The Battle for Rights – Getting Data Protection Cases to Court

1 Introduction

In his 1872 masterwork Der Kampf ums Recht, or The Battle for Right as it was known in England,¹ the German legal sociologist Rudolf von Jhering argued that the ideal environment for the creation of law is one in which aggrieved individuals voice their grievances publicly, and lawmakers including judges respond with the development of legal standards in sympathy with their concerns. Law is thus the product of a constant struggle by individuals for the recognition of legal rights. In words later echoed to a considerable extent by the American jurist Oliver Wendall Holmes Jr,² von Jhering said that ‘[t]he life of the law’ is based on the idea of ‘restless striving and working’.³ Or as Holmes eloquently put it in his own masterwork The Common Law in 1881, ‘the life of the law has not been logic; it has been experience’.⁴ Von Jhering may have restricted his comments to private law, taking the benevolent view that ‘the realisation in practice of public law and criminal law is assured, because it is imposed as a duty on public officials’.⁵ However, his logic may be extended to any law whose ‘practical realisation depends on the assertion by individuals of their legal rights’,⁶ including where public officials have wide discretion rather than a specific ‘duty’ to give effect to the law for the individual’s protection. In these instances, as in others where ‘the realisation’ of the law depends upon the ability of individuals to bring claims, it can be argued that the individuals concerned should have the power directly to vindicate their legal rights.

In any event, this was the position taken by the framers of the Bürgerliches Gesetzbuch (BGB) who, in 1896, responded to von Jhering and others who maintained that law should reflect modern concerns, including protection against ‘attacks on personality’.⁷ Section 823 II of the BGB stated that a person harmed as a result of another’s breach of a statutory provision adopted for his or her protection is entitled to bring a claim for damages in court.⁸ After the BGB came into force the provision became an early platform for the development of personality rights in Germany in the early 1900s,⁹ even before the inclusion of rights to dignity and personality in the post-second world war German Constitution, which prompted a more expansive reading of the provisions of the BGB to flesh out personality rights in accordance with the new constitutional standards.¹⁰

A number of jurisdictions in the common law world have adopted versions of section 823 II of the BGB in ways tailored to personality rights. For example, the New York legislature, after the failure of the plaintiff’s privacy claim in the 1902 case of Roberson v Rochester Folding Box Co,¹¹ enacted sections 50 and 51 of the New York Civil Rights Law in 1903. These sections, which continue in force today, impose criminal liability on those who without consent use a person’s name or likeness for advertising or trade purposes (the circumstances of the Roberson case) and further specify that a person harmed can bring a civil action for damages.¹² Thus, even without much by way of common law protection of privacy in New York, there is some statutory protection available to privacy through sections 50 and 51 of the Civil Rights Law including a right to bring claims to court. Moreover, this protection has withstood (to an extent) the broad reading given by the US courts, especially from the 1960s onwards, of the right to freedom of speech and the press under the First Amendment to the Bill of Rights in the US Constitution.¹³

Norway provides an example of a mixed system with some common law features. As noted in Lillo-Stenberg and Sæther v Norway,¹⁴ plaintiffs can rely on sections 3-6 of the Damages Compensation Act of 1969 in conjunction with section 390 of the Penal Code of 1902 to bring civil claims for legal protection of privacy.¹⁵ Although Norwegian courts have also developed their own non-statutory precedents in favour of privacy,¹⁶ the above statutory provisions have often been relied on in cases involving privacy claims, including the Lillo-Stenberg case. It was only because of the particular circumstances of the latter case (involving celebrity performers engaged in a spectacular celebration of their marriage in a publicly accessible area) that the Norwegian Supreme Court held that the publication of unauthorised photographs of parts of the celebration (but not the actual marriage ceremony) in the magazine Se og Hør was not an unlawful violation of the plaintiffs’ privacy. When the case came before the European Court of Human Rights, the latter accepted that an appropriate balance had been reached between the rights to private life and freedom of expression under Articles 8 and 10 of the European Convention on Human Rights and Fundamental Freedoms (ECHR) taking into account the margin of appreciation afforded to national law.

Nevertheless, common law jurisdictions have not, as a general matter, accepted that individuals should be entitled to bring an action under a statute adopted for their protection. Rather, developments of privacy law in common law jurisdictions have mainly been focused on common law (i.e. judge-made law), which itself is premised on the central idea of individuals bringing claims to court. While this approach has worked reasonably well for aspects of privacy law, it has led to a relative lack of development of data protection norms in these jurisdictions,¹⁷ although the situation appears now to be changing.

