Quotes from caselaw 6: HRH The Duchess of Sussex v Associated Newspapers Ltd [2021] EWCA Civ 1810- Megan Markle successful in defending appeal by Mail on Sunday

An appeal against the finding for summary judgment for her misuse of private information and copyright claim.

The appellant was granted permission appealed the elements of the case on seven grounds:

i) The new evidence issue: Whether the new evidence provided by each of the
parties should be admitted.

ii) The nature of the attack issue: Whether the judge mistakenly failed to
recognise the significance and importance of the People Article’s attack on Mr
Markle.

iii) The reasonable expectation of privacy issue: Whether the judge adopted a
flawed analysis of the factors undermining the Duchess’s alleged reasonable
expectation of privacy.

iv) The appropriate test issue: Whether the judge wrongly stated the test, by
suggesting that the defendant had to justify an interference with the claimant’s
right of privacy, when the proper approach was to balance the competing article 8 and 10 rights.

v) The right of reply issue: Whether the judge wrongly applied a strict test of
necessity and proportionality to Mr Markle’s right of reply to the People Article.

vi) The public interest/article 10 copyright issue: whether the judge failed
properly to evaluate the interference with article 10, saying that it would be a
rare case in which freedom of expression would outweigh copyright.


vii) The fair dealing copyright issue: whether the judge wrongly relied on his
privacy analysis to reject the fair dealing defence to breach of copyright, bearing
in mind the limited scope of the copyright in the Letter and the wide scope of
the concept of reporting current events.

The Sir Jeoffery Vos decided against the defendant on all grounds dismissing the appeal, in a unanimous judgment, stating summarily:

Essentially, whilst it might have been proportionate to disclose and publish a very small part of the Letter to rebut inaccuracies in the People Article, it was not necessary to deploy half the contents of the Letter as Associated Newspapers did. As the Articles themselves demonstrate, and as the judge found, the primary purpose of the Articles was not to publish Mr Markle’s responses to the inaccurate allegations against him in the People Article. The true purpose of the publication was, as the first 4 lines of the Articles said: to reveal for the first time [to the world] the “[t]he full content of a sensational letter written by [the Duchess] to her estranged father shortly after her wedding”. The contents of the Letter were private when it was written and when it was published, even if the claimant, it now appears, realised that her father might leak its contents to the media.

p.106

Quotes from caselaw 5: Lloyd v Google LLC [2021] UKSC 50 – no one size fits all claim available in data protection “Safari Workaround” class action

In one of the most significant privacy law judgments of the year the UK Supreme Court considered whether a class action for breach of s4(4) Data Protection Act 1998 (“DPA”) could be brought against Google of its obligations as a data controller for its application of the “Safari Workaround”. The claim for compensation was made under s.13 DPA 1998.

The amount claimed per person advanced in the letter of claim was £750. Collectively, with the number of people impacted by the processing, the potential liability of Google was estimated to exceed £3bn.

“The claim alleges that, for several months in late 2011 and early 2012,
Google secretly tracked the internet activity of millions of Apple iPhone users and used the data collected in this way for commercial purposes without the users’ knowledge or consent.”

Lord Leggatt at p.1

The class action claim was brought under rule 19.6 of the Civil Procedure Rules.

Lord Leggatt handed down the unanimous judgement in favour of the appellant Google LLC:

“the claim has no real prospect of
success. That in turn is because, in the way the claim has been framed in order to try to bring it as a representative action, the claimant seeks damages under section 13 of the DPA 1998 for each individual member of the represented class without attempting to show that any wrongful use was made by Google of personal data relating to that
individual or that the individual suffered any material damage or distress as a result of a breach of the requirements of the Act by Google.”

At p.159

It should be noted that the claim was brought under the Data Protection Act 1998 and not under the GDPR.

See the full judgement here. The Panopticon Blog has an excellent summary.

ICO issues provisional view to fine Clearview AI Inc over £17 million

The Information Commissioner’s Office (“ICO”) has issued a provisional view of the imposition of a £17m fine over Clearview AI.

The BBC cites that the firms’ database has over 10bn images. The ICO has issued a provisional notice to stop further processing of the personal data of people in the UK and to delete any such data following alleged serious breaches of the UK’s data protection laws.

In a joint investigation with the Australian Information Commissioner (“AIC”) the ICO concluded that the data, some scraped from the internet, was being processed, in the case of UK persons, unlawfully in some instances.

