The Sun illustrated its front page report on the England football team’s humiliating defeat at the hands of Iceland with a photograph of Wayne Rooney’s 6 year old son, Kai, in tears. Several other pictures of Kai at the match appeared in Sun Online.
The front page headline – a rather laboured reference to a supermarket advertising slogan – was “Dumbs gone to Iceland“. Similar pictures of Kai Rooney were published in a number of other national newspapers.
In a tweet today, Kai’s mother Coleen Rooney, described the front page as “absolutely shocking”.
Yes I've seen that front page and it's absolutely shocking!! 😡
— Coleen Rooney (@ColeenRoo) June 27, 2016
Some time after the publication of this tweet the pictures of Kai were mysteriously removed from Sun Online.
Media commentators have, predictably, been unsympathetic to Mrs Rooney. For example, Roy Greenslade suggests that
“… it is unlikely that Rooney will have cause to make a complaint to the Independent Press Standards Organisation (Ipso) because the Sun, and all the other titles that used pictures of Kai, do not appear to have breached the editors’ code of practice.
The boy was attending a public event. He and his brothers Kaly, aged three, and five-month-old Kit, have often been pictured with their parents. Seven days ago, Rooney posted a photograph of the boys with their father on Twitter”.
This is correct. None of the provisions of clause 6 of the Editors’ Code are breached by the publication of a photograph which does not concern the child’s welfare and is not taken at school. But this is not the end of the matter.
The Courts have considered the privacy rights of children in public places in a number of cases. The most recent of these was Weller v Associated Newspapers ([2014] EWCA Civ 1176). This concerned the taking of photographs of children in the street – not at a public event. It may be that a child in a football crowd has a reduced expectation of privacy. Bearing in mind the factors mentioned by Roy Greenslade – the nature of the event and the previously released pictures – a privacy claim would face obvious difficulties.
The position in relation to data protection is, however, very different. In the Weller case it was common ground that the misuse of private information and data protection claims stood or fell together (see [2014] EWHC 1163 (QB) [16]). But this is not, in fact, the case.
The argument in favour of a data protection claim goes like this:
(1) A photograph is “personal data” – it shows where a person was at a particular moment, what they looked like and (in the case of Kai’s photograph) what the subject was feeling at that time.
(2) The taking of a photograph with a digital camera, its storing, transmission or publication constitutes “processing” of that personal data within the meaning of section 1(1) of the Data Protection Act 1998 (“the DPA”).
(3) The photographer, photo agency and newspaper are all data controllers in respect of that data and, as a result, must comply with the requirements of the DPA. They must, for example, be registered on the Register of Data Controllers – a failure to register constitutes a criminal offence under section 17 of the DPA.
(4) Although there is an exemption from most of the DPA when personal data is processed for with a view to publication of journalistic material, by section 32(1) this only applies where
“(b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and
(c) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes”.
(5) A data controller which processes a photograph showing a crying child cannot reasonably believe that publication of this photograph would be in the public interest. As a result, section 32 does not apply.
(6) In order for the processing to be lawful, one of the conditions in Schedule 2 to the DPA must apply – these include, for example, consent or the processing being necessary for various purposes such as the performance of contracts or the administration of justice. None apply in this case. The fact that the photograph is taken at a public event or that the parents have previously consented to the publication of photographs of the child is wholly irrelevant.
(7) It follows that the processing by the photographer, the agency and the newspapers is unlawful under the DPA.
Finally, it is should be noted that although all newspapers and some agencies are on the Data Protection Register many photographers and some agencies (including some of those taking photographs of Kai on 27 June 2016) are not. Processing by an unregistered data controller is illegal in any event.
As a result, if Mr and Mrs Rooney wished to take action over the Sun’s front page, they would have a strong claim under the DPA. If the photograph has had an impact on Kai himself he would be entitled to damages for distress under section 13.
Hugh Tomlinson QC is a member of Matrix and an editor of Inforrm
What about consent to data processing? The terms and conditions of attending a Euro 2016 football match include:
“mandatory consent(s) in relation to personal data processing and acceptance of the Terms and Conditions as required by UEFA in the Registration Form and in the Application Form is(are) properly given by clicking the respective box(es)in the Registration Form and in the Application Form;”
While it also provides:
“Any Ticket Holder attending a UEFA EURO 2016™ Match acknowledges and accepts that use may be made by EURO 2016 SAS, UEFA and all those authorised by them, free of charge, of his/her voice, image and likeness, when he/she was in the Stadium, in still images, audio, visual and/or audio-visual transmissions or materials taken or recorded at such moment and used simultaneously to their capture or any time afterwards in relation to such match and UEFA EURO 2016™ in general.”
How does this affect the analysis?
Thank you for this – which is an important and interesting point.
It gives rise to a number of issues:
(a) Was “consent” given for the purposes of the DPA by purchasing a ticket (or probably in the case of Kai Rooney, by accepting the gift of a ticket)? This is a complex question on which the ICO has given some general guidance
(b) Were the photographers who took the photographs authorised by UEFA to take and publish such images?
(c) Even if the consent is effective is it wide enough to cover not just the taking of photographs but their publication in prominent positions in newspapers?
Hugh Tomlinson
All are very important questions.
So maybe the analysis in the post is a bit black and white, with statements such as “None [of the Schedule 2 principles] apply in this case. The fact that the photograph is taken at a public event … is wholly irrelevant.”
I agree that that there are more arguments than could be conveniently summarised in a short post, although my view remains that if the issues were fully analysed none of the Schedule 2 conditions would apply. The fact that the photograph is taken at a public event is irrelevant. What you have drawn attention to is the potential relevance of contractual consent which, I suspect, would not assist the data controller on the facts.
Hugh Tomlinson
Also, what about the fact that most of the acts of processing took place in France? See s.5 of the Act.
The question is where is the data controller established. News Group Newspapers Limited is certainly established in the UK and it appears that the photographs were largely taken by UK based photographers and agencies. As a result, I do think that the Data Protection Act 1998 would apply (as opposed to French data protection law which is, of course, to similar effect).
Hugh Tomlinson
It’s not entirely clear to me where the photographers or their agencies are established. If the claim were one for misuse of private information this probably wouldn’t make a difference – see Douglas & Weller – but I’m not sure that it would be quite straightforward if you were suing under the DPA.