England and Wales Court of Appeal (Civil Division) Decisions

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
Popplewell J
[2017] EWHC 695 (QB)

		Royal Courts of Justice Strand, London, WC2A 2LL
		30/07/2018

Sir Terence Etherton MR, Lord Justice McFarlane and Lady Justice Sharp :

1. This is an appeal from the order dated 6 April 2017 of Popplewell J in which he ordered a stay under section 32(4) of the Data Protection Act 1998 ("the DPA") of certain claims made in these proceedings by Mr James Stunt ("Mr Stunt"), the appellant, under the DPA against Associated Newspapers Limited ("AN"), the respondent.
2. This appeal concerns the proper interpretation of section 32(4) and, in the light of its interpretation: (1) whether it strikes a permissible balance under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 ("the Directive") between rights to freedom of expression by the press and rights of privacy in the form of data protection rights, such rights being guaranteed by both EU law, under the Directive and the Charter of Fundamental Rights of the European Union ("the Charter"), and by the European Convention for the Protection of Human Rights and Fundamental Freedoms ("the Convention"); (2) whether section 32(4) is incompatible with the right to an effective judicial remedy under EU law; and (3) if section 32(4) is found to be incompatible with EU law, what course of action the court is permitted to take by way of remedy.
3. By order of the court dated 18 May 2018 the Information Commissioner ("the Commissioner") was given permission to intervene by way of both written and oral submissions.

Legislative and regulatory background

4. The structure and key provisions of the DPA, the Directive and the Charter are as follows. Other relevant provisions are quoted in Appendix 1 to this judgment.

The fundamentals of the Directive

5. The DPA was intended to implement the Directive. The title of the Directive states that it concerns "the protection of individuals with regard to the processing of personal data and on the free movement of such data".
6. Recital (10) makes clear that the processing of personal data, which is the subject of the Directive, is protected by both Article 8 of the Convention and general principles of EU law:

"(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognized both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;"

7. The Directive requires member states in their implementation of the Directive to provide for certain exemptions or derogations from the data protection rights conferred by the Directive. In particular, Recitals (17) and (37) recognise that conflicts may arise between the right to privacy in the form of protection of personal data and the right to freedom of expression, the resolution of which will require appropriately framed exemptions or derogations:

"(17) Whereas, as far as the processing of sound and image data carried out for purposes of journalism or the purposes of literary or artistic expression is concerned, in particular in the audiovisual field, the principles of the Directive are to apply in a restricted manner according to the provisions laid down in Article 9;"

"(37) Whereas the processing of personal data for purposes of journalism or for purposes of literary of artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of information and notably the right to receive and impart information, as guaranteed in particular in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; whereas Member States should therefore lay down exemptions and derogations necessary for the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing, ..."

8. Article 1 of the Directive sets out its object. Article 1(1) is as follows:

"1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data."

9. Under Article 9 member states may only confer an exemption or derogation from personal data processing rights in the context of journalistic purposes or the purpose of artistic or literary expression where it is necessary to reconcile the right to privacy with the right to freedom of expression. It provides as follows:

"Processing of personal data and freedom of expression

Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression."

10. Article 22 of the Directive provides for the right of every person to a judicial remedy in respect of any breaches of personal data rights guaranteed by national legislation. It is as follows:

"Remedies

Without prejudice to any administrative remedy for which provision may be made, inter alia before the supervisory authority referred to in Article 28, prior to referral to the judicial authority, Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question."

11. Article 23 of the Directive provides for the right of every person to compensation where they have suffered damage as a result of unlawful processing or a breach of domestic implementing legislation.

The Structure of the DPA

12. Mr Philip Coppel QC, counsel for Mr Stunt, outlined the following five core concepts inherent in the operation of the DPA. Neither Mr Antony White QC, for AN, nor Mr Gerry Facenna QC, for the Commissioner, criticised that summary.
13. First, the DPA is concerned with regulating 'personal data'. The expression 'data' is defined in section 1(1) of the DPA as follows:

""data" means information which—

(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose,

(b) is recorded with the intention that it should be processed by means of such equipment,

(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system,

(d) does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as defined by section 68; or

(e) is recorded information held by a public authority and does not fall within any of paragraphs (a) to (d);"

14. Secondly, the activity that the DPA regulates is the 'processing' of that personal data. The expression "processing" is defined in section 1(1) to cover a wide range of activities, as follows:

""processing", in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including—

(a) organisation, adaptation or alteration of the information or data,

(b) retrieval, consultation or use of the information or data,

(c) disclosure of the information or data by transmission, dissemination or otherwise making available, or

(d) alignment, combination, blocking, erasure or destruction of the information or data;"

15. Thirdly, the principal person who is subject to the majority of obligations in relation to personal data processing is the 'data controller' who is defined in section 1(1) as follows:

""data controller" means, subject to sub-section (4), a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed;"

16. Fourthly, in their processing of personal data, data controllers are required by section 4(4) of the DPA to comply with the eight 'data protection principles' set out in Part I of Schedule 1 to the DPA. Those principles are as follows:

"1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

4. Personal data shall be accurate and, where necessary, kept up to date.

5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

6. Personal data shall be processed in accordance with the rights of data subjects under this Act.

7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data."

17. Pursuant to section 4(2) of the DPA, those principles are to be interpreted in accordance with Part II of Schedule 1.
18. Fifthly, the individual who is the subject of personal data which is processed by a data controller, and whose rights in relation to that personal data are protected by the DPA, is defined in section 1(1) of the DPA as the 'data subject'.

The rights provided by the DPA

19. In addition to the right to bring an action on a breach of the section 4(4) duty to comply with the data protection principles, the DPA provides data subjects with certain other rights against data controllers with respect to their personal data. Section 7(1) provides that, subject to certain specified limitations and conditions, a data subject is entitled to certain information as to whether their personal data is being processed by a data controller, as well as about certain aspects of the nature and content of that data. A request by a data subject invoking this right is colloquially referred to as a 'subject access request'. Section 7(9) provides that if a data controller has failed to comply with a subject access request, the court may order the data controller to comply.
20. Section 10(1) of the DPA provides that, subject to certain specified limitations and conditions, an individual is entitled to give written notice to require a data controller to cease or not begin processing his or her personal data where such processing is likely to cause substantial and unwarranted damage or distress. Section 10(4) provides for a court to order the data controller to take such steps for complying with such a written notice as the court thinks fit.
21. Section 13(1) of the DPA entitles an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of the DPA to compensation from the data controller for that damage. Such compensation is also recoverable where distress alone is suffered, that is to say where the data subject does not also incur pecuniary loss: Vidal-Hall v Google Inc [2015] EWCA Civ 311, [2016] QB 1003.
22. Section 14 of the DPA provides for a right of rectification, blocking, erasure and destruction of personal data in certain circumstances. They include the situation where an individual has suffered damage by reason of any contravention by a data controller of any of the requirements of the DPA, in circumstances entitling him to compensation under section 13 and where there is a substantial risk of further contravention in respect of those data in such circumstances.

The role of the Commissioner

23. The primary function and duty of the Commissioner is described in section 51(1) of the DPA as follows:

"(1) It shall be the duty of the Commissioner to promote the following of good practice by data controllers and, in particular, so to perform his functions under this Act as to promote the observance of the requirements of this Act by data controllers."

