Hawktalk

Privacy, the Press, Press regulation and super-injunctions: more heat than light

Super injunctions just for the rich and powerful? The Courts making it up a privacy law as they go along? Is that the impression you get from the media coverage of the current super injunction case? However, did you know that, in this case, the Court concluded that the question was more about blackmail than free speech? Did you know that the newspaper did not provide any evidence as to why the public interest was served by disclosure? [Note added on 17 May: 20 days late, most newspapers have reported the "blackmail" angle today]

One reason why the debate about privacy and press freedom is so skewed is because the public gets all its information from the very press that has a vested interest in the outcome of the debate. The fact that the media is against any further privacy constraints should not come as a surprise; for the tabloids especially, more bonking inevitably leads to more banking.

So, in this blog, I identify the six legal tests the Courts are using when considering to apply an injunction and I redress the collective press amnesia by reporting what the press has often failed to report.  I then conclude by focusing on the real issues. As usual, the cases are fully referenced.

Six legal tests before an injunction is granted

In another judgment, published last week, relating to a case involving a sexual relationship (male and female, both married, working in the entertainment industry - rumoured to be the same TV show), the woman lost her job soon after the man ended the affair following a denouement with “the wife”. The News of the World (prop. Mr Murdoch) wanted to publish a story that the two were connected and that woman was sacked because of the ending of their relationship. The man successfully applied for an injunction to stop publication arguing that it would interfere with his attempts to rebuild his family life (ETK and News Group Newspapers Ltd ([2011] EWCA Civ 439).

This judgment is useful in that it set out six principles which govern an application for an interim injunction to restrain publication by the press. These balance freedom of expression with privacy. The question that needs to be considered, therefore, is whether these six steps are reasonable or whether they need to be improved from a privacy or freedom of expression perspective. The six steps are:

Step 1: Has the applicant a reasonable expectation of privacy? If not, the claim fails.

Step 2: Is there a reasonable expectation of privacy in relation to the information?  This test assesses “whether a reasonable person of ordinary sensibilities, if placed in the same situation as the subject of the disclosure, rather than the recipient, would find the disclosure offensive” (in Campbell v MGN Ltd ([2004] UKHL 22, [2004] 2 AC 457).

In Step 2, the Court also takes into account of all the circumstances of the case (e.g. “attributes of the claimant, the nature of the activity in which the claimant was engaged, the place at which it was happening, the nature and purpose of the intrusion, the absence of consent and whether it was known or could be inferred, the effect on the claimant and the circumstances in which and the purposes for which the information came into the hands of the publisher" (following Murray v Express Newspapers [2009] Ch 481 at para 36).

Step 3: Is the information already in the public domain? In Browne v Associated Newspapers Ltd ([2008] QB 103 at para 61), the Court considered the impact of “information which is made available to a person's circle of friends or work colleagues and information which is widely published in a newspaper”. What “may start as information which is private has become information known to the public at large is a matter of fact and degree for determination in each case depending on its specific circumstances”.

Step 4: Is Article 8 actually engaged? If so apply  "the ultimate balancing test" which has four elements identified by Lord Steyn (in Re S (A Child) (Identification: Restrictions on Publication) [2005] 1 A.C. 593 at para 17):

"First, neither article [8 or 10] has as such precedence over the other. Secondly, where the values under the two articles are in conflict, an intense focus on the comparative importance of the specific rights being claimed in the individual case is necessary. Thirdly, the justifications for interfering with or restricting each right must be taken into account. Finally, the proportionality test must be applied to each”.

Step 5: Is there a public interest served by disclosure to the public?  (e.g. “the decisive factor in balancing the protection of private life against freedom of expression should lie in the contribution that the published photos and articles make to a debate of general interest" (following Von Hannover v Germany (2004) 40 EHRR 1, at para 76).

Step 6: Apply section 12(3) of the Human Rights Act 1998. This means that an interim injunction should not be granted unless a court is satisfied that the applicant is likely – in the sense of more likely than not – to obtain an injunction following a trial.

The omissions in some press reporting

Most of the press reported that the purpose of the super injunction was to stop the publishing of confidential material about the claimant’s private life. The judgment, for instance, states that the evidence “showed that the First Defendant, probably through her partner, had been negotiating with a newspaper group to sell intimate photographs and other information obtained in circumstances that were clearly private and in respect of which she owed the Claimant a duty of confidence”.

