I. Introduction
There is a widespread belief that London is the “libel capital of the world” and that both European and American defamation laws afford “better protection for media defendants”.Footnote 1 Nevertheless, for over a decade, English defamation law has been evolving in a more free-speech-friendly direction. The Defamation Act 2013 not only consolidates that shift, but furthers it considerably, thereby heightening concerns that gaps in the proper protection of natural persons' traditional right to reputation may have emerged. In this changing context, it is important to explore whether such claimants might increasingly rely successfully on data protection in order to vindicate this right. As will be seen, the broad purposes of this statutory scheme together with its complex structure mean that such claimants could seek to hang their argument on any one of a number of its provisions. Recourse to data protection law may be particularly enticing due to the fact that, over the very same time that defamation law has been liberalising, it has generally become more onerous. Both the broad scope and potentially onerous depth of data protection were recently highlighted by the seminal Court of Justice of the EU judgment of Google Spain which found that search engines had significant and ongoing responsibilities when indexing material from the public web.Footnote 2 Nevertheless, it remains true that data protection law in the UK contains numerous limitations and exemptions which seek to constrain its effect. Moreover, national jurisprudence on data protection is both limited and sometimes confused. In spite of this, it is the central argument of this article that data protection law will assume significantly greater importance in vindicating reputation over the coming years, especially in actions against website operators facilitating the dissemination of information posted by a third party, those involving the publication of opinion, or where either injunctive relief or the correction of inaccurate information is sought (in particular in cases of continuing online disclosure).
The article is structured into five sections. Following this brief introduction, section two explores both the fundamental concepts and historic contours of the law in this area. Section three then outlines the changes to defamation law made by the Defamation Act 2013 together with relevant developments within data protection, which largely arise from recent case law and changes in regulatory approach. This leads to section four which directly considers the way in which data protection might assume a greater role in vindicating the traditional right to reputation in the future. Lastly, the final section draws the strands of the argument and offers some conclusions.
II. Fundamental Concepts and Law
This article explores the role of two sets of laws – defamation and data protection – in protecting an individual's traditional “right to reputation” from publication which may violate it. Given this, it is important at the outset to explore in some detail the meaning and import of both the “right to reputation” as traditionally conceived and the right to freedom of expression which is in inevitable tension with it. Following this outline, the section then elucidates the historic purpose and contours of both defamation and data protection law. Finally, brief mention is made of the tort of malicious falsehood.
A. The “Right to Reputation” and Freedom of Expression
Reputation is defined by the Oxford English Dictionary as “[t]he general opinion or estimate of a person's character or other qualities; the relative esteem in which a person or thing is held”. Within the Western tradition, there is a long-standing and strong consensus that both reputation and the right to it are of foundational importance. Thus, Solove argues that:
[o]ur reputation is one of our most cherished assets …. Our reputation is an essential component of our freedom, for without the good opinion of our community, our freedom can become empty …. Our reputation can be a key dimension of our self, something that affects the very core of our identity. Beyond its internal influence on our self-conception, our reputation affects our ability to engage in basic activities in society. We depend upon others to engage in transactions with us, to employ us, to befriend us, and to listen to us.Footnote 3
In support of these arguments and assertions, Solove cites Shakespeare, Arthur Miller, President John Adams, and the sociologist C.F. Cooley.
Notwithstanding the centrality of the right to reputation, its precise scope remains ambiguous. Firstly, it is unclear whether reputation only covers the dissemination of statements which either directly or by necessary implication reflect on a person's esteem. Secondly, to the extent that its ambit is so restricted, the standards by which such an evaluation is made must be determined. At one extreme, statements interfere with reputation even if a person's esteem is only negatively affected in the eyes of just one individual. Many, however, reject such an interpretation fearing that allowing for “a search for the few idiosyncratic individuals who would think less of the plaintiff for conduct that the overwhelming majority would find laudatory” would open the door to “chaotic individualism”.Footnote 4 Jurisdictions, therefore, generally seek to restrict the situations in which such a right can be invoked. Indeed, rather at the other extreme, claimants may have to demonstrate that the “right-thinking member of society generally”Footnote 5 would consider that the statement in question would reflect negatively upon them. Between these two poles, some jurisdictions require only that a “substantial and respectable minority” of society would hold such an opinion.Footnote 6 Yet introduction of any such qualification poses difficult practical and theoretical challenges. Practically, published statements that say a person is a police informant or homosexualFootnote 7 may cause that individual considerable distress or even pecuniary damage. However, at least in 2013, it is not clear that any such statements would be actionable under the latter two standards detailed above. Moreover, at a theoretical level, it may be argued that the notion of a societal or communal consensus regarding estimation is a “myth” which often allows judges, even if unconsciously, to impose their values on the situation.Footnote 8
One historic consensus within the English tradition, however, is that the right to reputation cannot restrict the distribution of accurate, even if negative, statements about an individual. Thus, Rodgers argues that the law takes the view that “if people think the worse of [the claimant] when they hear the truth about him that merely shows that his reputation has been reduced to its proper level”.Footnote 9 Whilst challenged by new conceptualizations which have tended to merge such rights with broader notions of personal integrity including privacy, this traditional conceptualization will be accepted for the purposes of this article. Nevertheless, and importantly, it must be stressed that particular laws differ as to whether they place on claimants a requirement to prove any such inaccuracy or whether, absent sufficient contrary evidence, this is simply presumed. Moreover, statements of opinion may also be published which, although clearly impacting on reputation, are intrinsically incapable of being either accurate or inaccurate. An example would be asserting that somebody is a “depraved” individual. In such cases, criteria other than truth or falsity must be used to determine the statement's legality.