24. Under section 42 a request may be made to the Commissioner by or on behalf of any person who is, or believes himself to be, directly affected by any processing of personal data for an assessment as to whether it is likely or unlikely that the processing by the data controller has been or is being carried out in compliance with the provisions of the DPA. Upon such a request, or upon the initiative of the Commissioner where she reasonably requires any information for the purpose of determining whether the data controller has complied or is complying with the data protection principles, the Commissioner may serve the data controller with an 'information notice' under section 43 in order to obtain further information. Section 40(1) provides that if the Commissioner is satisfied that a data controller has contravened or is contravening any of the data protection principles, the Commissioner may serve the data controller with an enforcement notice. Section 47 provides that the failure to comply with any such notices served by the Commissioner constitutes a criminal offence.

Exemptions and derogations under the DPA

25. Part IV of the DPA (sections 27-39) provides for a number of exemptions or modifications for data controllers in respect of certain data processing obligations in specific situations. They fall under the following heads: national security (section 28), crime and taxation (section 29), health, education and social work (section 30), regulatory activity (section 31), journalism, literature and art (section 32), research history and statistics (section 33), manual data held by public authorities (section 33A), information available to the public by or under enactment (section 34), disclosures required by law or made in connection with legal proceedings (section 35), and domestic purposes (section 36).
26. This appeal concerns the exception for the purposes of journalism in section 32. Journalism is one of the three "special purposes", an expression defined in section 3 of the DPA as follows:

"In this Act "the special purposes" means any one or more of the following—

(a) the purposes of journalism,

(b) artistic purposes, and

(c) literary purposes."

27. Section 32 is as follows:

32. Journalism, literature and art.

(1) Personal data which are processed only for the special purposes are exempt from any provision to which this sub-section relates if—

(a) the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,

(b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and

(c) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.

(2) Sub-section (1) relates to the provisions of—

(a) the data protection principles except the seventh data protection principle,

(b) section 7,

(c) section 10,

(d) section 12, and

(e) section 14(1) to (3).

(3) In considering for the purposes of sub-section (1)(b) whether the belief of a data controller that publication would be in the public interest was or is a reasonable one, regard may be had to his compliance with any code of practice which—

(a) is relevant to the publication in question, and

(b) is designated by the Secretary of State by order for the purposes of this sub-section.

(4) Where at any time ("the relevant time") in any proceedings against a data controller under section 7(9), 10(4), 12(8) or 14 or by virtue of section 13 the data controller claims, or it appears to the court, that any personal data to which the proceedings relate are being processed—

(a) only for the special purposes, and

(b) with a view to the publication by any person of any journalistic, literary or artistic material which, at the time twenty-four hours immediately before the relevant time, had not previously been published by the data controller,

the court shall stay the proceedings until either of the conditions in sub-section (5) is met.

(5) Those conditions are—

(a) that a determination of the Commissioner under section 45 with respect to the data in question takes effect, or

(b) in a case where the proceedings were stayed on the making of a claim, that the claim is withdrawn.

(6) For the purposes of this Act "publish", in relation to journalistic, literary or artistic material, means make available to the public or any section of the public.

Section 45 determinations

28. Section 45 provides as follows:

"45.— Determination by Commissioner as to the special purposes.

(1) Where at any time it appears to the Commissioner (whether as a result of the service of a special information notice or otherwise) that any personal data—

(a) are not being processed only for the special purposes, or

(b) are not being processed with a view to the publication by any person of any journalistic, literary or artistic material which has not previously been published by the data controller,

he may make a determination in writing to that effect."

The Charter and the Convention

29. The right to respect for private and family life is enshrined in Article 7 of the Charter and Article 8 of the Convention. Unlike the Convention, Article 8 of the Charter provides for an additional distinct right to the protection of personal data. The right to freedom of expression and information is enshrined in Article 11 of the Charter and Article 10 of the Convention.
30. Article 47 of the Charter provides for an effective remedy for enforcement of charter rights as follows:

"Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article."

31. Article 52 of the Charter defines the scope of rights guaranteed by the Charter. So far as relevant, it provides as follows:

"Scope of guaranteed rights

1. Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.

...

3. In so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention. This provision shall not prevent Union law providing more extensive protection."

32. The Court of Appeal confirmed in Vidal-Hall v Google Inc (at [99]), that the Charter does not expand rights conferred by EU law. The rights to protection of data conferred by Article 8 of the Charter are based on the rights provided under the Directive and do not extend them.

The GDPR and the Data Protection Act 2018

33. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("the GDPR") entered into force earlier this year on 25 May 2018. It replaces the Directive, which was repealed pursuant to Article 94, with effect from that date. The United Kingdom has implemented the GDPR by enacting the Data Protection Act 2018 ("the DPA 2018") which repealed and replaced the provisions of the DPA relevant to this appeal: Part 1 of Schedule 19, para 44.
34. It is common ground that, under the transitional provisions of Part 2 of Schedule 20 of the DPA 2018, the claims brought by Mr Stunt under the DPA 1998 are preserved and the application of both the exemption and the stay under s.32 of the DPA 1998 also continue to have effect.

The factual background

35. AN is the publisher of the Daily Mail, the Mail on Sunday, and the Mail Online. Mr Stunt is a wealthy businessman who in 2011 married one of the daughters of Bernie Ecclestone, until recently chief executive of the Formula One Group. Mr Stunt has for several years complained about AN's publication of articles on various topics, including Mr Stunt's appearances in public and his business activities. Mr Stunt has also complained about AN's acquisition, retention, and use of personal data relating to him.

The proceedings

36. Following correspondence in 2014 and 2015, Mr Stunt issued proceedings against AN on 31 December 2015 for: (1) an injunction to restrain AN from further dissemination of articles and/or the private information they contained and from processing his data in breach of the DPA; (2) an injunction to restrain AN from, and damages or an account of profits in respect of, harassment contrary to the Protection from Harassment Act 1997 and invasion of privacy and misuse of private information; and (3) compensation pursuant to section 13 of the DPA for unlawful processing. Particulars of claim were served on 12 February 2016 identifying 27 articles published by AN between 8 March 2014 and 29 November 2015, of which complaint is made. In the particulars of claim the following relief is sought for the claims under the DPA: (1) compensation under section 13 for past breaches of the DPA; (2) orders under section 7(9) for compliance with data requests made under section 7(1) of the DPA in 2014 and 2015; (3) orders under section 10(4) for compliance with requests made under section 10(1) of the DPA in 2014 and 2015 to cease, or not to begin, processing personal data; and (4) orders under section 14(4) of the DPA that AN erase and destroy personal data and cease processing it.
37. AN issued an application notice dated 16 December 2016 for a stay of proceedings under section 32(4) of the DPA.
38. It was common ground that AN claimed that the personal data to which the proceedings related were being processed in the circumstances specified in section 32(4)(a)-(b), and that the court would be required to impose a stay on a literal interpretation of the section. Mr Stunt resisted a stay on the grounds, among others, that section 32(4) is incompatible with Articles 9, 22 and 23 of the Directive; and/or that section 32(4) is incompatible with Articles 7, 8, and 47 of the Charter; and that the court should accordingly disregard section 32(4) by application of the principle in C-106/89 Marleasing SA v La Comercial Internacional de Alimentación SA [1990] ECR I-4135 or by application of the principle in Benkharbouche v Embassy of the Republic of Sudan (Secretary of State for Foreign and Commonwealth Affairs intervening) [2015] EWCA Civ 33, [2016] QB 347.
39. The application was heard before Popplewell J for two days between 1 and 2 March 2017. The Judge handed down his judgment on 6 April 2017.

