If Leveson’s proposals to erode the journalistic exemption under the Data Protection Act 1998 (“DPA”) materialise, libel claimants may have an extra string to their bow. But is the DPA already being used and abused by libel claimants? Ashley Hurst and Jack Gilbert discuss.
Amongst the many recommendations in Lord Justice Leveson’s 2,000-page report, his proposed changes to the UK data protection regime would include significantly scaling back the journalistic exemption currently afforded by section 32 of the DPA. This exemption currently allows data controllers to collect and use personal data without the need to comply with the other provisions of the Act, on the basis that it is collected with a view to the publication of journalistic material and is in the public interest.
If Leveson has his way, the exemption would be narrowed to permit only data processing that is “necessary” for publication, and the public interest assessment would no longer be weighted in favour of freedom of expression over the protection of privacy. The effect of this in practice would be to severely limit the ability of media organisations to process and store personal data without being in breach of the legislation.
By its nature, investigative journalism is provocative and often comes with the assumed threat of libel proceedings from disgruntled subjects if allegations cannot be defended or substantiated. Whilst responsible journalists may be able to rely on a defence of truth or qualified privilege in relation to such claims, a scaled-back journalistic exemption is likely to give some libel claimants a new remedy in circumstances where they are not so sure about their claim for libel. There is a danger that this will inhibit investigative journalism.
Yet the DPA is already being used, and occasionally abused, in defamation actions. In considering Leveson’s proposals, the government should therefore be mindful not to tilt the balance too far against the media. We consider below how the DPA can be used by individuals seeking to protect their reputations as an additional tool to libel and how the DPA can occasionally extend beyond its original purpose.
Scope of the DPA
The DPA was first introduced to protect the privacy of individuals and to ensure that their personal data was processed appropriately and, where possible in the circumstances, with their knowledge and consent. Yet in the thirteen years since its commencement on 1 March 2000, many claimants have sought to use the DPA in ways that were unlikely to have been intended by Parliament.
One particularly good example of this is the use of subject access requests. Data controllers are increasingly finding themselves in receipt of wide-ranging subject access requests under the DPA, which can also be seen by claimants as a means of obtaining pre-action disclosure or simply as a fishing expedition for the purposes of parallel litigation. Whilst data controllers can refuse to comply with such requests if they are obviously an abuse of process, this line can be extremely difficult to draw and many claimants will also have a legitimate interest to establish whether there has been a misuse of their personal data. It was therefore established in Elliott v Lloyds Bank PLC and Another  EW Misc 7 that unless it could be shown that a claimant would not have made a subject access request but for his improper collateral purpose, such a request must be complied with.
In the context of defamation claims, it is therefore perhaps unsurprising that the Information Commissioner has traditionally shown reluctance to adjudicate on an individual’s right to freedom of expression. In 2011, the Chief Executive of the Law Society wrote to the ICO to complain about the ‘Solicitors from Hell’ website, which was the source of a number of legal claims of which many readers of this blog are likely to be familiar.
The Information Commissioner responded that the DPA was not designed to deal with such issues and that it was “not the purpose of the DPA to regulate an individual right to freedom of expression – even where the individual uses a third party website, rather than his own facilities, to exercise this.” He highlighted the obvious practical difficulties of regulating material posted on websites in this manner, and relied on the exemption for personal processing under section 36 of the DPA.
A claim was subsequently brought in the courts against Rick Kordowski, the owner of the website, for defamation, harassment under the Protection from Harassment Act 1997 and breach of the DPA (The Law Society and others v Rick Kordowski  3185 (QB), better known as the ‘Solicitors from Hell’ case). With regard to the latter of these claims, the court held that the Defendant was a data controller of personal data (including sensitive personal data) relating to the solicitors in question and had processed this data “in a grossly unfair and unlawful way by, in particular, […] publishing highly offensive defamatory allegations about these solicitors and other individuals on the Website.”
Finding the Defendant in breach of both the First and Fourth Data Protection Principles (processing data fairly & lawfully and accurately respectively), Judge Tugendhat expressed sympathy with the Information Commissioner’s position but held that the section 36 exemption for domestic purposes did not apply. The fact that a claimant may have a claim under an alternative cause of action did not prevent enforcement under the DPA, and in cases where the processing is clearly unlawful it was difficult to say that the ICO could properly refuse to exercise its powers under Part V DPA.
The ruling in the Solicitors from Hell case is potentially very significant, as it leaves the door open to potential defamation complaints dressed up as complaints under the DPA being made directly to the ICO. Yet even more broadly than this, this decision represents something of a turning point in judicial attitude to the DPA being used to bolster defamation claims.
Taking a front seat
Prior to the decision in Kordowski, the courts had traditionally taken a similar view to the ICO that the DPA should not be seen as a parallel remedy to failed defamation claims. In Quinton v Peirce & Cooper  EWHC 912 (QB), the Claimant was a Conservative candidate who brought proceedings against his Liberal Democrat opponent for malicious falsehood and breach of the DPA in respect of election leaflets he had distributed that claimed Mr Quinton had not attended certain meetings.
