Lawyers and Wokkas – revisited

Mull of Kintyre Lighthouse © Patrick Mackie

On 2 June 1994 RAF Chinook HC2 ZD576 crashed on the Mull of Kintyre, killing all twenty five passengers and all four crew.  The two pilots, Flt Lt Jonathan Tapper, 28, and Flt Lt Rick Cook, 30, were found by the RAF to have caused the accident by their “gross negligence“, despite that fact that the initial RAF Board of Inquiry did not find any evidence to prove pilot error to any standard (civil – balance of probability, criminal – beyond all reasonable doubt, gross negligence for deceased aircrew under RAF Manual of Flight Safety – absolutely no doubt whatsoever).  In my post on this and other legal questions concerning RAF Chinooks (Lawyers and Wokkas) I speculated that the air officers who reviewed the Board of Inquiry findings and made the gross negligence finding were either extremely badly advised on the legal aspects of what they were doing as reviewing officers, or did not take appropriate legal advice.

Yesterday the Mull of Kintyre Review set up by the Secretary of State for Defence, Rt Hon. Dr Liam Fox on 16 September 2010, published its report.  It’s core finding that the finding of gross negligence be set aside was accepted immediately by the Secretary of State.

What caught my eye was the section in the report dealing with the Reviewing Officers.  It would appear that one of the air officers did receive legal advice, which appears to have been incorrect, whereas the other did not.  Paragraph 6.2.15 of the report states:

Both Reviewing Officers agreed that there was little point in making findings of negligence against deceased aircrew but, standing the Regulations in force at the time, considered that they had no alternative but to do so. In fairness to them, we do not consider that the application of the unfamiliar standard of proof was an easy task for professional aviators with no legal training. Sir John Day very properly sought legal advice, something which we were told had not previously been done in connection with a Board of Inquiry. Regrettably, the effect of the introduction of paragraph 9 of Annex G had not previously been the subject of careful consideration by the RAF Directorate of Legal Services. The result was that the legal advice provided to the Reviewing Officers did not for the reasons we have already explained assist them in their task. It provided them with comfort when it should have emphasised the restriction on their powers.

It gives me little pleasure to say that my initial assessment made in 2009 was right.  Sometimes there is no substitute for getting proper legal advice.

The Browns’ damage or distress

Paper files of medical records

What would you do if you were approached by a newspaper that wished to publish an article about your child’s illness?  Assuming you do not have the resources to instruct lawyers specialising in privacy and data protection to consider obtaining an injunction, you could look at a little-known and rarely-exercised right in the Data Protection Act 1998.

Section 10(1) & (2) of the Data Protection Act 1998 states:

10  Right to prevent processing likely to cause damage or distress.

(1) Subject to subsection (2), an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons—

(a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and

(b) that damage or distress is or would be unwarranted.

(2) Subsection (1) does not apply—

(a) in a case where any of the conditions in paragraphs 1 to 4 of Schedule 2 is met, or

(b) in such other cases as may be prescribed by the Secretary of State by order.

In the scenario being dealt with here, none of the conditions in subsection (2) apply.  As this right is rarely exercised, even less made the subject of any court proceedings, there is no judicial interpretation of what is required to meet the “substantial” level or where the line may be drawn between warranted and “unwarranted” for section 10.  However, it is a cost-free approach to issue a section 10 notice.  As this is a fundamental right under the Act, any recipient data controller ignoring it risks court action, or more likely, enforcement action by the Information Commissioner following a complaint by a person issuing the notice that their rights were ignored.

Although the Information Commissioner’s guidance on when he would be minded to issue a monetary penalty is not completely clear on this point, it is at least arguable that any denial of a section 10 right would be a severe breach of the Data Protection Act.  As a severe breach, it could be the subject of a monetary penalty notice, which can include a fine of up to £500,000.  The risk of being subject to a £500,000 fine, as well as the reputational fall out for a newspaper, might be enough to make a publisher think twice.