Judgment under appeal

40. The following is a very brief summary of the Judge's careful analysis.
41. The Judge noted (at [7]-[10]) that the Directive, particularly Recitals (17) and (37) and Articles 9 and 13(1), expressly recognises that the data protection rights for which it provides may come into conflict with the right of freedom of expression, in the field of journalism, and that a balance must be struck between those conflicting rights in implementing the Directive in national law.
42. He went on to note (at [11]-[12]) that the case law of the Court of Justice of the European Union ("the CJEU") and the European Court of Human Rights ("the ECtHR") has emphasised the importance of both the right to respect for a private life in relation to the processing of personal data and the right to freedom of expression by the media in its vital role of 'public watchdog'.
43. In considering the statutory framework of the DPA (at [28]-[40]), the Judge observed that the scope of section 32(4) is more limited than the exemption provisions of section 32(1).
44. After outlining the process for bringing about a lifting of the stay under section 32(5) by way of a determination under section 45, including the fact that the Commissioner has a discretion not to pursue a section 45 determination, the Judge emphasised (at [38]-[40]) that the data subject will have limited ability to participate, and is largely a spectator in what could be a lengthy process of review and appeal.
45. The Judge noted (at [41]-[43]) that, in giving effect to the Directive, member states have a wide margin of appreciation in adopting domestic measures aimed at balancing fundamental rights of privacy against those of freedom of expression, but bearing in mind that Article 9 of the Directive and Article 10 of the Convention each provide that there may only be derogation from such rights so far as is necessary.
46. In the light of Parliamentary material at the time the Bill which became the DPA was passing through Parliament, the Judge found (at [50]) that section 32(4) was intended to involve substantive rights and is not purely a procedural provision, other than in the sense that it provides for a stay of proceedings, which is a procedural remedy. He found that section 32(4) has a particular purpose in preventing the adverse effect on journalism of the threat of prior restraint on publication posed by an injunction: Parliament intended that whilst the degree of protection of Article 10 of the Convention afforded by the conditions in section 32(1) was sufficient in terms of any post-publication remedies pursued by a data subject, a greater degree of protection was justified prior to publication in order to protect against pre-publication restraint and the chilling effect of the potential availability of an injunction.
47. The Judge noted (at [51]-[53]) that both domestic and European jurisprudence recognise that protection of freedom of expression in the field of journalism requires particular importance to be attached to protection from pre-publication restraint and that protection of the private rights of individuals may adequately be secured by the ability to sue for damages after publication. The Judge also said (at [56]) that the mere existence of the possibility of an application to the court by the data subject requiring information to be provided under section 10(4) of the DPA may have the chilling effect which Parliament legitimately wished to avoid by the clear terms of section 32(4).
48. The Judge was of the view (at [57]) that it is material that the DPA is not the primary means by which effect is given in domestic law to privacy rights under the Convention. Such rights, he said, are protected by private law torts of harassment, breach of confidence and misuse of private information, for which both interim and final remedies are available. He considered that section 32(4) is only of significance where there is no remedy other than a claim under the DPA, perhaps because of the DPA's wider definitions of 'personal data' and 'processing'. He considered that this situation is most likely to arise in a relatively narrow set of circumstances usually involving less serious invasions of individuals' private rights.
49. The Judge concluded (at [61]) that he did not consider section 32(4) to be inconsistent or incompatible with Article 9 of the Directive. He said that section 32(4) is part and parcel of the balancing exercise required by Article 9 and within the margin of appreciation afforded to the UK Parliament to protect the right of freedom of expression by a measure of relatively narrow application designed to prevent the stifling of journalism in progress.
50. The Judge found (at [62]) that Articles 22 and 23 of the Directive are irrelevant. Since sections 32(1) and (4) form part of the balancing exercise required by Article 9 of the Directive, they must be taken together as shaping the substantive rights in the context of journalistic activities, and so there is nothing in section 32(4) that can be said to fail to give effect to the rights conferred by the Directive as enacted by national law.
51. The Judge also concluded (at [63]) that, since rights to protection of data conferred by Article 8 of the Charter are based on the rights provided under the Directive and do not extend them, section 32(4) is not incompatible with the Charter.
52. The Judge found it unnecessary in the circumstances to determine the further issues as to whether in the event of incompatibility it would have been possible to disregard section 32(4) by applying the reasoning in Marleasing or Benkharbouche (at [64]).
53. The Judge considered (at [65]-[67]) that on the correct interpretation of section 32(4) the stay relates only to the claims under the DPA.

Grounds of appeal

54. Mr Stunt was granted permission to appeal on eight grounds by order of Longmore LJ dated 13 September 2017. They may broadly be summarised as follows:

i) Ground 1: The Judge departed from binding Court of Appeal precedent in holding that section 32(4) shaped substantive rights and was not merely procedural.

ii) Ground 2: The Judge overstated the impact on rights under Article 10 of the Convention of claims under the DPA in respect of pre-publication processing.

iii) Grounds 3 and 4: The Judge downgraded the importance of the privacy and data protection rights under the DPA.

iv) Ground 5: The Judge wrongly concluded that there was nothing in section 32(4) which failed to give effect to rights conferred by the Directive enacted by national law and that there was no breach of Article 22 of the Directive.

v) Ground 6: The Judge wrongly considered that the Commissioner "policed" the question of whether processing falls within the scope of section 32(4).

vi) Ground 7: The Judge failed to recognise that the publication of personal data does not necessarily take the personal data outside the scope of section 32(4).

vii) Ground 8: The Judge failed to take account of section 12 of the Human Rights Act 1998 ("the HRA").

55. AN served a respondent's notice dated 3 October 2017 seeking to uphold the Judge's judgment for the following three additional reasons: (1) the Judge's conclusion as to the compatibility of section 32(4) with the Directive is supported by the decision of the Grand Chamber of the ECtHR in Satakunnan Markkinapörssi Oy and Satamedia Oy v Finland (2018) 66 EHRR 8 which post-dated the Judge's judgment; (2) even if, contrary to the Judge's judgment, section 32(4) is incompatible with the Directive, the reasoning in Marleasing cannot be used so as to avoid a stay in the present case; and, furthermore, (3) section 32(4) cannot be disapplied under the Charter pursuant to the reasoning in Benkharbouche.

Discussion

56. The starting point for any consideration of the conformity of section 32(4) with the requirements of Article 9 of the Directive must be the precise scope and effect of the provisions of the sub-section.

The interpretation of section 32(4)

57. The parties are not in agreement as to the meaning of section 32(4) so far as concerns the extent of any stay once journalistic material comprising or relying on personal data has been has been published. The problem arises because, whilst the introductory words of section 32(4) mean that the sub-section is engaged when personal data is being processed, the imposition of the stay is triggered by reference to the intention that journalistic material which has not previously been published by the data controller will be published in the future. The imposition of the stay is, therefore, not expressly made conditional on the present or past processing of hitherto unpublished personal data with a view to future publication but by reference to an intention to publish different journalistic material, irrespective of whether or not that journalistic material contains, or relies upon, personal data already published.

58. The initial position of Mr Coppel on this issue was that, once personal data has been published, there can be no stay of proceedings under section 32(4) in respect of the past and present processing of that data. The court, applying the exemption provisions of section 32(1)-(3), would be entitled to review past and present compliance with the DPA in respect of the published material, and remedies would be available, for example, for rectification, blocking, erasure and destruction pursuant to section 14 as well as compensation pursuant to section 13 in respect of the published material. Accordingly, to take the example of a misleading photograph that has already been published, Mr Coppel's initial position was that the court could order the data controller to destroy the file image, whether or not there was an intention to use it again in a future, but differently slanted, article.