Ruling on the case, Mr Justice Eady held that whilst the information in the leaflets did fall within the scope of the DPA, it was not processed in a way that broke the law and it was therefore neither necessary nor proportionate to interpret the scope of the DPA so as to provide a parallel set of remedies for the publication of information which was neither defamatory nor malicious. To grant the remedy of rectification available under the DPA would fly in the face of a long-established principle in defamation law that the courts will not force a Defendant to make an apology or retraction.
Yet since Kordowski, the approach of the courts has changed such that it has since been acknowledged that in some cases, a data protection claim may be the most appropriate cause of action and should take a front seat.
The DPA was also invoked in the recent case of Desmond v Foreman & Ors  EWHC 1900 (QB) (see the Inforrm comment here). Mr Desmond was a cover teacher who was suspended and ultimately dismissed following allegations of sexual impropriety towards a student. During the course of the investigation it came to light that in 2001, prior to his employment at the school in question, Mr Desmond had been arrested (but not charged) for attempted rape.
In fact, the Claimant had been arrested but was subsequently entirely exonerated after evidence was found that proved his innocence. The records held by the school and the local authority omitted this important detail, and Mr Desmond brought a claim for defamation, breach of the DPA and breach of the Human Rights Act 1998 on the basis that communications between the head-teacher and the local authority officials implied his guilt and were based on incomplete and incorrect information.
It is expressly stated in section 1 of the DPA that expressions of opinion about an individual constitute personal data, and as such inappropriate communication of such data can be a breach of the DPA as well as defamatory. Judge Tugendhat therefore held that the Claimant had a real prospect of succeeding with his claim.
This judgment is particularly interesting for its consideration of the role of the DPA in Mr Desmond’s claim, which represented a departure from the traditional standpoint. Instead of considering what a data protection claim could add to a defamation action, Judge Tugendhat considered the question in reverse – in what circumstances can a claim for defamation be used to bolster a claim for breach of the DPA?
Why might a libel claimant choose the DPA?
Ordinarily, a claim brought under the DPA alone will not be cost effective. Whilst such claims can be more straightforward than libel claims, awards for damages are usually small when compared to a successful claim for libel and a complaint to the ICO will not result in an award of damages at all. The real advantage of bringing a claim under the DPA lies instead in the alternative remedies that it can offer to claimants seeking alternative relief:
- Unlike most other claims, a claimant has just one year from initial publication in which to commence proceedings for defamation (although publication is considered to be renewed in respect of online publications). Given this relatively short window, a claim under the DPA gives a claimant up to five more years to bring a claim if the limitation period for defamation has expired.
- In some circumstances, and often in the context of online defamation, it may not be obvious who to commence legal proceedings against where allegations are made anonymously. In such circumstances it will be necessary to seek a Norwich Pharmacal disclosure order from the court. The requirement to demonstrate a prima facie cause of action in order to obtain such an order might be easier under the DPA than under libel law in some circumstances.
- Perhaps the most useful remedy that a claim under the DPA can provide, however, is the ability to obtain an interim injunction. It is a long-established rule in defamation law, dating back to 1891 (in the case of Bonnard v Perryman  2 Ch 269), that a court will not grant a claimant an interim injunction where the defendant expresses a bona fide intention to defend the claim. In practical terms, this means that injunctions for defamation are extremely difficult to obtain unless the defendant is anonymous or does not engage.
For claims brought under the DPA, however, quite the opposite is true. Indeed in many circumstances it will be of the utmost importance that a defendant is prohibited as soon as possible from continuing to process data in a way that is inconsistent with the DPA. Employing such a remedy in a defamation context can therefore provide a claimant with a powerful remedy that would not be available under traditional libel proceedings. This strategy was put to good effect in Sunderland Housing Company & Another v Baines & others  EWHC 2359 (QB) [pdf], where an injunction was granted to stop the defendant from processing personal data unlawfully and without a valid registration on its anonymous website (although this was also a rare case where an interim libel injunction was also granted).
It remains to be seen whether Leveson’s proposed reforms to the DPA will ever take effect. However if they do, our prediction is that the DPA is likely to take an increasingly prominent position in the toolbox of claimants seeking to protect their reputations.
Even as the law currently stands, recent case law suggests that in appropriate circumstances such claims can already provide claimants with powerful alternatives to traditional defamation actions and can even play a lead role to achieve certain results.
But the DPA can be abused in litigation as an alternative method of seeking pre-action disclosure or additional disclosure in parallel proceedings. If this practice continues, the government needs to be careful not to relax the journalistic exemption too far.
Ashley Hurst is a Partner and Jack Gilbert is an Associate in the Commercial Litigation team at Olswang LLP, specialising in media and internet-related disputes.
This article was first published in the Privacy Laws & Business UK Report, (Issue 66, March 2013) and is republished here with permission and thanks.