There is also the question of the lawfulness of the newspaper publishing the story concerning an individual’s medical condition.  In short, the publication is not covered by any of the lawful purposes for which medical data (included in the definition of “sensitive personal data” in the Act) may be processed. The only conceivable lawful purpose is contained in a statutory instrument, the Data Protection (Processing of Sensitive Personal Data) Order 2000. In particular, paragraph 3 of the Schedule to the Order states:

3.  The disclosure of personal data –

(a) is in the substantial public interest;

(b) is in connection with –

(i) the commission by any person of any unlawful act (whether alleged or established),

(ii) dishonesty, malpractice, or other seriously improper conduct by, or the unfitness or incompetence of, any person (whether alleged or established), or

(iii) mismanagement in the administration of, or failures in services provided by, any body or association (whether alleged or established);

(c) is for the special purposes as defined in section 3 of the Act; and

(d) is made with a view to the publication of those data by any person and the data controller reasonably believes that such publication would be in the public interest.

It is difficult to make a convincing case that knowledge of a child’s medical condition is in the substantial public interest for paragraph 3(a). Only the case of Leo Blair and MMR comes to mind as a possible example.  That, however, leaves the other conditions in paragraph 3 unfilled for this to be a lawful purpose.

However, newspapers can seek to apply the exemption at section 32 of the Act for journalism, literature or art.  The newspaper would have to be clear that publication was in the public interest (section 32(3)) and within the scope of the Press  Complaints Code (a designated code for the purposes of section 32 under the Data Protection (Designated Codes of Practice) Order 2000 – it is an anomaly that the sensitive personal data Order described above imposes a “substantial public interest” test in connection with journalism (the “special purpose” in paragraph 3(c)), whereas section 32 does not).  Note paragraph 6(v) of the current edition of the PCC Code to Editors, and point 5 of the note on the public interest test to be applied in matters concerning children:

v)  Editors must not use the fame, notoriety or position of a parent or guardian as sole justification for publishing details of a child’s private life.

5.  In cases involving children under 16, editors must demonstrate an exceptional public interest to over-ride the normally paramount interest of the child.

Clearly, the section 32 exemption must be one being relied upon by News International in connection with the publication of Fraser Brown’s medical condition.  It is disappointing, but perhaps not surprising in the circumstances of the relationship between No 10 and News International in 2006, that no complaint was made about the Fraser Brown report that would have given the Information Commissioner’s Office or a court a chance to describe the limits of section 32, or to resolve the conflicting public interest tests in section 32 and the sensitive personal data Order.

If you consider that section 32 gives newspapers too much leeway, then note that the exemption does not cover section 13 of the Act.  In particular, section 13(2)(b) provides, in effect, that “an individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if… the contravention relates to the processing of personal data for the [purposes of journalism]”. It would therefore be the case that if the Information Commissioner, as a result of a complaint, or a court ruled that the newspaper had not published (sensitive) personal data in the public interest, then the individual concerned could sue the newspaper for distress. This would be in addition to any monetary penalty imposed by the Information Commissioner for the contravention.

To date only Naomi Campbell has obtained such distress damages (Campbell v Mirror Group Newspapers [2002] EWHC 499 (QB), subsequently upheld by the House of Lords [2004] UKHL 22). Although not clearly identified as such, it would seem that these damages amounted to a modest £1,000, out of a total award of £3,500 damages under section 13 of the Act and for breach of confidentiality. The low level of these damages has itself probably deterred section 13 actions against newspapers.

What price investigative journalism?

Many questions are being asked about the fourth estate in the aftermath of the News of the World hacking scandal.  However, few seem to considering the potential that reactionary measures adopted as a result of widespread illegality by journalists may make genuine investigative journalism that is conducted in the public interest impossible.  In particular, the Information Commissioner’s 2006 report into the illegal sale of personal data, What Price Privacy?, is getting the attention it should have received 5 years ago. However, the reports of the number of incidences of sale of personal data to journalists fails to note that some of this activity could have been lawful.

There is already an exemption from the scope and reach of the Data Protection Act 1998 to cover genuine journalism. Section 32(1) of the Act states:

(1)  Personal data which are processed only for the special purposes are exempt from any provision to which this subsection relates if—

(a)  the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,

(b)  the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and

(c)  the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.

“Special purposes” means any one or more of for purposes of journalism, artistic purposes, and literary purposes (Section 3 of the Act).