Irrespective of whether the statements in question are ones of opinion or alleged fact, there is also a consensus that the right to reputation is in necessary and fundamental tension with the right to “receive and impart information and ideas”Footnote 10 – a key aspect of another central value within Western society, namely freedom of expression. A reconciliation between these values is, therefore, necessary. Lord Steyn provides a useful summary of the various rationales for according freedom of expression strong weight:
Freedom of expression is, of course, intrinsically important: it is valued for its own sake. But it is well recognised that it is also instrumentally important. It serves a number of broad objectives. Firstly, it promotes the self-fulfilment of individuals in society. Secondly, in the famous words of Holmes J. (echoing John Stuart Mill), “the best test of truth is the power of the thought to get itself accepted in the competition of the market” …. Thirdly, freedom of speech is the lifeblood of democracy. The free flow of information and ideas informs political debate. It is a safety value: people are more ready to accept decisions that go against them if they can in principle seek to influence them. It acts as a brake on the abuse of power by public officials. It facilitates the exposure of errors in the governance and administration of justice of the country.Footnote 11
The seminal importance of freedom of expression is recognised in the fact that it is set out as a stand-alone fundamental right within both the European Convention on Human Rights (ECHR)Footnote 12 and the EU Charter of Fundamental Rights.Footnote 13 At the same time, in cases where “an attack on a person's reputation” attains “a certain level of seriousness and in a manner causing prejudice to personal enjoyment of a right to respect for private life”,Footnote 14 the right to reputation is also recognised as falling within another right protected by both these instruments, namely the fundamental right to respect for private and family life. Additionally, as will be explicated below, the right to reputation of natural persons will generally fall within the right to the protection of personal data, which is recognised as a discrete fundamental right within the EU CharterFootnote 15 (but not the ECHR). When such fundamental rights are at stake, it is recognised that the courts must accord each right “equal respect”Footnote 16 and seek to strike a “fair balance”Footnote 17 between them in the concrete situation. In interpreting the law, courts should have recourse to an “ultimate balancing test” involving “an intense focus on the comparative importance of the specific rights being claimed in the individual case” coupled with a taking into account of “the justifications for interfering with or restricting each right”.Footnote 18
B. Defamation
Defamation law has long enjoyed a position of clear dominance in the vindication of the traditional right to reputation. This is reflective not only of its historical pedigree – it can traced back to the eleventh century within English lawFootnote 19 – but also to the fact that it has traditionally afforded “greater weight to the rights of the claimant at the expense of those of the defendant”.Footnote 20 Historically, this law has provided protection against any publication of a statement which has a tendency to have an adverse effect on reputation. Publication here is defined broadly as any dissemination to a person other than the claimant or one's spouse.Footnote 21 In contrast, reputation is defined relatively narrowly so as to protect only against statements which would “tend to lower the plaintiff in the estimation of right-thinking members of society generally”Footnote 22 or tend to lead members of society to shun or avoid him.Footnote 23 Thus the Court of Appeal held in Byrne v Deane that to say, even if manifestly falsely, of a person that “he has reported certain acts, wrongful in law, to the police, cannot possibly be said to be defamatory of him”.Footnote 24 On the other hand, the reputations of not only natural persons, but also most artificial persons, including corporations, are covered. The law is also based on a presumption that statements are false. Therefore, although the substantial accuracy of a statement constitutes a complete defence, defendants must prove this according to the ordinary civil standard. Absent an appropriate defence, liability in defamation is strict.Footnote 25 Moreover, at least when the statement is published in “permanent form”Footnote 26 and therefore constitutes a libel, a “conclusive or irrebutable presumption of damage”Footnote 27 historically applied. Thus, defamation was generally actionable per se. Finally, English defamation law has adopted a generous approach to assessment of damages providing not only compensation for actual damage to reputation and mental distress, but also acknowledging that “in case the libel, driven underground, emerges from its lurking place at some future date, he [the Claimant] must be able to point to a sum … sufficient to convince a bystander of the baselessness of the charge”.Footnote 28 Both aggravated and punitive damages may also be awarded.Footnote 29 The generosity of defamation awards was also related to the fact that claimants in defamation actions were historically entitled to a jury trial “unless the court is of the opinion that the trial requires any prolonged examination of documents or accounts or any scientific or local investigation which cannot conveniently be made by a jury”.Footnote 30 If a jury is appointed, then it has the responsibility of setting any award of damages in the first instance.
Although much of the core of defamation is stringently formulated, the law also includes important limitations which have been widened over time. The restrictive meaning given to the term reputation has already been noted. Secondly, turning to the relief obtainable, under the rule in Bonnard v Perryman,Footnote 31 the court is essentially prevented from granting an interim injunction so long as the defendant contends that a defence of the words will be mounted at the full hearing. Moreover, even before the abolition of a right to jury trial in the Defamation Act 2013, Court of Appeal control of excessive jury awards has not only always been possible but such control had been strengthened as a result of both legislation and case law.Footnote 32 Thirdly, legal aid has never been available in defamation actions. Moreover, whilst introduction of Conditional Fee Arrangements (CFAs) in the 1990s did increase opportunities for individuals to pursue a remedy in defamation, there is increasing pressure to prevent the additional costs of these agreements (namely “success fees” and after-the-event insurance) being passed on to the losing side.Footnote 33 Fourthly, in recognition of the potential “‘chilling’ effect” of its “rigorous, reputation protective principle”,Footnote 34 defamation law has long included a range of defences at both common law and in statute. Some of these provide absolute protections such as when parliamentaryFootnote 35 or UK court proceedingsFootnote 36 are being reported. Similarly, defendants are also free to disseminate opinions so long as these are based on facts which are both true and at least implicitly referred to, are held honestly, and, prior to the Defamation Act 2013, involved a matter of “public interest”.Footnote 37 Both these latter concepts have been defined liberally. Thus, an opinion will still be “honest” if it can be said that some honest or fair man “however exaggerated or obstinate his views” would have made the statement.Footnote 38 Meanwhile “public interest” was interpreted as covering any matter which the public at large “may be legitimately interested in, or concerned at”.Footnote 39
Other defences to a defamation action are qualified in that they may be defeated by the claimant demonstrating that the defendant's dominant purpose was to use a privileged occasion for an “indirect or improper motive”.Footnote 40 Thus, under statute, defendants are empowered to freely disseminate a wide range of specified material subject to this safeguard.Footnote 41 Moreover, under the common law, they also have a qualified right to convey information, even which turns out to be untrue, to anybody with an interest in receiving it so long as they also have a reciprocal moral, social, or legal duty to provide such communication. Most significantly, in Reynolds, the House of Lords modified this common law doctrine so as to also protect “responsible”Footnote 42 journalistic publication in situations when “the public was entitled to know the particular information”.Footnote 43 The court, however, stressed that such matters could only be assessed by having “regard to all the circumstances”,Footnote 44 with Lord Nicholls providing a list of 10 non-exhaustive, multi-factorial, and illustrative indicia which might be taken into account in this regard.Footnote 45Reynolds' “lack of hard edges in respect both of its reach and its effect”Footnote 46 led to a rather uncertain legal landscape for the media. Nevertheless, post-Reynolds, “the obvious trend in the case law is towards a more liberal understanding of press freedom in the libel law context”.Footnote 47 In particular, reversing both the High Court and the Court of Appeal, the House of Lords in Jameel stressed that “standard of conduct required” must be applied in a “practical and flexible manner”,Footnote 48 with weight generally being given to the “professional judgement” of the relevant editor or journalist.Footnote 49 It was also clarified that the defence was not restricted to journalists, but rather could be relied upon by “anyone who publishes material of public interest”.Footnote 50 Finally, the Defamation Act 1996 set out a special defence vis-à-vis the “innocent dissemination” of defamation material,Footnote 51 which as a result of the EU e-Commerce Directive 2000, transposed into UK law by the Electronic Commerce (EC Directive) Regulations 2002, was augmented by a general “intermediary” liability shield for storing information provided by a recipient of an information society service.Footnote 52 In sum, within defamation law, the balance between the right to reputation and freedom of expression has significantly shifted in favour of the latter. As will be seen below, this trend is continued in the Defamation Act 2013.