However, often there was a failure by the press to report some or all of the other key facts (listed below):

Fact 1: the Judge considered the case not to be one of kiss and tell, rather “a straightforward and blatant blackmail case”. Evidence was produced in Court “that a large sum of money was being discussed with Associated Newspapers Ltd but, at that point, someone acting on the First Defendant’s behalf contacted the Claimant’s solicitor on the evening of 29 January and told him that she would rather do “a deal” with him. It was said that she thought that the Claimant might prefer to pay some money to make the problem go away for good”.

Fact 2: the Court was provided evidence as to the likely adverse impact of publicity on the health and wellbeing of various members of the Claimant’s family. This involved “solid medical evidence as to the health, including the mental health, of the Claimant and various family members”. The judge concluded that “their rights plainly need to be taken into account”.

Fact 3: the newspaper provided no evidence about how the public interest would be served by the publication. The Judge notes that although the “Claimant’s advisers had been notified that leading counsel was to be instructed on their behalf to resist the order, but once the evidence was disclosed to them the matter was not pursued”. Consequently the judge reported that “I have no idea, therefore, what the grounds of opposition might have been” and as a result “I have to carry out the balancing exercise as best I can on the information before me”.

The important questions that need to be answered

I have never liked the argument that “super injunctions are only for the rich”. This is only true because only the rich can afford go to a Court; it does not follow that because the “not rich” are effectively excluded from the injunction process, that there should be no injunctions at all. The “rich only” argument deflects attention from the central issue: whether there should be a balance between freedom of expression by the press and privacy of the individual.

So this is the first question to resolve: should there be a balance or should there be no balance? Go on make your choice! In answering this question, you should consider whether a balance is enforceable in the Internet age (I think it is enforceable but you may beg to differ). If you consider that a balance is not enforceable, then that is the end of the questioning: your job as a tabloid newspaper editor beckons.

If there is to be balance, consider then who should establish that balance? There are five choices: the press decide where the balance lies; the Courts decide where the balance lies; Parliament changes the law (which is then interpreted by the Courts) so a new law decide where the balance lies; the balance is established by a regulatory regime; or the person whose privacy is invaded makes the decision.

Quite clearly, if there is to be balance, then the idea of an accessible regulatory regime would probably be more flexible than the Courts. If you choose the Courts, then you are back to the current position, possibly with other balancing criteria that differ slightly from the ones currently identified by the Courts (see the six tests above). Any new criteria cannot diverge too much as the UK has to implement Articles 8 and 10 of the European Convention on Human Rights. In fact, I would go so far as to say that if you chose the Courts, you are choosing the status quo.

Obviously a choice for the press or the individual deciding alone where the balence should lie is not a balance. I also do not like the idea of politicians going anywhere near press freedom or privacy; this is because there are too many vested interests involved (e.g. Government's interest in surveillance policy that invade privacy (for example, Passenger Name Record), most of the press support the Conservative Party; some MPs want to get even over the expenses scandal; Parliament is a weak institution with little effective power of scrutiny so what a balance in the Government's interest will be the likely outcome).

If you choose a regulatory regime, the choice is between: (a) self regulation by the Press Complaints Commission (PCC) or (b) statutory regulation by a regulatory framework (e.g. the Information Commissioner or placing the PCC on a statutory footing).

So, now you have arrived at the end-point. Probably this is a strengthened but non-statutory PCC adjudicating on matters prior to publication in the same way as they adjudicate on matters after they have been published. This, in summary, is the conclusion of the Parliamentary Select Committee which explored this issue (see references).

What do I think will happen?

The Press are on the back foot because the hacking scandal; this will continue put them in a very poor light and will increase the pressure for more regulation. The super injunction has been used as a godsend to present distracting headlines: this argues that there is too much regulation already.

I also think the politicians already know that legislating in the area of privacy versus press freedom delivers real pain for no gain; look at the history from Calcutt in the 1990's. That explains why the Section 55 custodial sentence has not been commenced after 4 years: locking up journalists simply does not get you friends in the press, especially at election time.

