Use personal information fairly

Factors to help consider reasonable expectations of privacy

If you are not sure whether someone has a reasonable expectation of privacy, general factors considered by the court in misuse of private information actions may help you. The court typically considers:

• the person concerned (eg Are they an adult or a child? Are they a public figure or do they perform a public role?);
• the nature of the activity and where it happens;
• how and why you plan to use the information;
• the absence of consent and whether it was known or could be inferred;
• the impact on the person; and
• how and why you obtained the information.

These factors are not exhaustive, and their significance varies from case to case, but they are regularly applied by courts as guidance.

Information already in the public domain

To consider the impact of any information that is already in the public domain, you may find it helpful to consider:

• the extent to which someone has made their personal information public;
• what personal information they have made public; and
• how you are planning to use their personal information.

When you are considering whether the information may be private, the extent to which it is in the public domain is generally an important factor. However, information does not necessarily lose its private character because the person concerned (or another person) has already disclosed, or intends to disclose, personal information about the same or similar parts of their life.

Naming a suspect in police investigations

The College of Policing guidance says the following about identifying suspects in a police investigation:

“Suspects should not be identified to the media (by disclosing names or other identifying information) prior to the point of charge, except where justified by clear circumstances, such as a threat to life, the prevention or detection of crime, or a matter of public interest and confidence”.

Allegations of criminal activity and reasonable expectations of privacy

There may be reasons why an expectation of privacy is not reasonable. For example:

• the activity may take place in a public place where it is not reasonable to expect privacy (eg rioting);
• an expectation, that was initially reasonable, may no longer be so (eg if the police decide to disclose information for operational reasons).

The Convention on the Rights of the Child, which was ratified by the UK in 1991, is a treaty designed to promote the protection of children worldwide.

Article 3 says:

“In all actions concerning children, whether undertaken by public or private social welfare institutions, courts of law, administrative authorities or legislative bodies, the best interests of the child shall be a primary consideration”.

Data Protection Act 1998 (DPA 1998) - reasonable expectation of privacy (paragraph 5.6 of the code).

Court of Appeal

Murray v Big Pictures (UK) [2008] EWCA Civ 446

This case concerned a newspaper’s publication of a photograph of Ms Murray’s child taken as her family were walking in a public street (Ms Murray is better known as JK Rowling, author of the Harry Potter books).

The judge’s comments in this case about misuse of private information have become part of general guidance to help assess whether a reasonable expectation of privacy exists. The judge said:

“…the question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case. They include the attributes of the claimant, the nature of the activity in which the claimant was engaged, the place at which it was happening, the nature and purpose of the intrusion, the absence of consent and whether it was known or could be inferred, the effect on the claimant and the circumstances in which and the purposes for which the information came into the hands of the publisher.” (36)

DPA 1998 - Spent convictions (paragraph 5.13 of the code).

High Court

NT1 & NT2 and Google LLC and ICO [2018] EWHC 799 (QB)

NT1 and NT2 asked Google to remove links of media reports about spent convictions about business activities.

The judge said: “The starting point, in respect of information disclosed in legal proceedings held in public, is that a person will not enjoy a reasonable expectation of privacy. But there may come a time when they do…. As a matter of general principle, the fact that a conviction is spent will normally be a weighty factor against the further use or disclosure of information about those matters, in ways other than those specifically envisaged by Parliament…

But the specific rights asserted by the individual concerned will still need to be evaluated, and weighed against any competing free speech or freedom of information considerations, or other relevant factors, that may arise in the particular case”.

Misuse of private information - Criminal allegations under investigation by the state, reasonable expectation of privacy, and professionals and business people (paragraph 5.14 and 5.22 of the code).

UK Supreme Court

Bloomberg LP v ZXC [2022] UKSC 5

This case concerned information based on a confidential letter of request from a UK law enforcement body. The claimant said that Bloomberg had misused his private information.

Although this case was not considered under data protection law, it is nonetheless relevant to the following:

• considering the requirement to use personal information fairly;
• when the legitimate interests lawful basis is used; and
• where relevant, when considering the journalism exemption.