C. Data Protection
If assessing the contours of defamation law presents difficulties in light of the recent enactment of the wide-ranging Defamation Act 2013, then any analysis of data protection law poses even greater challenges. These challenges stem not only from the complex interface between national and European law in this area, but also, as Lord Justice Leveson recently noted, from the reality that “[t]o say that it [data protection] is little known or understood by the public, regarded as a regulatory inconvenience in the business world, and viewed as marginal and technical among practitioners (including our higher courts) … is perhaps not so far from the truth”.Footnote 53 It nevertheless remains true that “the subject matter of the data protection regime … could hardly be more fundamental to issues of personal integrity, particularly in a world of ever accelerating information technology capability”.Footnote 54
In contrast to defamation law, data protection is of recent origin. It emerged globally in the 1970s from a belief that, without a new system of regulation, the rise of new forms of information technology (notably computerised processing) would pose an unacceptable threat to the rights and interests of natural persons. Whilst protecting privacy was a principal concern, it was far from the only value which seen to be under threat by these new developments. Instead, as the German Data Protection Act of 1977 stated, this law was to ensure against all “Mißbrauch” of personal data in order to “der Beeinträchtigung schutzwürdiger Belange der Betroffenen entgegenzuwirken”.Footnote 55 The French Data Protection Act of the same year required that information technology “ne doit porter atteinte ni à l'identité humaine, ni aux droits de l'homme, ni à la vie privée, ni aux libertés individuelles ou publiques”.Footnote 56 Rather more prosaically, the Council of Europe Convention on the subject finalised in 1981 simply stated that its purpose was to secure for every individual “respect for his rights and fundamental freedoms, and in particular his right to privacy”.Footnote 57 The EU Data Protection Directive 95/46, which was designed to “give substance to and amplify” the Convention's provisions, essentially mirrored this objective referring specifically to the protection of “the fundamental rights and freedoms of natural persons, and in particular their right to privacy”.Footnote 58 Although the reference in both the Convention and the Directive to rights and freedoms may be thought to limit the purposive scope of these instruments, it should be stressed that these terms were construed extremely expansively. Indeed, both the Convention's Explanatory ReportFootnote 59 and the DirectiveFootnote 60 text even refer to mere personal “interests” apparently synonymously with such “rights”. Therefore, within its material scope, data protection's goals are certainly broad enough to encompass protecting a natural person's right to reputation not simply through its incorporation either of the law of defamation or the right to respect for private and family life, but rather directly.Footnote 61 The autonomous nature of data protection is now reflected in the fact that it is protected as a separate fundamental right within the EU Charter of Fundamental Rights.Footnote 62
Whilst the philosophical origin of data protection was rooted in lofty and wide-ranging human rights concerns, its subsequent spread was strongly related to concern that, without harmonisation of law in this area, “trade would be fettered” as “information could not flow freely” between nations.Footnote 63 Thus, a number of countries drafted their data protection law principally out of a pragmatic concern to ensure compliance with transnational frameworks ensuring the free flow of data. It was in this context that UK first passed a Data Protection Act in 1984 to implement the Council of Europe Convention and replaced this with the Data Protection 1998 when the EU Directive was transposed into municipal law. As the quote from Leveson above indicates, the minimalist approach to data protection which this encouraged has generally been mirrored by our courts. At the same time, it remains a fundamental principle that, as far as possible, national legislation must be interpreted so as to give full effect to binding EU legal requirements.
Turning to the material scope of data protection, both the Data Protection Act (DPA) 1998 and Data Protection Directive regulate the processing of data which is personal. Although legal persons are clearly excluded, in other respects, these terms are defined broadly. Processing covers every activity performed on personal data including recording, holding, disclosing, destroying, and so forth.Footnote 64 Meanwhile, information will become data if it is processed on a digital deviceFootnote 65 or even within a structured manual filing system.Footnote 66 Thus, all information, whether in the form of words, sounds, or images, will be data if included on a computer, mobile phone, or digital camera. As the Court of Justice of the EU found in Criminal Proceedings against Lindqvist, even placing material on an unstructured internet page constitutes a processing of data.Footnote 67 Meanwhile, data will be personal so long as it “relate[s] to a living individual” who is directly identified or who is identifiable.Footnote 68 This is wide enough to cover any information which is clearly about an individual, irrespective of whether this concerns private, professional, or business life.Footnote 69 Published information, arguably even if as seemingly anodyne as the name of author coupled with a book title,Footnote 70 is also not excluded. Any “expression of opinion” about the individual is also specifically included.Footnote 71 Finally, it is the “data controller” who must generally ensure compliance with the data protection stipulations. This is defined as any “person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed”.Footnote 72 As a result of a specific exemption in both the EU e-Commerce Directive 2000Footnote 73 and the Electronic Commerce (EC Directive) Regulations 2002,Footnote 74 such data controllers cannot make use of the general intermediary liability shield noted above in order to absolve them from any of their responsibilities vis-à-vis the processing of personal data under the DPA.
In substantive terms, all data controllers must generally ensure that processing complies with eight data protection principlesFootnote 75 which stipulate inter alia that personal data be processed “fairly”,Footnote 76 be “adequate, relevant and not excessive”,Footnote 77 and be “accurate and, where necessary, kept up to date”.Footnote 78 Inaccurate data is defined as that which is “incorrect or misleading as to any matter of fact”.Footnote 79 As an aspect of the fairness principle, the Act also requires that, as far as practicable, those who are the subject of the data must be notified of processing except where information was not collected from them directly and it is explicitly justified that such notification would constitute a “disproportionate effort”.Footnote 80 Subjects are additionally given specific rights to access their data,Footnote 81 stop processing which is causing or likely to cause unwarranted substantial damage or substantial distress,Footnote 82 and obtain compensation for breach of the Act in certain circumstances.Footnote 83 Application may also be made for the rectification or erasure both of “inaccurate” data and data which contains “an expression of opinion which appears to the court to be based on the inaccurate data”.Footnote 84 In the case of inaccurate data and even in situations where this data has already been “rectified, blocked, erased or destroyed”, the court may further “order the data controller to notify third parties to whom the data have been disclosed” so long as it considers this “reasonably practicable”.Footnote 85 In addition, a supervisory authority,Footnote 86 the Information Commissioner, is established with wide-ranging powers to ensure compliance with the law including issuing enforcement notices requiring specific action of data controllers backed by criminal penaltyFootnote 87 and serving monetary penalty notices in relation to “serious” contraventions which are at least negligent in nature and are “of a kind likely to cause substantial damage or substantial distress”.Footnote 88 Data subjects may appeal to the Information Commissioner and he has a duty to assess their case and consider what action, if any, should be taken.Footnote 89
In line with its ambitious purposes, the DPA is clearly very expansive both in terms of scope and substantive subject matter. Nevertheless, it also contains a number of important limitations and exemptions. Firstly, as regards the requirement for accuracy, in significant contrast to defamation, not only is there no presumption of inaccuracy, but Sch. 1 of the DPA also stipulates that this requirement will not be contravened so long as “the data controller has taken reasonable steps to ensure that accuracy of the data” and “if the data subject has notified the data controller of the data subject's view that the data are inaccurate, the data indicate that fact”.Footnote 90 Moreover, if seeking compensation, subjects must generally first prove “damage”.Footnote 91 Proof of “distress” alone is only sufficient in relation to processing for the purposes of journalism, artistic purposes or literary purposes.Footnote 92 Data controllers may additionally defend against such action by proving they have taken “such care as in all the circumstances was reasonably required to comply with the requirement concerned” .Footnote 93 As regards the right to stop processing or to ensure the erasure or rectification of data,Footnote 94 the courts are also formally granted discretion as to whether to award a remedy. Finally, and perhaps most strikingly, where the processing is only for the purposes of journalism, artistic purposes, and/or literary purposes, controllers need not comply with any of the substantive data protection principles so long as they reasonably believe both that publication would be in the “public interest” and that compliance with the provision or provisions in question would be “incompatible” with these purposes.Footnote 95 The courts are also under a duty to stay proceedings until 24 hours after publication has taken place in these casesFootnote 96 and the Information Commissioner is somewhat restricted in the enforcement action that can be taken here.Footnote 97 Finally, domestic processing by an individual solely for his or her “personal, family or household affairs (including recreational purposes)” is exempt from all data protection restrictions.Footnote 98