Clearview AI Inc’s services were being used on a free trial basis by some law enforcement agencies. This has been confirmed to no longer be the case.

The ICO’s preliminary view is that Clearview AI Inc appears to have failed to comply with UK data protection laws in several ways including by:

  • failing to process the information of people in the UK in a way they are likely to expect or that is fair;
  • failing to have a process in place to stop the data being retained indefinitely;
  • failing to have a lawful reason for collecting the information;
  • failing to meet the higher data protection standards required for biometric data (classed as ‘special category data’ under the GDPR and UK GDPR);
  • failing to inform people in the UK about what is happening to their data; and
  • asking for additional personal information, including photos, which may have acted as a disincentive to individuals who wish to object to their data being processed.

Information Comissioner Elizabeth Denham commented:

“I have significant concerns that personal data was processed in a way that nobody in the UK will have expected. It is therefore only right that the ICO alerts people to the scale of this potential breach and the proposed action we’re taking. UK data protection legislation does not stop the effective use of technology to fight crime, but to enjoy public trust and confidence in their products technology providers must ensure people’s legal protections are respected and complied with.

Clearview AI Inc’s services are no longer being offered in the UK. However, the evidence we’ve gathered and analysed suggests Clearview AI Inc were and may be continuing to process significant volumes of UK people’s information without their knowledge. We therefore want to assure the UK public that we are considering these alleged breaches and taking them very seriously.”

This is one of the largest fines issued under the GDPR to date. Clearview now has the opportunity to respond, both in the UK and Australia (the AIC has found breaches of Australian privacy laws).

It’s unsurprising that its database, said to have included images scraped from social media, has drawn the attention of regulators. Facial recognition services have been at the forefront of recent data analytics scrutiny and data protection enforceability.

The ICO press release can be found here and the AIC press release here.

The previous statement of the ICO on the conclusion of the joint investigation can be found here.

Quotes from caselaw 4: PJS v News Group Newspapers Limited [2016] UKSC 26 – privacy rights are broader than just confidentiality

It is a rare case where an application for a interlocutory injunction succeeds despite an article on the subject already being published. Such was the case in PJS, one of the most significant English law cases concerning privacy law to date.

The leading judgment was handed down by Lord Mance. It concerned the grant of an injunction to keep details of an extra marital affair between a claimant of great renown being published by the press.

Lord Mance observes the fact that privacy is a zonal right justifying protection, differing in character from the right of confidentiality. The esteemed judge highlights previous cases at paragraphs 58 and 59 of the judgment, endorsing the well entrenched approach from the Court of Appeal.

He characterises privacy, rightly, as extending beyond the bounds of confidentiality. In doing so ones private life becomes a space that should remain, in certain circumstances, free from intrusion.

However, claims based on respect for privacy and family life do not depend on confidentiality (or secrecy) alone... “unwanted access to private information and unwanted access to [or intrusion into] one’s … personal space”

Lord Mance at p.58-59

Concluding Lord Mance opined on the capacity of the internet to change perceptions of privacy. He acknowledged that the courts need to remain cognizant of this. In doing so he affirmed the findings of previous caselaw, gave credence to commentators and noted the implications of tweeting and blogging:

 I also accept that, as many commentators have said, that the internet and other electronic developments are likely to change our perceptions of privacy as well as other matters – and may already be doing so. The courts must of course be ready to consider changing their approach when it is clear that that approach has become unrealistic in practical terms or out of touch with the standards of contemporary society. However, we should not change our approach before it is reasonably clear that things have relevantly changed in a significant and long-term way. In that connection, while internet access became freely available in this country only relatively recently, almost all the cases listed at the end of para 59 above were decided since that happened, and many of those cases were decided after blogging and tweeting had become common.

Lord Mance at p.70

TPP has commented further on the PJS case here.

Citation: INFORRM Blog, ZXC v Bloomberg LP: Privacy and Reputational Harm – Jeevan Hariharan

The INFORRM Blog has an excellent post on the inter-related nature of privacy and reputational harms.

Whether an individual has a reasonable expectation of privacy that outweighs the public interest in cases where there has been an investigation, but no charge, by the police is an imminent case before the Supreme Court in the case of ZXC v Bloomberg LP.

The case is before the UK Supreme Court on 30 November and 1 December next week and was cited by Hariharan in his analysis of the proximity between privacy and reputational harms.

The Court of Appeal judgment can be found here. The Court found that there could be a reasonable expectation of privacy in the fact of a police investigation. This builds upon notable caselaw such as the Cliff Richard case.

