private information and defamation.
¶4.65 The meaning of public interest was explored with Mr Thomas in his evidence. He agreed that it would be very difficult to justify conduct in public interest terms if someone was merely fishing for information without having identified in his or her mind what the public interest might be before starting the exercise.392 He thought it would be difficult for someone to say that finding out the name, telephone number or the address of someone so they could talk to them (in the context of checking a story) would be a matter of public interest. He expressed the view that it would be difficult to justify the vast majority of celebrity tittle-tattle in public interest terms.393 Mr Graham noted that the broad scope given to the public interest in journalism in Campbell v Mirror Group Newspapers suggested that a successful prosecution of a journalist would be unlikely.394 He said it was arguable that a journalist would have a public interest defence in circumstances where he was trying to obtain an ex directory telephone number from search group to contact the subject of a story. Mr Graham emphasised in his evidence that making a judgment on where the balance of the public interest lies on the facts of each case is something that the Information Commissioner is called upon to do under both the DPA and FOIA.395
1917¶4.66 Subsections 55 (4)-(8) make it an offence to sell or offer to sell personal data which has been or is subsequently obtained or procured knowingly or recklessly without the consent of the data controller.
¶Penalty for breach of s55(1)
¶4.67 Offences are punished by a fine of up to £5,000 in the Magistrates' Court and an unlimited fine in the Crown Court. However, since the Act came into force the penalties imposed by courts for the commission of data protection offences have been relatively light. Between November 2002 and January 2006, only two out of 22 cases resulted in fines amounting to more than £5,000.396
¶4.68 The Information Commissioner's report to Parliament "What Price Privacy? The unlawful trade in confidential personal information", published on 13 May 2006, and the follow up report "What Price Privacy Now?", published on 13 December 2006, recommended that the Lord Chancellor bring forward proposals to increase the penalty for persons convicted under s55 to a maximum of two years' imprisonment, a fine, or both on indictment; and on summary conviction to a maximum of six months' imprisonment, a fine, or both. The purpose of this recommendation was to discourage the undercover market in personal information, and to send a clear signal that unlawfully obtaining personal information would constitute a crime.397
¶4.69 The report "What Price Privacy Now?" set out in tabular form the publications which had been identified from documentation seized during Operation Motorman as being involved in the unlawful obtaining or procuring of personal data.398 The report noted at paragraph 5.8 that documents seized as part of Operation Motorman showed thousands of s55 offences and gave details of a number of identifiable reporters who had been supplied with information obtained unlawfully; implicating some 305 journalists.
¶4.70 A summary of the penalties imposed following convictions for data protection offences is set out in Annex A of the report "What Price Privacy?" The table demonstrates that of the prosecutions pursued between 2002 and 2006 by the Information Commission,23 p12-13, ibid of 26 resulted in convictions. It was noted that prosecutions brought under the Act have generally resulted in low penalties: either minimal fines or conditional discharges. Between November
1918¶2002 and January 2006, only 2 out of 22 cases produced total fines that amounted to more than £5000.399
¶Investigation and enforcement of s55 offences
¶4.71 Under schedule 9 of the Act, the ICO has powers of entry and inspection if it has reasonable grounds for believing that an offence has been committed. Mr Thomas noted that the ICO needed a warrant from a district judge to exercise these powers.400
¶4.72 In terms of the practicality of investigation and enforcement of s55, Mr Thomas explained that s55 enforcement was the responsibility of a small investigations team composed of former police and customs officers and that the ICO felt that its teams were not large enough and were under-resourced.401 Mr Thomas noted that if there is evidence of corruption and dishonest behaviour, which carries a stronger sentence, then it is inevitable that the case will be handed to the police and to the Crown Prosecution Service.402 For example, he recalled that there was evidence that private detectives were paying money to people inside the DVLA, British Telecom and the police service to get information. As this was a far more serious matter than a breach of s55, the Crown Prosecution Service took over responsibility for prosecution.403
¶4.73 In his evidence, Mr Graham noted that there are practical challenges in the investigation of the involvement of individual journalists for s55 offences, including demonstrating the degree of knowledge on the part of the individual journalist, addressing the public interest defence available to the media, and in the absence of a power of arrest securing any co-operation from a journalist who would undoubtedly say that he or she does not reveal sources.404 However, he commented that none of these considerations of principle and practicality should prevent the proper enforcement of the criminal law against the media.405
¶4.74 In relation to the scope of s55, Mr Graham explained that in some circumstances personal data could be obtained in a way that suggests the commission of offences under s55 of the Data Protection Act and other legislation. The investigation of offences which carry custodial sentences are, in practice, given precedence over the investigation of offences which do not, and the police will lead investigations where offences that carry a custodial penalty are suspected.