These significant limitations and exemptions have been augmented by the often reticent approach taken to data protection both by the English courts and indeed by the Information Commissioner. In particular, the Court of Appeal in Durant v Financial Services Authority used references to privacy in the recitals of the Directive to attempt to restrict the DPA only to regulating “information that affects [the data subject's] privacy whether in his personal or family life, business or professional capacity”.Footnote 99 This restrictive approach was echoed in the later case of Johnson v Medical Defence Union Footnote 100 where Buxton L.J. also argued obiter that claimants would have to actively prove rather than rely on a presumption of damage to reputation in order to secure DPA compensation. This restrictiveness has been mirrored in the approach of the Information Commissioner. In particular, as will be explored in subsequent chapters, the Commissioner has, at least until recently, proved very reluctant to respond to the publication of derogatory made by other individuals online.Footnote 101
At the same time, however, the pan-European landscape has been much more forthright in its defence of the meaning and importance of data protection. In the first place, the European Directive itself places no limitations at all on the general obligation to ensure data is processed fairly and accuratelyFootnote 102 and that individuals have access to a judicial remedy for any breach of their rights.Footnote 103 Moreover, whilst Member States may derogate from these rights if such action is “necessary” to protect “the rights and freedoms of others”,Footnote 104 it is unclear whether the over-arching limitations found within the DPA are sufficiently tailored to the defence of specific rights or freedoms so as to benefit from this provision. After all, at the time of adoption of the Directive, the Council and Commission adopted a Statement for the Minutes stating unequivocally that “the derogation … does not refer to rights such as the right to carry out data processing”.Footnote 105 In any case, the Court of Justice of the European Union (CJEU) has consistently held that any exemption must comply with the “requirement of proportionality with respect to the public interest objective being pursued” and that the “national court must also interpret any provision of national law, as far as possible, in light of the wording and the purpose of the applicable directive, in order to achieve the result pursued by the latter”.Footnote 106 Even in relation to processing solely for the purposes of journalism, artistic purposes, and/or literary purposes,Footnote 107 the court has argued that exemptions may be provided “only in so far as strictly necessary”Footnote 108 to achieve a balance between fundamental rights. The CJEU has further held that the domestic processing exemption, which is absolute in nature, can only be relied upon in relation to “activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people”.Footnote 109
D. Malicious Falsehood
Although this article is principally concerned with a comparison of defamation law with data protection law, it is necessary finally to note briefly the contours of malicious falsehood – a traditional cause of action which, although little used, is related to the protection of reputation. This tort protects against dissemination of a statement to somebody other the claimant of information which is false. The information need not have any tendency to lessen respect for that person but, unlike in defamation, the claimant must prove the relevant falsity.Footnote 110 In addition, the claimant must demonstrate actual, pecuniary damage or, alternatively, that the words either “are calculated to cause pecuniary damage to the plaintiff and are published in writing or other permanent form” or “are calculated to cause pecuniary damage to the plaintiff in respect of any office, profession, calling, trade or business held or carried on by him at the of publication”.Footnote 111 Finally, and most significantly, the claimant must prove “malice”. In this context, this requires that the defendant either knew or was recklessFootnote 112 as to whether the statement was falseFootnote 113 or was actuated by some dishonest or improper motive.Footnote 114 Negligence is not enough and an “[h]onest belief in an unfounded claim is not malice”.Footnote 115 These restrictions have severely circumscribed the ambit of this action. Despite this, the tort remains relevant, not only because of its historic relationship with defamation, but also because, as will be seen below, it has been referred to in case law interpreting the requirements of data protection law.
III. Developments in Defamation and Data Protection
Both defamation and data protection law are in a state of flux. On 1 January 2014, the Defamation Act 2013 came into force.Footnote 116 This Act effects a major reform of the law of defamation in England and Wales.Footnote 117 While there are no live legislative proposals for the reform of data protection, there have been important developments in domestic and European case law as well as regulatory stance here.
A. Defamation Act 2013
The Defamation Act 2013 arose from the initiative of a law reform coalition concerned that the current law on defamation was unduly curtailing freedom of speech.Footnote 118 The Act's substantive reforms of relevance to this article are the introduction of a “serious harm” threshold,Footnote 119 the crafting of new statutory defences of truth,Footnote 120 honest opinionFootnote 121 and publication on a matter of public interest,Footnote 122 and the introduction of various new defences to defamation, most notably that applicable to “website operators”.Footnote 123 By crafting a new “single publication rule”,Footnote 124 the Act also makes an important procedural change to defamation law. In addition, the right to a jury trial in defamation actions is abolished.Footnote 125
As the explanatory notes to the Act make clear, the new statutory defences of truth and publication on a matter of public interest are largely codifications of the existing common law justification (truth) and “Reynolds” defences.Footnote 126 However, the other changes are potentially much more significant. Firstly, s. 1 of the Act establishes that a publication will not be defamatory unless it has caused or is likely to cause “serious harm to the reputation of the claimant”.Footnote 127 This stipulation reverses what has traditionally been seen as a cardinal principle of English law, namely that libel be actionable per se.Footnote 128 It is true that the Court of Appeal in Jameel did strike out a defamation claim for abuse of process due to its failure to disclose a “real and substantial tort”,Footnote 129 and also indicated that changes in the Civil Procedure Rules and the introduction of the Human Rights Act (HRA) had rendered the court willing to take this, albeit still very rare, step more readily than in the past.Footnote 130 Moreover, in Thornton v Telegraph Group, Tugendhat J. held that defamation law “must include a qualification or threshold of seriousness, so as to exclude trivial claims”.Footnote 131 Nevertheless, Thornton remains a very recent decision at first instanceFootnote 132 and, overall, it is clear that this new section “raises the bar” for bringing a defamation claim in the future.Footnote 133
Secondly, turning to the clause dealing with “honest opinion”, many of the details of this new statutory defence merely consolidate the current common law defence of “fair comment” which it replaces. Nevertheless, this restatement comes on the back of the Supreme Court's expansive reading of this latter defence in Joseph v Spiller.Footnote 134 There, the court found that the potential to defeat the defence by showing “malice” had been “significantly narrowed”.Footnote 135 In particular, it was in no way relevant whether the defendant had been “motivated by spite or ill-will”.Footnote 136 Rather, it was only necessary that the comment was honestly held, based on true facts which were indicated (even if only implicitly and in general terms) to the receiver of the message and finally was on a matter of “public interest”. Whilst the court found that the scope of the latter requirement had been “greatly widened”,Footnote 137 this last requirement nevertheless imparted a critical objective element into this defence. Importantly, however, the new statutory defence entirely removes this “public interest” requirement.Footnote 138 As Phillipson noted during the lead-up to the Bill's enactment, this would appear to create a situation whereby the publication of “disparaging opinions on private life lacking a public interest would be lawful when the disclosure of the related private facts [at least when originally made] would not”.Footnote 139 As an example, Phillipson suggests that free-ranging defamatory comment on Max Mosley's German prison-themed sado-masochistic sessions would be legal even though the disclosure of the facts on which the comment was based were published in breach of the tort of the misuse of private information.Footnote 140
