The balance of power in English media law may be shifting in this post-Leveson world. Data protection law could become a new frontier in media cases.
The expanding role of data protection on media content
With the Defamation Act 2013 now making it harder for claimants to win cases against the media, claimants are expected to turn to data protection law to try to control what is said about them in the media. Data protection law is also potentially wider than privacy law.
Data protection law had previously been deployed as a bolt-on to privacy or was overlooked in most media cases. The English courts have also tended to avoid going into details of data protection law in media cases, letting privacy or defamation law set the scene. However, we anticipate that this is likely to change and that we will see an increase in the number of publishing-related claims focusing on data protection law in future.
What has changed?
The Defamation Act 2013, came into force on 1 January 2014, primarily to boost free speech. Its impact is already being felt. It is now harder for claimants, particularly corporate claimants, to bring claims. The key change is that claimants must now prove the statement complained of has caused serious harm to their reputation, or in the case of a company, serious financial loss. Other significant changes include a new website operators' defence, an anti-libel-tourism clause, a simpler opinion defence and a new, potentially more flexible, public interest defence.
Another major development in 2014, was the controversial Gonzalez v Google Spain judgment from the Court of Justice of the European Union (CJEU). The CJEU found that search engines are data controllers in respect of their search results; that European data protection law applies to their processing of the personal data of EU citizens, even where they process the relevant data on servers outside the EU; and that a 'right to be forgotten' applies to outdated and irrelevant data in search results unless there is an overriding public interest in the data remaining available, even where the search results link to lawfully published content. One of the key points is the apparent presumption that the data subject's rights override the interests of the search engine and of internet users unless there is a public interest in the search result being published. This appears to contrast with the ultimate balancing exercise explained in Re. S whereby neither Article 8 nor 10 ECHR are presumptively dominant and the proportionality of interfering with one right must be carefully weighed against the proportionality of interfering with the other.
What role can data protection play in a media case?
Personal data is any data which identifies a living individual either alone or with other data. Under data protection law, personal data must be processed fairly and lawfully. The data must be accurate, relevant, not excessive, up to date and not kept longer than necessary for its purpose. These are broad principles which may potentially give individual claimants additional routes to complaining about media content than those available under defamation and privacy law.
To bring a defamation claim, the claimant has to show that the statement complained of has caused serious harm to his or her reputation. A claim will fail if, for example, a defendant can prove the statement is substantially true. However, an individual claimant (rather than a corporate) could potentially bring an action for unlawful processing of personal information under the Data Protection Act 1998 (DPA) without having to show serious harm and regardless of whether the material is true or false.
To bring a privacy claim, a claimant must show that the information in question is private and, if so, that any public interest in disclosure is outweighed by the claimant's right to privacy. In a data protection claim, however, there is no requirement that the information be private, as the DPA only governs the processing of personal data, not private information.
It is possible that data protection law could also potentially be deployed in some cases for an alleged breach of a person's image or personality rights (perhaps in place of or in addition to the law of passing off or trade marks). Well-known individuals might be able to argue that the commercial processing of their image constitutes a breach of the DPA.
The result of the Google Spain judgment is that rather than going direct to publishers, claimants can also attempt to argue that links to content should be taken down merely because the content is excessive, outdated or irrelevant (and consequently in breach of the third and fourth data protection principles), without having to meet the higher standards required under defamation and privacy claims. Claims will, however, be subject to a consideration of the public interest and a balancing of the right to freedom of expression with the right to privacy (see our article on the Google Spain judgment for more on this).
Another potential avenue under the DPA, is where a claimant serves a notice under section 10 DPA, on a media entity or journalist as data controller, requiring them to cease processing any personal data on the grounds that the processing is likely to cause substantial damage or substantial distress and that the damage or distress is or would be unwarranted. A data controller would then have to comply unless it could establish that there was no substantial damage or distress or that this was warranted or that the journalistic exemption applies (see below).
The journalistic exemption and the ICO guidance for the media
The journalistic exemption under section 32 DPA is crucial for the media. It provides an exemption for the processing of personal data with a view to publication of any journalistic, artistic or literary material. To rely on this, the data controller must reasonably believe that:
- having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest; and
- in all the circumstances, compliance with the Act is incompatible with the purposes of journalism, art and literature.
The importance of the journalistic exemption was recognised by Lord Justice Leveson in his inquiry into culture, practice and ethics of the press, when he made data protection-related recommendations, including that the Information Commissioner's Office (ICO): "take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data".
As a result, the ICO published a guide for the media on data protection and journalism in September 2014 (read our article for more on this). The guide mostly clarifies existing rules, reminding the media that although there is a broad exception for journalism from many provisions of the DPA, it does not exempt media organisations from every part of the Act. For example, there is no exemption from the right to compensation for damage or distress under section 13 DPA, nor for prosecution under section 55 DPA, under which it is an offence to knowingly or recklessly obtain personal data from another organisation without its consent (e.g. by blagging, hacking or other covert measures).
The ICO considers there is a need to balance the fundamental human rights to freedom of expression and privacy in each case. The ICO is clear that neither right automatically trumps the other. The guide accepts that a journalist's information, which may not be relevant to a current story, may be retained if it is of more general journalistic interest and that, in the context of journalism, it may be necessary to keep some information for long periods. As regards publication, the guide states that the media must determine "how much personal data it is necessary to publish to properly report the story, balanced against the level of intrusion into the private life of the data subjects, and the potential harm this may cause. For instance, if a story would be highly intrusive or harmful then it is less likely to be fair to publish personal data. This is also the case with stories with very little obvious public interest, or where publication should have been delayed to verify facts."
It is likely that the English courts will rule, in most cases, that the scope of the journalistic exemption is co-extensive with the scope of privacy and defamation law. However, this may not necessarily be the position in all cases and only case law will determine this question.
With defamation actions being harder to bring and privacy actions requiring that the information be private, it is possible that claimants will increasingly try to rely on the DPA against the media. A lot will rest on how the English courts and, ultimately, the CJEU, will balance the fundamental rights and interests in question and the journalistic exemption.