Jersey Unreported Judgments

Data protection - application for an order requiring the respondent to cease processing their personal data on his personal blog site.

[2013]JRC170

Royal Court

(Samedi)

4 September 2013

Before     :

Sir Charles Gray, Kt., Commissioner, and Jurats Kerley and de Veulle.

 

Advocate F. B. Robertson for the Representors.

The Respondent did not appear and was not represented.

judgment

the commissioner:

Hearing in private

At the outset of the hearing I directed that the hearing should be in private because it seemed to us that this was necessary in order to secure the proper administration of justice: see Jersey Evening Post Limited-v-Al Thani and Ors [2002] JLR 542 at paras [14]-[15].

The nature of the Application

1.        This is an application by the representors named above for an Order pursuant to Article 10 of the Data Protection (Jersey) Law 2005 ("the DPL") requiring the respondent (Mr Syvret) to cease processing their personal data on his personal blog site, ("the Blog"), and not to begin processing such data hereafter. 

2.        The background to the present application is as follows: Mr Syvret served as a Deputy in the States of Jersey from 1990 to 1993 and as a Senator from 1993 until 2010.  During that time he was President of the Health and Social Services Committee from 1999 until 2005 and thereafter was Minister for Health and Social Services from 2005 until September 2007.  He forfeited his senatorial seat in April 2010 after he spent 6 months out of Jersey. 

3.        Mr Syvret set up the Blog in January 2008.  The four representors are amongst those who have been repeatedly identified by name on the Blog as having, amongst other things, engaged in criminal behaviour.  In order to prevent further identification of the representors, I have decided that they should be referred to in this judgment as AB, CD, EF and GH. 

4.        The case for the representors is that Mr Syvret is a "data controller" within the meaning of the DPL and that he has processed their personal data by uploading, publishing and storing false and offensive posts on the Blog.  The representors contend that the allegations made about them on the Blog are untrue and unjustified. 

5.        The representors further contend that Mr Syvret is responsible for and moderates comments left on the Blog by third parties.  Their case is that Mr Syvret would be able to remove such comments from the Blog but has refused to do so. 

6.        "Notices to Stop Processing" have been served on Mr Syvret on behalf of each of the representors.  They assert that Mr Syvret has refused to stop processing their personal data which remain stored and published on the Blog. 

7.        On 17^th November, 2010, Mr Syvret was convicted in the Magistrate's Court of two offences, one of disclosing personal data without consent and one of processing personal data without being registered as a data controller.  Mr Syvret's appeal against his said conviction in the Magistrate's Court was dismissed by the Royal Court on 30^th August, 2011. 

8.        On 13th August, 2012, the representors made an application to the Court, without notice to Mr Syvret, seeking an interim injunction restraining him from posting on the Blog or any other blog any material relating to the representors.  The Royal Court granted the injunction sought.  Subsequently on 17^th August, 2012, the Royal Court issued a clarification which stated that the injunction granted on 13^th August, 2012, did not apply to material already stored on the Blog but only restrained him from posting additional material on the Blog in the future. 

9.        By the present application all four representors seek a final injunction restraining Mr Syvret from processing their personal data within the meaning of the DPL. 

Proceedings in private

10.      Before turning to the merits of the present application, we should explain why, as was made clear at the beginning of this judgment, the hearing of this application was held in private.  This is a case where we are satisfied that, if any publicity were to be given to the facts of the case (including the nature of the relief sought, the evidence given and the terms of the present judgment), the object of the application would be defeated.  For the same reasons that earlier proceedings in the case have been held in private, we are satisfied that the present proceedings, including the evidence, the written argument and the terms of this judgment, should also be private.  This means that no reporting of any part of the proceedings is permissible.

Delay

11.      Before turning to the substantive issues which arise in the present application, we must consider whether the delay which has occurred in the present case is such as to deprive the representors of any entitlement which they might otherwise have had to injunctive relief. 

12.      As Advocate Robertson, who appeared for the representors on the hearing of the present application, rightly accepted in the course of his admirably clear submissions, there was some delay both before the first Notice was issued on 3^rd August, 2010, as well as thereafter.  His contention is that there are several reasons which explain the delay that occurred both before and after the Royal Court granted an interim injunction on 13^th August, 2012. 

13.      The charges against Mr Syvret of offences under the DPL were laid as long ago as 3^rd June and 8^th July, 2009.  The date initially set for the trial of those charges was 27^th September, 2010.  As we understand it, the principal reason why the trial did not take place earlier was that Mr Syvret left Jersey for about 6 month after being charged and did not return until April 2010. 

