CHAPTER 4: Improving Protection of
Privacy
90. There are a series of distinct areas in which
the current operation of the law could be further improved. We
discuss these in this chapter.
Online enforcement
91. New and digital media present many challenges
for enforcing and maintaining privacy injunctions. Injunctions,
where appropriately granted, are necessary to protect individual
privacy; indeed, they are often the only means of protecting it.
If injunctions are to provide adequate protection, it is essential
that there are no avoidable barriers to their enforcement. The
Giggs case, and other cases, demonstrate that steps should
be taken to limit the capacity for online breaches.
92. New media have greatly increased the range
and availability of information sources; in addition, technological
developments have allowed citizens to become "publishers".
Anyone can make his or her views known to the world, or can break
their own news. This has obvious benefits for freedom of expressionthe
role of Twitter in fostering the exchange of ideas and the organisational
capability that led to the Arab Spring, for example, is widely
documented. At the same time, the internet is also acknowledged
to have had far-reaching effects on individual privacy.
93. The removal of the traditional publisher's
role of "gatekeeper" gives everyone, through new media,
the opportunity to disseminate information, and to express their
views. Views on privacy, on the boundaries of private life, and
on the nature of the public interest are not universally shared.
The internet allows those who have competing views to give effect
to them, and to publish information which would not ordinarily
be published in traditional media.
94. The global nature of the internet also poses
jurisdictional challenges, as much of the material accessed from
the United Kingdom is published on servers hosted in foreign domains.
We heard from UK-based bloggers whose blogs are physically hosted
in the United States, in order to benefit from First Amendment
protections there.[103]
This is done in order to protect the blog against legal action
in the UK which, whilst still possible, would become more difficult
and expensive as a result of the overseas hosting.[104]
95. Max Mosley explained how, since his successful
privacy action against the News of the World, he had sought
to remove videos which breached his privacy from the internet,
which required repeated action in numerous different jurisdictions.
He had spent over £500,000 on actions in 23 different countries
to try to remove offending material from the internet.[105]
Nonetheless the offending material can still be found on the web.
96. The proliferation of online media outlets
increases the possibility for injunctions to be breached, and
offers the potential for injuncted information to be spread quickly
around the world. The challenges posed to injunctions were demonstrated
in May 2011 when the Giggs injunction was broken by at least one
Twitter user and the information repeated as many as 75,000 times.
Whilst there are unlikely to be easy solutions to this problem,
we have considered a number of practical steps which can be taken
to limit the potential for online breaches of privacy and privacy
injunctions.
CONTEMPT OF COURT
97. Mainstream newspapers are invariably served
with the terms of injunctions granted against newspapers and so
usually take care not to breach them.[106]
Individuals who reveal information subject to an injunction usually
have not been served with it. However, if they publish injuncted
information online knowing there is an injunction in place, in
principle they run the risk of being held to be in contempt of
court.[107]
98. The onus for bringing contempt proceedings
in privacy cases lies with the party who sought the injunction
in the first place. This is as it should be; having requested
the injunction it is primarily for the claimant to enforce it.
However, for reasons of cost and practicality claimants are unlikely
to pursue every breach of an injunction on the internet. Moreover,
an action for contempt of court will add to the publicity about
the case, which after all concerns a matter the claimant considers
private.
99. There can be difficulties in bringing action
in respect of breaches of injunctions online. In the main, these
difficulties are due to the cross-jurisdictional nature of the
internet, as well as the capacity for anonymous posting from internet
service providers which do not easily identify their end-user.
However, these difficulties are not always insurmountable.
100. Action can be taken to determine the identity
of individuals behind Twitter accounts, and Twitter will hand
over the information of account holders when presented with a
valid court order.[108]
Personal data cannot otherwise be handed over without risk of
breaching data protection law. Action has been taken against identifiable
Twitter users in a number of recent cases including, for example,
prosecutions for racist abuse and hoax bomb threats. Action has
also been taken against Facebook users recently, for example,
for incitement to riot. The internet is not, therefore, ungoverned
by the law, or without enforcement options.