¶Amendments to s55
¶4.75 The Department of Constitutional Affairs (DCA) commenced a consultation exercise on 24 July 2006 in relation to the possibility of increasing penalties for deliberate and wilful misuse of personal data. The DCA published their response on 7 February 2007, which contained the following summary:
1919(a) Respondents generally welcomed the introduction of custodial penalties to provide a deterrent to potential offenders, to provide public reassurance that offenders would receive the appropriate sentence and to achieve parity with a number of disparate pieces of legislation which deal with similar types of offences. (b) The majority of respondents agreed that custodial penalties would be an effective deterrent because it would demonstrate the legal importance of data protection compliance and the seriousness of the offence. A few respondents did not agree with the proposal and argued that unlimited fines were more appropriate. (c) Many respondents agreed with the proposed length of custodial sentence and that the courts should have access to the same sanctions as it would for similar offences. A minority of respondents argued that a maximum sentence of twelve months on summary conviction and five years on indictment would be more effective.
¶4.76 The Criminal Justice and Immigration Bill contained a clause to introduce custodial sentences for s55 offences. A number of press organisations opposed this proposal and the clause was amended such that custodial sentences could be introduced only after a Ministerial Order, the Order being preceded by consultation with media organisations and other interested parties.406 This is now found in s77 of the Criminal Justice and Immigration Act 2008 (CJIA).
¶4.77 The other amendment to the DPA contemplated by the CJIA is the inclusion of a further defence to the s55 offence, which is of specific relevance to journalists. This was enacted in s78 of the CJIA, although this section is not yet in force. If brought into force, it would be a defence where a person acted for special purposes, including journalism, with a view to the publication by any person of journalistic material and in the reasonable belief that the obtaining, disclosing or procuring of that information was in the public interest. The amended defence is broader in terms than the defence currently set out in s55 DPA: the extended defence contemplated by s78 CJIA does not require a journalist to show that their conduct in obtaining, procuring or disclosing the data is objectively justified in the public interest, but introduces a subjective element, namely that the journalist has a reasonable belief that the conduct is in the public interest and that they acted with a view to publication of journalistic material. Mr Graham described the proposed amended defence as a "very, very good increased defence for journalists".407
¶4.78 In terms of the possible amendments to the legislation which are currently found in s77 and s78 of the CJIA, Mr Graham explained that the current position is that the Government is awaiting the outcome of the Inquiry before taking a decision on activating ss77 and 78.408
¶4.79 There is support for the amended defence from a number of media organisations. For example, News International submitted that the statutory language of s55 at present produces the bizarre result that a journalist investigating allegations of improper conduct in the honest and reasonable, though mistaken, belief that publication would be in the public interest would be able to establish an exemption from civil liability but unable to establish a defence to a criminal charge arising out of the same facts. It is further argued that the importance of that amendment is that Parliament has expressly reconfirmed in the field of regulation of misuse of personal data by media organisations that the focus must be on whether the media defendant acted in the reasonable belief that its processing of data was in the public interest, and not on whether it actually was in the public interest. Guardian News argued that s55 is more far reaching than unlawful theft and trading of confidential information, catching not just those responsible for obtaining personal data but also those responsible for its procurement and – perhaps most critically for present purposes – for its subsequent disclosure.409 Whilst s78 of the CJIA provides specific protection for journalistic activity based on a subjective threshold, the reasonableness of the journalist's belief at the time of publication remains to be assessed against an objective standard.
