The Browns’ damage or distress

Paper files of medical records

What would you do if you were approached by a newspaper that wished to publish an article about your child’s illness?  Assuming you do not have the resources to instruct lawyers specialising in privacy and data protection to consider obtaining an injunction, you could look at a little-known and rarely-exercised right in the Data Protection Act 1998.

Section 10(1) & (2) of the Data Protection Act 1998 states:

10  Right to prevent processing likely to cause damage or distress.

(1) Subject to subsection (2), an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons—

(a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and

(b) that damage or distress is or would be unwarranted.

(2) Subsection (1) does not apply—

(a) in a case where any of the conditions in paragraphs 1 to 4 of Schedule 2 is met, or

(b) in such other cases as may be prescribed by the Secretary of State by order.

In the scenario being dealt with here, none of the conditions in subsection (2) apply.  As this right is rarely exercised, even less made the subject of any court proceedings, there is no judicial interpretation of what is required to meet the “substantial” level or where the line may be drawn between warranted and “unwarranted” for section 10.  However, it is a cost-free approach to issue a section 10 notice.  As this is a fundamental right under the Act, any recipient data controller ignoring it risks court action, or more likely, enforcement action by the Information Commissioner following a complaint by a person issuing the notice that their rights were ignored.

Although the Information Commissioner’s guidance on when he would be minded to issue a monetary penalty is not completely clear on this point, it is at least arguable that any denial of a section 10 right would be a severe breach of the Data Protection Act.  As a severe breach, it could be the subject of a monetary penalty notice, which can include a fine of up to £500,000.  The risk of being subject to a £500,000 fine, as well as the reputational fall out for a newspaper, might be enough to make a publisher think twice.

There is also the question of the lawfulness of the newspaper publishing the story concerning an individual’s medical condition.  In short, the publication is not covered by any of the lawful purposes for which medical data (included in the definition of “sensitive personal data” in the Act) may be processed. The only conceivable lawful purpose is contained in a statutory instrument, the Data Protection (Processing of Sensitive Personal Data) Order 2000. In particular, paragraph 3 of the Schedule to the Order states:

3.  The disclosure of personal data –

(a) is in the substantial public interest;

(b) is in connection with –

(i) the commission by any person of any unlawful act (whether alleged or established),

(ii) dishonesty, malpractice, or other seriously improper conduct by, or the unfitness or incompetence of, any person (whether alleged or established), or

(iii) mismanagement in the administration of, or failures in services provided by, any body or association (whether alleged or established);

(c) is for the special purposes as defined in section 3 of the Act; and

(d) is made with a view to the publication of those data by any person and the data controller reasonably believes that such publication would be in the public interest.

It is difficult to make a convincing case that knowledge of a child’s medical condition is in the substantial public interest for paragraph 3(a). Only the case of Leo Blair and MMR comes to mind as a possible example.  That, however, leaves the other conditions in paragraph 3 unfilled for this to be a lawful purpose.

However, newspapers can seek to apply the exemption at section 32 of the Act for journalism, literature or art.  The newspaper would have to be clear that publication was in the public interest (section 32(3)) and within the scope of the Press  Complaints Code (a designated code for the purposes of section 32 under the Data Protection (Designated Codes of Practice) Order 2000 – it is an anomaly that the sensitive personal data Order described above imposes a “substantial public interest” test in connection with journalism (the “special purpose” in paragraph 3(c)), whereas section 32 does not).  Note paragraph 6(v) of the current edition of the PCC Code to Editors, and point 5 of the note on the public interest test to be applied in matters concerning children:

v)  Editors must not use the fame, notoriety or position of a parent or guardian as sole justification for publishing details of a child’s private life.

5.  In cases involving children under 16, editors must demonstrate an exceptional public interest to over-ride the normally paramount interest of the child.

Clearly, the section 32 exemption must be one being relied upon by News International in connection with the publication of Fraser Brown’s medical condition.  It is disappointing, but perhaps not surprising in the circumstances of the relationship between No 10 and News International in 2006, that no complaint was made about the Fraser Brown report that would have given the Information Commissioner’s Office or a court a chance to describe the limits of section 32, or to resolve the conflicting public interest tests in section 32 and the sensitive personal data Order.

If you consider that section 32 gives newspapers too much leeway, then note that the exemption does not cover section 13 of the Act.  In particular, section 13(2)(b) provides, in effect, that “an individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if… the contravention relates to the processing of personal data for the [purposes of journalism]”. It would therefore be the case that if the Information Commissioner, as a result of a complaint, or a court ruled that the newspaper had not published (sensitive) personal data in the public interest, then the individual concerned could sue the newspaper for distress. This would be in addition to any monetary penalty imposed by the Information Commissioner for the contravention.

To date only Naomi Campbell has obtained such distress damages (Campbell v Mirror Group Newspapers [2002] EWHC 499 (QB), subsequently upheld by the House of Lords [2004] UKHL 22). Although not clearly identified as such, it would seem that these damages amounted to a modest £1,000, out of a total award of £3,500 damages under section 13 of the Act and for breach of confidentiality. The low level of these damages has itself probably deterred section 13 actions against newspapers.

The Daily Mail, Dorries and Data Protection

Community Trade Mark E7490592

Our last two posts addressed the position of Nadine Dorries MP under the Data Protection Act 1998 (the “DPA”) in respect of sensitive personal data concerning her partner’s wife posted on the MP’s website in her Personal Statement to the Press (here and here).

It appears that the Personal Statement to the Press may have been made in anticipation of a story being published in the Daily Mail the following day on the MP’s new relationship. In that story the same sensitive personal data was published, raising the question of whether the Daily Mail was itself potentially in breach of the DPA.

There is one material difference between the two cases. The Daily Mail, being a news organisation, can rely on the exemption at section 32 of the DPA. This applies where the processing of personal data, including the publication of it, is done for the special purposes of journalism, literature or art.  It is not a complete exemption from the provisions of the DPA, but it does permit a journalism organisation which “reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest” to breach a data protection principle (section 32(1)(b)) to breach a data protection principle where it “reasonably believes that, in all circumstances, compliance [with the data protection principle] is incompatible [for the purposes of journalism]” (section 32(1)(c)).

Publication, it is clear, includes making the journalistic material available to the public or any section of the public by any media (from section 32(6)).

A subject of any journalistic material retains their right to bring an action for compensation, including damages for distress (section 13(2)(b)), which means that any newspaper wishing to publish must weigh up the risk of being sued under the DPA and a court finding that newspaper could not have had a reasonable belief that the publication was in the public interest.  There are extremely few cases on this point, but perhaps the most notable is the Naomi Campbell case.  She brought a case against the Mirror as a result of pictures being published of her leaving a Narcotics Anonymous meeting.  The data protection aspect of the case was thoroughly described by the Master of the Rolls, Lord Phillips, when the case was appealed to the Court of Appeal (Naomi Campbell v Mirror Group Newspapers [2002] EWCA Civ 1373, subsequently appealed to the House of Lords [2004] UKHL 22).  At the Court of Appeal it was determined that the publication was in the public interest so that the section 32 exemption applied.  In the House of Lords the case was determined upon the basis of the balance of rights under the Human Rights Act 1998 rather than expressly dealing with the DPA, but this can be implied from section 32(1)(b) as being the balance between the right to freedom of expression and the right to privacy.

So in deciding whether the Daily Mail has breached the DPA, you have to consider, as a court would, whether there were grounds for a reasonable belief that publication of information on her partner’s wife was in the public interest.