The court considered whether, in general, a person under criminal investigation by the state has, prior to being charged, a reasonable expectation of privacy about information relating to that investigation. It set out the following:

• The legitimate starting point is that there is a reasonable expectation of privacy in the above circumstances.
• The reason for this is that publication of such information ordinarily causes damage to a person’s reputation together with harm to multiple aspects of their private life. The harm and damage can on occasion be “irremediable and profound”.
• The legitimate starting point is not a legal rule or legal presumption. It all depends on the facts.
• The claimant still has to prove that the circumstances mean there was a reasonable expectation of privacy.
• From the starting point, the court will consider whether the expectation did not arise at all, or was significantly reduced. If it is significantly reduced, that is factored into the balance of the public interest.

For the public interest, a weighty factor in the balance was the generally strong public interest in observing duties of confidence and the specific public interest in not prejudicing an ongoing criminal investigation.

The court was clear that this case is:

“…confined to the impact of information derived from an investigation of a person by an organ of the state rather than the distinct and separate situation that might arise if Bloomberg wished to publish information as to the results of its own investigations.” (78)

Data Protection Directive 95/46/EC - whether someone is a “public figure” or has a “role in public life” (paragraph 5.23 of the code)

European Court of Justice (ECJ)

Google Spain C-131/12

Working party guidance published to support this judgement may help you to decide whether someone is “a public figure” or has “a role in public life”.

Role in public life

The guidance acknowledges that it is not possible to establish hard-fast rules about this, but it said:

“…by way of illustrating, politicians, senior public officials, business-people and members of the (regulated) professions can usually be considered to fulfil a role in public life…

A good rule of thumb is to [consider whether publication to the public]…would protect them against improper public or professional conduct”.

Public figures

The guidance again acknowledges the difficulties of a set description of this sub-group of people. However, it said:

“In general, it can be said that public figures are individuals who, due to their functions/commitments, have a degree of media exposure.

The Resolution 1165 (1198) of the Parliamentary Assembly of the Council of Europe on the right to privacy provides a possible definition of ‘public figures’. It states that, ‘public figures are persons holding public office and/or using public resources and, more broadly speaking, all those who play a role in public life, whether in politics, the economy, the arts, the social sphere, sport or in any other domain’.”

Misuse of private information and DPA 1998 - Public figures and reasonable expectation of privacy (paragraph 5.23)

High Court

Sir Cliff Richard OBE v the BBC [2018] EWHC 1837 (Ch)

This case concerned the BBC’s decision to broadcast the police search of Sir Cliff Richard’s home and to name him specifically as the subject of a police investigation into an allegation of sexual abuse.

The judge said:

 “…the very act of making certain aspects of oneself public means…that there is a corresponding loss of privacy in those areas which are made public. However, it does not follow that there is some sort of across the board diminution of the effect of privacy rights…It depends on the degree of ‘surrender’, the area of private life involved and the degree of intrusion into the private life.”

Misuse of private information – arrest in a public place (paragraph 5.27)

High Court

Sicri v Associated Newspapers Ltd [2020] EWHC 3541 (QB)

This case concerned the arrest of a suspect in the investigation into the terrorist attack at the Manchester Arena in 2017. In line with standard practice, the police did not name the suspect, but he was named by a newspaper.

The newspaper largely relied on the argument that someone who was arrested in “a high-profile police operation in the middle of a small town would stand little expectation of privacy given the speed at which a story like this would spread around local residents.” (89)

The court referred to the action against Bloomberg by ZXC (see case 3 above). It referred to the general principle that a person under criminal investigation by the state has, prior to being charged, a reasonable expectation of privacy about information relating to that investigation. It said that the court had made clear in different decisions that:

 “…there may be exceptions to the general rule, which stands ‘not as an invariable or unqualified right to privacy during an investigation but as a legitimate starting point’…Factors that might defeat the legitimate expectation were identified in ZXC.” (86) The court gave examples, including:

• the public nature of the activity under consideration (eg rioting); and
• a decision by the police for operational reasons to reveal a suspect’s name.

The court also said that “…it may accordingly be too much for a person arrested at his home to expect his neighbours to stay silent, and not to gossip amongst themselves…and yet entirely reasonable for that same person to expect that a media publisher will refrain from reporting his identify as a suspect online, in permanent form, to tens of millions of strangers.” (93)

UK GDPR article 5(1)(a) – the lawfulness, fairness and transparency principle

UK GDPR guidance and resources: Lawfulness, fairness and transparency

UK GDPR guidance and resources: Children’s information