1920¶Role of the Information Commissioner
¶4.80 The role of an independent data protection regulator was first established by the Data Protection Act 1984 under the name of Data Protection Registrar.410 The regulator was renamed as the Data Protection Commissioner under the DPA 1998 and the name was changed to Information Commissioner when the FOIA 2000 came into force.411 The functions of the Information Commissioner are set now out in the Data Protection Act 1998 and the Freedom of Information Act 2000.412 The various powers and duties contained in the Acts are vested in the Commissioner; although in practice they are largely discharged through some 300 staff who constitute the Information Commissioner's Office (ICO).413
¶Duties of the Information Commissioner in relation to the Data Protection Act 1998
¶4.81 The Act sets out a number of general functions and duties of the Commissioner. Generally these relate to promoting good practice rather than punishing poor practice and can be described as functions relating to education and co-operation.414
¶4.82 It is the duty of the Commissioner to promote the following of good practice by data controllers and, in particular, to promote the observance of the requirements of the Act by data controllers.415
¶4.83 The Commissioner has a duty to disseminate information and guidance to the public relating to the Act. The information must set out details of the operation of the Act, good practice and other matters within the scope of his or her functions under the Act.416
¶4.84 The Commissioner must arrange for the dissemination, in such form and manner as is considered appropriate, of such information as may appear expedient to give to the public about the operation of the Act, about good practice, and about other matters within the scope of his or her functions under the Act, and may give advice to any person as to any of those matters.417
1921¶4.85 The Commissioner has a duty where either (1) the Secretary of State so directs by order, or (2) the Commissioner considers it appropriate to do so, to prepare and disseminate to such persons as he considers appropriate codes of practice to provide guidance as to good practice. Prior to issuing codes of practice the Commissioner must consult trade associations, data subjects or persons representing data subjects as appears to him to be appropriate.
¶4.86 The Information Commissioner must prepare a code of practice which contains (1) practical guidance in relation to the sharing of personal data in accordance with the requirements of the DPA, and (2) such other guidance as the Commissioner considers appropriate to promote good practice in the sharing of personal data. Before a code is prepared, the Commissioner must consult such of the following as the Commissioner considers appropriate: (a) trade associations, (b) data subjects, and (c) persons who appear to the Commissioner to represent the interests of data subjects.418 When such a code is prepared, it must be submitted to the Secretary of State for approval and there are rules as to procedure.419
¶4.87 The Commissioner also has responsibility for disseminating information relating to: (a) any finding of the European Commission that a country or territory outside the European Economic Area does, or does not, ensure an adequate level of protection, (b) any decision of the European Commission which is made for the relevant purposes, and (c) such other information as it may appear to him or her to be expedient to give to data controllers in relation to any personal data about the protection of the rights and freedoms of data subjects in relation to the processing of personal data in countries and territories outside the European Economic Area.420
¶4.88 In terms of duties to report, the Commissioner must lay annually before each House of Parliament a general report on the exercise of his or her functions under the DPA. The Commissioner may from time to time lay before each House of Parliament such other reports with respect to those functions as he or she thinks fit, under s52. In 2006, the Information Commissioner published two reports, "What Price Privacy? The unlawful trade in confidential personal information" and the "What Price Privacy Now?", pursuant to this section.
¶4.89 A corollary of the fact that the DPA largely leaves it to individuals to take action to assert their rights in relation to processing of personal data for special purposes, including journalism, is that such individuals may apply to the Commissioner for assistance in their cases. An individual who is an actual or prospective party to any proceedings which relate to personal data processed for the special purposes, including the purposes of journalism, may apply to the Commissioner for assistance in relation to those proceedings.421 The power to provide assistance is limited to cases which involve a matter of substantial public importance. Assistance in most cases refers to the costs of advice or assistance from legal representatives or an agreement to indemnify the applicant against costs. The Commissioner must consider and decide whether and to what extent to grant the application, but cannot do so unless the case involves a matter of substantial public importance.422 The existing Information Commissioner notes that since 2009 no applications for such assistance have been made.423
¶418 s52A 419 s52B 420 s51(6)421 ibid
1922¶Duties of the Information Commissioner in relation to the Freedom of Information Act 2000
¶4.90 The Commissioner has a number of powers and duties under FOIA. Whilst FOIA has not been the subject of extensive evidence before the Inquiry, it is useful to summarise the provisions of FOIA to the extent that they relate to the Commissioner in order to understand the entire framework of the regulatory position.
