Misuse of private information in UK law

Article 8 of the European Convention on Human Rights ('the Convention') protects a person’s right to "respect for his private and family life, his home and his correspondence", while article 10 protects the right to freedom of expression.

While a variety of different causes of action may be relevant to a complaint about a person’s private life, including harassment and defamation, the primary cause of action is misuse of private information. This was developed by the House of Lords in the 2004 Naomi Campbell v Mirror Group Newspapers case as a means of incorporating the rights granted by articles 8 and 10 of the Convention into English breach of confidence law. According to the ruling in the Campbell case, misuse of private information claims are concerned with “the protection of human autonomy and dignity—the right to control the dissemination of information about one’s private life and the right to the esteem and respect of other people".

What does a claimant need to show?

While misuse of private information claims tend to be fact-sensitive, the courts will invariably apply a two-stage process.

Stage one - reasonable expectation of privacy

A claimant must first establish that they have a reasonable expectation of privacy in the information in question. In 2008, in a case between JK Rowling's son David Murray and the Big Pictures agency, the Supreme Court held that: “the question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case".

Read more on data, privacy and media law

• Defamation in England and Wales
• Malicious falsehood in English law
• Civil and criminal harassment in the UK

The Supreme Court suggested that the circumstances a court might consider include:

• the attributes of the claimant;
• the nature of the activity in which the claimant was engaged;
• the place at which it was happening;
• the nature and purpose of the intrusion;
• the absence of consent and whether it was known or could be inferred;
• the effect on the claimant; and
• the circumstances in which and the purposes for which the information came into the hands of the publisher.

Further guidance is contained in other court judgments.

In the Campbell ruling, the House of Lords confirmed that in some instances the information is obviously private, such as where it relates to an individual’s health or sexual relationships. Where it is not, the court will consider whether a reasonable person of ordinary sensibilities would find the disclosure offensive if placed in the same position as the claimant.

The publication of private information by way of photographs is governed by the same principles as information published by other means. However, publishing images has been found to be particularly intrusive and it has resulted in a number of successful privacy claims such as in the David Murray case, and in cases involving Princess Caroline of Monaco and Paul Weller's children.

The Court of Appeal has said that it is possible to bring a claim for misuse of private information even where the information in question is false, if that false information is of a personal nature.

In 2022, in ZXC v Bloomberg, the Supreme Court confirmed that an individual usually has a reasonable expectation of privacy in the fact that they are the subject of criminal investigations up until the point that they are charged with an offence.

Although claimants have increasingly sought to bring misuse of private information actions alongside data protection claims for personal data breaches, it is important to remember that individuals do not have a reasonable expectation of privacy with respect to information purely because it is their personal data.

Article 8 will only be engaged if the interference in question is not trivial, with the Court of Appeal noting that people are expected to "adopt a reasonably robust and realistic approach to living in the 21st century". In that regard, the High Court has suggested that public figures are expected to have a 'thicker skin' than private individuals.

Stage two - the balancing exercise

If the claimant establishes a reasonable expectation of privacy, the court then conducts a balancing exercise between the competing rights engaged: those of the publisher to impart, and the public to receive, the information; and the privacy rights of the claimant.

In a 2004 case in the House of Lords, Lord Steyn identified four relevant principles from the Naomi Campbell case:

• neither article 8 nor 10 has precedence over the other;
• where there is a conflict between the rights under article 8 and 10, an "intense focus" is necessary upon the comparative importance of the specific rights claimed - as the Supreme Court has also since confirmed;
• the court has to take account of the justifications for interfering with or restricting each right; and
• the proportionality test has to be applied to each.

The degree to which the intended disclosure is in the public interest is a key factor in balancing competing rights under articles 8 and 10 of the Convention.

The publication of private information is easier to justify when it relates to matters of significant public interest, such as corruption and politics. In the case involving Princess Caroline of Monaco, the European Court of Human Rights emphasised the "fundamental distinction … between reporting facts – even controversial ones – capable of contributing to a debate in a democratic society relating to politicians in the exercise of their functions … and reporting details of an individual who … does not exercise official functions". The English courts have followed this approach, for example in the 2008 case between Max Mosley and the News of the World.

However, the High Court has also said that there may be a public interest in less obviously serious information - where, for example, publication corrects or exposes a public image advanced by the claimant.

Has a “misuse” occurred?

In 2021, the High Court confirmed that there must be some form of positive action by the defendant capable of amounting to a “misuse” in respect of the information in question. In that case it was third-party hackers, and not the company as the victim of their attack, who had misused the claimant's information.

The High Court has applied this requirement for a positive action relatively broadly holding, for example, that:

• a retailer’s failure to wipe a customer’s data from a Smart TV before resale was not a positive action with respect to that data capable of amounting to a misuse; and
• an NHS Trust had not misused patient information by granting a third party contractor access to those patients, even though that third party had unlawfully accessed patient paperwork during visits.

In a media context, the 'misuse' tends to be the disclosure, usually the publication or threatened publication, of private information - but a claim does not require publication. In a 2011 ruling in a case involving the model Imogen Thomas, Mr Justice Eady said that "the modern law of privacy is not concerned solely with information or 'secrets': it is also concerned importantly with intrusion". This approach was followed by Mr Justice Mann in the well-publicised phone hacking cases brought against Mirror Group Newspapers, where separate damages awards were made for the hacking itself as well as for the publication of stories relating to the claimants.

Remedies

The same remedies are available for misuse of private information as for breach of duty of confidence: an injunction, compensatory damages or account of profits, delivery up or destruction of offending material. In media cases, it is an injunction to restrain the misuse, usually to prevent publication, which the claimant may be most interested in.

Despite Max Mosley’s attempts to argue otherwise there is no right to prior notification, and it is in any event worth bearing in mind that an application for an injunction may result in even greater publicity than would otherwise have been the case.

Damages awards for misuse of private information have historically tended to be quite low. Mosley’s successful claim against News of the World publisher News Group Newspapers in 2008 resulted in an award of £60,000, which was the largest damages award at that time for a misuse of private information claim.

Since then there have been the widely reported settlements in the phone hacking claims against News International. More recently, the decision in the phone hacking claims, in which Mr Justice Mann made damages awards ranging from £72,500 to £260,250, has raised the bar considerably. The judgment also established that claimants advancing misuse of private information claims could be entitled to damages for the loss of control of their private information in and of itself, as well as for distress.

Costs

Where claimants are successful in bringing claims for misuse of private information, they will be able to recover any associated after-the-event (ATE) insurance premiums from the defendant. In recent years, this has led to a trend of claimants including a claim for misuse of private information in low-value data breach claims, which might otherwise be rendered financially unviable by the size of any premiums payable compared to the claim value.

It is therefore important to establish the claimant’s funding position at an early stage where a claim in misuse of private information is threatened and to factor the potential recoverability of ATE premiums into any strategy decisions.