The result is that these politicians will set up a committee to cool down the debate, the committee will deliberate slowly, a boring report will follow and nothing will happen on the legislative front. I am sure you know the definition of a Committee: "a body where good ideas go and get buried".

However, this more or less leaves the status quo and injunctions decided by the Courts. That is why those with wise heads in the media should begin to argue that the Press Complaints Commission should adjudicate in private on such injunction matters.

Far better a voluntary self regulatory solution before an imposed statutory solution.

Relevant links

Press standards,privacy and libel; Second Report of Session 2009–10, http://www.parliament.the-stationery-office.co.uk/pa/cm200910/cmselect/cmcumeds/362/36210.htm. This is a detailed report which focused on the current situation.

If you want to find out about other press injunctions, then this link is useful: http://lawjusticejournalism.org/2011/04/14/privacy-injunction-hearings-not-super-but-anonymous/

Advert: Forthcoming courses including ISEB courses: Data Protection in London starting on May 10th and Data Protection in Manchester starts on 12th May. FOI starts in London on 13 June. Next Update is October 17th 2011 in London. We have timetabled our Audit, Privacy Impact Assessment, and RIPA courses for September 12th, 13th and 14th in London. Full details on the Amberhawk main site (www.amberhawk.com) 

Privacy, the Press and journalist hacking: Answers to some unanswered questions

I thought I would put into the public domain my answers to some very important questions surrounding the journalist phone hacking scandal. Of course I am reading the runes to obtain my answers, but after all its Friday – the day when one can speculate irresponsibly. However, please look carefully at what is said about “acceptable use” policies.

Q1: Why has the Metropolitan Police upped its inquiry and have 50 officers on the case?

I think the Met Police had been acting on the wrong legal advice which stated that unread emails could only be intercepted in breach of the Regulation of Investigatory Powers Act (RIPA).

This position was reached by looking at Section 2(2) of RIPA which states that "a person intercepts a communication in the course of its transmission by means of a telecommunication system if, and only if, he—
           (a)so modifies or interferes with the system, or its operation,
           (b)so monitors transmissions made by means of the system, or.
           (c)so monitors transmissions made by wireless telegraphy to or from apparatus comprised in the system,

as to make some or all of the contents of the communication available, while being transmitted, to a person other than the sender or intended recipient of the communication (my emphasis). 

However, the Met’s analysis misses out section 2(7) of theRIPA which extends the meaning of section 2(2). Section 2(7) states that:

“For the purposes of this section the times while a communication is being transmitted by means of a telecommunication system shall be taken to include any time when the system by means of which the communication is being, or has been, transmitted is used for storing it in a manner that enables the intended recipient to collect it or otherwise to have access to it."

So, if you include section 2(7) of RIPA it is clear that accessing a read message is still an interception as the law applies to messages stored 'in a manner that enables the intended recipient to collect it or otherwise to have access to it".

At our UPDATE event last week, Rosemary Jay added, that it was very important for those organisations who have acceptable use policies that look at private emails after they have been read (thinking that there is no RIPA issue) should re-examine them. If you retain such emails on your system to have access to them in future, then those read communications have been stored in order to enable the intended recipients to have access to them. In other words, looking at such read emails can still be subject to RIPA.

Of course we do not know for certain whether the Met’s legal advice has changed; but something clearly fundamental has.

 

Q2: Why has there been an offer to settle outstanding cases?

The key objective of the offer is to close the privacy cases down with a minimum of embarrassing disclosure. Those claimants who fail to settle and continue the claim in the Courts run the risk of being awarded costs if the settlement is less than what is on offer. For example, suppose you are offered £20K to settle and your refuse. If the Court awards less than £20K, you become liable for all costs.

The problem for this strategy is that the criminal inquiry risks further disclosure unless the journalists plead guilty. So, does this mean that there may be financial incentives for anybody facing a trial to plead guilty if they are guilty? An interesting thought as those journalists who plead guilty will know where other skeletons lie. They might offer to exhume them, or act as witness against senior managers. In other words, the more journalists are arrested, the more likely that the net will widen.

Q3: Are only News of the World journalists involved?