¶4.91 The purpose of the Act is stated at the outset to be, "to make provision for the disclosure of information held by public authorities or by persons providing services for them".424
¶4.92 The FOIA creates a general right of access, on request, to information held by public authorities. On receipt of a freedom of information claim a public authority has two corresponding duties. Firstly, a duty to inform a member of the public whether or not it holds the information requested and secondly, if it does hold that information, to communicate that fact to the person making that request.425 A critical distinction between the DPA and the FOI is that whilst under the DPA a request for data is limited to data held about yourself as a data subject, there is no such constraint in relation to information held by the public authority that is sought under the FOIA.
¶4.93 The basic duty is supplemented by an additional duty to aid individuals in making requests and ensuring that they frame their FOI requests appropriately.426 A public authority is to be taken to have complied with this duty in any particular case if it has conformed with the provisions of this Code in relation to the provision of advice and assistance in that case. The duty to assist and advise is enforceable by the Information Commissioner. If a public authority fails in its statutory duty, the Commissioner may issue a decision notice under s50, or an enforcement notice under s52.
¶4.94 At the heart of the FOIA is the definition of public authority – namely those bodies against whom the right to information can be asserted. Section 3 of the Act defines a public authority as any body, person or office-holder listed in Schedule 1, designated by order under s5 and publicly owned companies as defined in s6. Schedule 1 sets out a broad range of public bodies subject to the Act, including central Government departments, local government, strategic health authorities and primary care trusts, governing bodies of maintained schools, police authorities and a wide range of committees and commissions exercising public functions.
¶4.95 The Act contains a number of provisions which provide for exemptions from disclosure in relation to certain types of information. There are two forms of exemption: an absolute exemption which is an absolute bar to disclosure, and qualified exemption which is subject to a public interest test, balancing the public interest in maintaining the exemption against the public interest in disclosure.
¶4.96 The absolute exemptions include information that: i) is accessible by other means, ii) relates to or deals with security matters iii) is contained in court records, iv) the disclosure of which would infringe parliamentary privilege, v) information held by the House of Commons or the House of Lords, where disclosure would prejudice the effective conduct of public affairs, vi) information which (a) the applicant could obtain under the Data Protection Act 1998; or (b) where release would breach the data protection principles, vii) information provided in confidence, viii) where disclosure of the information is prohibited by an enactment; incompatible with an EU obligation; or would commit a contempt of court.427
1923¶4.97 The Act also contains qualified exemptions which introduces a two stage test. First, the public authority must decide whether or not the information is covered by an exemption and second, the authority must disclose the information unless the application of a public interest test is such that the public interest outweighs disclosure.
¶4.98 A number of qualified exemptions relate to particular classes of documents, namely information which that: i) is intended for future publication ii) required for the purpose of safeguarding national security, iii) is held for purposes of investigations and proceedings conducted by public authorities, v) relates to the formation of government policy, ministerial communications, advice from government legal officers, and the operation of any ministerial private office, vi) relates to communications with members of the Royal family, and conferring honours, vii) prevents overlap between FOIA and regulations requiring disclosure of environmental information, viii) is covered by professional legal privilege, and ix) is a trade secret.428
¶4.99 A number of qualified exemptions relate to particular harm that may be occasioned by compliance with the duty to disclosure. These include where disclosure would prejudice: i) defence or the capability, effectiveness or security of any relevant forces, ii) international relations, iii) relations between any administration in the United Kingdom and any other such administration, iv) the economic interests of the UK, v) law enforcement (e.g., prevention of crime or administration of justice), vi) the auditing functions of any public authorities, or vii) would in the reasonable opinion of a qualified person prejudice the effective conduct of public affairs, prejudice collective responsibility, or inhibit the free and frank provision of advice or exchange of views, viii) would endanger physical or mental health, or endanger the safety of the individual, (ix) would endanger commercial interests.429
¶4.101 It is important to note that for four public authorities listed under Schedule 1, the Act has limited effect. For example, Part VI of Sch 1 provides that the BBC, the Channel Four Television Corporation, the Gaelic media service and the Sianel Pedwar Cymru (the Welsh television channel known as S4C) are subject to the Act only in respect of information which is "held for the purposes other than those of journalism, art or literature". The purpose of this exemption is to protect journalistic activities from possible compromise. This section of the Act was recently analysed by the Supreme Court, which held that information held predominantly for the purposes of journalism does not fall within the scope of the Act, even if the information is held for other purposes as well.430
¶4.102 The Office of the Information Commissioner oversees the operation of the Act. Part IV of FOIA gives the Information Commissioner a number of enforcement powers.
