What Leveson sought to achieve was a system that emasculated bullies on both sides of the argument. I am very sympathetic to small publishers who simply cannot withstand the financial risk of a litigation threat from a wealthy individual or organisation. The greatest impediment to asserting privacy rights or indeed rights to freedom of expression is usually financial constraints.
Another impediment is the threat posed by anonymous bloggers or social media sites. The internet provides extraordinary opportunities for free expression. Nearly 50% of the world’s population have access to the internet. But it also provides extraordinary opportunities for unlawful publication.
In the somewhat dated US Supreme Court case of Reno v ACLU [1997] it was put in this rather quaint way:
“Through the use of chat rooms, any person with a phone line can become a town crier with a voice that resonates farther than it could from any soapbox”.
The challenges of the internet and protecting privacy (in this case the identity of a child) were considered by Sir James Munby in Re J (A Child) [2013] EWHC 2694 (Fam):
“First, the internet allows anyone, effectively at the click of a mouse, to publish whatever they wish to the entire world – or at least to everyone who has access to the internet. No longer does the campaigner have to persuade a publisher, newspaper or broadcaster to disseminate the message. So there is very little editorial control. The consequence is that the internet is awash with material couched in the most exaggerated, extreme, offensive and often defamatory terms, much of which has only a tenuous connection with objectively verifiable truth. Second, material once placed on the internet remains there indefinitely and, because of powerful search engines, is easily accessible by anyone wanting to track it down. Third, internet providers are often located outside the jurisdiction, in countries where practical difficulties or principled objections stand in the way of enforcing orders of this court.”
My instructions are now far more likely to be in connection with an online publication than a newspaper article. Sometimes “revenge porn” or scurrilous tweet. I also have a case where a client has been the victim of what is likely to be a state sponsored online reputational attack. Anonymous websites set up using proxy web hosts and social media sites.
Mischievous or malicious bloggers are becoming increasingly sophisticated and potential claimants have the uncertain option of repeated third party disclosure applications under the process established by the case Norwich Pharmacal [1974] AC 133. But having obtained your Order in the UK you then have to persuade (usually) US ISPs to comply.
Of course, the ubiquitous camera phones, the culture of selfies and “oversharing” online can mean that we can enjoy our absolute freedom of expression and invade our own privacy at the same time. Often, no conflict between these rights will emerge, but one’s own publications can be turned against us. The unfortunate Facebook photograph from university days will inevitably be unearthed during a job interview. Likewise, if one (in later life) needs to seeks the protection of privacy rights, evidence of past self-exposure (whether a Hello photoshoot or revealing selfie) will be used in evidence against you.
Two recent decisions arising from the European Data Protection Directive have had a significant impact on this area. In Vidal-Hall v Google Inc. ([2015] EWCA Civ 311) the Court of Appeal held that there can be a claim for compensation under the Data Protection Act without pecuniary loss and that misuse of private information is a tort, not an equitable wrong. The judgment also contains important holdings about the meaning of “personal data” within s1 (1) of the DPA. By using the internet we are disclosing valuable personal information whether we like it or not.
Vidal-Hall concerns Google’s gathering of users’ data for advertising purposes. The Court held that the data was “personal data” within the provisions of the act
“because identification for the purposes of data protection is about data that ‘individuates’ the individual, in the sense that they are singled out and distinguished from all others. It is immaterial that the BGI (Browser Generated Information) does not name the user. The BGI singles them out and therefore directly identifies them for the purposes of section 1(1) (a) of the DPA…” ([115]).
This case has reignited the DPA and seen it deployed in cases where it was never before considered.
The other highly significant case is Google Spain v AEPD and Mario Costeja Gonzalez [2014] C-131/12 which was handed down by the Grand Chamber of the European Court of Justice on 14 May 2014. The court held that search engines are responsible for ensuring that search results are compatible with the rights of individuals under the Data Protection Directive. The court stressed that search results amount to “a structured overview of the information relating to an individual that can be found on the internet – information which potentially concerns a vast number of aspects of his private life… and thereby to establish a detailed profile of him [80]”.
It held that, in most cases, the rights of the data subject outweighed the rights of the internet user. This case has probably had the greatest impact on internet freedom of expression (and therefore arguably all freedom of expression) given Google’s pre-eminence as our means of obtaining information on people. Upon the finding of the ECJ Google had to implement an online mechanism by which we can all remove websites from search results. As Google explain within their take-down page:
“When you make such a request, we will balance the privacy rights of the individual with the public’s interest to know and the right to distribute information. When evaluating your request, we will look at whether the results include outdated information about you, as well as whether there’s a public interest in the information –for example, we may decline to remove certain information about financial scams, professional malpractice, criminal convictions or public conduct of government officials.”
The process led to great excitement among lawyers and Google have had to deal with thousands of requests. Given their size and wealth I think that they are well able to do so. But the process is something of a mess at the moment. First-hand experience of using the process has seen inconsistent or contradictory responses, delays and confusion. This is perhaps no surprise. What was usually the task of an experienced judge, to weigh up the competing rights and public interest considerations, is now been done on a huge scale by anonymous Google employees. One inevitably pictures a disinterested spotty nineteen year old in California conducting what the courts have described as an “intense focus” between competing rights. Whilst the ICO has not yet been flooded with complaints, I suspect that we will see significant cases emerge for publishers and data subjects.
I am conscious that I have done little to disguise my bias in considering the two rights. My appreciation for the importance of privacy is emphasised by the experience of being with clients as they face a potential publication or deal with the consequence of a publication or other intrusion. The consequences of a serious privacy invasion are often particularly severe for family members.
But I think we have come a long way in the last 6 years and there is now a more mature discussion about the importance of privacy and how it should interact with freedom of expression. No longer is privacy a dirty word or the preserve of footballers. In addition to the phone hacking scandal’s impact on victims of crime, every school kid is likely to be aware of the threat of privacy invasion whether by a malicious tweet or misuse of private images. The explosion of free mechanisms of expression has required further awareness of and protection for privacy. It is for this reason that I think Michael Gove (a former Times journalist and friend of the Murdochs) is wrong to see the UK Bill of Rights he is working on as a means of favouring freedom of expression over privacy.
Laws concerning privacy and freedom of expression other than those already mentioned include civil liabilities in harassment, breach of confidence, defamation and copyright, and criminal liabilities under Regulation of Investigatory Powers Act, the Criminal Justice and Courts Act, and Malicious Communications Act. I am also conscious that I have concentrated on publication rather than the gathering of information. The unseen gathering of information, whether by a social media site or an investigatory journalist can have unsettling repercussions and give rise to a right to compensation as seen in Vidal-Hall and the important and phone-hacking damages decision in Gulati [2015] EWCA Civ 1291 recently endorsed by the Court of Appeal.
I hope that I have given some idea of the framework for the contests in which I become involved. The law remains young in this area but despite its youth it struggles to maintain pace with innovation in communication and information. Whilst Michael Gove may have an idea to curb privacy rights, it is certainly true that the law on privacy is strengthening for those who have access to it. But we all have access to the internet and the ever more creative platforms it provides for communication, so our freedom to express ourselves has never been greater.
Dominic Crossley is a partner of Payne Hicks Beach Solicitors.
This is Part 2 of a Speech given at the University of Stirling Human Rights in Law Conference 2016. Part 1 was published yesterday.
Leave a Reply