59. Mr Facenna, for the Commissioner, submitted that the stay provisions in section 32(4) were much more extensive. He submitted that the sub-section must be read literally. He said that no claim at all can proceed under sections 7, 10, 12, 13 or 14 of the DPA, whether in respect of any past, present or future processing, unless either (1) the data controller concedes that the personal data are no longer being processed only for journalistic, literary or artistic purposes or (2) the personal data (whether previously published or not) are no longer being held with a view to the publication by any person of any journalistic, literary or artistic material which has not already been published by the data controller.

60. Mr Facenna said that this literal interpretation reflects the Commissioner's experience of what happens in practice: media organisations routinely assert that personal data they are processing, including photographs or information that they have already published, continue to be held with a view to the publication of 'new' journalistic material in the future (that is to say, any journalistic material not already published by the data controller itself).

61. Mr Facenna said that was the approach taken by News Group Newspapers Limited ("NGN"), the publisher of the Sun newspaper, and Warby J in Sube v News Group Newspapers Limited [2018] EWHC 1234 (QB). In that case NGN applied for, and Warby J granted, a stay of claims for compensation under section 13 of the DPA and/or orders under sections 13 and 14 of the DPA for the rectification, blocking or erasure of posts by readers published in the comment sections of the Sun's website. NGN contended that section 32(4) was satisfied by the mere fact that it claimed that any personal data to which the proceedings related were being processed only for the purposes of journalism and with a view to the publication by it of journalistic material which it had not previously published. It referred, for that proposition, to the decision of the Judge in the present case. One of the arguments raised by the claimants in opposition to the application for a stay was that section 32(4) only applies to unpublished information, that is, personal data which has not previously been published in journalistic material. Warby J said (at [98]):

"I am not sure that is quite accurate. The wording seems to contain a rather different and more precise test. In any event, this argument does not engage with the point made by [NGN] in reliance on Stunt. It is not for me to determine that News Group's claim is wrong. The statute provides that when a data controller makes claims of the kind described in s.32(4) it is the Information Commissioner who has the exclusive or at least the primary jurisdiction to determine whether those claims are sound. [NGN] has made such claims, and I accept the argument of [NGN]."

62. Mr Facenna summarised the effect of such a literal interpretation of section 32(4) as being that there is, essentially, a permanent barrier to any DPA proceedings for as long as the data controller asserts that any of the personal data to which such proceedings relate is being held with a view to the publication of 'new' journalistic, literary or artistic material by any person in the future.

63. In the light of Mr Facenna's submissions, Mr Coppel modified his position and agreed with Mr Facenna's literal approach to the interpretation of section 32(4).

64. Contrary to what Mr Facenna said was the habitual stance taken by media organisations, Mr White, for AN, contended for a much more nuanced and restricted interpretation of section 32(4). He submitted that a stay under section 32(4) cannot be granted where proceedings are brought under the DPA in respect of (1) processing of data in the form of publication of journalistic material and (2) the processing of that data which culminated in that publication.

65. He accepted that this is not a literal interpretation but a purposive one. He referred, in that regard to Campbell v Mirror Group Newspapers Ltd [2002] EWCA Civ 1373, [2003] QB 633. The central DPA issue in that case was whether section 32 ceases to provide protection in relation to proceedings for infringement of the DPA once publication has taken place. The Court of Appeal concluded (at [120]) that, where proceedings are brought for infringement of the DPA, sub-sections (1)-(3) of section 32 apply to those claims both before and after publication. For present purposes, however, what is material is what the Court of Appeal said both obiter and implicitly (at [115]) about the operation of sub-section (4) and (5) of section 32. They said there that sub-sections (4) and (5) are "purely procedural". They also thought, or at least assumed, that section 32(4) applies only during the period prior to publication when they said as follows:

"Presumably, if the publication takes place before the Commissioner has ruled on the claim, the stay ceases to be effective. Section 32 leaves this to inference."

66. As Mr White observed, that is consistent with what the Court of Appeal said (at [116]) is the purpose of sub-sections (4) and (5), namely to prevent the restriction of freedom of expression that might otherwise result from gagging injunctions ordered prior to publication.

67. Both Mr Facenna and Mr White submitted that their respective interpretations of section 32(4) were consistent with the judgment and order of the Judge in the present case and the record in Hansard of the statements made in Parliament on the passage of the Bill which in due course was enacted as the DPA.

68. We consider that section 32(4) should be given the purposive and restricted interpretation for which Mr White contended. We accept Mr Facenna's submission that, on a literal interpretation, if the data controller claims that any personal data to which the proceedings relate are being processed only for journalistic purposes, and with a view to the publication by any person of hitherto unpublished journalistic material, there will be a stay (subject to section 45) on claims under sections 7, 10, 12, and 14 irrespective of whether the personal data being processed with a view to the publication of new journalistic material is personal data that has already been published or been relied upon for a publication.

69. Such a literal interpretation would provide an extremely wide ground for stifling or delaying claims for breaches of the DPA. It would be far more extensive a restriction on such claims than is necessary for the purpose of sub-sections (4) and (5) of section 32 identified by the Court of Appeal in Campbell, namely to prevent curtailment of freedom of expression from gagging injunctions and the "chilling effect" on investigative journalism of the prospect of claims under the DPA, including for injunctive relief. Mr White's interpretation would, as he said, be consistent with the view expressed by the Court of Appeal in Campbell (at [116]) that a stay under section 32(4) ceases to be effective once publication takes place.

70. The Parliamentary material referred to by the Judge in his judgment is set out in the Annex to this judgment. It is entirely consistent with the purpose of sub-sections (4) and (5) of section 32 identified by the Court of Appeal in Campbell. It does not disclose any clear intention to provide the wide stay for which the Commissioner and Mr Stunt contend. On the contrary, we agree with Mr White that it shows that the Government's concern, in enacting what became sub-sections (4) and (5) of section 32 of the DPA, was to avoid injunctions or other forms of relief that might be used to stop processing of personal data pre-publication in special purposes cases.

71. The provisions of section 176 of the 2018 Act correspond to sub-sections (4) and (5) of section 32 of the DPA. Section 176 does not perpetuate the distinction in section 32(4) of the DPA between the "personal data to which the proceedings relate", on the one hand, and the intended future publication by any person of new "journalistic material", on the other hand. Under section 176 a stay is imposed only if the personal data to which the proceedings relate are being processed with a view to the publication by any person of any journalistic material, and the personal data has not previously been published by the data controller. While section 176 cannot be deployed as a positive indication of a particular interpretation of section 32(4) of the DPA, what can be said is that it is entirely consistent with the purposive interpretation of that sub-section that we favour.

72. Furthermore, the width of the stay provisions in sub-sections (4) and (5) of section 32, if interpreted literally, would not comply with the requirement in Article 9 that member states shall provide an exemption for the processing of personal data carried out solely for journalistic purposes "only if the exemption is necessary" to reconcile the right to privacy with the rules governing freedom of expression: see the Grand Chamber's emphasis on that point in C-73/07 Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy [2010] 1 All ER (EC) 213 at para 56. The right to a stay consistent with a literal interpretation of section 32(4) would be greater than is "necessary" to reconcile the right to privacy with the rules governing freedom of expression pursuant to Article 9 of the Directive.