1924¶4.103 The powers of the Information Commissioner include: i) a power requiring a public authority to furnish the Commissioner with information he or she reasonably requires to determine whether a public authority has complied with its obligations under Part 1 and whether its practices comply with the Code of Practice, (ii) a power to issue an enforcement notice, if the Commissioner is satisfied that a public authority has failed to comply with Part 1, requiring the public authority to take the steps in the notice, (iii) certify that a public authority has failed to comply with a decision notice, information notice or enforcement notice, which allows the High Court to inquire into the matter and the deal with the public authority as if it had committed contempt of court, (iv) powers of entry and inspection pursuant to Schedule 33.431
¶4.104 Pursuant to s57 the public authority may appeal against a decision notice, information notice or enforcement notice to the Information Tribunal.
¶4.105 There are a number of general functions conferred on the Information Commissioner pursuant to s47 of the FOIA:
1925(a) The Commissioner has a duty to promote the following of good practice by public authorities and in particular to perform his or her function under the Act to promote the observance by public authorities of the requirements of the Act and the provisions of the codes of practice under ss45 and 46. The Act confers a number of powers on him or her to enable this, specifically in relation to the Code. (b) The Commissioner shall arrange for the dissemination of information as it may appear expedient to give to the public about the operation of the Act, about good practice and other matters within the scope of his or her functions under the Act. (c) The Commissioner may, with the consent of any public authority, assess whether that authority is following good practice. (d) If it appears to the Commissioner that the practice of a public authority in relation to the exercise of its functions under the Act does not conform with that proposed in this Code of Practice, a recommendation may be given to the authority under s48 specifying the steps which should, the Commissioner's opinion, be taken for promoting such conformity. (e) The Commissioner may also refer to non-compliance with the Code in decision notices issued as a result of a complaint under s50 of the Act and enforcement notices issued under s52 of the Act where, irrespective of any complaints that may have been received, the Commissioner considers that a public authority has failed to comply with any requirement of Part 1 of the Act. (f) If the Information Commissioner reasonably requires any information for the purpose of determining whether the practice of a public authority conforms to the Code, under s51 of the Act the Commissioner may serve an "information notice" on the authority, requiring it to provide specified information relating to its conformity with the Code. (g) The Commissioner shall from time to time as considered appropriate consult the Keeper of Public Records about the promotion by the Commissioner of the observance by public authorities of the provisions of the code of practice under s46 in relation to records which are public records for the purposes of the Public Records Act 1958.
¶4.106 Section 49 provides that the Commissioner shall lay annually before each House of Parliament a general report on the exercise of his or her functions under this Act and other such reports from time to time with respect these functions as thought fit.
¶Possible reform of the law in this area
¶4.107 In November 2010 the European Commission announced a review of the Data Protection Directive.432 On 25 January 2012, the European Commission published a draft European Data Protection Regulation that will supersede the Data Protection Directive.433 The Commission has proposed a new regime comprising:
(a) a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), and (b) a proposal for a Directive of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data.
¶4.108 The draft Regulation seeks to modernise the legal framework for data protection needs in the EU in response to increasingly sophisticated information systems, global information networks, mass information sharing and the collection of personal data online.
¶4.109 A number of amendments to the current Directive are contemplated by the draft Regulation. These include:
(a) strengthening provisions relating to consent to the processing of data, by requiring explicit rather than implied consent, (b) strengthening the right to object to processing of data, with no requirement to show that use of the data would cause substantial damage or distress, (c) placing important legal obligations directly on processors: introducing a compulsory data breach notification duty that applies across all sectors, a requirement to demonstrate compliance with the regulation through the adoption of policies and procedures, the requirement to undertake data protection impact assessments prior to processing that is likely to impact on the privacy of a data subject, and the power of supervisory authorities to impose sanctions on data controllers for administrative offences such as not complying with a data subject request, a failure to maintain the requisite records or a failure to comply with the right to be forgotten.
¶Article 80 is of particular relevance and concerns the processing of personal data and freedom of expression. It provides as follows:
1926"Member States shall provide for exemptions or derogations from the provisions on the general principles in Chapter II, the rights of the data subject in Chapter III, on controller and processor in Chapter IV, on the transfer of personal data to third countries and international organisations in Chapter V, the independent supervisory
authorities in Chapter VI and on co-operation and consistency in Chapter VII for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression".