101. Information obtained from content platforms
such as these might not always easily identify the end-user responsible
for publishing breaches. In addition, action taken to obtain such
disclosures of information will add to the cost of the injunctive
process, as would any subsequent action for contempt of court.
102. Proceedings for civil contempt of court
(the vast majority of proceedings concerning privacy injunctions
will be civil claims) can also be brought by the Attorney General
in his role as Guardian of the Public Interest. The Attorney General,
the Rt Hon Dominic Grieve QC MP, said this is a "reserve
power" which would be used only in exceptional circumstances
as he is not a party to the proceedings and will not normally
have knowledge of individual cases.[109]
103. Whilst not wishing to spend public funds
on enforcing civil litigation as a matter of course, the Attorney
General said that he might consider bringing proceedings in exceptional
circumstances, where there is a clear public interest in doing
so and where it is unlikely that anybody else would initiate such
proceedings. The examples he gave of when that might happen were
if a breach of a civil order was endangering somebody's life,
seriously endangering their welfare or if there was a "systematic
conspiracy ... to undermine the ability of the civil courts to
carry out their work."[110]
It was suggested that the single most effective measure for enforcing
an injunction which had been widely flouted would be for the Attorney
General to bring an action for contempt.[111]
104. We believe the Attorney General should
be more willing to exercise his power as Guardian of the Public
Interest to bring actions for civil contempt of court in respect
of breaches of injunctions online. The threshold for him intervening
should be lower. Such action would provide a strong deterrent
against future such breaches.
NOTICE AND TAKE DOWN
105. Internet access providers, hosting providers,
content platforms and publishers[112]
typically operate on a notice and take-down basis. That is, they
take down illegal material once they have been notified by a complainant
that the material is, for example, defamatory or breaches copyright,
otherwise they may be exposed to liability. The same principle
applies to material infringing privacy. Companies managing information
publication and distribution on a global basis might not always
know whether or not information breaches the law in a particular
jurisdiction. They therefore await notice from a court or other
official entity before reactively taking down prohibited material.
106. Such an approach allows compliance with
court orders, whilst also complying with the European Electronic
Commerce Directive[113]
and preventing internet service providers (ISPs) from having to
vet content on the internet.[114]
Witnesses representing ISPs and social networks were clear they
would remove infringing content if they were to receive a notice
alerting them to it.[115]
Wikipedia pages can be amended by anyone, and are governed by
a community with well-developed policies and guidelines,[116]
including compliance with the site's local law in Floridathough
we heard evidence that the process is not perfect.[117]
107. Notice and take down is not without difficulties,
mainly because of jurisdictional issues.[118]
Paul Staines hosts the Guido Fawkes blog in the United States.
While hosting in the US may provide some protection for the content
on the website owing to the First Amendment, the individual authors
and publishers of material can still be subject to the jurisdiction
of UK courts. The Attorney General suggested that action might
be possible, for example, against an individual blogging in the
United States, in defiance of court orders, who subsequently visited
the United Kingdom.[119]
108. A new Twitter policy allows the company
to filter content on an "in-country" basis. Upon receipt
of a court order or notice from an "authorised entity",
Twitter can selectively block content in one country, whilst leaving
it available to users in other parts of the world.[120]
But a careful balance must be struck between protecting privacy
and freedom, and Britain should only participate very reluctantly
in any restriction on the freedom to communicate over the internet,
which is proving such a vital weapon against dictatorship. The
"Chilling Effects" website will keep a log of all tweets
restricted; viewers in the country where it is blocked will see
a grey box displayed in place of the tweet. The intention is to
allow Twitter to remain compliant with the law in the domains
in which it operates, whilst also providing transparency around
the way in which the new policy is operating.[121]
In oral evidence to the Leveson Inquiry Twitter appeared to suggest
that a ruling from the Press Complaints Commission, as currently
established, would not trigger Twitter to remove a tweet.[122]
109. We recommend that, when granting an injunction,
courts should be proactive in directing the claimant to serve
notice on internet content platforms, such as Twitter and Facebook.