Thirdly, the Act substantially broadens the range of defences to defamation action. There is an extension of absolute privilege to fair, accurate, and contemporaneous reporting of courts worldwide as well as a broad range of international courts and tribunals.Footnote 141 Meanwhile, qualified privilege is extended to publication of fair and accurate copies, summaries, or extracts of material produced by any legislature or governmental body as well as reports of proceedings at a wide range of public meetings.Footnote 142 A specific qualified privilege defence is also set out for the first time in relation to the publication of peer-reviewed statements in scientific or academic journals.Footnote 143 By far the most significant new defence, however, is that provided to any “operator of a website in respect of a statement posted on the website”Footnote 144 where it did not itself post the statement. These entities have a complete shield from liability unless the claimant demonstrates that it was not possible for him to identify the person who did post the statement, the claimant gave the operator a notice of complaint and the operator failed to respond in accordance with the Defamation (Operators of Websites) Regulations 2013.Footnote 145 Where the operator has no electronic means of contacting the poster, these Regulations require that, to benefit from the defence, the operator remove the statement within 48 hours of receiving notice.Footnote 146 In other situations, however, the operator only needs to notify the poster stating that the statement may be removed unless the operator receives a written response from the poster stating that he does not wish the statement to be removed and providing his full name and postal address.Footnote 147 The operator has to remove the material from the website 48 hours after the end of the period in cases where the poster fails to respondFootnote 148 or where the poster's response is incomplete.Footnote 149 The latter does include situations where a “reasonable website operator would consider the name or postal address … to be obviously false”.Footnote 150 However, in all other cases, the operator need only inform the complainant in writing within the same period that the poster does not wish the statement to be removed and that the statement has not been removed.Footnote 151 So long as the poster has not consented to the release of his name and/or address, the operator must simply notify the complaint in writing of that fact.Footnote 152 It will, therefore, be up to the complainant to apply for a court order for the possible release of this information. Even if these details, once released, turn out to be false, no further liability will rest on the website operator.Footnote 153 Thus, this new defence goes far beyond the “innocent dissemination” defence in the Defamation Act 1996 and the so-called intermediary liability shield under the Electronic Commerce (EC Directive) Regulations 2002 noted above.Footnote 154 Moreover, it is clear that the defence extends well beyond the kind of passive internet hosting protected by these latter Regulations. Indeed, the Act provides on its face that the defence “is not defeated by reason only of the fact that the operator of the website moderates the statements posted on it by others”.Footnote 155 During the House of Commons proceedings, the Government stated that the clause was “intended to cover websites that directly host user-generated content” including “individuals or companies that run websites and exert influence over them”. This definition was further held to a wide range of interactive and social media outlets including “website operators such as Facebook and Mumsnet, and online newspapers and bulletin boards that enable users to post and read messages”.Footnote 156 Moreover, although this defence may technically be defeated if a claimant shows that the operator “had operated with malice in relation to the posting of the statement concerned”,Footnote 157 the Government correctly emphasised that “it is difficult to foresee circumstances” in which a website operator otherwise complying with s. 5 “could do so maliciously”.Footnote 158 In addition to this defence, it should be noted that s. 10 also establishes that “[a] court does not have jurisdiction to hear and determine an action for defamation brought against a person who was not the author, editor or publisher of the statement complained of unless the court is satisfied that it is not reasonably practicable for an action to be brought against the author, editor or publisher”.Footnote 159
Finally, the Act reforms the limitation period for claims brought in both defamation and malicious falsehood by introducing a “single publication rule”. There has long been a special one-year limitation period for launching such actions.Footnote 160 However, this provision was almost entirely undercut by another rule under which a fresh publication is deemed to take place each time a statement is viewed, sold, or otherwise republished.Footnote 161 Especially when applied to the internet,Footnote 162 this proved extremely onerous for publishers leading some to argue that “in effect, there [was] no limitation for libel”.Footnote 163 The Act addresses the situation by providing that once a statement is published to the public at large,Footnote 164 the limitation period will run from this time so long as, firstly, any subsequent statement is at least “substantially the same”,Footnote 165 and, secondly, that the manner of subsequent publication is not “materially different” from the first.Footnote 166 Moreover, although the courts retain discretion to waive limitation periods in defamation where it would be “equitable” to do so,Footnote 167 in practice, it is “rare” for such limitation periods to be set aside.Footnote 168 These new provisions, therefore, significantly restrict the right to a judicial remedy here.
B. Data Protection Developments
Unlike in defamation, there have been no significant legislative changes to UK data protection within the past few years.Footnote 169 Nevertheless, there have been important developments both in the case law and in the broader context which relate directly to the role of data protection in protecting reputation. The case law will first be considered before briefly examining this broader context.
1. Quinton v Peirce
Although there has been a greater recent focus within domestic law on the interface between data protection and the right to reputation, not all of the cases have been supportive of a significant role for the DPA in this area. In fact, Quinton v Peirce,Footnote 170 the first case centrally concerned with this issue, took rather the opposite viewpoint. This case concerned a local Conservative politician, Mr. Quinton, who argued that certain misleading or even false (although not defamatory) statements had been included in his political opponent Mr. Peirce's election leaflets during a hard-fought local government election campaign in 2007. Quinton claimed not only malicious falsehood, but also breach of both the accuracy and fairness provisions of the DPA. Eady J., who heard the case, considered that the DPA was applicable,Footnote 171 that Mr. Peirce was a “data controller”,Footnote 172 and that the exemptions for “journalism” were not relevant.Footnote 173 In other respects, however, he reacted very unsympathetically to the data protection claim. In sum, as regards the alleged violation of the accuracy standard, Eady J. stated that he could “see no reason to apply different criteria or standards in this respect from those I have applied when addressing the tort of injurious [malicious] falsehood”.Footnote 174 As noted in section two, this little used tort requires proof of “malice”. According to Tomlinson, this makes the tort “a ‘non-starter’ … successful actions are vanishingly rare because the burden of proof is so high”.Footnote 175 Meanwhile, as regards the argument that the DPA fairness principle's data subject notification provisions required that Quinton be informed of the leaflet in advance, Eady J. simply stated that he declined “to interpret the statute in a way which results in absurdity”.Footnote 176 Eady J. was clearly frustrated by the “fine and arbitrary distinctions” which the DPA appeared to require – distinctions which to him illustrated the “confusion and uncertainty attending the application of these legislative provisions”.Footnote 177
Overall, it may be argued that Quinton “is an illustration of what happens to a data protection claim to which an English court has reacted unsympathetically, particularly when it is brought before a court unfamiliar with data protection issues and concerned to fit them into a familiar pattern of well-known torts, defamation and malicious falsehood”.Footnote 178 Given the overriding need to interpret the legislation in line with the purpose of the Data Protection Directive,Footnote 179 the court should really have addressed the completely different question of “whether the traditional torts are consistent and support the superior law derived from the European institutions”.Footnote 180 Indeed, as Tugendhat J. stated prior to his elevation to the bench:
It is vital to note that the 1984 [Data Protection] Act created, and the 1998 Act continues, concepts entirely new to English law. These rights do not depend on whether the data subject (as the person to whom information relates is called) would have rights under the existing law of confidentiality or defamation or any other tort or statute.Footnote 181
2. Clift v Slough Borough Council
The other main English cases in this area have all centrally involved the participation of Tugendhat J. who, as just mentioned, has long been on record as supporting a far more expansive interpretation of the data protection regime than that articulated by Eady J. The first such case, Clift v Slough Borough Council, was considered in both the High CourtFootnote 182 and the Court of Appeal.Footnote 183 This defamation case concerned a Ms. Jane Clift who was placed on Slough Borough Council's Violent Persons Register as somebody posing a medium risk of violence. This outcome arose from a reference Clift had made to the Council's Anti-Social Behaviour Coordinator, Ms. Rashid, regarding some criminal damage she had witnessed. This was acrimoniously dealt with and led Clift to make a complaint to the Council during the course of which she repeatedly expressed a desire to inflict physical violence upon Rashid. Clift's inclusion on the Register was circulated by the Council to a wide range of its employees and to four “partner organisations”. Responding to Clift's action, the Council accepted that the publication was defamatory but sought to rely on a defence of justification (truth) and qualified privilege. Part of Clift's response to the latter was to claim malice which would have prohibited the Council's use of any privileged occasion. In fact, the jury rejected both the Council's defence of justification and Clift's allegation of malice.Footnote 184 The legal point of interest, which was considered at length by both Tugendhat in the High Court and Ward L.J. in the Court of Appeal, concerns the scope of qualified privilege and, more particularly, the role of other legislation including potentially the DPA in constraining this.