¶4.110 Article 80 imposes a duty on Member States to make provision for exemptions from the obligations imposed by the new Directive and Regulation where processing is carried out solely for the journalistic purposes, but the exemptions need extend only to reconcile the protection of personal data with the right to freedom of expression.
¶4.111 The explanatory memorandum to the draft regulation sets out that Member States should classify activities as "journalistic" for the purpose of the exemptions and derogations to be laid down under this Regulation if the object of these activities is the disclosure to the public of information, opinions or ideas: irrespective of the medium which is used to transmit them. They should not be limited to media undertakings and may be undertaken for profit-making or for non-profit-making purposes.
¶4.112 Responses to the draft Regulation have been provided by the ICO and the Government. The Justice Select Committee was tasked by the European Scrutiny Committee to give its opinion on the EU Commission's proposals to reform EU data protection laws. The Justice Select Committee has heard evidence on this issue over a number of sessions and taken written evidence on the proposals.
- Criminal law Introduction
¶5.1 The criminal law imposes restrictions on the methods and practices used to obtain information from or about third parties. The conduct of journalists in this respect is restrained by the provisions of the law which criminalise forms of hacking, blagging, obtaining information by payments to public officials, obtaining, disclosing or procuring the disclosure of personal data and obtaining information in breach of the Official Secrets Act. The criminal law also restricts the content of publications in certain respects: for example, there are statutory provisions which prevent the reporting of certain criminal proceedings, which criminalise the publication of information that has been disclosed in contravention of the provisions of the Official Secrets Acts, and which criminalise publications which incite hatred on grounds of race, religion or sexual orientation.
¶5.2 Whilst some offences are strict liability offences, other criminal offences are subject to an express defence that the conduct was in the "public interest". In these circumstances a journalist acting in the course of their profession may seek to persuade the court that their conduct, or the publication in question, was in the public interest.
¶5.3 A journalist is not above the law and a journalist who breaks the law will be in the same position as any other member of the public – there is no exemption from compliance with the criminal law simply by virtue of their profession. However, particular provisions of the law and defences have special application to journalists. It is generally rare for the CPS to prosecute journalists who commit offences in the course of their work and a prosecutor will be required to balance the competing considerations in determining whether prosecution is in the public interest.434 The Director of Public Prosecutions has released interim guidelines on the approach that prosecutors should take when assessing the public interest in cases affecting the media. These guidelines have immediate effect. The interim consultation period closed on 10 July 2012, after which final guidelines will be issued.
1927¶5.4 As is apparent from the analysis in Part D Chapter 1 of the Report (to which reference is essential for an understanding of the role of regulation), that the operation and enforcement of the criminal law generates real challenges for the police and other law enforcement agencies. Having said that, the key provisions of criminal law of relevance to journalists, in particular the restrictions on methods and practices for obtaining information and the content of publications are as follows.
¶Restrictions on the methods of obtaining information Interception of communications – Regulation of Investigatory Powers Act 2000
¶5.5 The Regulation of Investigatory Powers Act 2000 (RIPA) creates two offences relating to the interception of communications:
(a) It is an offence for a person intentionally and without lawful authority to intercept at any place in the United Kingdom any communication in the course of its transmission by means of a public postal service or a public telecommunication system, see s1(1). (b) It is an offence for a person intentionally and without lawful authority to intercept at any place in the United Kingdom any communication in the course of its transmission by means of a private telecommunication system, see s1(2). It is a defence for a person who would otherwise be liable under s1(2) if they have a right to control the operation or the use of the system; or have the express or implied consent of such a person to make the interception, see s1(6).435
¶5.6 Section 1(1A), which came into force on 16 June 2011, provides that the Interception of Communications Commissioner may serve a monetary penalty notice on a person if the Commissioner considers the person has intercepted without lawful authority any communication in the course of its transmission by means of public telecommunication system and was not, at the time of the interception, making an attempt to act in accordance with an interception warrant which might explain the interception, and the Communications Commissioner does not consider that the person has committed an offence under s1(1).