The Information Commissioner has documented in his “What Price Privacy?” series that the practice of hacking is likely to be endemic. He reported that the invoice trail indicated that the few private investigators he had investigated had delivered “services” to the following tabloid newspapers:

Daily/Sunday Mail had paid for 1,218 investigations to be undertaken by Private Investigators on behalf of up to 91 different journalists. The Daily/Sunday Mirror ordered 824 investigations on behalf of up to 70 journalists. The Sunday People ordered 802 investigations involving up to 50 journalists, and the News of the World (the paper of current interest” had ordered 228 transactions of up to 33 journalists.

The evidence above suggests there were large number of invasions of privacy by hacking and the News of the World are not the only culprits. It is also difficult to see that the 50 officers now on the case are looking at journalists from only one newspaper. In my view, this story will run and run for quite a bit.

Q4: What are the consequences?

If the Met police inquiry ranges to more newspapers, then the need for a statutory right to privacy is back on the political agenda, especially as politicians and Cabinet Ministers have been targeted by journalist hackers. A toughening up of the Press Complaints Regime, perhaps placing it on some kind of statutory basis, appears to be a minimum measure

Relevant links

"Police legal advice says there is full RIPA protection for unread spam (but no privacy protection for your confidential archive": http://amberhawk.typepad.com/amberhawk/2010/09/police-legal-advice-says-there-is-full-ripa-protection-for-unread-spam-but-no-privacy-protection-for-your-confidential-archi.html

"Privacy lawyer challenges police view of intercept law": http://www.out-law.com/page-11382

"What Price Privacy Now" (ICO report):  http://www.ico.gov.uk/upload/documents/library/corporate/research_and_reports/ico-wppnow-0602.pdf.

Details of Operation Motorman: http://www.ico.gov.uk/upload/documents/library/corporate/detailed_specialist_guides/section_55_response_to_moj_consultation_20091112.pdf

Advert: Forthcoming  courses including ISEB courses: Data Protection in London starting on May 10th, Manchester 12th May. FOI starts in London on 13 June. Next Update is October 17th 2011 in London.  We have timetabled our PIA, Audit and RIPA courses for September. See Amberhawk main site (www.amberhawk.com)

Data Protection: UK wants to extend PNR Directive despite proportionality fears and the lack of evidence

Last week the European Data Protection Supervisor (EDPS) posted a damning report into how the proposed Passenger Name Record (PNR) Directive was disproportionate and failed to protect the privacy of passengers arriving in Europe. At more or less the same time the UK Government, with the support of a Committee of the House of Lords, supported the extension of this Directive to include the capture of details of passengers using internal flights within Europe. This proposal is being pushed through despite the fact there is no published evidential basis for the need for this PNR Directive.

To understand why the EDPS criticism is so trenchant, you have to start with the Article 29 Working Party (WP29) report last November (see references: WP29 is a Committee whose members are national Data Protection Commissioners). At that time, many discussions were taking place about the content of a proposed PNR Directive, so the WP29’s objective was to guide those discussions into considering fundamental data protection matters.

That is why the WP29 insisted on saying that:

“Any PNR system should be:
1. demonstrably necessary to address the problem;
2. demonstrably likely to address the problem;
3. proportionate to the security benefit;
4. demonstrably less invasive than alternative measures;
5. regularly reviewed to ensure the measures are still proportionate”.

Now ask yourself a simple question: “why did the WP29 stress these five comments?”. The answer, I am afraid is obvious: “because what they had seen did not convince them that fundamental privacy requirements were being addressed”. When you look at these five items, they are - well - sort of obvious. The fact that they needed to be expressed meant that WP29 were implying that these five issues were not a priority for those involved in drafting the PNR proposals.

Additionally, the WP29 could not directly criticise something whose content was not finalised. But when the PNR proposal text was published in early February 2011 (see references), it only took seven weeks for the EDPS to enter the fray and give vent to the very concerns the WP29 had raised some four months earlier.

In the EDPS’s view, the PNR proposals “fail to demonstrate the necessity and the proportionality of a system involving a large-scale collection of PNR data for the purpose of a systematic assessment of all passengers” adding that it is “their use in a systematic and indiscriminate way, with regard to all passengers, which raises specific concerns". In other words, European Member States are proposing legislation that is likely to breach Article 8 of the Human Rights regime of every Member State.