The Council argued that, following Kearns v General Council of the Bar,Footnote 185 it could claim a defence of qualified privilege in relation to all its communications since, according to the Council, they were in each case made within an “established relationship … which required the flow of free and frank communication between them on all questions relevant to the discharge of the defendants' functions”.Footnote 186 Nothing short of malice could defeat this.Footnote 187 Clift in response argued that the defence could have no application where the communication was inconsistent with the duties of the Council to act compatibly with her European Convention right to reputationFootnote 188 as required of public authorities by s. 6 HRA. This was accepted by both the High Court and the Court of Appeal. Furthermore, although the Council was found to have a legitimate aim in publishing the material, its publication of the statement to employees in the Council's Licensing, Food and Safety and Children and Education Services as well as to Community Wardens, Trade Union Officials, and anyone in the four partner organisations was found to be disproportionate and therefore in violation of Clift's Convention rights.Footnote 189
Clift did not directly concern pleadings related to the DPA.Footnote 190 Nevertheless, in the course of both the High Court and Court of Appeal judgments, there were important dicta about the potential role of data protection in constraining the scope of qualified privilege especially vis-à-vis private actors (who are not directly covered by the HRA). In particular, responding to the argument made in Kearns that, when common law qualified privilege applied, “[t]he need to act responsibly will not arise”,Footnote 191 Tugendhat J. baldly stated “[i]n cases where the HRA or the DPA apply, that can no longer be said”.Footnote 192 To the contrary:
[t]he DPA … requires attention to be focused on the rights of those who are the subject of references and warnings, as well as on the rights of those to whom the references and warnings are addressed. Personal data must be processed (which includes disclosed) “fairly and lawfully”, and it must be accurate: see Sch. 1.Footnote 193
This was important, since “[w]hen incorrect information is communicated, carelessness or innocent error is more likely than malice to be the explanation”.Footnote 194
In the Court of Appeal, Clift did rely in part on an argument that the narrow construction of qualified privilege favoured in the High Court was consistent with the Council's duties under the DPA.Footnote 195 Moreover, in addressing the proportionality point, Ward L.J. stated:
In my judgement it cannot be held to be disproportionate for a local authority to do what it is bound to do anyway whether in performance of its public law responsibilities, or its duty under the Data Protection Act 1998 or the Information Commissioner's Data Protection Act 1998 compliance advice used in the public sector, each of which is to all intents and purposes to the same effect.Footnote 196
It therefore seems that Tugendhat J. was right to make the, albeit rather understated, remark that “[t]he conclusions I have reached in this case may have some impact upon defences of qualified privileged [sic] raised by defendants who are not public authorities, but who have published information in breach of the DPA”.Footnote 197
3. Law Society v Kordowski
The High Court case Law Society, Hine Solicitors & Kevin McGrath v Rick Kordowski, which did directly include a DPA claim brought against a private sector actor, concerned an action, brought on a representative basis, to injunct the defendant from publishing the website “Solicitors from Hell” and to restrain him from publishing any similar website in the future.Footnote 198 Founded in 2005, this website comprised a “‘blacklist’ of law firms and solicitors that should be avoided”Footnote 199 collated from almost invariably anonymous postings made by disgruntled members of the public who were invited to “NAME and SHAME your OPPRESSOR”.Footnote 200 Action was brought in libel, harassment under the Protection from Harassment Act 1997, and also breach of requirements to process data “fairly and lawfully”, accurately, and in accordance with data subjects' rights under the DPA. It was brought not only on behalf of the named claimants themselves, but also of “all those currently featuring on the website and those who might, in the future, feature on the website”.Footnote 201 The Law Society had previously sought to have their complaint resolved through enforcement action by the Information Commissioner.
As regards the specific statements complained of by the Second and Third Claimants, Tugendhat J. had little difficult finding them actionable in libel and in violation of both the Protection Against Harassment Act 1997 and the requirement under the DPA to “fairly and lawfully” process personal data.Footnote 202 He was therefore prepared to grant perpetual injunctions requiring their removal from the website and prohibiting publication on a similar website under all these causes of action.Footnote 203 Matters were not so straightforward in relation to the representative action, necessary to get the website removed in its entirety. Tugendhat J. ruled that such action could be sustained under the DPA. This was because all the represented partiesFootnote 204 had a “common interest” arising from the defendant's “course of conduct, which includes data processing, which is the same or similar in relation to all”.Footnote 205 Crucially, he also found that, under the DPA, “whilst the falsity or inaccuracy of the words (the course of conduct complained of) is not irrelevant … truth is not of itself a defence”.Footnote 206 A perpetual injunction was therefore granted on this basis.Footnote 207 In contrast, following the rule against interim injunctions set out in Bonnard,Footnote 208 no such relief could be granted in defamation.Footnote 209 This was because, despite there being a similar “common interest”, in this case “[w]hether publication of those words is, or will be, unlawful does not depend on the conduct of the Defendant. It depends upon whether the words are true or false, or whether they can be defended under one or other established defences in libel”.Footnote 210
A further notable feature of this case was that, during the course of his judgment, Tugendhat J. made some highly critical remarks about the approach the Information Commissioner had taken to the Law Society's complaint. In this context, it should be noted that the Commissioner had written to the Law Society in early January 2011 in the following terms:
The inclusion of the “domestic purposes” exemption in the Data Protection Act (s. 36) is intended to balance individual's rights to respect for his/her private life with the freedom of expression. These rights are equally important and I am strongly of the view that it is not the purpose of the DPA to regulate an individual right to freedom of expression – even where the individual uses a third party website, rather than his own facilities, to exercise this …. The situation would clearly be impossible were the Information Commissioner to be expected to rule on what it is acceptable for one individual to say about another be that a solicitor or another individual.Footnote 211
In contrast, Tugendhat J. stated that he did “not find it possible to reconcile the views on the law expressed in the Commissioner's letter with authoritative statements of the law”,Footnote 212 that “[t]he DPA does envisage that the Information Commissioner should consider what it is acceptable for one individual to say about another”,Footnote 213 and that he did “not understand how it could be said that s. 36 has any application to the present case”.Footnote 214
4. Google Spain
On 13 May 2014, the Grand Chamber of the CJEU handed down a path-breaking preliminary reference judgment, Google Spain, Google Inc. v Agencia Espaňola de Protección de Datos (AEPD), Mario Costeja González – a case which arose from Costeja's demand that information originally published 16 years previously related to “a real-estate auction connected with attachment proceedings for the recovery of social security debts”Footnote 215 be de-indexed from Google search engines. The Court found that, even when mirroring in unaltered form material published live on the internet, search engines were not only data controllers,Footnote 216 but operated outside the special shield established for journalistic and allied purposes.Footnote 217 As a result, the Court held that:
“[i]nasmuch as the activity of a search engine is … liable to affect significantly, and additionally compared with that of publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine … must ensure, within the framework of its responsibilities, powers and capabilities, that the activity meets the requirement of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved.”Footnote 218
Not only its purpose, but also data protection's substantive requirements were interpreted expansively. In particular, the judgment stressed that (unless excused by specific derogations in national law justified under Article 13 of the Data Protection Directive) data controllers had to ensure that personal data are processing fairly and lawfully, that they are adequate, relevant and not excessive, and that they are accurate. It was particularly emphasised that “even initially lawful processing of accurate data may, in the course of time, become incompatible with the directive”Footnote 219 – an understanding which may prove especially helpful to an individual wishing to get removed, or at least de-indexed, statements (particularly of opinion rather than fact) which are having an ongoing negative impact on their reputation. It was stressed that, not only was it not necessary for the data subject to prove that the processing “causes prejudice”, but that, in light inter alia of the fundamental right to data protection set out in the EU Charter, “those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject's name”.Footnote 220 Finally, as regards the concrete claim at issue, the court found that Costeja had established “a right that the information should no longer be linked to his name by means of such a list”.Footnote 221
5. Broader context
This burgeoning data protection case law has been mirrored by broader developments which have also indicated the potential for a much greater role for the DPA in the area of reputation rights in the future. Firstly, in December 2010, the extent of the European Commission's infringement proceedings against the UK's potentially incorrect transposition of the Data Protection Directive finally came to light. These proceedings, which began as far back as 2004, alleged, in particular, that the DPA's “domestic purposes” exemption was phrased too broadly, that the Act incorrectly granted courts a discretion in relation to the updating, rectification, erasure, or blocking of personal data, that it incorrectly limited rights to compensation in relation to non-material damage, and that the Commissioner appeared to have been granted inadequate investigative powers.Footnote 222 Even if this action is not finally pursued before the CJEU, both the depth and breadth of these concerns suggest that UK courts may have wide-ranging obligations to expansively interpret the DPA in order to ensure, as far as possible, that proper effect is given to the Directive which it is meant to implement.
