Misuse of Private Information and the Data Protection Act 1998

The case of Campbell v Mirror Group Newspapers Ltd [2004] UKHL 22 firmly established a cause of action for invasion of privacy. The facts of the case are well known. The Mirror published covertly taken photographs which disclosed that model Naomi Campbell was receiving treatment for drug addiction at Narcotics Anonymous. Ms Campbell brought an action against the Mirror for damages for breach of confidence alongside a claim under the Data Protection Act for compensation. In the House of Lords, the judges held that the cause of action for breach of confidence had shaken off any requirement for an initial confidential relationship between the parties. The law now imposed a duty of confidence whenever a person receives information he knows or ought to know is fairly and reasonably to be regarded as private. It was accepted that there was no all-embracing action for invasion of privacy. However, since the European Convention on Human Rights (ECHR) is now enshrined into UK law, the equitable remedy of breach of confidence had to be extended to provide a remedy where private information had been misused.

To establish whether there had been a misuse of private information (MPI) a two stage test was applied to the circumstances of the case:

Is there a reasonable expectation of privacy?
How should the balance be struck between the individual’s right to privacy on the one hand and the publisher’s right to publish on the other?

It was held that the information was prima facie private and would normally attract the attention of Article 8 as it related to medical treatment. Nonetheless, Ms Campbell had said previously in the media that unlike other models she did not take drugs. Accordingly, Ms Campbell did not have a reasonable expectation of privacy in relation to the fact that she was a drug addict and it was justified in the public interest for the Mirror to expose Ms Campbell’s drug addiction. However, on balancing the competing rights of the parties under Articles 8 (right to respect for private and family life) and 10 (right to freedom of expression) of the ECHR, it was not justified to publish the photographs of Ms Campbell leaving the meeting or details of her treatment.

Data protection and Misuse of Private Information

In the UK, the collection, processing and use of personal data is mainly governed by the Data Protection Act 1998 (DPA), which came into force on 1 March 2000 to implement EU directive 95/46/EEC (the Data Protection Directive). The DPA applies to “Personal data” which extends to data relating to living individuals who can be identified from that data. Data processing is broadly defined to include obtaining, recording, holding, using, disclosing or erasing data. All of the obligations under the DPA fall on the data controller, that is, the person who determines the purposes for which the personal data is to be processed. An individual can apply to court where his data has been unlawfully and/or unfairly processed under the DPA. There are many different technical provisions that a data controller must comply with in the DPA therefore claimants have lots of options when attempting to establish a breach.

The Court of Appeal decision in Campbell confirmed that the DPA applies to the media where personal information has been published in contravention of the act. As the terms “Personal data” and “Data processing” are drafted very widely under the DPA it makes sense why law practitioners would include a claim for a breach of the DPA alongside an action for MPI. Personal data under the DPA includes information that would not be covered under the first limb of an action for MPI as the claimant must only show that the information is personal not that it is private. The European Court of Justice has held that “personal data” covers the name of a person or identification of him by other means such as giving his telephone number or information regarding his working conditions or hobbies [Case C-101/01, 6 November 2003, at paragraph 27]. In contrast, when considering whether information is private the Court takes all of the circumstances of the case into account [Murray v Big Pictures (UK) Limited [2008] EWCA Civ 446]. Further, to come within the first limb of an action for MPI the infringement of privacy must be serious enough to engage Article 8 [Elena Ambrosiadou v Martin Coward [2011] EWCA Civ 409]. However, in media DPA cases claimants must contend with the exemption contained in Section 32 of the DPA. This exempts the data controller from complying with most of the data protection provisions if it believes that publication would be in the public interest and that compliance with the DPA provisions would be incompatible with the special purposes of journalism, art or literature.

In relation to the second stage of the test for MPI, it appears that in some circumstances the balance between the Article 8 rights of the individual and the Article 10 rights of the data controller may be relevant to whether there has been a breach of the DPA. In Murray v Express Newspapers plc and Big Picture (UK) Limited [2007] EWHC, a case concerning the publication of photographs of the baby son of author JK Rowling, the second defendant submitted that the processing had been fair as it was necessary for the purposes of the legitimate interests pursued by the data controller i.e. business interests. Mr Justice Patten agreed and said that this provision replicated the considerations which the Court routinely takes into account under Article 8 and Article 10.

In Weller v Associated Newspapers Limited [2015] EWCA Civ 1176, musician Paul Weller successfully sued Associated Newspapers for MPI and breach of the DPA, after the Mail Online published photographs of his children on a family outing. The claim was run predominantly as a MPI claim with a parasitic DPA claim attached. It was considered by the parties and by the Court that the claim under the DPA would stand or fall with the claim for MPI. However, in a case very similar to Weller, actors Ashton Kutcher and Mila Kunis have brought proceedings against Associated Newspapers after photographs of their baby daughter were published on the Mail Online. Unusually, this claim is pleaded predominantly as a DPA claim with a MPI claim bolted on. If the claim makes it to trial, it may provide much needed clarification on the scope of the DPA in respect of infringements of privacy by the media.

Remedies for Misuse of Private Information

An injunction is usually the most important remedy sought by a MPI claimant. Injunctions can restrain first publication and prevent publishers from republishing the private material. The Court can grant an interim injunction to restrain publication before trial if it is satisfied that the applicant is likely to establish that publication should not be allowed. The Court may refuse to grant an injunction if the private information has become very widely available. There is also a specialised form of an interim injunction that prohibits not only the reporting of the private information but also the fact that the order has been granted. These types of orders are known as super-injunctions though they are sometimes confused with anonymised injunctions. After obtaining an interim injunction, if the proceedings continue to trial the claimant can apply for a final injunction against the world.