73. In accordance with Marleasing the courts of member states are under a 'duty of consistent interpretation' of EU law. They must interpret national law enacted for the purpose of transposing an EU directive into its law, so far as possible, in the light of the wording and the purpose of the directive in order to achieve the results sought by the directive. It is not possible to do so if the change brought about by the interpretation would alter a fundamental feature of the legislation or would be inconsistent with its essential principles or would go against its grain: Ghaidan v Godin-Mendoza [2004] UKHL 30, [2004] 2AC 557 at [121]; The Commissioners for Her Majesty's Revenue and Customs v IDT Card Services Ireland Ltd [2006] EWCA Civ 29, [2006] STC 1252 at [85]. That would not be the case if section 32(4) was given the purposive interpretation for which Mr White contended. Accordingly, giving section 32(4) that interpretation is not only consistent with, but required by, the Marleasing principle.

Conformity of the DPA with Article 9 of the Directive

74. The question which then arises is whether, if section 32(4) is given a restrictive purposive interpretation, it is consistent with Articles 9 and 22 of the Directive. We are divided in our views about that issue.

The minority view

75. Sharp LJ considers that the compliance of section 32(4) with the Directive, even with the purposive interpretation we have given to section 32(4), is far from clear. The following points are made in support of that view.

76. First, the imposition of the stay and examination of its legitimacy are not subject to any judicial involvement. The stay comes into effect automatically when the data controller makes a claim that the personal data to which the proceedings relate are being processed in the circumstances specified in section 32(4)(a) and (b) regardless of the degree of sensitivity of the personal data or the lawfulness of the proposed publication before it takes place (if it ultimately does so). Secondly, the imposition of the stay depends wholly and exclusively on the claim of the data controller, which, as Mr Coppel submitted, is self-interested and can be expected to make a self-justified claim. Further, because 'special purposes' and 'publish' are widely defined, the data controller whose claim automatically triggers a stay, need not be a journalist or media organisation but may be a person engaged in a wide range of other activities falling within the definition. There is, however, no provision for any judicial scrutiny of the data controller's claim or for any judgement, whether by the data controller or the court, as to the balance to be struck between the right of privacy and to the protection of personal data, on the one hand, and freedom of expression, on the other hand, as specified in Article 9 of the Directive. In that connection, it must be remembered that both are fundamental rights, which deserve equal respect: Satakunnan Markkinapörssi Oy and Satamedia Oy v Finland (2018) 66 EHRR 8 (at [163]); Schrems v Data Protection Commissioner (Case C-362/14) [2016] QB 527 (at [39]).

77. There is a marked contrast between section 32(4), on the one hand, and sub-sections (1)-(3) of section 32, on the other hand. The exemption in section 32(1) for current processing of personal data for the special purposes is conditional on fulfilment of the requirements in section 32(1)(a), (b) and (c). The condition in section 32(1)(b) is that the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest. The condition in section 32(1)(c) is that the data controller reasonably believes that, in all the circumstances, compliance with the provisions of the data protection principles (except the seventh data protection principle), and sections 7, 10, 12 and 14(1) to (3) is incompatible with the special purposes. The exemption under section 32(1), therefore, involves the exercise of a balancing judgement by the data controller on the facts of the particular situation under consideration, a requirement that the requisite beliefs of the data controller are reasonable, and scope for judicial scrutiny both of the existence of the data controller's requisite beliefs and of their reasonableness.

78. The stay under section 32(4) is not subject to any of those qualifications and safeguards. Section 32(4) provides that the stay will come to an end when a determination of the Commissioner under section 45 takes effect. The oversight of the Commissioner under that section is, however, a very weak review mechanism. It was described in detail by the Judge in paragraphs [33] to [40] of his judgment in terms which have not been criticised on this appeal.

79. Salient points in that regard are, first, that the Commissioner is not obliged to carry out any such review. She has a discretion to do so.

80. Secondly, the Commissioner is limited to determining two matters of fact, namely whether the personal data are being processed only for the special purposes and whether they are being processed with a view to the publication by any person of any journalistic, literary or artistic material which has not previously been published by the data controller. The Commissioner, like the data controller under section 32(4), is under no obligation to form a judgment as to the reasonableness of the stay in the light of the balancing exercise required by Article 9, including the qualification that the stay must only be imposed if and to the extent that it is necessary for reconciling the two rights mentioned there. Indeed, the Commissioner is not even empowered to make such a determination.

81. Thirdly, the data controller has various rights of appeal that could significantly impede and delay a determination by the Commissioner under section 45. They include a right of appeal against the service by the Commissioner on the data controller under section 44 of a special information notice requiring the data controller to provide information, and the right to appeal against a determination of the Commissioner under section 45. The appeal is to the First-tier Tribunal ("the FTT"), with a further right of appeal on a point of law to the Upper Tribunal, and then, with permission of the Upper Tribunal or the Court of Appeal, to the Court of Appeal. The data subject has no entitlement to participate in such appeals but may apply to be joined. Furthermore, the data subject has no right of appeal against a decision by the Commissioner not to serve the data controller with a special information notice or against a decision of the Commissioner not to make an adverse determination against the data controller under section 45. In both cases, the only recourse of the data subject would be to apply for judicial review of the Commissioner's decision.

82. The Judge's conclusion on this aspect was as follows (at [40]):

"The upshot is that once a data controller has made a claim that the two conditions in s.32(4) are fulfilled, the data subject cannot compel the Commissioner to embark upon a s.45 exercise, which if it takes place at all may well involve a lengthy process in which the data subject is largely a spectator, with the result that the stay is itself either permanent or of lengthy duration."

83. These matters are important because, as Mr Facenna pointed out, if a claimant is precluded from obtaining an injunction to prevent publication, the only remedy of the claimant for unlawful processing of data in the form of publication, which results in a wrongful invasion of privacy, with once and for all adverse effect, is compensation.

84. In the light of all those matters, Sharp LJ considers that the better view is that the stay provisions in section 32(4), even with a limited purposive interpretation, go beyond what is "necessary" to reconcile the right to privacy with the rights governing freedom of expression, and so are in breach of Article 9 of the Directive.

85. In addition, Sharp LJ considers that there is a strong argument that section 32 of the DPA contravenes Article 22 of the Directive. The argument is that the provisions of sub-sections (1)-(3) of section 32 confer the substantive right to an exemption. As mentioned earlier, they were held in Campbell to apply both before and after publication. It is those provisions which include the critical balancing exercise mirroring the requirements of the Directive. That balancing exercise has echoes of the kind of balancing and proportionality exercise which the court undertakes when the right to privacy under Article 8 of the Convention must be balanced against the right to freedom of expression under Article 10 of the Convention, taking into account the provisions of the HRA – a balancing exercise which take places even at the interlocutory stage: see, for example, PJS v News Group Newspapers Ltd [2016] UKSC 26, [2016] AC 1081, especially at [20] and [33]. The argument continues that sub-sections (4) and (5) of section 32 are, on the other hand, purely procedural. They were so described in Campbell (at [115]). Nevertheless, section 32(4) operates to prevent a claimant from obtaining the other remedies which give effect to the data protection rights guaranteed by the Directive contained in sections 7(9), 10(4), 13 and 14(4) to (5) of the DPA (the right of access to personal data, the right to prevent processing likely to cause damage or distress and the right to rectification, blocking, erasure and destruction).

86. On that analysis, and in the light of the absence of any judicial oversight of the automatic stay under section 32(4), Sharp LJ considers that there has been a failure of the requirement in Article 22 that "Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed to him by the national law applicable to the processing in question."

The majority view

87. The starting point for the majority (Sir Terence Etherton MR and McFarlane LJ) is the significant margin of appreciation given to member states at the European level and to the decision maker at the domestic level in implementing the Directive in national legislation. The margin of appreciation in this context was addressed in the following way by Advocate General Kokott in Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy:

"43. Strict application of the data protection rules could substantially limit freedom of expression. Investigative journalism would to a large extent be ruled out if the media could process and publish personal data only with the consent of, or in conformity with information provided by, the person concerned. On the other hand, it is obvious that the media may violate the right of individuals to respect for their private life. Consequently a balance must be found."