The main criminal offence being committed by phone hackers under the Data Protection Act 1998 is the unlawful obtaining of individuals’ phone numbers and PINs for voice mail boxes – the actual interception of communications is either an offence under the Regulation of Investigatory Powers Act 2000 or the Computer Misuse Act 1990.  In particular, section 55 of the Act states:

55 Unlawful obtaining etc. of personal data.

(1)  A person must not knowingly or recklessly, without the consent of the data controller—

(a)  obtain or disclose personal data or the information contained in personal data, or

(b)  procure the disclosure to another person of the information contained in personal data.

(2)  Subsection (1) does not apply to a person who shows—

(a)  that the obtaining, disclosing or procuring—

(i)  was necessary for the purpose of preventing or detecting crime, or

(ii)  was required or authorised by or under any enactment, by any rule of law or by the order of a court,

(b)  that he acted in the reasonable belief that he had in law the right to obtain or disclose the data or information or, as the case may be, to procure the disclosure of the information to the other person,

(c)  that he acted in the reasonable belief that he would have had the consent of the data controller if the data controller had known of the obtaining, disclosing or procuring and the circumstances of it, or

(d)  that in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest.

(3)  A person who contravenes subsection (1) is guilty of an offence.

(4)  A person who sells personal data is guilty of an offence if he has obtained the data in contravention of subsection (1).

(5)  A person who offers to sell personal data is guilty of an offence if—

(a)  he has obtained the data in contravention of subsection (1), or

(b)  he subsequently obtains the data in contravention of that subsection.

(6)  For the purposes of subsection (5), an advertisement indicating that personal data are or may be for sale is an offer to sell the data.

(7)  Section 1(2) does not apply for the purposes of this section; and for the purposes of subsections (4) to (6), “personal data” includes information extracted from personal data.

(8)  References in this section to personal data do not include references to personal data which by virtue of section 28 or 33A are exempt from this section.

It is therefore clear that there is a public interest defence to the section 55 criminal offence, at section 55(2)(d), that would enable the techniques being used by News of the World and others to continue to be used for legitimate investigative journalism.

When it comes to interception of communications, which is an offence under section 1 of the Regulation of Investigatory Powers Act 2000, there are a complex set of exemptions both in the Act itself (at section 3) and under the Telecommunications (Interception)(Lawful Business Practices) Regulations 2000.  I therefore have some sympathy with investigative journalists in that there does not appear to be a simple public interest defence open to them to be able to intercept communications lawfully. Similarly, if accessing voice mail boxes were considered to be computer misuse under the Computer Misuse Act 1990, there is no public interest defence under the 1990 Act.

I therefore consider that in any consideration of greater regulation of the press, consideration should be given to providing for public interest defences for the purposes of journalism in the 1990 and 2000 Acts. I also agree that the maximum penalty of £5,000 for a breach of section 55 is lamentable. It was in 2006, it clearly is in 2011.

Will Tesco rescue News International, James Murdoch and Rebekah Brooks?

© Copyright Steve Daniels

Tesco Supermarkets Ltd –v- Nattrass [1972] AC 153 is a well known case that describes and limits the application of what is known as the attribution or identification principle. This determines under what circumstances a company can be considered to have committed a criminal offence as a result of the acts or omissions of any of its directors or employees.   In the words of Lord Reid (at paragraph 170):

A living person has a mind which can have knowledge or intention or be negligent and he has hands to carry out his intentions. A corporation has none of these: it must act through living persons, though not always one or the same person. Then the person who acts is not speaking or acting for the company. He is acting as the company and his mind which directs his acts is the mind of the company. There is no question of the company being vicariously liable. He is not acting as a servant, representative, agent or delegate. He is an embodiment of the company or, one could say, he hears and speaks through the persona of the company, within his appropriate sphere, and his mind is the mind of the company. If it is a guilty mind then that is the guilt of the company. It must be a question of law whether, once the facts have been ascertained, a person in doing particular things is to be regarded as the company or merely as the company’s servant or agent. In that case any liability of the company can only be a statutory or vicarious liability.

In practice this has meant that there has to be a close connection between the acts or omissions of any particular employees and the company itself; in many cases, successful prosecutions of companies have only followed where the criminal offence has been committed by a managing director/sole or majority shareholder in a small company (see my earlier post on corporate manslaughter).