Claimants may also seek compensatory damages for MPI. Traditionally awards for MPI have been modest, for example in Campbell damages of £3500 for distress were awarded. Max Mosely was awarded £60,000 after the News of the World invaded his privacy by exposing his involvement in a sadomasochistic sex act involving five prostitutes including publishing a video of the incident on their website [Mosley v News Group Newspapers [2008] EWHC 1777]. However, in Mosley Eady J stressed that the case was serious and that the claimant had hardly been exaggerating when he said his life was ruined. The case of Google Inc. v Judith Vidal-Hall and others [2015] EWCA Civ 311 confirmed that an action for MPI was a tort and not an equitable wrong albeit that it was borne out of the equitable wrong of breach of confidence. Therefore, tortious damages could be awarded (including exemplary damages) as of right, rather than remedies being equitable and therefore discretionary.

The case of Gulati v MGN Newspapers [2015] EWHC 1482 raised the ceiling for damages for MPI. The case concerned infringement of privacy rights founded in telephone hacking by MGN. The Court of Appeal held that not only were the claimants entitled to damages for distress, as is usual in MPI cases, but that they should also receive compensation for being deprived of the right to control the dissemination of their private information.

The awards in Gulati ranged from £72,500 to £260,250 reflecting the nature of the intrusion which consisted of the hacking of the claimants’ telephones daily over a period of several years. Thus, it is important to note that in part these awards are only relevant to phone hacking cases. In February 2016, the High Court followed Gulati and awarded £5000 in damages to Paul Burrell for MPI after without consent Max Clifford faxed a letter to the News of the World newspaper which Burrell had written to Clifford [Burrell v Clifford [2016] EWHC 294 (Ch)].

Remedies under the DPA and the case of Google v Vidal Hall

There are remedies under the DPA which are not available in MPI claims. A court can order that the data controller rectifies, blocks, erases or destroys any personal data. Claims under the DPA can also be brought in the County Court enabling claimants to escape the risk of adverse costs orders. One of the disadvantages of applying under the DPA is that claimants cannot restrain the first publication of information where the processing is undertaken with a view to the publication of any journalistic, literacy or artistic material.

Previous to the decision in Google, individuals claiming damages for distress for a contravention of the DPA had to first establish that they had suffered pecuniary damage. This proviso did not apply to cases where personal information had been published by the media, as contraventions of the DPA for the purposes of journalism, the arts, or literature are exempt from this requirement. Individuals were also able to claim damages for distress where nominal damages had been awarded by the court [Halliday v Creation Consumer Finance [2013] EWCA Civ 333]. To date damages awarded under the DPA have been relatively low compared to MPI damages.

In Google, a group of claimants issued proceedings against Google for MPI and a breach of its duties under the DPA after it collated information relating to their internet usage on the Apple Safari browser without their consent. The claimants were granted permission by the High Court to serve proceedings on Google out of the jurisdiction, but Google appealed the decision to the Court of Appeal on several points including the meaning of damage under Section 13 of the DPA. The Court of Appeal considered the award of damages under Section 13 (2) of the DPA with reference to the Data Protection Directive it implemented.

It was held that Section 13 (2) of the DPA conflicted with the rights guaranteed by Articles 7 (right to a private and family life) and 8 (protection of personal data) of the European Charter of Fundamental Rights and should therefore be dis-applied. Effectively it found that Section 13 allows individuals to claim damages for distress even where they have suffered no pecuniary loss. The Court of Appeal also considered the level of seriousness required before compensation for distress can be granted under the DPA for an invasion of privacy. It was stated that Article 8 does not need to be invoked to establish a breach of the DPA. However, if an invasion of privacy does not meet the seriousness required by Article 8, it is unlikely that damages will be awarded for distress.

Comment

Where there has been a privacy infringement usually actions for both MPI and a breach of the DPA are pursued as both causes of action provide different advantages. For example, an action for MPI allows a claimant to apply for an injunction to restrain first publication and claim tortious damages. However, under the DPA there is no Article 8 seriousness threshold to meet nor does the information need to be private. In this respect we await with interest to see whether Ashton Kutcher’s and Mila Kunis’s case against Associated Newspapers makes it to trial. If they succeed on the DPA claim alone the case could set a precedent that would allow claimants to remove information from the public domain that would not meet the two stage test in Campbell. The high cost of litigation alongside other pressures of print media could induce newspapers to remove articles at the first indication of a DPA claim. This could effectively gag the press and have a chilling effect on freedom of expression.

There is also further potential in utilising the DPA to remedy privacy violations that do not concern publication in the media. Some commenters have suggested that the disapplication of Section 13 (2) of the DPA in Google will open the proverbial floodgates to litigation. However, as Google makes clear, to obtain damages for distress claimants must establish that the infringement of privacy meets the Article 8 level of seriousness. Furthermore, Google has been granted part permission to appeal to the Supreme Court on the issue of damages under Section 13 (2) of the DPA, therefore the Court of Appeal decision on this point may be reversed. Many DPA issues such as those relating to seriousness and triviality may be re-visited if a full trial is held in the Google proceedings.