14.      In the event the criminal charges against Mr Syvret were not concluded until 17^th November, 2010, when, as we have already said, he was convicted of both offences.  Mr Syvret appealed against those convictions.

15.      We were told by Advocate Robertson that the representors took the view that civil proceedings should not be commenced against Mr Syvret until after the outcome of the criminal proceedings in the Magistrate's Court was known.  We do not feel that this was an unreasonable position for the representors to have adopted in all the circumstances of the present case.  Once Mr Syvret decided to appeal, a further postponement was inevitable.  The appeal was dismissed on 30^th August, 2011. 

16.      Advocate Robertson invited us to take into account various considerations, namely:-

(i)        The fact that Mr Syvret decided to stand for election as Senator in October 2011;

(ii)       The fact that the fourth representor (who had sought the assistance of the Data Protection Controller in April 2011) needed to serve on Mr Syvret a formal "Notice to Stop Processing" in order to be entitled to the relief sought in these proceedings, and

(iii)      That Mr Syvret should be afforded a further opportunity to comply with the earlier requests made on behalf of the representors before proceedings were commenced.

17.      We have carefully considered whether the delay which has taken place between the final determination of the criminal proceedings in August 2011 and the issue of the present proceedings in August 2012 is in all the circumstances unreasonable.  We have concluded, not without some hesitation, that the delay which occurred over this period is not such as to deprive the representors of the relief sought.  We accept that this period of delay was in all the circumstances excusable.  In August 2012 directions were given for the substantive hearing of the present application. 

The relevant law

18.      We turn next to the applicable law.  The starting point is to consider in what circumstances individuals such as the four representors are entitled to prevent the processing of their personal data, which is the principal relief sought in the proceedings. 

19.      Article 10 of the DPL provides as follows:-

"Right to stop processing that causes distress or damage

(1) An individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which the individual is the data subject, on the ground that, for reasons specified in the notice -

(a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to the individual or to another individual; and

(b) that damage or distress is or would be unwarranted."

(We need not set the terms of paragraph 10(2) because it appears to us that none of the conditions in paragraphs 1-4 of Schedule 2 is applicable)

"(3) The data controller shall within 21 days of receiving notice under paragraph (1) give the individuals who gave it a written notice -

(a) stating that the data controller has complied or intends to comply with the individuals notice; or

(b) stating the data controller's reasons for regarding the individual's notice as to any extent unjustified and the extent (if any) to which the data controller has complied or intends to comply with it.

(4) If a court is satisfied, on the application of any person who has given notice under paragraph (1) -

(a) that the notice is justified to any extent; and

(b) that the data controller in question has failed to comply with the notice to that extent, the court may order the data controller to take such steps as it thinks fit for complying with the notice to that extent.

(5) The failure by a data subject to exercise the right conferred by paragraph (1) does not affect any other right conferred on the data subject by this Part."

20.      Mr Syvret having chosen not to take part in the present proceedings, Advocate Robertson drew our attention to the arguments which Mr Syvret might have advanced if he had been present.  He accepted that, where the circumstances in which the data is processed are clearly in the public interest and must necessarily be carried out without the consent of the individual concerned, then the processing of the information will be lawful.  He drew our attention to the Data Protection (Sensitive Personal Date)(Jersey) Regulations 2005, which contain a list of additional circumstances in which the processing of sensitive personal data is permitted.  He also referred us to Article 32 of the DPL which provides a number of additional exemptions. 

21.      However, it is in our judgment clear that none of these provisions are applicable in the circumstances of the present case.  There is no suggestion that any of the claimants consented to the processing of their personal data.  Nor is the data in the public domain.  We do not accept that the data with which this case is concerned could be exempted on the ground it was reasonable in the public interest for it to be published; see the decision of the English Court of Appeal in Campbell-v-Mirror Group Newspapers [2003] QB 633 at paragraph 120-1.

22.      Mr Syvret has sought to rely on Article 10 of the European Convention on Human Rights.  It is however, established law that the right to freedom of expression contained in Article 10 has to be balanced against the right to respect for private and family life contained in Article 8 of the Convention.  Whilst we accept that Article 8 does not encompass a right to privacy as such, there is ample authority that the Court is required in cases such as the present one to have regard to the rights of individuals such as the representors in the present case to respect for their private and family life.  We are in no doubt that the right of Mr Syvret to freedom of expression is outweighed by the right of the representors to protection under Article 8. 