Beyond that, claimants in privacy cases should make full use of
notice and take-down procedures operated by responsible internet
service and social media providers, who should also seek to disseminate
best practice and discourage illegality amongst users and other
providers.
THE ROLE OF SEARCH ENGINES
110. A weakness of notice and take-down procedures
is that some content providers and hosting companies may require
separate notice for each individual offending item. In cases where
there are many offending items, obtaining such notices could well
become a costly and time-consuming procedure.
111. Max Mosley explained the difficulties he
had faced in trying to press Google to remove offending pictures
from its image search facility
"Every time an obscure, tiny site in the Andes
puts it up, you have to put your lawyers into action to take it
down. We had a very high-level meeting with Google in which I
said, "Here are the pictures. We know which ones they are.
Simply programme your search engine so they don't appear."
That is demonstrably technically feasible. They refused to do
it as a matter of principle."[123]
112. In response Daphne Keller, Associate General
Counsel at Google, said
"We do not have a mechanism that finds duplicates
of pictures or text and makes them disappear from our Web Search
results. As a policy matter, I do not think that would be a good
idea, simply because an algorithm or a computer programme that
tried to do something like that would not have the ability that
a judge does or any person does to see the context, to see if
a particular phrase is actually appearing in a news report or
in political commentary."[124]
113. Ms Keller acknowledged that it might be
technically possible to develop algorithms that allow Google to
filter in the manner suggested by Mr Mosley in future, but argued
that this would not be desirable from a policy point of view,
as it would require Google as an intermediary proactively to monitor
content on the internet.[125]
In addition, she said the European Court of Justice in Scarlet
v SABAM[126] had
ruled that pro-active monitoring was not required under the Electronic
Commerce Directive, and an attempt to require them pro-actively
to monitor may not be consistent with the Directive.[127]
114. Where an individual has obtained a clear
court order that certain material infringes their privacy and
so should not be published we do not find it acceptable that he
or she should have to return to court repeatedly in order to remove
the same material from internet searches.
115. Google acknowledged that it was possible
to develop the technology proactively to monitor websites for
such material in order that the material does not appear in the
results of searches. We find their objections in principle to
developing such technology totally unconvincing. Google and other
search engines should take steps to ensure that their websites
are not used as vehicles to breach the law and should actively
develop and use such technology. We recommend that if legislation
is necessary to require them to do so it should be introduced.
LIMITING THE CIRCULATION OF INJUNCTION
NOTICES
116. In order to appear online, information breaching
an injunction may originate from someone who has knowledge of
the injunction. At present, it would be difficult to know who
the source of the "leak" might bethe options
could include a friend of either party, the parties themselves,
those involved in the legal process, notified media parties and
a multitude of others.
117. Steps could be taken to limit the distribution
of injunction notices and consequently limit the number of people
who know of an injunction. When issued with an injunction, media
bodies will internally distribute it, in order that the injunction
is not breached. Circulation of the notice within newsrooms could
be limited to senior editors and the legal department.[128]
118. Measures which help to restrict knowledge
of injuncted material are to be welcomed, as they reduce the potential
for breaches at a later date. We understand, however, that a certain
level of knowledge is required in each newsroom in order to ensure
that an injunction is not inadvertently breached.
119. When issued with an injunction, media
organisations should only circulate the notice to those employees
who have authority to publish. An up-to-date list of these individuals
should be maintained by each organisation, and made available
to the court upon request.
Remedies
120. Once privacy has been breached, it can be
difficult to provide a satisfactory remedy, as it is not possible
to make the information "private" again. For this reason
most individuals would prefer to prevent a breach of privacy occurring
in the first place. Injunctions are, of course, one means of doing
this; mediation and arbitration may provide another (this is discussed
further in the next chapter). Other remedies are available to
the courts when someone's privacy has already been infringed.
PRIOR NOTIFICATION
121. Some witnesses argued that when a newspaper
plans to write about something which concerns a person's privacy,
there should be a legal requirement to inform that person, so
that he or she has the opportunity, if appropriate, to seek to
prevent its publication, perhaps by obtaining an injunction.[129]
This is known as "prior notification".
