In an important judgment in the case of Stunt v Associated Newspapers ([2017] EWHC 695 (QB)) that will be reassuring to news media organisations, the High Court has determined that section 32(4) of the Data Protection Act 1998 is not incompatible with EU law.
On the application of Associated Newspapers, it has accordingly ordered a stay of certain claims under the DPA relating to unpublished material which Associated says it is holding for journalistic purposes with a view to future publication.
Facts of the case
Associated Newspapers, publisher of the Daily Mail, Mail on Sunday and Mail Online, is being sued by James Stunt, a wealthy businessman who is married to the younger daughter of the Formula One tycoon Bernie Ecclestone. Mr Stunt has for several years complained about the publication in Mail titles of material about him, including articles about his business activities and history and photographs of him in public enjoying a flashy lifestyle featuring expensive cars and trips to art dealers, charity events and restaurants.
Mr Stunt’s claims concern 27 articles published between March 2014 and November 2015 and allege misuse of private information, harassment and breaches and threatened breaches of the Data Protection Act. His claims under the Act include claims for damages for past breaches of the Act. But he also seeks the following relief:
- Orders for compliance with subject access requests made under s7 of the DPA.
- Orders for compliance with requests under s10 of the DPA to cease, or not to begin, processing of his personal data.
- Orders under s14 of the DPA that Associated should erase and destroy personal data and cease processing it.
Associated applied to the court for a stay of the proceedings under s32(4) of the DPA.
The legal framework
Although this is the first case in which a court has been asked to give full consideration to s32(4), the provision will be familiar to most media lawyers. It provides as follows:
“(4) Where at any time (“the relevant time”) in any proceedings against a data controller under section 7(9), 10(4), 12(8) or 14 or by virtue of section 13 the data controller claims, or it appears to the court, that any personal data to which the proceedings relate are being processed–
(a) only for the special purposes, and
(b) with a view to the publication by any person of any journalistic, literary or artistic material which, at the time twenty-four hours immediately before the relevant time, had not previously been published by the data controller,
the court shall stay the proceedings until either of the conditions in subsection (5) is met.”
Section 32(5) provides that the conditions in s32(4) are:
(a) that a determination of the Commissioner under section 45 with respect to the data in question takes effect, or
(b) in a case where the proceedings were stayed on the making of a claim, that the claim is withdrawn.
In short, the section obliges the court to stay proceedings involving DPA claims where those proceedings concern unpublished material held for the purposes of journalism.
The Claimant’s objection to the stay
It was common ground between the parties that the conditions for the application of a stay under s32(4) were fulfilled. All s32(4) requires is that the data controller (in this case Associated) should claim that the personal data to which the proceedings relate are being processed (a) only for the special purposes and (b) with a view to the publication of new material not previously published. Associated had made such a claim.
Mr Stunt’s argument on Associated’s application for a stay was that although the court was obliged to impose a stay on a literal interpretation of the section, it should not do so because s32(4) was incompatible with the EU Directive on Data Protection (95/46/EC) and should be disregarded. This ambitious argument was based essentially on a proposition that s32(4) was not “necessary” as part of the Directive’s process of balancing rights of free speech against data protection rights: see article 9 of the Directive. On Mr Stunt’s case, the essential balancing provision was contained in s32(1) (which contains more demanding requirements for a journalistic exemption from the DPA) and s32(4) was a purely procedural provision which did nothing to address or qualify those rights and served merely to block or delay their determination.
The Defendant argued that section 32(4) formed a proper part of the balancing process envisaged by Article 9 and was within the margin of flexibility permitted to the UK as a Member State. In particular, the provision was designed to control the extent to which parties could seek to use data protection legislation as a means of obtaining prior restraint to stop journalists and news organisations from investigating and publishing new stories.
The judgment
The court comprehensively dismissed the argument that section 32(4) was incompatible with EU law. The judge held that the measures in section 32(4) and (5) constituted a proper balance of the competing rights:
- While s32(4) was in a sense procedural as it concerned a stay, that did not determine the issue of whether it was part of the legitimate balancing of data privacy and free speech rights.
- The Hansard materials put before the judge provided “powerful support” for the Defendant’s position.
- s32(4) had a particular purpose in preventing the adverse effect on journalism of the threat of prior restraint. Parliament plainly intended that whilst the degree of Article 10 protection afforded by the conditions in s32(1) was sufficient in terms of any post publication remedies, a greater degree of protection was justified prior to publication.
- In considering whether the pre-publication restriction contained in s32(4) was within the permitted margin of appreciation it is material that it applies only to claims under the DPA. Conduct will often be relied on as constituting both a breach of the DPA and other torts such as misuse of private information and harassment. It is only in a relatively narrow sphere that s32(4) operates to impose a substantive restriction, i.e. in cases where the conduct breaches DPA rights and other private rights, the stay will not affect the other private rights or DPA rights concerning published material.
In light of his findings, the judge did not need to consider whether in the event of incompatibility it would have been possible to disregard s32(4) by application of the Marleasing principle or otherwise.
Although s32(4) may be read as requiring a stay of the entire proceedings, the judge stayed only the DPA claims relating to unpublished material. Mr Stunt is free to pursue his claims relating to published material.
Comment
This is a clear and comprehensive judgment which clarifies and confirms the existence of an important element of protection for freedom of expression. Paragraph 56 has particular resonance:
“Investigative journalism often requires acquiring and retaining data which is protected by the Act over a period of time and using it for a number of stories, in a way which could be seriously hindered and discouraged were the data to be subject to the full rights under the Act at the suit of the data subject prior to its full and final deployment in the published journalistic material. The process would be thwarted if the subject had access to the detailed extent or direction of the investigation, of the information gathered or of the intended story. It would be severely inhibiting to such a process were the subject able to go to Court and seek to require the information to be provided under s. 10(4) of the Act. Section 32(1) alone would not provide adequate protection. On such an application the very investigation of whether the s. 32(1) conditions were fulfilled, or arguably fulfilled, would have to involve disclosing to the data subject the nature of the information held by the journalist and the scope and intended scope of the investigation and story, if the subject were to be afforded a fair opportunity of contesting the issue or fulfilment or arguable fulfilment of the s. 32(1) criteria. Moreover, the mere existence of the possibility of such an application may have the chilling effect which Parliament legitimately wished to avoid by the clear terms of section 32(4).”
Claimants and their lawyers have for some time been making determined efforts to use data protection laws to stifle or interfere with legitimate journalistic activity and, as in this case, insisting even in the face of clear legislative wording that the law must give way to individuals’ data rights. This is a welcome rebuke to such efforts – including those recently published on the Inforrm blog!
Mr Stunt has been refused permission to appeal.
Keith Mathieson is a partner of RPC and acted for Associated Newspapers in this case.
Reblogged this on World4Justice : NOW! Lobby Forum..