APPENDIX 119
Memorandum submitted by Mr Richard Thomas,
the Information Commissioner
I am grateful for the opportunity to set out
briefly the extent to which my role touches upon matters covered
by the Committee's enquiry into the treatment of those not generally
"in public life" who none the less have found themselves
to be the focus of media attention. This submission concentrates
upon the relevance of the Data Protection Act 1998—which
gives me authority as the Information Commissioner—to the
issues which are likely to be considered by the Committee.
The Data Protection Act 1998 regulates the processing
of personal data, that is information relating to identifiable
individuals. The Court of Appeal—in the Campbell case—has
recently confirmed and clarified various "routine" matters
of interpretation relating to the EU Data Protection Directive
and the Data Protection Act 1998. In his judgment the Master of
the Rolls observed:
"Foremost among [the Directive's] aims is
the protection of individuals against prejudice as a consequence
of processing of their personal data, including invasion of their
privacy . . .
. . . Because the Act has in large measure, adopted
the wording of the Directive, it is not appropriate to look for
precision in the use of language as is usually to be expected
from the Parliamentary draftsman. A purposive approach to making
sense of the provisions is called for".
The Court of Appeal also confirmed that the
definition of "processing" in the Data Protection Act
is "very wide" and that "publication must be treated
as part of the operations covered by the requirements of the Act".
Although the Campbell case reversed the decision
of the High Court, in my view it would be quite wrong to characterise
the judgement as a denial to any right of privacy. The courts,
in my view, are in fact still feeling their way in that direction.
There is a tension between Articles eight (privacy) and Article
10 (freedom of expression) of the European Convention on Human
Rights. On the central question of where the law stands on this
"Article eight vs Article 10" issue, the courts are
slowly and carefully moving towards establishing a common law
concept of privacy within, alongside or (possibly) outside the
realms of the law of confidence. Lord Phillips MR alluded to this
paragraph 43 and 61 of his judgment
"The courts are in the process of identifying,
on a case by case basis, the principles by which the law of confidentiality
must accommodate the article eight and Article 10 rights . . .
. . . Protection of privacy by expanding the
scope of confidence . . . [is] in the course of development .
. .".
He went on to say:
"The development of the law of confidentiality
since [the Human Rights Act] has come into force has seen information
described as "confidential" not where it has been confided
by one person to another, but where it relates to an aspect of
an individual's private life which he does not choose to make
public. We consider that the unjustifiable publication of such
information would better be described as a breach of privacy rather
than a breach of confidence" (emphasis added).
I think this comes very close to a recognition
by the Court of Appeal that, in an appropriate case, on the particular
facts, the courts will almost inevitably find there to be a "breach
of privacy" as opposed to "breach of confidence".
I predict that the courts are more likely to move further down
this road in a case involving a private person, rather than a
celebrity or a public figure.
As and when such cases emerge I—as Information
Commissioner—may have a role to play in various ways. This
may arise before or during litigation or a complaint to the Press
Complaints Commission—most likely in some sort of complementary
way. In such circumstances I will need to decide whether the Data
Protection Act applies in the particular circumstances. If so,
there will be questions as to whether the section 32 exemption
applies (see below) or whether there has been a contravention
of one of the Data Protection Principles which set rules for the
collection, holding and use of personal data.
My involvement in such matters is likely to
manifest itself in a request for me to make an Assessment as to
whether there has been compliance with the Data Protection Principles.
The Act says that I am required to carry out such Assessment on
receiving a valid request. I do have discretion as to the manner
in which I carry out such Assessments. I am likely to take into
account whether the matter is actually or prospectively before
the Courts or the PCC. I will have to be realistic and take into
account the rather convoluted enforcement procedures which are
available to me, which are particularly convoluted in the so called
"special purposes" cases, that is cases involving journalism
and artistic expression. I should stress that the Assessment I
make is not binding, it is essentially a statutory informed opinion.
No one knows when, where and how these cases
will come forward. We will have to wait and see. But my prediction
is that they will come forward and that I will have a role to
play.
I would like to make four further points.
First, a brief word about section 32 which provides
exemptions in relation to data processing for journalism, artistic
or literacy purposes—the so called "special purposes".
The Court of Appeal adopted a wide approach to this exemption.
They made it quite clear that it applies after, as well as before,
publication, even though it is quite clear that much of the rationale
for this provision is in order to seek to ensure that the Data
Protection Act does nor provide a mechanism for prior restraint.
The important message, however, is that this does not provide
unlimited exemption from the whole Act for the media. This is
very clearly not the case. The section 32 exemption only applies
in relation to particular provisions of the Act and only applies
to the extent that there is a reasonable belief that otherwise
journalistic purposes would be prejudiced. Section 32 certainly
does not provide carte blanche for the media.
Second, section 53 of the Act empowers me, on
receiving an appropriate request, to provide assistance to an
actual or prospective litigant who is involved in proceedings
under specified parts of the Act. These proceedings must relate
to the "special purposes" and assistance can only be
provided where the case "involves a matter of substantial
public importance". There has not been a case where assistance
has been provided under section 53 yet. However, it is clearly
a possibility for the future. To speculate a little it seems to
me quite possible that the sort of case where I might consider
that assistance is warranted is where there has been a gratuitous
disclosure of the identity of a private individual, someone who
is not at all in the public eye, in circumstances where revealing
the identity of the individual cannot sensibly be held to be a
matter of legitimate public interest. In such circumstances I
may well decide that it is a matter of "substantial public
importance" to clarify the application of the law in this
area. I should stress, however, that I do not consider it was
Parliament's intention that I should routinely support all those
whose cases have merit.
I should make clear that I have no powers to
punish a data controller for a non criminal breach of the Principles.
Nor do I have any power to award compensation. However, section
13 of the Act provides that an individual who suffers damage by
reason of any contravention by a data controller of any of the
requirements of the Act may claim compensation in the courts.
Where the contravention involves the processing of personal data
for "special purposes" then an individual is entitled
to compensation where he or she suffers distress regardless of
whether he or she is able to prove that actual damage has occurred.
For the sake of completeness I ought to also
mention the existence of section 55 of the 1998 Act. This creates
a criminal offence in relation to the unlawful obtaining and use
of personal data. The section 32 exemption has no relevance here
at all and the section applies to members of the media in the
same way as anyone else. This offence arises where a person knowingly
or recklessly obtains or discloses personal data without the consent
of the data controller. This may arise, for example, where a journalist—or
his agent—impersonates someone to obtain personal information
from a bank of from a government department such as the Inland
Revenue. There are various defences available but these are narrowly
drawn.
I would like to conclude by stressing several
points:
— The Court of Appeal decision in Campbell
is not the last word on the development of a law of privacy.
— As Information Commissioner I do
not want, or seek, to be a backdoor regulator of the press.
— However the media do not have carte
blanche. The special provisions relating to journalism do not
take the media outside the Data Protection Act altogether.
— My approach will be to promote good
information handling practice amongst all data controllers, including
the media. This will involve a great deal of persuasion, cajoling
and the use of both carrots and sticks.
— There are enforcement powers and
it may be necessary to take appropriate action in blatant cases—probably
cases involving private citizens, where there is no genuine public
interest, where their privacy has been invaded as a result of
clearly improper conduct in relation to the handling of personal
information.
Finally, I should emphasise that I am not advocating
the creation of a statutory right to privacy. That is a matter
for Ministers and Parliament. However, I am anxious that the Committee
is aware of the extent to which I have a role to play in this
area under existing legislation.
February 2003
| 