122. Max Mosley took a case to the European Court
of Human Rights claiming that his article 8 right to privacy was
infringed by the failure of the UK government to require by law
prior notification where a story concerns intimate or sexual details
about someone's private life. In May 2011 the Court found that
the European Convention on Human Rights did not oblige such a
measure, and said that compulsory prior notification would be
unworkable and have a disproportionate "chilling effect"
on the media.[130]
123. We heard widespread support for prior notification
becoming a requirement for editors intending to run a story which
compromises an individual's private life.[131]
As with other civil actions, the primary remedy once an individual's
privacy has been breached is damages. It was suggested that a
failure to pre-notify could be considered to be a factor which
might justify an award of aggravated damages when they are subsequently
assessed by a court.[132]
124. At present claimants seeking a privacy injunction
are required by section 12(2) of the Human Rights Act 1998 to
notify other parties to the claim of their intention unless there
are "compelling reasons" not to notify. It might be
considered ironic that such notification is required by the individual,
but a newspaper is not required to notify an individual when it
intends to publish something about that person's private life.[133]
125. Prior notification is, however, the norm
across the newspaper industry. We heard that the times when prior
notification is not given are "minuscule".[134]
The reasons for not providing prior notification could include
preventing the "tipping off" of criminals, and reducing
the risk that the story in question might be run by another newspaper.[135]
Clearly, in some cases, such as the criminal cases cited by newspapers,
there is a public interest in not providing prior notification,
though the risk of being "scooped" by a rival publication
does not seem to us a relevant public interest consideration.[136]
126. It was suggested that a requirement for
prior notification should be contained in the Press Complaints
Commission's Editors' Code of Practice.[137]
Such a measure was recommended by the House of Commons Culture,
Media and Sport Committee in its 2010 report Press standards,
privacy and libel, which expressed surprise that prior notification
was nowhere mentioned in the Code.[138]
127. We reject the case for a statutory requirement
to pre-notify. However, the reformed media regulator's code of
practice must include a requirement that journalists should notify
the subject of articles that may constitute an intrusion into
privacy prior to publication, unless there are compelling reasons
not to.
128. If a complaint is made to the new regulator
about an individual's right to privacy having been infringed and
that individual was not given prior notification of the story,
the publication should be required to explain why they did not
do so. If it was because it was in the public interest not to,
the publication should state how, and with whom, the public interest
was established at the time.
129. Courts should take account of any unjustified
failure to pre-notify when assessing damages in any subsequent
proceedings for breach of article 8.
LEVEL OF DAMAGES AND EXEMPLARY DAMAGES
130. The News of the World was required
to pay Max Mosley damages of £60,000, along with a proportion
of Mr Mosley's legal costs. This was the largest sum ever paid
out in a privacy claim.[139]
Naomi Campbell was awarded damages of £3,500 for her successful
privacy claim; Michael Douglas and Catherine Zeta Jones £14,600.[140]
These sums are small in comparison to awards in other fields of
civil law, notably defamation. Mr Mosley was still left significantly
out of pocket despite the success of his legal case.[141]
131. Some witnesses suggested that exemplary
damages should be able to be awarded in privacy cases.[142]
Such damages would not necessarily reflect the harm caused to
the claimant, but would be set at such a high level as to deter
future privacy breaches. It is doubtful, however, whether on the
present law the courts have the power to award exemplary damages
for misuse of private information.[143]
132. We heard concerns that the award of exemplary
damages might limit the capacity of newspapers to contest a legal
action when they believed that they had a clear public interest
defence. The threat of exemplary damages could make newspapers,
particularly local and regional newspapers, cautious about contesting
a case.[144] This would
negatively affect their ability to pursue investigative journalism.
Moreover, awards of exemplary damages depart from the normal principle
that damages should compensate the claimant and not punish the
defendantthough they may be awarded in defamation cases.
133. In February 2012, in deciding not to grant
an injunction in respect of information about Jonathan Spelman,
son of the Secretary of State for Environment, Food and Rural
Affairs, the Rt Hon Caroline Spelman MP, Mr Justice Tugendhat
suggested that damages awarded in earlier privacy cases, such
as Naomi Campbell's, should not be assumed to reflect the limit
of the court's powers. He referred to the amounts involved in
recent settlements of phone hacking cases.