Applicability of the DPL to blog sites

23.      Although Mr Syvret has chosen not to appear before us we have nevertheless considered whether the provisions of section 10 of the DPL apply to blog sites.  There is no Jersey authority, so far as we are aware, on this point.  We were therefore invited by Advocate Robertson to consider the position under English law. 

24.      We accept that section 1 of the English Data Protection Act 1998 defines "data" in broad terms. 

25.      We were referred by Advocate Robertson to Carter-Ruck on Libel and Privacy (6th edition), paragraph 22.14 of which reads as follows:-

"Given the now near-ubiquitous retention and processing of information in electronic form on digital devices by those working in the media - and many other - contexts, the scope of the first two of these concepts is extremely broad.  They would extent, for example, to information captured and/or held in audio, visual and textual file formats on computers, video cameras, voice recorders, disks and so on."

26.      It appears to us that Jersey law should likewise give a wide meaning to the term "data".  Since posts on the Blog are disseminated to others by computers and/or the internet, we consider that posts on blogsites fall within the scope of the DPL.

Interaction between the DPL and other causes of action such as defamation and harassment.

27.      Given that, so far as we are aware, there is no Jersey authority as to the interaction between data protection law and other parallel concepts such as defamation, we think it right that we should consider the English authorities which bear on the point.  We feel that we are justified in doing so since the English Data Protection Act is in very similar terms to the Jersey DPL. 

28.      We were referred by Advocate Robertson to two English authorities, namely Campbell-v-Mirror Group Newspapers [2004] 2 WLR 1232 and The Law Society-v-Kordowski [2011] EWHC 3185.  Whilst we accept that it is the practice in England for claimants to advance claims for defamation and harassment with a claim for data protection in the same proceedings, we are satisfied that there is no reason why a claim for data protection should not stand alone as a separate and distinct cause of action. 

29.      In Kordowski, Tugendhat J observed at paragraph 172:-

"I note with interest that an injunction preventing the processing of personal data in relation to a website was granted in representative proceedings in SHG-v-Baines [2006] EWHC 2359...  The terms of the injunction were to restrain publication of defamatory words and harassment as well as processing personal data."

Tugendhat J granted a perpetual injunction in Kordowski restraining the defendant from processing personal data as well as from publishing defamatory words and harassment. 

30.      Whilst we are not of course obliged to follow English authority, which is no more than persuasive as far as the Courts of Jersey are concerned, we think it right that the Courts of Jersey should follow English law.  Accordingly we take the view that the court may in an appropriate case grant relief under Article 10 of the DPL independently of any other cause of action. 

The first question: do the posts on the Blog constitute "sensitive personal data" as defined in the DPL?

31.      We now turn to the questions which arise in relation to the concepts which are to be found in the DPL, starting with the definition of "sensitive personal data". 

32.      Article 1 of the DPL defines "data" as:-

"Information which is being processed by means of equipment operating automatically in response to instructions given for that purpose, is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, or forms part of an accessible record."

Given that posts on the Blog are both stored and disseminated via computers and/or the internet, we consider that they fall within the definition of "data" in the DPL.

33.      The next question is whether the data with which the case is concerned qualifies as "personal" data.  Article 1 of the DPL defines such data as being:-

"data that relates to a living individual who can be identified [either] from those data, or [else] from those data and other information that is in the possession of, or is likely to come into the possession of, the relevant data controller, and includes any expression of opinion about an individual who can be so identified and any indication of the intentions of the data controller or any other person in respect of an individual who can be so identified."

34.      The material criteria are:-

(i)        The identifiability of the individual concerned and

(ii)       The possession or likely possession of the data.

It is to be noted that data includes "any expression of opinion about an individual".  We have noted the hostile and abusive opinions expressed by Mr Syvret on the Blog. 

35.      In Durant-v-Financial Services Authority [2003] EWCA Civ 1746 the English Court of Appeal indicated two ways in which it might be determined whether data qualifies as personal data about an individual: firstly, by considering whether the information is "biographical to a significant degree" and, secondly, by considering whether the person concerned is "the focus of the information".  We are satisfied on the basis of Durant that the data with which this case is concerned qualifies as "personal" data for the purposes of the DPL. 

36.      Finally we consider next whether the personal data concerning the representors qualify as "sensitive" personal data?  The term is defined in Article 2 of the DPL as comprising inter alia information about an individual's physical or mental condition, sexual life, commission or alleged commission of criminal offences and any related legal proceedings. 