"44. This situation of conflict between different fundamental rights and also between data protection and other general interests is characteristic of the interpretation of the Data Protection Directive. As a result, the relevant provisions of the directive are formulated in relatively general terms. They allow the member states the necessary margin of discretion in adopting implementation measures which can be adjusted to the various conceivable situations. In that context, the member states must respect the position with regard to the fundamental rights concerned and reconcile them."

"53. … [I]t must be concluded from the broad scope of the Data Protection Directive … that the [CJEU], when striking a balance between conflicting fundamental rights in the context of the directive, should in principle allow the member states and their courts a broad discretion within which their own traditions and social values can be applied."

88. The wide margin of discretion or appreciation afforded to member states in the light of their different traditions, social values and practices reflects the similarly wide margin of appreciation in cases in which Article 8 of the Convention is engaged. In Mosley v United Kingdom [2012] EMLR 1, for example, the ECtHR said as follows:

"108. The Court recalls that a number of factors must be taken into account when determining the breadth of the margin of appreciation to be accorded to the State in a case in which Article 8 of the Convention is engaged. First, the Court reiterates that the notion of "respect" in Article 8 is not clear-cut, especially as far as the positive obligations inherent in that concept are concerned: bearing in mind the diversity of the practices followed and the situations obtaining in the Contracting States, the notion's requirements will vary considerably from case to case. Thus Contracting Parties enjoy a wide margin of appreciation in determining the steps to be taken to ensure compliance with the Convention. In this regard, the Court recalls that by reason of their direct and continuous contact with the vital forces of their countries, the State authorities are, in principle, in a better position than the international judge to give an opinion on how best to secure the right to respect for private life within the domestic legal order."

89. In reaching its conclusion in Mosley that the United Kingdom was not in breach of its obligations under Article 8 of the Convention by failing to impose a legal duty on the News of the World to notify the applicant in advance in order to allow him the opportunity to seek an interim injunction to prevent publication of material which violated his right to respect for his private life, the ECtHR took into account such matters as the system of self-regulation of the press in the United Kingdom, the report of the House of Commons Culture, Media and Sport Committee rejecting such a pre-notification duty, and the chilling effect on investigative journalism of any such requirement. The ECtHR said the following:

"122. The Court recalls, first, that the applicant's claim relates to the positive obligation under Article 8 and that the State in principle enjoys a wide margin of appreciation. It is therefore relevant that the respondent State has chosen to put in place a system for balancing the competing rights and interests which excludes a pre-notification requirement. It is also relevant that a parliamentary committee recently held an inquiry on privacy issues during which written and oral evidence was taken from a number of stakeholders, including the applicant and newspaper editors. In its subsequent report, the Select Committee rejected the argument that a pre-notification requirement was necessary in order to ensure effective protection of respect for private life."

90. The ECtHR's conclusion was stated as follows:

"132. The limited scope under Article 10 for restrictions on the freedom of the press to publish material which contributes to debate on matters of general public interest must be borne in mind. Thus, having regard to the chilling effect to which a pre-notification requirement risks giving rise, to the significant doubts as to the effectiveness of any pre-notification requirement and to the wide margin of appreciation in this area, the Court is of the view that Article 8 does not require a legally binding pre-notification requirement. Accordingly, the Court concludes that there has been no violation of Article 8 of the Convention by the absence of such a requirement in domestic law."

91. There is no reason to think that the CJEU would not take into account similar considerations when adjudicating whether Article 9 of the Directive has been properly implemented in the domestic legislation of member states: cf. Article 7 (respect for private and family life), Article 8 (protection of personal data), Article 11 (freedom of expression and information) and Article 53(3) of the Charter of Fundamental Rights of the European Union (in so far as Charter rights correspond to Convention rights, the meaning and scope of those rights shall be the same as those laid down by the Convention).

92. The Parliamentary material in the Appendix 2 to this judgment relating to the passage through Parliament of what became the DPA shows that Parliament was particularly conscious of the following matters in enacting section 32(4). First, Article 9 of the Directive required the Government and Parliament to reconcile data protection privacy rights with freedom of expression. Secondly, it had not been an easy task for the UK to do so. The Government had exhaustive discussions with media interests to identify difficulties, including the Press Complaints Commission, the BBC, Channel 4 and independent television companies, as well as newspapers and newspaper lawyers generally. Thirdly, freedom of expression is an essential and continuing part of the British way of life and its traditions. Fourthly, the biggest problem which had been identified involved the need to avoid injunctions freezing the preparation of a story. Fifthly, there was a recognition of the chilling effect of pre-publication restrictions. Sixthly, it was specifically with that in mind that the Government considered it was right that there should be no possibility of a litigation challenge to processing of personal data for the special purposes prior to publication.

93. The majority consider that those considerations were not only legitimate considerations in principle in carrying into domestic legislation the reconciliation or balancing required by Article 9 of the Directive but they are all matters specifically recognised and endorsed in the jurisprudence of the ECtHR (as to which, see [89] above). Given our purposive interpretation of section 32(4), which restricts the stay to journalistic material containing unpublished personal data, that is to say limited to the pre-publication or disclosure stage, the majority consider that the provisions of sub-sections (4) and (5) of section 32(4) fall clearly within the margin of appreciation afforded to member states and the legitimate range of discretion enjoyed by Parliament as the decision maker.

94. It is well-established in the jurisprudence of the ECtHR that the gathering of information is an essential preparatory step in journalism and an inherent, protected part of press freedom: Satakunnan Markkinapörssi Oy and Satamedia Oy v Finland (at para 128). In that case the Grand Chamber of the ECtHR (at paras 175 and 191) accepted that a provision of Finland's Personal Data Act (Act No. 523/1999) was compliant with the Convention and an acceptable balancing of the right to privacy under Article 8 and the right to freedom of expression under Article 10 insofar as it granted in effect a blanket exemption from the legislative safeguards of the right to privacy in respect of the processing of data at the pre-publication or disclosure stage for purposes of journalism or artistic or literary expression. That exemption, it must be emphasised, did not depend on any balancing exercise in an individual case, whether by the data controller, an independent regulator or the courts.

95. Having regard to the matters considered and discussed in Parliament on the passage of the DPA, summarised above, it is relevant to note that, in reaching its conclusion in Satakunnan Markkinapörssi Oy and Satamedia Oy v Finland, the ECtHR had regard (at para 193) to the fact that:

"parliamentary review of Finnish legislation relating to access to information and taxation data in particular, as well as that relating to data protection, has been both exacting and pertinent."

96. It is true that, under the provision in the Finnish Act, the court still had jurisdiction to say whether the processing was in fact for purposes of journalism or artistic or literary expression whereas, under the provisions of sub-sections (4) and (5) of section 32 of the DPA, the stay comes into existence if the data controller merely claims that the processing of the data meets the conditions in 32(4) (a) and (b), subject only to review of such a claim by the Commissioner and at her discretion. The decision of the Commissioner not to undertake such a review or not to make a determination under section 45 are, however, subject to a judicial review challenge by the data subject.

97. Again, while it is true that it is possible for the data controller to appeal an adverse decision of the Commissioner, which would lengthen the time for a successful conclusion of a challenge to the stay, the possibility of appeals to the Court of Appeal and beyond are a feature of many interlocutory decisions of the court. Furthermore, if the data subject applied to be joined to any appeal from a decision of the Commissioner, it is difficult to imagine that such an application would be refused.

