On 20 November 2015, the Court of Appeal handed down its decision in Weller & Ors v Associated Newspapers Limited  EWCA Civ 1176. The Court of Appeal held unanimously that the trial judge had been correct to find the Daily Mail liable for both misuse of private information and breach of the Data Protection Act 1998.
It was agreed by both parties that the data protection claim stood or fell with the main privacy claim, meaning that the data protection element gains little attention in either the High Court or Court of Appeal judgment. Nevertheless, the case is yet another reminder of the increase in the use of the Data Protection Act 1988 (DPA) in tandem with the more traditional claims of misuse of private information and defamation and shows how the three remedies are being increasingly combined by claimants.
The Weller appeal
Paul Weller first initiated proceedings in the High Court following an article and photographs published by Mail Online on 21 October 2012. The article, headed "a family day out", included seven photographs of Weller with his sixteen year old daughter and 10 month old twins shopping in the streets of Santa Monica and relaxing in a café. The photographs had been taken without consent by paparazzi who had been asked to stop taking the photographs and had assured the family that the photographs would be pixelated when published. This did not happen, and the resulting article not only showed the photos unpixelated but identified the children by name (although incorrectly in the case of the elder daughter, who was identified as his wife). It was for this inaccuracy that the story was taken down on 22 October 2012.
Weller brought proceedings for misuse of private information and breach of data protection and in April 2014 the High Court found that the article had breached the family's privacy. The Daily Mail was ordered to pay Weller's costs plus £10,000 in damages (£5,000 for the elder daughter and £2,500 each for the twins).
The Daily Mail appealed the High Court decision, arguing that there was no inherent privacy in an innocuous photograph where nothing inherently private is shown. Second, they argued that, as the taking and publishing of the photographs would have been legal in California, the expectation of privacy was reduced. The Court of Appeal dismissed the appeal, finding that the High Court judge had been correct to hold that the children had a reasonable expectation of privacy in the photographs and that their privacy rights outweighed the publisher's right to freedom of expression. The privacy hurdle having been established, the data protection reach also fell away. The Daily Mail was refused permission to appeal to the Supreme Court.
While the privacy rights of children were already well established under English law, the Court of Appeal appeared to recognise that "the fact that a child's parents are in the public eye means that the child is potentially exposed to a special vulnerability: it could put their safety and security at risk". The exception to this rule is where the parents have invited publicity for the child, in which case their expectation of privacy is reduced.
The rise of data protection in media litigation
Data protection has been used in tandem with the tort of misuse of private information since that tort was first developing from the law of confidence. It appeared in early privacy cases brought by Naomi Campbell and Michael Douglas and Catherine Zeta-Jones, although perhaps initially as more of a sideshow. In the Douglas case for example, a court awarded £3,750 for the distress caused by the privacy breach but only £50 each under the DPA. It took the important Court of Appeal ruling in Vidal–Hall v Google Inc  EWCA Civ 311 (see: Vidal-Hall v Google) to finally cement data protection as a truly viable standalone alternative.
Prior to the Court of Appeal ruling in Vidal-Hall, it had been viewed that the bar on distress-only damages, save in media cases (section 13(2)(b) of the DPA), prevented privacy claims under the DPA. Vidal-Hall established that damages for breach of section 13 of the DPA can be awarded where there is no evidence that financial loss has occurred, meaning that the DPA claim could now take centre stage (although note that the Supreme Court has granted Google permission to appeal – watch this space).
The synergy between privacy and data protection law is a strong one. Misuse of private information is based on the principle under Article 8 of the Human Rights Act that everyone has the right to respect for his or her private and family life. Where a reasonable expectation of privacy exists in information, a balancing act must be carried out between that privacy right and the publisher's Article 10 right of freedom of expression. Where the balance falls in favour of privacy, publication can be restrained.
Similarly, the DPA imposes obligations on data controllers to obtain, hold and process information fairly and lawfully, and to process personal information in accordance with the rights of data subjects (the 6th Principle). These rights include the section 13 right for compensation mentioned above, but also the right to prevent the processing of personal data likely to cause damage or distress (section 10 of the DPA), and the right to rectify or erase information that is inaccurate (section 14 of the DPA).
Therefore in DPA claims, as in misuse of private information, a claim can be brought whether the information itself is false or true.
Data protection does not just align with privacy, but is also now a viable alternative to defamation claims where a claimant might struggle to pass the new requirement in the Defamation Act 2013 to prove they have suffered serious harm. The High Court has recently confirmed (His Highness Prince Moulay Hicham Ben Abdullah Al Alaoui of Morocco v Elaph Publishing Limited  EWHC 2012 (QB)) that a data protection claim can be run with defamation.
It seems data protection is not just here to stay in the context of media litigation, but depending on the Supreme Court decision in Vidal-Hall, could be ready to take centre stage.
While damages remain low (although they are creeping up as Vidal-Hall emphasises), the real value of a data protection claim is the difficulties it creates for data controllers by way of nuisance value. We can expect a growing use of data protection law and, it seems, put to some novel uses. You have been warned!
Click here to read more posts from Information Matters.
For more information on the Court of Appeal decision or in relation to the use/role of data protection and privacy rights in a litigation context, please contact Jennifer Agate (firstname.lastname@example.org; 020 3375 7194), Owen O'Rorke (email@example.com; 020 3375 7114) or your usual contact at the firm on 020 3375 7000. Further information can also be found on the Intellectual Property page on our website.
This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.
© Farrer & Co LLP, December 2015
Information Matters - The Modern World - Data Protection in Media Litigation.pdf247kB