37.      The reason why it is material to consider whether the information with which the case is concerned qualifies as "sensitive" is that the DPL imposes an additional requirement that sensitive personal data should be processed "fairly and lawfully". 

38.      It appears to us to be clear that many of the posts on the Blog complained of do come within the statutory definition of "sensitive personal data" in Article 2 of the DPL.  In particular we are satisfied that some posts contain data about the commission or alleged commission of criminal offences and proceedings regarding such offences. 

39.      We note that in his response to the notices to stop processing issued on behalf of the first, second and third representors, Mr Syvret contended that the information published on the Blog consists of "generally known, public information, hearsay, opinions, and other such, much of which was conveyed to me by my former constituents.  It thus constitutes material that falls squarely within the bounds of free speech as guaranteed by the ECHR."

40.      As it appears to us, Mr Syvret is implicitly accepting in the description he gives of the material contained on the Blog that it does contain "personal data" which is "sensitive" within the meaning of Article 2 of the DPL. 

Is Mr Syvret the "data controller" of material published on the Blog?

41.      We are satisfied that Mr Syvret comes with the definition of "Data Controller" in Article 1 of the DPL which defines a data controller as meaning:-

"a person who (either alone or jointly or in common with other persons) determines the purpose for which and the manner in which any personal data are, or are to be, processed".

We accept that Mt Syvret falls fair and square within this definition; on his own case it was he who decided what personal data should be processed and his purpose and manner of doing so. 

42.      An allied question is whether Mr Syvret "processed" data on the Blog.  We note that "processing" is defined in Article 1 of the Law as follows:-

""Processing", in relation to information or data, means obtaining, re cording or holding the information or data, or carrying out any operation or set of operations on the information or data, including -

(a) organising, adapting, or altering the information or data;

(b) retrieving, consulting or using the information or data;

(c) disclosing the information or data by transmission, dissemination or otherwise making it available; or

(d) aligning, combining, blocking, erasing or destroying the information or data."

43.      We are satisfied on the evidence that Mr Syvret carried out most, if not all, of the operations on the information or data published on the Blog which are set out in (a) to (d) inclusive.  In consequence we find that he is the "data controller" of the material on the Blog. 

Substantial damage or distress

44.      The principal relief sought against Mr Syvret by the representors is an injunction.  We consider that each of the representors is plainly entitled to the injunctive relief sought. 

45.      The representors also claim that they have suffered substantial damage and substantial distress.  Given the nature of the allegations made by Mr Syvret against each of the representors, we readily accept that each of them will have been distressed and angered by the postings on the Blog. 

46.      The statutory requirement sit at the representors must establish substantial distress.  There is little help to be derived from the English authorities as to the meaning in the present context of the word "substantial".  We consider that, when used to qualify distress, substantial bears the meaning that the distress caused is more than merely trivial. 

47.      As to the requirement that the damage suffered must be substantial we take the view that the word "substantial", when applied to the level of damage, bears the same meaning as it does when applied to distress, namely that to qualify as substantial the damage suffered must be more than merely trivial.  We reject the notion that damage needs to involve financial loss or physical harm in order to qualify as substantial. 

48.      Each of the four representors describes both in that Notice to Stop Processing and in that witness statements the nature of the damage and distress they claim to have suffered. 

49.      One of the representors explains in the Stop Notice the nature of the substantial distress and substantial damage he claims to have suffered.  He asserts that the distress arises mainly from the statements accusing him of most serious criminal wrongdoing.  As to damage, his case is that the unwarranted imputations made by Mr Syvret about him have caused substantial damage to his business interests as well as damage to his health and reputation.  The other representors advance comparable claims as to the damage suffered. 

50.      We are satisfied that the distress and damage suffered by each of the four representors are "substantial" in the sense which we have indicated. 

51.      Accordingly for the reasons set out above we are satisfied that each of the applicants has established his entitlement to the relief sought. 

Authorities

Jersey Evening Post Limited-v-Al Thani and Ors [2002] JLR 542.

Data Protection (Jersey) Law 2005.

Data Protection (Sensitive Personal Date)(Jersey) Regulations 2005.

Campbell-v-Mirror Group Newspapers [2003] QB 633.

European Convention on Human Rights.

Data Protection Act 1998.

Carter-Ruck on Libel and Privacy (6th edition).

Campbell-v-Mirror Group Newspapers [2004] 2 WLR 1232.

The Law Society-v-Kordowski [2011] EWHC 3185.

Durant-v-Financial Services Authority [2003] EWCA Civ 1746.