In addition to this major shortcoming of the proposed system the EDPS recommendations included the following:

• That the scope of application should be limited to serious crimes where minor crimes are explicitly excluded. This comment has been made because current PNR proposal can include minor crimes (see blog of 8/02/2011: link in references)

• No personal data should be kept beyond 30 days in an identifiable form, except in cases requiring further investigation. This comment has been made because the current PNR proposal includes a 5 year retention criterion.

• The data protection principles adopted should be of the standard of the Data Protection Directive; This comment has been made because the Principles the PNR Directive authors have in mind are those specially adopted by law enforcement for law enforcement (the Framework Decision 2008/977/JHA) which are particularly weak in several areas (e.g. transfers to third countries, supervision).

• The list of PNR personal data remains too extensive and should be further reduced. This comment has been made because a prime function of the PNR system is to gather intelligence for a host of law enforcement bodies.

• The statistics required to justify implementation of the PNR system, once implemented, are not collected. This comment has been made because it is left to Member States to provide the statistics. I would go so far as to say the lack of independence in these provisions allows Member States to statistically “cook the books” in favour of self-justifying the need for the PNR Directive.

The EDPS criticisms have not deterred the House of Lords from issuing a report in favour of the PNR Directive. Not only do the Committee say the UK should opt-in to its provisions PNR Directive, but the Directive itself should be extended to internal flights within the European Union. It observes that “The Government made strenuous efforts to extend this to flights between Member States—intra-EU flights—but had not succeeded by the time the negotiations were suspended” and recommends that this step be taken.  My own view is that such an inclusion to internal flights is inevitable: just think for a second: which flights do most European citizens take!

The Government’s position is clearly in favour of this extension. A memorandum given to the Committee (and published for the first time on this blog) states “The UK Government strongly believes that the ability to collect and process PNR data on intra-EU flights is vital to improving security and to fighting crime within the EU and beyond” (see references; paragraph 24’s emphasis).

The absence of evidence for the PNR Directive

In his report, the EDPS “notes that the Impact Assessment includes extensive explanations and statistics to justify the Proposal” but that “these elements are however not convincing”. He then details four examples of the “not-convincing” narrative and concludes that “there is not enough relevant and accurate background documentation which demonstrates the necessity of the instrument”. Strong stuff!

The Centre for European Politics (CEP) has also cast light on the lack of evidence for a PNR Directive (see references). It explains that “Commission itself, however, admits that “detailed statistics on the extent to which such data help prevent, detect, investigate and prosecute serious crime and terrorism are not available [COM(2011) 32, p. 6]”. However the CEP briefing then explains that “according to the Commission this is due to the fact that the EU has little experience in using PNR data” (see references).

However CEP then states that the Commission’s explanation is simply wrong. It recalls that “the existing experience gained from PNR agreements with third Countries” has been studiously ignored, and speculates that this lack of interest in existing PNR arrangements “could be explained by the fact that this experience indicates that the impact of PNR data on successful counter-crime and counter-terrorism is insignificant”.

No evidential problems, apparently,  with the House of Lords. Its report notes that “In the course of our inquiry the following year into the draft EU PNR Framework Decision, we received from the Home Office further material which persuaded us that PNR data, when used in conjunction with data from other sources, can significantly assist in the identification of terrorists. We now have no hesitation in accepting the Home Office's assessment of the value of PNR data for the prevention and detection of serious crime and terrorism.” (Para 6 of the Report; Report’s emphasis).

Since the House of Lords Report did not publish this evidence, I asked the Committee officials where I could find “the Home Office further material” that the Committee had “received”. The response was as follows. In 2008, the Committee held an inquiry into the PNR Framework Decision in draft; it expressed support for the PNR Decision “based on confidential material – not formal evidence - received from the Home Office in May 2008.  This was not distributed to the Committee but was read to members by the then Chairman at a meeting.  It was not published”.

The comment concludes: “the current members (of the Committee) accept the views of their predecessors: hence their conclusion in para 6 of the 2011 report” (this is the “...no hestitation..” quote which the Committee emphasised – see above).  In other words, there is no published evidence justifying the PNR Directive: the EDPS can’t find it, the CEP can’t find it, and Parliament hasn’t been given it in a way that can be independently examined.