¶5.7 Section 2(1) defines various terms including public postal service, public telecommunications service and private telecommunications system. Interception is defined in s2(2) as follows: a person intercepts a communication in the course of its transmission by means of a telecommunication system if, and only if, he (a) so modifies or interferes with the system or its operation, (b) so monitors transmissions made by means of the system, or (c) so monitors transmissions made by wireless telegraphy to or from apparatus comprised in the system, as to make some or all of the contents of the communication available, while being transmitted, to a person other than the sender or intended recipient of the communication. A tape recording of a telephone call by one party to the call without the knowledge of the other party does not amount to interception of a communication within s2.436 Further, a recording of one side of a telephone conversation picked up by a surveillance device in a car that does not record the speech of the other party does not amount to interception of a communication.437
1928¶5.8 The Inquiry has heard evidence that there has been some uncertainty as to the circumstances in which an offence will be committed under s1, and the interpretation of interception, as defined in s2(2).438 In particular, the statutory provisions are unclear as to whether an offence will be committed only if a voicemail message was intercepted before it was accessed by the intended recipient (the narrow view), or whether an offence is also committed if a communication is intercepted after it was accessed by the intended recipient and for so long as the system in question is used to store the communication in a manner which will enable the recipient to have access to it (the wide view). Whilst there is arguably some support for the narrow view in the judgment of Lord Woolf CJ in R (NTL Group) v Crown Court at Ipswich the written opinion of Leading Counsel articulates persuasive arguments in favour of the wide view.439 Without seeking to determine the point, I endorse the view expressed by Leading Counsel that there are convincing arguments in support of a wider construction of the meaning of interception.
¶5.9 The offence is not committed in circumstances where the person intercepting the communication has lawful authority to do so. Lawful authority is defined in s1(5) as:
(a) authorisation by virtue of the consent to the interception of both the person who sent the communication and the intended recipient of the communication (s3); (b) authorisation under s4 (in relation to a person outside the UK and the interception is in accordance with circumstances set out in regulations made by the Secretary of State)440 (c) interception takes place in accordance with an interception warrant (s5); (d) interception in relation to any stored communication in the exercise of any statutory power that is exercised for the purpose of obtaining information or of taking possession of any document or other property.
¶5.10 The provisions and procedures in relation to issuing, exercising and overseeing a warrant are set out in ss5-11 of RIPA.
¶5.11 There is no public interest defence for breach of the provisions and there is no provision for anyone outside the police or security services to obtain a warrant to intercept calls or messages.
¶5.12 The maximum penalty on conviction on indictment is a term of two years of imprisonment and/or a fine, or on summary conviction a fine not exceeding the statutory maximum.
1929¶Computer hacking – Computer Misuse Act 1990
¶5.13 The Computer Misuse Act 1990 was introduced in August 1990 following a Law Commission report surrounding computer misuse and the need to react to increasing technological development and potential abuse of this technology.441
¶5.14 The Act provides, in ss1, 2,3 Visits 9 Chapter 2: the approach 10 and 3A for criminal sanctions for unauthorised access to any material held on a computer and for impairment of the operation of a computer, with further sanctions if this is done with a view to the commission of a crime and for making, supplying or obtaining articles for use in the relevant offences.442
¶5.15 The Computer Misuse Act introduced three new offences into UK criminal law which can be summarised in broad terms as follows: unauthorised access to computer material, unauthorised access with intent to commit a further offence, and unauthorised modification.
¶5.16 Section 1 concerns unauthorised access to computer material. It provides that a person is guilty of an offence if they:
(a) cause a computer to perform any function with intent to secure access to any program or data held in any computer;443 (b) the access intended is unauthorised; and (c) the person knows at the time when they cause the computer to perform the function that that is the case.444
¶5.17 The meaning of computer is not defined in the Act, although there are strong arguments in favour of an interpretation which includes a voicemail system within the meaning of computer.
¶5.18 A person guilty of an offence under these provisions is liable on conviction on indictment to imprisonment for a term not exceeding two years and/or to a fine, or on summary conviction to imprisonment for a term not exceeding six months and/or to a fine not exceeding the statutory maximum.445
¶5.19 Section 1 does not require the use of one computer to gain unauthorised access to another: an offence under section 1 can be committed if a program or data is accessed directly from the computer to which the defendant has access: A-G's Reference (No 1 of 1991).446 Further, s1(1) creates an offence which can be committed as a result of having intent to secure unauthorised access without in fact actually succeeding in accessing any data.447 The offence is drafted to include conduct that ordinarily would be within the scope of the law of attempt.