Citation: BBC: WhatsApp changes privacy policy after Irish data protection authority issues £190m fine

The BBC has an insightful article on WhatsApp’s behaviour after the sanctions imposed on it by the Irish Data Protection Authority fined it £190m in September 2021.

According to the BBC, the tweaks are designed to “add additional detail around [WhatsApps] existing practices”, and will only appear in the European version of the privacy policy, which is already different from the version that applies in the rest of the world.

“There are no changes to our processes or contractual agreements with users, and users will not be required to agree to anything or to take any action in order to continue using WhatsApp,” the company said, announcing the change.

WhatsApp is appealing the fine imposed against it by the Irish Data Protection Commissioner.

TPP number 30 on Feedspot – Top 35 Privacy Websites and Blogs

We are delighted to be ranked 30 out of Feedspots top 35 blogs. TPP was ranked alongside law firms and authoritative blogs on privacy law.

According to Feedspot sites are ranked “by traffic rank, social media followers, domain authority & freshness.” The full list can be found here and is a must read for anyone interested in privacy law matters.

TPP re-published by the The Student Lawyer: Use of facial recognition software in school lunch queues in North Ayrshire

TPP is pleased to announce that the article that appeared on this site analysing use of facial recognition software in schools in North Ayrshire has been republished by the Student Lawyer.

The Student Lawyer is a go-to legal news and blogging site for law students. You can find the article here.

Citation: 5RB: European Court of Human Rights upholds Article 8 privacy breach in relation to reputation of a dead person

In a case builds upon pre-existing caselaw on the rights of those who are deceased the European Court of Human Rights has found an article 8 breach in relation to news articles posted about a deceased Roman Catholic Priest.

ML v Slovakia 34159/17 concerned a number of articles published by three Slovakian newspapers about the historic sex offence convictions of the claimants son.

The Court found that the articles were inaccurate and sensationalist citing that: “However, it follows from what has been said above that the domestic courts failed to carry out a balancing exercise between the applicant’s right to private life and the newspaper publishers’ freedom of expression in conformity with the criteria laid down in the Court’s case-law.

Concluding the Courts stated, applying Article 8:

“…dealing appropriately with the dead out of respect for the feelings of the deceased’s relatives falls within the scope of Article 8 of the Convention”.

Furthermore the Court stated a clear and concise view on the journalistic integrity of the reporting: “Although the journalists must be afforded some degree of exaggeration or even provocation, the Court considers that the frivolous and unverified statements about the applicants sons private life must be taken to have gone beyond the limits of responsible journalism” -p.47

5RB has an excellent case comment.

ICO launches consultation on the Draft Journalism Code of Practice

The ICO’s consultation on its Draft Journalism Code of Practice has begun.

Be sure to have your say- the deadline to submit responses is 22 January 2022.

The Code covers privacy safeguards among many other topics. In particular, it covers the journalism exemption under the Data Protection Act 2018 and its broad exemption that disapplies requirements to holding and processing data.

Journalism should be balanced with other rights that are also
fundamentally important to democracy, such as data protection and the
right to privacy.

at p.4

The Code substantively addresses the safeguarding of journalism under the exemption, briefly touching on balancing a free press against privacy rights before going on to discuss how this balance is struck under data protection laws:

Why is it important to balance journalism and privacy?


It is widely accepted that a free press, especially a diverse press, is a
fundamental component of a democracy.

It is associated with strong and
important public benefits worthy of special protection. This in itself is a public
interest.

Most obviously, a free press plays a vital role in the free flow of

communications in a democracy. It increases knowledge, informs debates
and helps citizens to participate more fully in society. All forms of journalistic
content can perform this crucial role, from day-to-day stories about local
events to celebrity gossip to major public interest investigations.

A free press is also regarded as a public watch-dog. It acts as an important
check on political and other forms of power, and in particular abuses of
power. In this way, it helps citizens to hold the powerful to account.

However, the right to freedom of expression and information should be
balanced with other rights that are necessary in a democratic society, such
as the right to privacy. The public interest in individual freedom of expression
is itself an aspect of a broader public interest in the autonomy, integrity and
dignity of individuals.

The influence and power of the press in society, and the reach of the

internet, means that it is particularly important to balance journalism and
people’s right to privacy.

This code provides guidance about balancing these two important rights by
helping you to understand what data protection law requires and how to
comply with these requirements effectively.

at p.25