When the News of the World royal correspondent Clive Goodman and inquiry agent Glenn Mulcaire were found guilty for offences under the Regulation of Investigatory Powers Act 2000 (RIPA) (and Criminal Law Act 1977), it appeared at the time that the interception of communications by them was, as far as the News of the World was concerned, the act of one rogue reporter and his agent.  In the words of the last ever editor of News of the World, Colin Myler, to the Press Complaints Commission, the episode concerning Clive Goodman and Glenn Mulcaire was “an exceptional and unhappy event in the 163 year history of the News of the World, involving one journalist”.  There was no suggestion that News International was considered for prosecution at the time Clive Goodman and Glenn Mulcaire were prosecuted.

In light of more recent events, there are indications that the scope of hacking by Glenn Mulcaire for News of the World was much more widespread than merely working for one rogue reporter. There are also suggestions that involvement of the editors at the time, Andy Coulson (arrested today) and Rebekah Brooks, means that there is a real prospect that if they can be considered to be the controlling mind of News International for the purposes of RIPA criminal offences, then News International could itself be prosecuted under RIPA.

This leads to another interesting conclusion. RIPA, like many Acts of Parliament, includes a provision that catches directors of companies that are prosecuted for a criminal offence. The RIPA version of this provision states, at section 79(1):

79 Criminal liability of directors etc.

(1) Where an offence under any provision of this Act other than a provision of Part III is committed by a body corporate and is proved to have been committed with the consent or connivance of, or to be attributable to any neglect on the part of—

(a) a director, manager, secretary or other similar officer of the body corporate, or

(b) any person who was purporting to act in any such capacity,

he (as well as the body corporate) shall be guilty of that offence and liable to be proceeded against and punished accordingly.

So if editors of newspapers are considered sufficiently close to a newspaper to be its controlling mind for the purposes of a relevant criminal offence, and directors of that newspaper neglected to ensure that practices and procedures in the company were lawful or condoned the illegal practices that enabled the newspaper to score many scoops, then those directors may also be criminally liable.  In this light, the statement by James Murdoch concerning the closure of the News of the World makes interesting reading.

It should be noted that given current company case law following Tesco Supermarkets v Nattrass, it is a big “if” to consider that the identification principle would result in News International being successfully prosecuted as a result of actions by its editor(s). Consequently, the prospect of James Murdoch or other directors facing prosecution is even more remote.

Standards in the media

After years of tenacious reporting by The Guardian, the scandal of telephone hacking and interception of communications by The News of the World has finally reached a tipping point. Yesterday the Prime Minister, in response to a question from the Leader of the Opposition in Prime Minister’s Questions, promised at least one public inquiry into the whole affair. Many commentators have already re-quoted David Mellor’s statement that the press were drinking in the last chance saloon (widely reported to be in 1989, when as Secretary of State for the Department of National Heritage, but no Hansard reference found). So what will happen?

It is more than possible that there will be a call for statutory regulation of newspapers. It is obvious that the Press Complaints Commission has been unable to act as a rigorous regulator. Self-regulation may no longer be tenable in print media.

How does this compare with broadcast media? Radio and television are subject to statutory control under the Communications Act 2003 and the Broadcasting Act 1996. Regulation on standards in programmes, sponsorship, product placement in television programmes, fairness and privacy are consequently set out in the Ofcom Broadcasting Code. In particular, there are separate sections of the Code that deal with fairness and privacy. There is a degree of precedent in the way Ofcom considers complaints about breaches of fairness and privacy. Ofcom has published guidance on procedures for dealing with fairness and privacy complaints, with all adjudications published in the Broadcasting Bulletin. Financial penalties can be imposed to a theoretical limit of 5% of relevant turnover (or “qualifying revenue”, in the terminology of the Broadcasting Act 1990). Fines have reached into the millions, for example £3,000,000 against LWT (Holdings) Limited in connection with breaches in connection with Ant & Dec’s Saturday Night Takeaway in 2008.

I suggest, therefore, that a statutory scheme already exists that could easily be extended to cover print media. All that is required is the political will.