98. Even if publication of personal data is able to proceed because of the stay provisions in section 32(4), and the data subject thereby suffers irreversible damage to reputation, the jurisprudence of the ECtHR has recognised that, in the interests of freedom of expression, compensation is an adequate remedy. In Mosley, for example, the ECtHR observed (at para 120) that it had implicitly accepted that ex post facto damages provide an adequate remedy for violations of Article 8 Convention rights arising from the publication by a newspaper of private information.

99. Finally, the majority do not consider that there is any question of section 32(4) contravening Article 22 of the Directive. Article 22 requires member states to provide a judicial remedy for breach of the rights "guaranteed … by the national law applicable to the processing in question". Whether or not the processing in question is exempt and the extent of the exemption, both before and after publication, will depend upon satisfaction of the conditions in section 32(1) to (3) and the existence of the automatic stay in the circumstances specified in sub-sections (4) and (5). The stay under those sub-sections is as much an inherent part of, and delineates, the extent of the guaranteed rights as sub-sections (1) to (3) of section 32. The question whether or not section 32(4) is properly characterised as procedural or substantive does not seem to the majority to be helpful in this context. It imposes a procedural bar on the prosecution of court proceedings but it is a constituent part of the exemption for the processing of personal data for the special purposes.

100. This analysis of the majority deals with all the grounds of appeal apart from grounds 3, 4 and 8. We do not consider those remaining grounds of appeal make any difference to the reasoning. So far as concerns grounds 3 and 4, we accept that the Judge may have placed too much weight on causes of action other than those under the DPA, but the majority do not rely on that reasoning in reaching their decision. So far as concerns ground 8, this did not feature in oral argument before the court.

Reference

101. Those disagreements between the members of the court mean that the issue whether section 32(4) complies with the Directive is not acte clair. We consider that there should therefore be a reference to the CJEU for a preliminary ruling on whether section sub-sections (4) and (5) of section 32 of the DPA contravene the Directive.

102. We shall consider further submissions on the form and content of any such reference.

……………………………………………………………………………………..

APPENDIX 1 Data Protection Act 1998

"7. Right of access to personal data.

(1) Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled—

(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,

(b) if that is the case, to be given by the data controller a description of—

(i) the personal data of which that individual is the data subject,

(ii) the purposes for which they are being or are to be processed, and

(iii) the recipients or classes of recipients to whom they are or may be disclosed,

(c) to have communicated to him in an intelligible form—

(i) the information constituting any personal data of which that individual is the data subject, and

(ii) any information available to the data controller as to the source of those data, and

(d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.

(2) A data controller is not obliged to supply any information under sub-section (1) unless he has received—

(a) a request in writing, and

(b) except in prescribed cases, such fee (not exceeding the prescribed maximum) as he may require.

(3) Where a data controller—

(a) reasonably requires further information in order to satisfy himself as to the identity of the person making a request under this section and to locate the information which that person seeks, and

(b) has informed him of that requirement,

the data controller is not obliged to comply with the request unless he is supplied with that further information.

(4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless—

(a) the other individual has consented to the disclosure of the information to the person making the request, or

(b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.

(5) In sub-section (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that sub-section is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.(6) In determining for the purposes of sub-section (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to—

(a) any duty of confidentiality owed to the other individual,

(b) any steps taken by the data controller with a view to seeking the consent of the other individual,

(c) whether the other individual is capable of giving consent, and

(d) any express refusal of consent by the other individual.

(7) An individual making a request under this section may, in such cases as may be prescribed, specify that his request is limited to personal data of any prescribed description.

(8) Subject to sub-section (4), a data controller shall comply with a request under this section promptly and in any event before the end of the prescribed period beginning with the relevant day.

(9) If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.

(10) In this section—

"prescribed" means prescribed by the [F3 Secretary of State] by regulations;

"the prescribed maximum" means such amount as may be prescribed;

"the prescribed period" means forty days or such other period as may be prescribed;

"the relevant day", in relation to a request under this section, means the day on which the data controller receives the request or, if later, the first day on which the data controller has both the required fee and the information referred to in sub-section (3).

(11) Different amounts or periods may be prescribed under this section in relation to different cases."

"10. Right to prevent processing likely to cause damage or distress.

(1) Subject to sub-section (2), an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons—

(a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and

(b) that damage or distress is or would be unwarranted.

(2) Sub-section (1) does not apply—

(a) in a case where any of the conditions in paragraphs 1 to 4 of Schedule 2 is met, or

(b) in such other cases as may be prescribed by the Secretary of State by order.

(3) The data controller must within twenty-one days of receiving a notice under sub-section (1) ("the data subject notice") give the individual who gave it a written notice—

(a) stating that he has complied or intends to comply with the data subject notice, or

(b) stating his reasons for regarding the data subject notice as to any extent unjustified and the extent (if any) to which he has complied or intends to comply with it.

(4) If a court is satisfied, on the application of any person who has given a notice under sub-section (1) which appears to the court to be justified (or to be justified to any extent), that the data controller in question has failed to comply with the notice, the court may order him to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.

(5) The failure by a data subject to exercise the right conferred by sub-section (1) or section 11(1) does not affect any other right conferred on him by this Part."

"13. Compensation for failure to comply with certain requirements.

(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.

(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—

(a) the individual also suffers damage by reason of the contravention, or

(b) the contravention relates to the processing of personal data for the special purposes.

(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.

"14. Rectification, blocking, erasure and destruction.

(1) If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data.

(2) Sub-section (1) applies whether or not the data accurately record information received or obtained by the data controller from the data subject or a third party but where the data accurately record such information, then—

(a) if the requirements mentioned in paragraph 7 of Part II of Schedule 1 have been complied with, the court may, instead of making an order under sub-section (1), make an order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve, and

(b) if all or any of those requirements have not been complied with, the court may, instead of making an order under that sub-section, make such order as it thinks fit for securing compliance with those requirements with or without a further order requiring the data to be supplemented by such a statement as is mentioned in paragraph (a).

(3) Where the court—

(a) makes an order under sub-section (1), or

(b) is satisfied on the application of a data subject that personal data of which he was the data subject and which have been rectified, blocked, erased or destroyed were inaccurate,

it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.

(4) If a court is satisfied on the application of a data subject—

(a) that he has suffered damage by reason of any contravention by a data controller of any of the requirements of this Act in respect of any personal data, in circumstances entitling him to compensation under section 13, and

(b) that there is a substantial risk of further contravention in respect of those data in such circumstances,

the court may order the rectification, blocking, erasure or destruction of any of those data.

(5) Where the court makes an order under sub-section (4) it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.

(6) In determining whether it is reasonably practicable to require such notification as is mentioned in sub-section (3) or (5) the court shall have regard, in particular, to the number of persons who would have to be notified."

APPENDIX 2 DPA Parliamentary material

The Bill was introduced in the House of Lords. In moving the second reading Lord Williams of Mostyn referred to clause 31 of the Bill (which became s. 32 of the DPA) in the following terms (Hansard (HL Debates) Fifth Series Vol DLXXXV, 2 February 1998, cols 441-2):

"I pause on one exemption which is of great importance. It is to be found in Clause 31, to which I promised to return. It relates to processing for the special purposes; namely, journalistic, literary and artistic purposes. The media have been concerned about the implications for their work of the EC Data Protection Directive. I am happy to repeat again publicly that the Government recognise the central importance of the work of a free press in a free society. With its broad definition of "processing", not to mention the inclusion of manual records and the range of rights for individuals, the directive, and therefore the Bill, goes considerably further in protecting individuals' personal information than does the present Act of 1984. It therefore inevitably has greater potential to put at risk the media's legitimate use of such personal information. I am happy to see the noble Lord, Lord Wakeham [then Chairman of the Press Complaints Commission], in his place. He and I and others from the BBC, Channel 4 and the independent television companies, as well as newspapers and newspaper lawyers generally, had discussions throughout the summer and autumn of last year. We have provided for exemptions for the media. We have done that as deliberate policy, not by way of Christmas accident, where they are necessary to reconcile privacy with freedom of expression.