1930¶5.20 Access of any kind by any person to any program held in a computer is "unauthorised" if they are not entitled to control access of the kind in question to the program or data, or do not have the consent to access the kind of program or data in question from any person so entitled.448 The section identifies two ways in which authority may be acquired – either by being oneself the person entitled to authorise access or by being a person who has been authorised by a person entitled to authorise access. It also makes clear that the authority must relate not simply to the data or programme, but also the actual kind of access secured.449
¶5.21 There is some uncertainty as to whether an offence is committed under s1 by a person who is authorised to secure access to particular computer material, or data, but does so for unauthorised purposes.450 The leading authority on this point under the Data Protection Act 1984 (now repealed) was DPP v Bignell, in which the Court held that the retrieval of information from the police national computer (PNC), by someone with the proper authority under the Computer Misuse Act 1990, but at the request of others who were to use the data for non-police purposes, was a matter for the Data Protection Act 1984 or for police disciplinary proceedings rather than the Computer Misuse Act 1990.451 However, dicta in DPP v Bignell which related to the Computer Misuse Act 1990 were disapproved in R v Bow Street Metropolitan Stipendiary Magistrate, ex p Government of the United States of America which held that the Computer Misuse Act 1990 prevented someone with the authority to access data at a particular level on a computer system from accessing other data held on the same system for improper purposes, on the basis that such access will be unauthorised access within the meaning of section 1(1).452 It therefore remains unclear as to whether a person who had authorised access to information held on a computer, for example the PNC, but accesses this information for improper purposes, for example to sell it to a journalist, would commit an offence under s1 as well as s55 of the DPA. In a number of cases involving misuse of information held on police computers, offenders have been prosecuted for misconduct in public office rather than under the 1990 Act.453
¶5.22 Section 2 covers unauthorised access to computer material pursuant to s1, with the intent to commit an offence or to facilitate the commission of further offences. The basis notion is that someone guilty of an offence under s1 will have further criminal sanctions imposed on them if this is done with the intention to commit or facilitate the commission of further offences, although it is not necessary to prove that the intended further offence has actually been committed.
¶5.23 Further offences for the purposes of s2 are offences which have a sentence fixed by law or where an individual found guilty of that offence would be liable for a term of imprisonment of five years or more. For example, a person will be guilty of an offence under s2 if unauthorised access to sensitive information held on a computer was obtained for the purposes of blackmailing a person to whom that information related, or where unauthorised access was obtained for the purposes of theft.
¶5.24 It is immaterial for the purposes of s2 whether the further offence is to be committed on the same occasion as the unauthorised access or on any future occasion and a person can be guilty of the offences under s2 even though the facts are such that the commission of the further offence is impossible.454
1931¶5.25 Section 3 creates an offence for unauthorised modification. A person is guilty of an offence if they do any unauthorised act in relation to a computer, knowing at the time that it is unauthorised and either:
(a) they intend by doing the act to impair the operation of any computer, to prevent or hinder access to any program or data held in any computer, or to impair the operation of any such program or the reliability of such data;455 or (b) they are reckless as to whether the act will do any of these things.456
¶5.26 A person found guilty of this offence is liable on conviction on indictment to imprisonment for a term not exceeding ten years and/or to a fine, or on summary conviction to imprisonment for a term not exceeding six months and/or a fine not exceeding the statutory maximum.457
¶5.27 Section 3A relates to the making, supplying or obtaining of articles for use in offences under ss1 or 3. Section 3A provides that a person is guilty of an offence if a) they make, adapt, supply or offer to supply any article intending it to be used to commit, or to assist in the commission of, an offence under ss1 or 3, (b) they supply or offer to supply any article believing that it is likely to be used to commit or to assist in the commission of an offence under ss1 or 3, (c) they obtain any article with a view to its being supplied for use to commit, or to assist in the commission of, an offence under ss1 or 3. For the purposes of s3A "article" includes any program or data held in electronic form.458
¶5.28 There are no guideline cases on sentencing for offences under the Computer Misuse Act 1990. In the case of Delamere, an employee who sold confidential details of two bank account holders was sentenced to four months' detention.459 In the case of Lindesay a computer consultant who corrupted a website of a client company which had dismissed him was sentenced to nine months imprisonment following a guilty plea to three s3 offences.460