So there we have it, Home Office whispers in a Committee Chairman’s ear three years ago amounts to evidence!

Concluding comment

Lurking in the back of my mind is the fact that if the air carriers are monitored, any self respecting crook will travel by train or sea. Surely, if we apply the logic underpinning the PNR Directive, we conclude that internal EU flights have to be included and it can’t be long before the argument arises that if air travel has to be monitored, then other forms of international travel have to be monitored as well.

International car travel is already covered by a surveillance infrastructure: if one drives into the UK, there is a panoply of ANPR cameras all ready primed to “meet and greet” visitors to these shores. Similarly, foot passengers are already covered by CCTV; facial recognition linkage to digital photographs in passports and driving licences is just a matter of time.

Welcome to surveillance Europe!

References

The WP document “Opinion 7/2010 on European Commission's Communication on the global approach to transfers of Passenger Name Record (PNR) data to third countries” is  available from http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/2010_en.htm

The EDPS criticism is available from: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2011/11-03-25_PNR_EN.pdf

The Centre for European Politics briefing on PNR is on http://www.cep.eu/en/analyses-of-eu-policy/transport/passenger-name-record-data/

Download the House of Lords Committee report on PNR: Download Lords-select-cttee-report on PNR

Download the Home Office Memo to the Lords Committee on PNR:Download Lords-Home Office memo_select-cttee-report on PNR

The PNR Directive can be obtained from: http://ec.europa.eu/home-affairs/news/intro/docs/com_2011_32_en.pdf

Blogs: Why the PNR Directive is disproportionate and does not protect privacy. http://amberhawk.typepad.com/amberhawk/2011/02/why-the-pnr-directive-is-disproportionate-and-does-not-protect-privacy.html (please note the comment at the end of this blog).

Advert: Forthcoming courses: Data Protection in London starting on May 10th, Manchester 12th May. FOI starts in London on 13 June. Download course schedule here:Download Amber_dates_table_2011

Oyster Card Passenger Name Record system to protect London Olympics

The European Commission has published today a proposal for an “Oyster Card Passenger Name Record (OCPNR) Regulation” to fight serious crime and terrorism before and during the London Olympics. The proposal obliges Transport for London (TfL) to provide EU Member States with data on passengers using London Tube and Bus system whilst at the same time guaranteeing a high level of privacy protection for Olympians and other VIPs.

"This proposal for an OCPNR Regulation is an extension of the existing PNR directive” said Cecilia Malmström, European Commissioner for Home Affairs. “It enhances EU security policy by allowing the PNR system, for example, to include the fine details of when drugs smugglers, people traffickers and terrorists travel on the Central Line to Stratford”.

Cecilia Malmström continued: “Special provisions ensure that passengers' privacy is respected and we recognise this is especially important to UK pensioners when using their bus pass to get to the local Tesco. Like the PNR Directive, our proposal protects privacy by requiring OCPNR data to be retained only for 5 years. We are especially proud of our subject access procedures which are second to none: these allow passengers to discover where they have gone and which bus they have used".

The Commission proposes that bus drivers transfer data on their passengers in real time but in a way that does not interrupted in their important task of transporting people to the Games. Buses drivers will have a pair of electronic Special Oyster Card Systems (or SOCs) that they will fasten around their lower calf area; these will transmit the oyster card data to the authorities.

These SOC data are combined with data from air carriers' reservation IT systems which will be transmitted to the authorities in order to complete their SOCIT data system. It is this combined system that permits Member States to SOCIT to serious criminals.

The Commission point to strong protection of privacy and personal data in the Regulation. Like the PNR data, OCPNR data cannot be transferred to Third Countries without the say-so of the Member State concerned. Member States must set up secure units that are monitored by an independent supervisory (data protection) authority who, in the UK, does not have the power of audit. Non-custodial sentences are available to punish those staff who deliberately disclose the whole database of personal data to unauthorised persons.

References:

To find out more about protecting London in 2012 follow the link: http://www.homeoffice.gov.uk/publications/counter-terrorism/olympics/london-2012-public-booklet?view=Binary

To find out more about the PNR system, follow the link: http://europa.eu/rapid/pressReleasesAction.do?reference=IP/11/120

Download the European Commission Press Release about the Oyster Card here:Download Oyster card April First