2 The Common Law Approach

In common law jurisdictions, in contrast to the broad freedom accorded to common law doctrine developing through judicial resolution of individual grievances, statutes are given a restricted role. Thus in the UK and Australia, it is said that a statute, being the provenance of the legislature, must manifest an intention to allow private claims to be brought before the courts. Indeed, where a statute provides its own mechanism for enforcement – as for instance with the appointment of a public official or body to oversee its operation – the assumption is against private claims (except to the extent provided for under the statute). The classic statement is still held to be that of Lord Tenterden CJ in Doe d Bishop of Rochester (Murray) v Bridges in 1831: ‘[w]here an Act creates an obligation, and enforces the performance in a specified manner, we take it to be a general rule that performance cannot be enforced in any other manner’.¹⁸ In the US there is sometimes said to be no tort of breach of statutory duty¹⁹ – although this statement may go too far, for a court may take a statutory standard into account in assessing liability for the common law tort of negligence or in fashioning other torts based on the statutory ‘policy’.²⁰ Nevertheless, if a statute provides its own mechanism for enforcement, the inclination is often (with some variations) against this.²¹

These approaches have limited the development of rights over personal data in common law jurisdictions. For instance, section 5 of the US Federal Trade Commission Act of 1914 (as amended in 1938)²² broadly prohibits ‘unfair or deceptive acts or practices’ in trade. This is often billed as a consumer data protection provision. Yet it has been treated as offering a relatively limited base for the development of consumer data protection norms. The courts have held that enforcement of section 5 vests in the Federal Trade Commission. This is on the basis that ‘[o]n careful examination of the Act and its legislative history … Congress did not contemplate or intend … a private right of action’ and ‘the social ends to be fostered [by the statute] and the administrative means of achieving those objectives, are inseparably interwoven into a unified and comprehensive statutory fabric’, with the legislative balance ‘[taking] into account not only consumer protection but also the interests of the businesses affected, with particular concern for tempered enforcement, the orderly development of commercial standards, and freedom from multiplicitous litigation’.²³ The FTC is entitled to bring cases to court but rarely does so, leaving this as the last option for situations where it cannot itself resolve the matter. Moreover, its preference is usually to resolve matters through a process of negotiated compromise rather than the pronouncement of relevant legal norms. Commentators have noted that ‘the FTC has asserted itself as a strong watchdog in this domain based on its broad authority to regulate “unfair and deceptive trade practices” pursuant to Section 5 of the Federal Trade Commission Act’.²⁴ However, the FTC hardly operates as a vehicle for the stringent vindication of data protection rights, due to its conciliatory approach.²⁵

Not all US states have emulated the federal approach under the FTC Act. California, for instance, has a number of statutory protections of personal data which allow for individual claims. These include the protection of a person’s name or likeness from unauthorised use in advertising under section 3388 of the California Civil Code;²⁶ the protection against ‘unfair competition’ under section 17200 et seq of the California Business and Professional Code;²⁷ the protection of medical records under section 56 of the California Confidentiality of Medical Information Act;²⁸ and rules on ‘personal information privacy’ dealt with under section 1798.81 et seq of the California Civil Code.²⁹ Several substantial class actions relying on these provisions have been brought in California in recent years. A high profile example is the Fraley v Facebook class action launched after the social network’s change of terms of service to facilitate its sponsored stories advertising programme. The plaintiffs’ claims included breach of customers’ publicity rights and unfair competition. After Facebook failed in its attempt to have the claims struck out summarily,³⁰ a settlement was arrived at, requiring payment of damages and clear notification of Facebook terms. Adobe has been another target.³¹ And more recently, current and former employees of Sony Entertainment have brought several class actions against the company after a major 2014 hack of the company resulted in the release of their personal data, including sensitive health information, on the internet. The claims against Sony include, inter alia, breach of the Confidentiality of Medical Information Act and the personal information privacy standards of the California Civil Code.³² Thus, it seems that California is developing as a centre for what might be called data protection law – much in the same way as it earlier developed as a locus of common law and statutory claims around the protection of privacy and publicity.

