Privacy

Our control over our private or confidential information is something we often take for granted.

When it is taken from us the consequences can be serious. We may feel violated, exposed, upset and/or embarrassed. In some instances we may suffer reputational harm or financial loss. It is only relatively recently that the law has recognised the importance of an individual’s privacy.

Over the years we have helped thousands of public figures, HNWIs and professionals enforce their privacy rights. Our highly-regarded media law department is unique because all our solicitors work exclusively in this field.  This means that our clients receive the best possible advice and representation.

Privacy and confidentiality breaches may take place in any number of contexts.  Common examples include: the media publishing a ‘kiss and tell’ story, the posting of private information on social media, the sharing of intimate images by electronic message, and the leak of medical information.

Listed in the Times Best Law Firms, Legal 500 and Chambers & Partners as a leading firm in the field of defamation and privacy, Brett Wilson is perfectly placed to deliver expert support designed to protect your privacy or help you seek redress when it is breached.

What facts will give rise to a privacy claim?

Typically, the unauthorised and unjustified disclosure of private and/or confidential information to one or more parties.  Additionally, the mere accessing of private information – or the threat to disclose it – may also amount to an actionable claim for privacy. The private information will normally need to be more than anodyne: a claim based on information that is technically private, but (objectively) trivial in nature is susceptible to being struck out.

What is the legal basis for bringing a privacy claim?

Privacy claims are typically brought as claims for the misuse of private information, breach of confidence and/or breach of the UK General Data Protection Regulation (‘UK GDPR’)/Data Protection Act 2018.

What is the difference between “private” and “confidential” information?

“Private information” is personal information which is private because of its nature; for example, because it concerns an individual’s health or sex life.  It is information in which a claimant is said to have a “realistic expectation of privacy”.  The tort [legal wrong] of “misuse of private information” has evolved since the inception of the Human Rights Act 1998.  This Act requires Courts to act in a way which gives effect to individual’s “right to respect for a private life” under Article 8 of the European Convention on Human Rights.  In 2015 the Court of Appeal acknowledged that the tort is now a distinct feature of English law in its own right.

In many instances what amounts to private information will be obvious. However, this is not always the case.  For example, an individual may not have a reasonable expectation of privacy if the information is already in the public domain (especially if they have caused this).

“Confidential information” is effectively “secret” information.  It may be confidential by virtue of an agreement (e.g. a clause in an employment contract or a non-disclosure agreement reached as part of a settlement), an established relationship (e.g. doctor-patient) or simply because it is information which has the necessary nature and quality of confidence.  The law of breach of confidence is well-established in English law.

Information is often both private and confidential.  As such, privacy claims may be brought as both a misuse of private information and breach of confidence.

What is the UK General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018?

The UK GDPR stipulates how “personal data” and “sensitive personal data” should be processed and stored.  Whilst data protection rights are arguably not privacy rights as such, there is often an overlap.  The Data Protection Act 2018 supplements the UK GDPR.

How can I stop my private information being misused, my confidence being breached or data protection rights being abused?

It some instances it may be sufficient for us to send a legal notice or warning.  If necessary we can seek an injunction (a court order) prohibiting the act.

If my privacy has already been breached what damages am I entitled to?

The High Court and the Court of Appeal set out the approach to privacy damages in 2015.  Damages can be recovered (1) for the infringement itself/the loss of control over the private information and (2) distress, anxiety, injury to feelings and embarrassment suffered as a result of the breach.

In some circumstances, it will additionally be possible to recover financial loss where a claimant can prove this has been caused by the breach.

A successful claimant will normally also be entitled to recover most of their legal costs.

What defences can be raised to a privacy claim?

A defendant may seek to argue that the information is not confidential or that it is not information over which a claimant has a reasonable expectation of privacy.

A defendant may deny they are responsible for the disclosure.

A claim will also be defeated if a defendant can show that the claimant consented to the disclosure.

A defendant may also argue that their Article 10 right to freedom of expression outweighs a claimant’s Article 8 right to respect for their private life.  In these circumstances, the Court will perform what is known as the “ultimate balancing test” to determine whether the disclosure is justified.  Such a defence may succeed where a disclosure is in the public interest.  The legal definition of the “public interest” is not necessarily always the same as “what the public are interested in”.  For example, the disclosure of information that suggests a politician may be corrupt will normally be in the public interest; that a famous actor has had an affair may not be.

A defendant may also claim the private information is anodyne/bland.

What if private information is false?

Whether the information is truth or false is often not determinative in privacy claims.  The issue is whether the information is private.  However, the publication of false information may also give rise to a defamation claim in some circumstances.

Can I sue a search engine or an online platform?

In certain circumstances it may be possible to assert a privacy claim against an ‘intermediary’, although normally the platform will need to have had sufficient notice that they are publishing private information and have failed to remove it within a reasonable period.  We will be able to advise you on the viability of such a claim.

Following the decision of the European Court of Justice in Google Spain SL, Google Inc. v Agencia Espanola de Proteccion de Datos (AEPD) and Mario Costeja Gonzalez (Case C-131/12) it may also be possible to sue search engines and other platforms under the UK GDPR/Data Protection Act 2018 (see our ‘Right to be Forgotten’ page here).

What if I do not know who is responsible for breaching my privacy?

If someone else does (e.g. a telephone/internet company/online platform) we may be able to apply to the Court on your behalf to obtain a disclosure order.  See our page here.

What is the first step in bringing a privacy claim?

This will depend on the urgency of the matter.  If a breach is imminent then the priority will be to try and prevent it from occurring.  This might require a legal notice/request and/or an urgent application for an injunction (see our webpage here).  An interim injunction can be granted until trial if the Court is satisfied that the claimant is likely to succeed at trial.  An interim injunction can also bind third parties who are aware of the order’s existence.

If a privacy breach has already taken place then you can instruct us to prepare a Pre-Action Protocol Letter of Claim.  To do this we will need to review the material complained of, other relevant documentation and to take your detailed instructions.  We will then prepare and send a formal Letter of Claim to the defendant setting out your case and your requirements.

What if a Letter of Claim does not resolve the matter immediately?

Where liability is not accepted or a case is not settled, ultimately a claim will be issued in the King’s Bench Division of the High Court or county court.  This may prompt settlement discussions.  If the claim does not settle the matter will be set down for a trial normally 9-18 months after the issue of the claim.

How long do I have to bring a privacy claim?

Privacy claims should be brought within six years (of the date of the breach or, if the information was concealed, from when it could have reasonably have been discovered).  The Court has a discretion to disapply or defer this period in exceptional circumstances.  Nevertheless, claimants are advised to bring claims promptly.