134. Whilst damages for breaches of privacy
are never as good as preventing the breach in the first place,
the maximum level of damages that has been awarded is too low
to act as a real deterrent. We recommend that the courts should
have the power to award exemplary damages in privacy cases, if
necessary by giving the courts that power through legislation.
In deciding whether to award exemplary damages the courts should
take into account the financial situation of the media organisation
concerned.
Costs and access to justice
135. The costs of bringing and defending privacy
actions are both too high. They have largely increased as a result
of case law, with increasing amounts of information being required
of applicants and respondents. In addition, due to the nature
of the matters at hand, and impending publication deadlines, applications
are usually drafted and heard at the last minute, which further
increases costs.[145]
136. For claimants, it is apparent that legal
redress is beyond the means of most ordinary citizens. Max Mosley
spent £510,000 on legal fees on his case.[146]
Keith Mathieson, a partner at Reynolds Porter Chamberlain, estimated
the minimum cost of obtaining an interim injunction would be £15,000
to £25,000more depending on the degree of opposition
to it. It costs a lot more to take a privacy case to full trial;
he said that Rio Ferdinand's costs in his case were about £270,000
or £280,000.[147]
137. The legal costs for respondents can also
be significant. Ian Hislop, editor of Private Eye, estimated
they had spent £350,000 defending one case, and £75,000
on challenging the super-injunction obtained by Andrew Marr.[148]
Mirror Group newspapers spent £160,000 defending Rio Ferdinand's
case.[149]
138. Excessive costs limit the ability of newspapers
and broadcasters to respond to threatened legal action and can
result in them not challenging an injunction on the ground of
cost alone.[150]
139. Whilst it is ultimately the approaches taken
by the parties to a claim that determines costs, a number of measures
can be taken to reduce costs when claims came to court. These
include robust case management from judges, limiting the number
of hearings and dealing with arguments on paper.[151]
140. There is a power under the Civil Procedure
Rules to cost cap. We heard that a practice direction states that
the power should only be used in exceptional cases, meaning it
is hardly ever used. The practice direction could be removed to
allow for more liberal use of cost capping, for both claimants
and defendants.[152]
141. The costs of a privacy action are prohibitive
to many possible claimants, and can also act to stifle the freedom
of the press. Judges and legal representatives must take all possible
steps to manage costs more effectively. In particular, we recommend
that the practice direction which limits cost capping to exceptional
cases should be removed for privacy actions.
CONDITIONAL FEE AGREEMENTS
142. Conditional fee agreements (CFAs)
allow cases to be pursued on a "no win, no fee" basis.
Most commonly, the claimant is legally represented on the basis
that if he or she does not win the case they pay no legal fees.
If they win a "success fee" is payable in addition to
the normal fees. Often insurance is taken out to cover the costs.
CFAs have been used by both claimants and defendants in privacy
cases.
143. The Government are proposing significant
changes to CFAs in the Legal Aid, Sentencing and Punishment of
Offenders Bill, which has been proceeding through Parliament during
our inquiry. Because the two Houses have been examining the Bill
closely, and because CFAs apply in many areas of law other than
privacy, we have not sought extensive evidence on them. However,
we here offer some general conclusions based on the evidence of
how they have been used in privacy cases.
144. Whilst CFAs are of limited use in seeking
injunctions, they are often utilised by clients of limited means
who are looking to take post-publication privacy action.[153]
They are also used by defendants; Alex Hall explained how, eventually,
she had been able to defend her case once she had entered into
a conditional fee agreement with a specialist solicitor.[154]
145. For newspapers, CFAs increased the likelihood
that they would be placed at risk of legal action. This might
be considered to affect newspapers' right to freedom of expression,
both in terms of not publishing investigative articles which risk
provoking litigation, and of settling claims which they would
otherwise defend, due to the fear of excessive costs being incurred.[155]
146. CFAs are defended because they provide a
mechanism for people of limited means to exercise their privacy
rights. Concern was expressed that the reforms currently proposed
by the Government in this area were likely to leave access to
justice "significantly curtailed".[156]
147. Access to justice is essential for those
whose privacy is infringed. Conditional fee agreements have provided
people of limited means with the ability to take action when their
right to privacy has been infringed; they have also been used
by defendants in privacy cases. We have not sought to enter the
wider debate on the future of CFAs, but stress that following
the reforms to them it is important that access to justice is
maintained for all citizens when seeking to protect their right
to privacy.