Dealing with privacy and publicity rights as a matter of common law may be a reasonable option for plaintiffs given the inherent flexibility of common law doctrines. Samuel Warren and Louis Brandeis argued in their seminal article on ‘The Right to Privacy’ published in 1890³³ that the law should move further to acknowledge the right to privacy in response to claimants’ demands in a way that, some have suggested, was influenced by von Jhering.³⁴ Yet, they were talking about a new common law (rather than statutory) privacy tort which would build on and supplement previous common law developments. In this respect, they were following Holmes who in the 1880s treated the common law as a principal site of the development of legal rights in response to new social circumstances.³⁵ It was a powerful argument at the turn of a century when social changes included the widespread use of the portable camera,³⁶ the ‘yellow press’,³⁷ and modern advertising techniques,³⁸ leading to some public consternation about the consequences for privacy.³⁹ The plaintiffs’ claims, bolstered by Warren and Brandeis’ arguments, inspired the development of a number of privacy torts in various US states. These torts were subsequently catalogued by Prosser as torts of, respectively, publication of private facts, intrusion on seclusion, false light publicity, and appropriation of name or likeness⁴⁰ (the latter a precursor to what would later become a publicity right).

Might the common law produce a set of data protection norms? In some ways common law developments have been quite well geared to modern conditions of weak computerised information-security systems combined with powerful communication networks. For example, in the pending Sony litigation in California, one of the claims rests on negligence, which is framed in terms of a lack of due care in guarding employees’ and former employees’ personnel files from malicious hacking and internet publication.⁴¹ Comparable claims have already succeeded in other US cases, including in Remsburg v Docusearch, Inc in New Hampshire where an internet-based investigation and information service was held liable for negligence for retrieving and passing on social security and address details of a woman to a stalker who murdered her.⁴² American privacy scholars have identified Remsburg as ‘an important step forward in recognising and remedying modern information privacy harms’.⁴³ European scholars might consider this a step beyond privacy protection as it is focussed on the protection of personal information rather than privacy as such, although it still clearly falls short of a European-style right of data protection.⁴⁴ Certainly, there are limits to the use of negligence as a common law data protection doctrine, premised as it is on a duty of care owed by the defendant to the plaintiff, and there have been only a few cases.⁴⁵

In the UK as well, most of the development of personality rights has also been around the common law, and if anything its historical character has determined even more the shape of the development than in the US where there is more open adherence to Holmes-inspired legal realist ideas. Thus, what in the US is called a right of publicity is in the UK dealt with under a more traditional common law doctrine of passing off, although the latter is construed broadly to include unauthorised personal endorsement cases.⁴⁶ Similarly, the protection of privacy has until recently been largely dealt with as a matter of the equitable action for breach of confidence,⁴⁷ a doctrine that has also come to be broadly construed. It extends, for instance, to cases involving the misuse of information obtained with knowledge or notice of confidentiality rather than being confined to cases where the information was imparted in a relationship of confidence.⁴⁸ In the wake of the Human Rights Act of 1998, giving effect to the ECHR, English courts have identified a new tort of ‘misuse of private information’,⁴⁹ but they have treated this as an offshoot of the breach of confidence doctrine rather than framing it as a breach of a statutory duty prescribed by the Act.⁵⁰

Interestingly, breach of confidence has also developed as a source of rights in cases that are not solely or necessarily about privacy. Such cases include Douglas v Hello! (in which one of the plaintiffs – OK! Magazine – had tendered for the exclusive rights to cover a celebrity wedding)⁵¹ and Imerman v Tchenguiz (in which the plaintiff objected to the defendants’ surreptitious access of his computer hard drive in his office to find evidence for a family law dispute).⁵² In both cases the claims based on breach of confidence succeeded. Indeed, in Imerman the court seemed prepared to hold that accessing the hard drive might in itself entail a breach of confidence rather than in more conventional terms premising the breach on the (potential) subsequent misuse of the information. As the court put it, ‘[i]t is of the essence of the claimant’s right to confidentiality that he can choose whether, and, if so, to whom and in what circumstances and on what terms, to reveal the information which has the protection of the confidence’.⁵³ Such expansive reasoning suggests that this doctrine, which in the US has largely now dwindled to a narrow doctrine based on special relationships of confidence,⁵⁴ could evolve in the UK into something quite significant by way of a common law data protection right, despite the constraints of the doctrine’s focus on confidential, not just personal, information.⁵⁵