Secondly, in late 2012, Lord Leveson published his report on press regulation, produced as a result of an inquiry commissioned by the Government in July 2011. The report gave prominence to data protection, expressing criticism both of the current legislation and of the timid approach taken to it by legal practitioners, the higher courts,Footnote 223 and most particularly the Information Commissioner himself.Footnote 224 The Leveson Report also specifically cited the Kordowski case considered above, arguing that it also “took a wider view of the ICO's functions in relation to journalism than it was minded to take itself”.Footnote 225 For the future, Leveson proposed significant reform of both the Information Commissioner's approach and the legislative framework. Regarding the former, Leveson recommended that the ICO take immediate steps “to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press comply with the legal requirements of the data protection regime”,Footnote 226 that it likewise “prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data”,Footnote 227 and finally that it “publish advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice”.Footnote 228 Meanwhile, as regards the DPA itself, Leveson recommended that the exemptions provided for the purposes of journalism, artistic purposes, and literary purposes be significantly narrowed including in particular removing all of the special limitations on the requirement to ensure the accuracy of personal data.Footnote 229 He further recommended that it be made clear that compensation under the DPA be generally available for pure distressFootnote 230 and that the procedural restrictions on the courts issuing injunctions and the Commissioner using his enforcement powers in relation to the purposes of journalism, artistic purposes, and literary purposes be repealed.Footnote 231 Finally, Leveson proposed that the judiciary's Civil Justice Council review the level of damages generally available for breach of data protection.Footnote 232
Although the Government initially committed to consulting on Leveson's recommendations for legislative reform,Footnote 233 this has not been forthcoming and it seems unlikely that significant statutory change will ultimately eventuate. In contrast, following both the Kordowski judgment and the Leveson Report, the ICO has been engaging in a process of reanalysis of its stance vis-à-vis free-speech issues. Related principally to the former, in May 2013, the Office published new guidance on social networking and online forums.Footnote 234 In stark conflict with the CJEU's holding in the Lindqvist case (see above), this guidance maintained the Office's former position that, as a result of the DPA's “domestic purposes” exemption, individuals “who have posted personal data whilst acting in a personal capacity” would not themselves need to comply with the DPA's data protection principles in any case.Footnote 235 On the other hand, the guidance also held that, additionally to any responsibilities they had under inter alia defamation law,Footnote 236 social networking and online forums were themselves data controllers subject to the DPA including in relation to information posted by either individual or corporate third parties.Footnote 237 Such websites therefore had a duty to take “reasonable steps to check the accuracy of any personal data that is posted”.Footnote 238 Even in relation to forums where the vast majority of site content is posted by third parties, the volume of third party posts is significant, and the site is not pre-moderated, the guidance suggested that “reasonable steps” would include having clear and prominent policies for users about acceptable and non-acceptable posts, having clear and easy-to-find procedures in place for data subjects to dispute the accuracy of posts and ask them to be removed and responding to disputes quickly, and having procedures to remove or suspend access to content, at least until such time as a dispute has been settled.Footnote 239 Finally, as regards non-factual posts, the guidance added that policies must also be in place that are sufficient to deal with “complaints from people who believe that their personal data may have been processed unfairly or unlawfully because they have been the subject of derogatory, threatening or abusive online postings by third parties”.Footnote 240 This broad understanding of the scope of the data controller responsibility vis-à-vis corporate online actors who play an active role in the facilitation of information dissemination originating from others has clearly also been vindicated in Google Spain, a judgment which the Office also welcomed.Footnote 241
Meanwhile, in September 2014, the ICO published its guidelines on data protection vis-à-vis the media.Footnote 242 Although acknowledging that the s. 32 provision for the purposes of journalism, artistic purposes, and literary purposes was “one of the broadest exemptions”,Footnote 243 the draft guidance also stressed that, to benefit from s. 32's substantive protections, the data controller must prove a reasonable belief as to both the public interest of publication and also as to the incompatibility of compliance with general data protection principles.Footnote 244 Most significantly, these requirements were interpreted strictly vis-à-vis accuracy:
The DPA requires you to record details correctly and take reasonable steps to check your facts. You should also clearly distinguish between fact and opinion, and if the individual disputes the facts you should say so. … We would not expect you to fall back on the [s. 32] exemption very often, as it is hard to argue it is in the public interest to publish clearly inaccurate stories or to retain clearly inaccurate information without making reasonable checks.Footnote 245
IV. A Developing Role for Data Protection?
Over the past few years, a number of lawyers have increasingly vocalised concerns over whether defamation law provides sufficient protection for an individual's traditional right to reputation in all circumstances. It has even been suggested that English defamation law may fail to fully vindicate the floor of such rights as are incorporated within Article 8 of the European Convention of Human Rights. These concerns, which partly arise from the weakening of this law as a result of jurisprudential developments, will become more acute under the Defamation Act 2013. These developments, therefore, raise anew the question of whether data protection law can fill at least some of these potential protection “gaps” in the future.