BETTER REGULATION
148. Most known privacy cases involve wealthy
figures, who are often in the public eye. That perhaps is predictable,
as these are the types of individuals whom newspapers wish to
write about, and the types of person who can afford to go to court
to protect their privacy.[157]
However, the impact of a privacy invasion for those who are not
in the public eye can be just as severe.
149. If individuals who have suffered, or might
suffer, an invasion of privacy do not have the means for recourse
to legal action, it is essential that there are other avenues
for redress available to them. There is a case for a reformed
media regulator to play a much greater role in protecting privacy.[158]
150. Many individuals cannot seek redress
for a breach of privacy because the legal costs are beyond their
means. It is essential that a reformed media regulator provides
an alternative route, which is cost free, to prevent and redress
breaches of privacy.
151. The following chapter discusses in more
detail how a reformed regulator can do that.
103 Q 398. Back
104
QQ 398-400. Back
105
Q 731. Back
106
Though we have heard evidence about "jigsaw identification"
by publishers whereby a story about an anonymised injunction is
juxtaposed with pictures of or a story about the individual who
is thought to have obtained the injunction, so as to give a strong
impression to the reader of who has obtained the injunction. Back
107
Q 1078. Back
108
Q 107-10. Back
109
Q 1070. Back
110
Q 1070. Back
111
Q 117. Back
112
For explanations of these terms see the evidence of Nicholas Lansman,
secretary general of the Internet Service Providers Association
(Q 557). Back
113
2000/31/EC. Back
114
Q 565. Back
115
QQ 566-7 and 1436. Back
116
Q 575. Back
117
Cohen; Kolbe and Buckner. Back
118
Q 567. Back
119
Q 1077. Back
120
Q 1418. Back
121
Q 1447. Back
122
7 February 2012. Back
123
Q 739. Back
124
Q 1403. Back
125
Q 1421-2. Back
126
Case C-70/10. Back
127
Q 1409. Back
128
Q 106; Schillings; Grabiner and Hughes. Back
129
QQ 697 and 707. Back
130
Mosley v United Kingdom [2011] ECHR 774. Back
131
Q 708. Back
132
Carter-Ruck. Back
133
Q 102. Back
134
Q 1262. Back
135
QQ 1262-5 and 1561-2. Back
136
Scott. Back
137
Brett. Back
138
Culture, Media and Sport Committee, 2nd Report (2009-10):
Press standards, privacy and libel (HC 362-I), paras 91
to 93. Back
139
Mosley. Back
140
Douglas v Hello Ltd [2005] EWCA Civ 595 at [25]. This comprised
only £3,750 each solely for breach of privacy. £7,000
was awarded between them for the cost and inconvenience of hurriedly
making a selection of authorised photos for OK! magazine,
and nominal damages of £50 each were awarded for infringement
of the Data Protection Act 1998. Back
141
Q 733. Back
142
Grabiner and Hughes; Petley; Carter-Ruck. Back
143
Mosley v NGN [2008] EWHC 1777. Back
144
Newspaper Society; Chartered Institute of Journalists; Society
of Editors. Back
145
Law Society. Back
146
Q 733. Back
147
Q 42. Back
148
Q 196. Back
149
Q 42. Back
150
Chartered Institute of Journalists; Society of Editors; Newspaper
Society; BBC. Back
151
Carter-Ruck. Back
152
QQ 1249-50. Back
153
QQ 78-80. Back
154
QQ 1677-81. Back
155
Foot Anstey. Back
156
Supplementary evidence from Pepper. Back
157
QQ 42 and 76. Back
158
Media Standards Trust. Back
|