3 The Turn to Statute

Until recently, courts in the UK have made little of the data protection statute drafted to comply with the standards set down in the European Union Data Protection Directive of 1995.⁵⁶ The latter prescribes (in Articles 22 and 23) that individuals should have a right of action in cases where they are harmed as a result of a breach of its standards. Similarly, the UK Data Protection Act of 1998, which transposes the Directive, allows for cases to be brought by aggrieved individuals.⁵⁷ Nevertheless, the courts suggested in early cases under the Act that little significance would be accorded to the statute despite the readiness of plaintiffs to invoke it. In one early case, Durant v Financial Services Authority,⁵⁸ the Court of Appeal construed the meaning of ‘personal data’ in the Act as importing a requirement that the data should be of a private character. In other cases it was simply said that the statutory data protection claims added nothing to the other claims of misuse of private and confidential information.⁵⁹ Further, at least until recently, little was made of the right to data protection in Article 8 of the EU’s Charter of Fundamental Rights of 2000,⁶⁰ now part of EU constitutional law under the Lisbon Treaty of 2009. Thus, while important data protection cases have come out of other European jurisdictions, with questions referred to the European Court of Justice on issues such as the implications of European data protection standards for general monitoring of internet users for copyright infringements;⁶¹ data retention;⁶² and the so-called right to be forgotten,⁶³ we have seen less attention paid to these matters in English courts. Yet, the position may be changing, as shown by some recent cases.

One such case is Rugby Football Union v Viagogo,⁶⁴ decided in 2012. The Supreme Court dealt with the defendant’s argument that a preliminary discovery (or ‘Norwich Pharmacal’) order requiring release of the identities of persons involved in illegal ticket scalping using the Viagogo website would breach the Data Protection Act without taking the restrictive Durant line of insisting that the information should also be ‘private’.⁶⁵ Further, the court noted the right to data protection in the Charter.⁶⁶ More recently, in the Vidal-Hall v Google case,⁶⁷ Tugendhat J granted leave to serve the defendant out of jurisdiction for claims including breach of the Data Protection Act brought by the plaintiffs after they discovered that Google had bypassed their Apple Safari security measures to access their personal information and engage in targeted advertising. The judge treated the data protection claim as distinct from the misuse of private information claim (with the ‘private’ information detailed in a secret annex to the judgment).⁶⁸ For the first time it was suggested that a data protection claim may give more protection to personal information than one for misuse of private information.⁶⁹

The decision was recently upheld by the Court of Appeal,⁷⁰ which went further by suggesting that the Data Protection Act in its present terms falls short of the right to data protection embodied in the Charter. Specifically, it noted that section 13(2) of the Act limits recovery of non-pecuniary loss to cases where (i) the claimant also suffers pecuniary or material loss or (ii) the contravention relates to the processing of personal data for ‘special purposes’ (journalism, artistic, or literary purposes – none of which were thought to apply in the case at hand). The qualifications are not found in Article 47 of the Charter, which states that ‘everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article’.⁷¹ The Court bluntly concluded that ‘what is required in order to make section 13(2) compatible with EU law is the disapplication of section 13(2), no more no less’.⁷² In future English cases we may expect to see further explication of the right to data protection now supported by the Charter.⁷³

4 Final Reflections

All in all, the UK appears to be becoming more European in its approach to data protection, especially as more cases get into the courts. We can expect this trend to continue at least as long as the UK remains subject to European data protection standards as well as the constitutional framework of the EU Charter, including its Article 8 right to data protection. The trend may take the UK even further away from other common law jurisdictions and not only the USA. For instance, Australia has so far seen little development of its data protection standards in part due to the limited scope allowed for those whose interests are affected to bring claims in court for breach of the statute.⁷⁴ Other avenues might be explored, including relying on breach of confidence following the lead of the English Court of Appeal in Imerman;⁷⁵ adopting the American approach of treating negligence as a standard that takes into account obligations imposed under statute (including a data protection statute);⁷⁶ and developing a body of consumer data protection law to the extent that applicable consumer protection legislation allows this and permits claims in court.⁷⁷ Judges might also, as in one recent Australian case, consider data protection values in the exercise of judicial discretion.⁷⁸

At best, however, these techniques can only go so far in framing data protection norms in the absence of the ability of courts to deal directly with the terms of a data protection statute at the instance of those whose rights are directly involved. Moreover, ideally the development of data protection norms, concerned as they often are with conduct that transcends national borders, should be a cross-jurisdictional effort. As von Jhering noted in the 19th century, the life of the law is ideally ‘a common life; a system of reciprocal contact and influence’.⁷⁹ Until recently that has been true of many common law jurisdictions (although to a lesser extent in the US), but whether it will continue into the future is a matter of speculation.