Following the meetings to which I referred, we have included in the Bill an exemption which I believe meets the legitimate expectations and requirements of those engaged in journalism, artistic and literary activity. The key provision is Clause 31. This ensures that provided that certain criteria are met, before publication - I stress "before" - there can be no challenge on data protection grounds to the processing of personal data for the special purposes. The criteria are broadly that the processing is done solely for the special purposes; and that it is done with a view to the publication of unpublished material. Thereafter, there is provision for exemption from the key provisions where the media can show that publication was intended; and that they reasonably believe both that publication would be in the public interest and that compliance with the Bill would have been incompatible with the special purposes.

We have specifically written into the Bill reference to compliance with a code of conduct which is capable of being approved by the Secretary of State. We have deliberately placed upon the face of the Bill, I believe for the first time in an Act of Parliament in this country, that the public interest is not the narrow question of whether this is a public interest story in itself but that it relates to the wider public interest, which is an infinitely subtle and more complicated concept. That is expressed elegantly in Article 10 of the European Convention on Human Rights as regards the transmission of views and opinions by the press and the necessary co-related right on behalf of the public to receive those expressions of views and opinions.

………….

We do not wish, and would not want, to inhibit the freedom of expression which is a fundamental and continuing part of the British way of life and which British broadcasters have enjoyed up to now in making programmes in a generally responsible way. It is clearly part of that tradition of information, the dissemination of views and discussion of ideas; for example, historical programmes dealing with analysis of the past. It is not the intention of the Government in implementing the directive that the making of these programmes should be inhibited or prevented by individuals attempting to use its provisions to re-write history or prevent the responsible discussion of historical subjects and documentaries which are an important part of the media's role in informing, educating and stimulating public discussion.

Equally, it is part of the British tradition of freedom of expression that entertainment programmes, such as arts programmes, comedy, satire or dramas, can refer to real events and people. It is not the intention of the Government for the directive to be used to inhibit programme-makers from making programmes as they have up to now. The Government believe that both privacy and freedom of expression are important rights and that the directive is not intended to alter the balance, which is a fine one and always should be, that currently exists between these rights and responsibilities. I believe that the Bill does strike the right note in that respect. It was not until after a good deal of consultation and discussion, and perhaps cross-fertilisation of ideas, that we came to our conclusion. However, I repeat that if there is reasonable room for improvement, our minds are not closed."

At the amendment stage in the House of Lords, Lord Falconer, then the Solicitor General, said the following (Hansard (HL Debates) Fifth Series Vol DLXXXVII, col 513):

"The remaining four amendments to Clause 31 are of a little more substance, but they clarify or complement the provision which is already made in the clause rather than changing it. An essential feature of the mechanism is that it prevents data protection considerations being used to prevent the publication of unpublished journalistic and other material in certain circumstances. Clause 31 (4) provides for civil proceedings under any relevant provisions of the Bill to be stayed where a data controller claims that the processing is undertaken only for the special purposes - that is, journalistic, literary or artistic purposes - and with a view to the publication of previously unpublished material. The stay on proceedings remains until either the claim is withdrawn or a determination of the commissioner under Clause 43 that those criteria are not satisfied takes effect."

In the course of the Bill's consideration by the Standing Committee in the House of Commons, Mr George Howarth MP, the Parliamentary Under Secretary of State for the Home Department, said the following (Hansard (HC Standing Committee D) 5 May 1998 col 210-211):

"The directive recognises the need to reconcile data protection privacy rights with freedom of expression. Article 9, to which the hon. Member for Ryedale referred says that we

"shall provide for exemptions or derogations"

from the directive's main provisions for processing

"solely for journalistic purposes or the purpose of artistic or literary expression"

and then "only if" - which means to the extent that "they are necessary". We must also

"reconcile the right to privacy with the rules governing freedom of expression",

which in practice means article 10 of the European convention on human rights. …

The directive leaves it to member states to find the best way to do that in their own circumstances - the legal background and the way in which the media, art and literature have developed in each country are, of course different. It was not an easy task for the UK. Those who tried to negotiate a way through the subject did not pretend for a moment that it was an easy undertaking. We had exhaustive discussions with media interests to identify difficulties. The biggest problem involved the need to avoid injunctions freezing the preparation of a story. Such a story ultimately might be in the public interest, but one item of information or piece of data might cause its preparation to be halted. The result is a careful set of checks and balances, which I shall set out in some detail, although I simplify the language.

Clause 31(1) provides exemptions from the data protection principles except security, subject access, blocking of processing, rectification and blocking of processing, rectification and blocking of automated decisions taking. Those apply where there is or was an intention to publish, where there is a public interest justification and where compliance with the Bill mechanism is not compatible with journalism.

Clause 31(4) provides a stay on court enforcement action where processing is claimed to be solely for journalism with a view to publication of fresh material.

Clause 43 provides a power for the commissioner to serve a special information notice solely to find out whether those two conditions are actually met.

Clause 44 provides a power for the commissioner to make a determination, subject to appeal, that those conditions are not, or are no longer, met and hence to lift any stay on court proceedings.

Clause 45 provides a power for the commissioner to a normal information notice only once it has been determined under clause 44 that processing is not or is no longer solely for journalism with a view to publication of fresh materials - and only then with leave of the court.

Clause 45 also provides a power for the commissioner to serve a normal enforcement notice only retrospectively and only if a court agrees that she can because there is a contravention of substantial public importance.

Clause 52 provides a power for the commissioner to help an individual bring an action against the media where there is a matter of substantial public importance.

All the measures are intended, in .a nutshell, to protect journalists' right to handle material about people provided that it is for true journalistic purposes and in the public interest. They do not give individuals who have something to hide a lever to stop investigations but they ensure that there are remedies for an individual where the privacy of information about them was in fact invaded.

As part of the broader package of provisions in the Bill for journalism and its two related purposes, clause 31 plays a key role by exempting personal data processed for the special purposes from the main Bill mechanisms, provided that three cumulative conditions are met. Those conditions are: that the processing is with a view to publication of journalistic, literary or artistic material; that the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest; and finally, that the data controller reasonably believes that, in all the circumstances, compliance with the particular Bill mechanism is incompatible with the special purposes."

In the context of a proposed amendment which would have made the stay criteria justiciable, he said the following:

"We think it right that there should be no possibility of challenge to processing for the special purposes, prior to publication. We wish to avoid what has been called the chilling effect of pre-publication restrictions. That is, in our view, wholly inconsistent with freedom of expression. A central thrust of the arrangements made in clause 31 and the associated provisions is to achieve that principle.

Sub-sections (4) and (5) of clause 31, together with later provisions, are directed at ensuring that no injunctions or other forms of relief depending solely on data protection considerations may be used to stop processing pre-publication in special purposes cases. The amendment would seriously weaken this carefully constructed mechanism by allowing applications to be made by third parties for injunctive and other proceedings relating to the special purposes to go ahead prior to publication."