It was reported last month in various newspapers that Max Mosley, the Former Formula One boss, has threatened to issue legal proceedings against The Daily Mail, The Times, The Sun and The Daily Mirror in respect of articles that he claims breach the Data Protection Act 1998 (“DPA”).
He also apparently seeks the destruction of specified personal data retained by the papers. In short, Mr Mosley complains about references to what he terms a ‘private party’, which was the subject of his privacy claim heard by Mr Justice Eady in 2008, and inaccurate references to his relationship with IMPRESS, an independent press regulator in the UK.
The press industry took umbrage at Mr Mosley’s complaint and various newspapers (including The Times and The Daily Mail) responded with stinging rebukes (as well as gratuitous articles about Mr Mosley’s youth). Unsurprisingly, the newspapers presented Mr Mosley’s complaint as a chilling attack on the freedom of the press. The DPA, the press contended, was being misused for a purpose for which it had not been intended.
While the complaint was portrayed by the press as a novel attack on their industry and freedom of expression, newspapers have been the subject of DPA complaints for many years now (Naomi Campbell’s famous privacy claim issued against Mirror Group Newspapers in 2001 included a DPA claim, for instance). Indeed, media lawyers have also previously succeeded in raising similar arguments to Mr Mosley to have historic content removed from, or corrected on, newspaper websites (including, in the case of this author, against one of the publications to whom Mr Mosley has complained). Mr Mosley, it appears, has been unfairly targeted for his approach, which is perhaps unsurprising given that he has been so assiduous in holding the press to account for their wrongdoings since his successful privacy claim in 2008.
The law
It is unknown precisely how the claim has been put, but the legal basis of such complaints is normally that a data controller (i.e. a newspaper in this instance) has failed – and/or is failing – to comply with its duty under section 4(4) of the DPA to comply with the Data Protection Principles (which are set out in Schedule 1 of the DPA). The relevant Data Protection Principles in such cases are:-
- Not to process data unfairly or unlawfully and, in particular, only if specified conditions (set out in Schedule 2 and 3 of the DPA) are met (the First Data Protection Principle).
- Only to obtain personal data for a specified and lawful purpose and only to use it for such a purpose (the Second Data Protection Principle).
- To ensure that the purposes for which personal data is processed are adequate, relevant and not excessive (the Third Data Protection Principle).
- To ensure personal data is accurate and kept up to date (the Fourth Data Protection Principle).
- Not to keep personal data for any longer than is necessary (the Fifth Data Protection Principle).
Mr Mosley, the data subject, served notices pursuant to section 10(1) of the DPA in which he objected to the processing of his personal data (including sensitive personal data) by the data controllers – here the companies that own the newspapers in question – on the basis that such processing is causing him unwarranted and substantial damage or distress. Under section 10(3) of the DPA, the newspapers are required to respond within 21 days of receiving Mr Mosley’s complaint and state whether they intend to comply. If they do not, the newspapers must give reasons for their decision.
Based on newspaper reports, it appears that Mr Mosley’s complaint was submitted prior to 14 February 2018, which means that the 21 day period for the response has now expired. It is unclear whether, and, if so, how, the newspapers have responded (beyond the diatribes in their publications).
Mr Mosley has suggested that failure to comply with his request will force him to ‘go to court’. He will likely be seeking an order under section 10(4) and/or section 14 of the DPA. The former requires a data controller to stop processing personal data in the manner complained of. The latter requires a party to rectify, block, erase or destroy data that is inaccurate. Additionally, under section 13 of the DPA the court can award compensation for damage and distress that has been caused by the newspapers’ alleged contravention of the DPA.
Public interest
Under section 32 of the DPA newspapers do not need to comply with the Data Protection Principles or sections 10/14 if personal data is processed only for journalistic, artistic or literary purposes and the following conditions are met at the time at which the data was processed in relation to each item of data being processed:-
- the data is being processed with a view to publication of some material,
- with a reasonable belief that publication is in the public interest, and
- with a reasonable belief that compliance is incompatible with journalism.
Notwithstanding that the words ‘with a view to publication’ are specifically used in the DPA, the Court of Appeal in Campbell v MGN Ltd [2002] EWCA Civ 1373 held that this exemption applies to the media both before and after publication. This exemption has frequently been raised by publishers as a stock response to any data subject having the audacity to raise a complaint about a breach of their data protection rights.
Since the inception of the DPA nearly 20 years ago, newspapers have generally been acting as if section 32 virtually confers blanket immunity on them. To a large extent they have got away with this because data subjects, and even lawyers, have not called their bluff. Many find the DPA impenetrable and, at first blush, the exemption does appear to afford the press significant protection. The, exemption, however, is not as wide as many think and in recent years the scope of section 32 has been increasingly challenged by claimants’ lawyers (as a recent example see Stunt v Associated Newspapers Ltd [2017] EWHC 695 (QB) in which the unsuccessful claimant has been granted permission to appeal). One of the main issues in dispute is the interpretation of what should constitute the ‘public interest’ and the data controller’s ‘reasonable belief’ in the public interest.
This appears to be an argument that Mr Mosley has advanced in respect of the ‘private party’. At Mr Mosley’s privacy trial in 2008, Mr Justice Eady determined that there was no public interest in the exposé. Even if the newspapers believe that the Judge was wrong about that, any limited public interest in the story must have surely waned with the passage of time, to the extent that any reasonable data controller ought not believe that ongoing publication (which constitutes a form of processing) remains in the public interest.
Comment
The DPA does not enable claimants to ‘muzzle the press’ as has been suggested. What it mainly provides – or at least ought to provide – is protection for data subjects against journalism that interferes with their fundamental privacy rights and lacks any meaningful public interest. This ought not to be controversial. The absence of a legitimate public interest can also be fatal to a newspaper’s defence to the more traditional claims for libel, misuse of private information and breach of confidence. If there is a genuine public interest in a story, the section 32 exemption is still likely to apply.
Mr Mosley also contends that references about his relationship with Impress are incorrect. Such a contention will obviously turn on the true facts. If, however, Mr Mosley is right, then it is entirely unremarkable that he is requesting that these references be corrected. Each of the four newspapers to whom Mr Mosley sent a complaint subscribe to the Independent Press Standard Organisation’s Editors’ Code of Practice, the first clause of which states:-
“1. Accuracy
i) The Press must take care not to publish inaccurate, misleading or distorted information or images, including headlines not supported by the text.
ii) A significant inaccuracy, misleading statement or distortion must be corrected, promptly and with due prominence, and — where appropriate — an apology published. In cases involving IPSO, due prominence should be as required by the regulator.”
Taking into account the safeguards to freedom of expression provided by section 32, there is no legitimate reason why the press should be able to ride roughshod over individuals’ data protection rights when other data controllers are expected to comply with the Data Protection Principles. In the final analysis the position of the press is one of arrogance that implies that they are above the law. This is at a time when, following the abandonment of Leveson 2, it has never been more important to ensure individuals have effective legal recourse against the might of the press.
If the newspapers believe that their processing complies with the DPA, then they should state their reasons why rather than leading readers to believe that Mr Mosley is threatening a draconian and arcane legal claim to muzzle the press. This is exactly the type of misleading reporting Mr Mosley seeks to restrain.
This post originally appeared on the Brett Wilson Media Law Blog and is reproduced with permission and thanks
from Inforrm's Blog https://inforrm.org/2018/03/28/the-misreporting-of-max-mosleys-dpa-claim-against-the-press-iain-wilson-and-tom-double/
via
Security CCTV Installs
Comments
Post a Comment