A. Perceived Gaps in Protection
It is possible to locate a range of substantive and procedural limitations under the reformed law of defamation which are likely to prove irksome to a potential claimant. The key limitations, most of which were discussed in detail in the previous two sections, may be briefly summarised as follows. At a substantive level, defamation law will now provide no redress for publication of even a manifestly inaccurate statement unless this “has caused or is likely to cause serious harm”Footnote 246 to the standing of applicant vis-à-vis “members of society generally”.Footnote 247 Defamation also includes an expanding range of defences, particularly as regards communication on a privileged occasion, which will generally defeat any action. Moreover, in relation to factual statements, in those cases where defamation law provides for a full defence other than truth, it does not even provide for partial redress in the form of a declaration of falsity. This limitation has become more serious since Reynolds provided for a broad defence for publication to the world which was not dependent on the accuracy of the statements made. Thus, a “wrongly libelled reputation” may be “left besmirched” under current defamation law.Footnote 248 In addition, the Act's new defence of “honest opinion” will allow for the broad publication of defamatory comment about purely private persons without any need for show a “public interest”.Footnote 249 The breadth of the Act's new defence for website operators is of greatest concern.Footnote 250 This will leave claimants powerless to hold a wide range of online actors responsible under defamation law not only when they release the name and address of the original poster, but even in cases where the claimant must obtain, undoubtedly at considerable expense, a court order to secure such details and, most worryingly, even when these details later turn out to be inaccurate and perhaps useless.Footnote 251
Turning to the procedural aspects, Bonnard Footnote 252 already largely rules out the granting of interim relief in defamation. Tomlinson contends that:
this rule proceeds on the basis that the claimant's right to reputation is always over-ridden at the interim stage by the defendant's right to freedom of expression. It is difficult to see how this can be consistent with the requirement to balance the rights under Article 8 [to reputation] and Article 10 [to freedom of expression] on the facts of each case.Footnote 253
The law also includes a special provision requiring that claims in defamation be brought within the “relatively short window”Footnote 254 of one year.Footnote 255 Although, historically, the effect of this provision was curtailed by rules allowing the founding of an action based on any republication of a statement, the Defamation Act 2013's introduction of a “single-publication rule” in many contexts ensures that this restriction will bite in a much wider range of cases. Finally, actions in defamation can be notoriously expensive – a fact which will increasingly trouble claimants if and when the reforms of CFAs are commenced in relation to such actions.Footnote 256
B. Can Data Protection Fill the Gaps?
At a purely conceptual level, it is possible to envisage data protection filling many of the gaps elucidated above. Turning to the substantive issues first, any inaccuracy, even if it alleges a state of affairs which would encounter no opprobrium within majority society, can in principle found an action under the DPA. There is also no over-arching requirement to demonstrate that “serious harm” has resulted. Moreover, the courts' right, which applies even when inaccurate personal data has already been “rectified, blocked, erased or destroyed”, to order the data controller “to notify third parties to whom the data have been disclosed”Footnote 257 of this inaccuracy means that the DPA does provide for the possibility of a declaration of falsity. Thirdly, as signalled in Clift, the making of a statement of an occasion of qualified privilege does not absolve a data controller from compliance with the data protection principles, including the duty to process data “fairly”.Footnote 258 Such requirements may limit the scope of this privilege in defamation as well as founding a separate action under the DPA itself.Footnote 259 Regarding the latter, the DPA may also provide redress in cases where an opinion, as opposed to a fact, about a purely private person is widely published in a way which clearly will have a disproportionate and, therefore, unfair effect on that individual.Footnote 260 Court judgments such as Kordowski and Google Spain as well as recent guidance from the ICO also highlight that many website operators will have data controller responsibilities under the DPA as a result of playing an active role in facilitating the dissemination of information originally posted by third parties. These responsibilities apply irrespective of whether they benefit from the new defence included within the Defamation Act 2013.
The DPA's potential procedural flexibility should also be noted. Firstly, as the Kordowski case vividly illustrated, interim and other injunctive relief is available here in a much broader range of situations than in defamation. Indeed, in marked contrast to the approach taken in Bonnard, data protection is premised on the belief that:
in many circumstances it will be of the utmost importance that a defendant is prohibited as soon as possible from continuing to process data in a way that is inconsistent with the DP Act. Employing such a remedy in a defamation context can therefore provide a claimant with the powerful remedy that would not be available under traditional libel proceedings.Footnote 261
Secondly, not only does action brought under the DPA benefit from the general six-year limitation period in tort,Footnote 262 but, due to the broad meaning of the term “processing”, it encapsulates as Google Spain again highlighted a mirror of the old “multiple publication rule” in defamation. Finally, turning to the legal cost issue, in the case of data protection, there is an alternative to court action in the form of making a cost-free complaint to the Information Commissioner requesting that he deploy his extensive regulatory enforcement powers to provide redress.Footnote 263
C. The Broader Context
Notwithstanding the clear potential outlined above, it is also necessary to take into account a broader context filled with a range of obstacles placed in the way of any claimant seeking to use data protection to vindicate reputation. Firstly, as outlined in section two, the DPA is replete with limitations and exemptions. Although these are almost always significantly qualified, they are wide-ranging. One important example is the special provision for the purposes of journalism, artistic purposes, and literary purposes found in s. 32. This reality is reflective of the fact that the Act was generally designed to “implement the [Data Protection] Directive in the least burdensome way for data users”.Footnote 264 As a result, there remain major uncertainties as regards when a court will actually find a violation of the Act, when and according to what metric compensation should be awarded, and, finally, in what circumstances a non-financial remedy such as rectification of data is available. Although the legitimacy of many of these restrictions under EU law may be questioned, the effect of them on the domestic claimant is nevertheless very real. Secondly, again as noted previously, at least until recently, the English courts have generally adopted a narrow and even hostile interpretation of the DPA and even the Information Commissioner has also historically proved reluctant to support the deployment of the DPA in this area. Nevertheless, whilst the full extent of any shift remains unclear, in the wake of Kordowski, the Leveson Report, and Google Spain, there are signs that that data protection is being taken more seriously in this area, including by the Commissioner himself.
V. Conclusion
Historically, defamation law has occupied a position of overwhelming dominance in the legal framework for vindicating the traditional right to reputation. Nevertheless, the past decade has seen a liberalisation of this body of law – a development which is substantially extended by the Defamation Act 2013. This has led a number of legal commentators to argue that English defamation law may fail to adequately protect the right to reputation even as instantiated in Article 8 of the ECHR.
The potential for UK data protection law to safeguard the reputation of natural persons has generally been overlooked. This reflects not only of the minimalist transposition of the EU Data Protection Directive made by the DPA, but also the constrained interpretation adopted of it by both the courts and the Information Commissioner. Nevertheless, concerns that the rights to reputation of natural claimants may not be being adequately protected have recently led to pressure on data protection to fill the relevant gaps. There are now signs in both the case law and in broader policy thinking that such pressure is beginning to bear fruit.
Data protection certainly offers the natural person claimant a number of tantalising potential advantages including general applicability as regards its material scope and breadth as regards its substantive standards as related to both accuracy and fairness. Moreover, even if a website operator benefits from the new liability shield under the Defamation Act 2013 vis-à-vis content originally posted by a third party, this will in no way absolve them from having responsibilities under data protection if they are playing an active role in facilitating the dissemination of this information. Finally, there is the potential remedial flexibility of data protection including through the granting of injunctive relief as demonstrated in Kordowski. It seems therefore clear that claimants will increasingly seek to use DPA to vindicate their reputation in proceedings before both the courts and the Information Commissioner. Despite this, the legislative and other obstacles placed in the way of their success remain formidable. Consequently, although data protection will undoubtedly assume significantly greater importance in this area in the future, both the extent and precise modalities of this change remain more uncertain.
