The transcripts of the official inquiry into the culture, practices and ethics of the press. More…


  • Thank you, Mr Coppel. Your full name, please?

  • Philip Antony (with no H) Coppel.

  • Thank you. You've kindly provided us with a statement dated 28 June 2012. It starts at our page 01178. Are you content to confirm the truth of the facts and matters set out?

  • I confirm the truth of facts and matters.

  • Thank you. Now, Mr Coppel, you are a barrister practising at 4-5 Gray's Inn Square. You were called to the bar in 1994, appointed Queen's Counsel in 2009. You practise in the realms of public law and commercial law with a particular interest in data protection and freedom of information; is that a fair summary?

  • You were asked to deal with a number of aspects of the Data Protection Act so far as they bear on the press and the scope of your evidence. That is set out in paragraphs 3 and 4 of your statement; is that right?

  • May we move straight to paragraph 7, the introduction to the DPA, in particular the background. I'm going to ask you to assume that your listeners may or may not be that familiar with the minutiae of data protection law. All the lawyers here will carefully have pre-read your statement but no everybody --

  • -- watching this, so we need to find the right balance between too much detail and too little. Could you tell us in other words, please, about the background to the first Data Protection Act, which was, of course, enacted in 1984 in the light of international, European and common law obligations?

  • The 1984 Act was not the product of a directive, unlike the 1998 Act. It emanated from the parliament of this country, although it was responsive to certain international moves which had taken place in the 1960s and 1970s and 1980 in particular, when the OECD issued guidelines to countries as to the manner in which personal data was to be handled by states that were members of the OECD, of which the United Kingdom is one.

  • Thank you. The OECD, of course, is the Organisation for Economic Co-operation and Development. Does that cover the same entities as the EU or is it wider?

  • It's wider than the EU. So for example, the United States, Australia, are all members of the OECD.

  • Thank you. The Data Protection Act, which is the first piece of legislation in this area, was enacted in 1984, and you say in paragraph 11:

    "It did provide some protection against mishandling of personal, private information."

    And there was litigation in the House of Lords in relation to that. Could you tell us, please, in a nutshell, what the protections were in the first Act?

  • Well, the protections were more limited insofar as they didn't give much rise -- sorry, much opportunity for an individual to bring personal claims for abuse of personal information, unlike the 1998 Act. It was more concerned with the actual processing itself to ensure that it adhered to the requirements which were set out in the act, so in terms of what it gave the individual in relation to information that related to that individual, it was less than that which was provided by the 1998 Act.

  • I think at that stage we weren't dealing with a commissioner; we were dealing with a registrar. The name changed between 1984 and just before the implementation of the 1998 Act in the year 2000? Is that right?

  • Yes, the office was called the Data Protection Registrar. It became the Information Commissioner, I believe, after 1998 through amendments effected by the Freedom of Information Act 2000.

  • And what happened in the 1990s is that consideration was given to a new directive and in October 1995, the European Parliament, as you remind us, formally adopted the directive, but the UK abstained in the vote. Is anything to be deduced from our abstention?

  • Well, I couldn't possibly say, other than we didn't want to vote in favour and we didn't want to vote against, presumably.

  • Yes, I think that's called mind-bogglingly obvious. Yes.

  • Following the directive, the Home Office, under the then Conservative government, issued a consultation paper. The government itself said it didn't see the need for the directive, but nonetheless, in line with its principles, had to consider implementation. There was then a consultation exercise. The directive required implementation by the end of October 1998, but the DPA was, I think, just before then with implementation on 1 March 2000; is that right?

  • I think it was enacted on 24 October 1998. There was a sunrise provision in relation to various parts of the Act itself, but it came fully into force on 1 March 2000.

  • You make an important point in paragraph 15, which anybody who understands European law will be fully familiar with, but then not everybody will know the detail of this. You explain the directive is a harmonisation measure. There's nothing to prevent a member state from doing more, provided that that which is done more is not expressly prevented by some other provision of Community law, but a member state can't do less than that which the directive specifies.

  • Is that right? And that may or may not be relevant to Section 32, when we come to consideration of that difficult provision.

    The Lisbon Treaty. You deal with this in paragraph 17. What, please, is the significance of that apart from the fact it amended the Treaty of Rome?

  • The significance is that there is a specific article in there recognising the protection of personal data relating to an individual. So there is a more fundamental recognition than previously existed of the importance of protecting the individual's personal information.

  • Thank you. The scheme of the Data Protection Act -- first of all you point out, paragraph 18, that the obligations, generally speaking, under the Act are imposed on government bodies, companies and individuals. So -- I think those concepts are self-explanatory. What may be a little bit more difficult is the matter caught by the Act: personal data. Could you explain for us, please, the concepts of data and personal data?

  • Data is probably best characterised as information, but unlike information, we think of data not necessarily being internally explicable. So if I draw the analogy of a jigsaw puzzle. We have a completed jigsaw puzzle. We say that's information. We see an image, and that's information. Data may be regarded as the individual pieces themselves. The shape of those pieces tells you how it relates to the other data, but it's only when you put them together that an ordinary person -- or at least most of the pieces together, that an ordinary person understands what it is that is being conveyed. Nevertheless, each of the individual pieces may be said to constitute data, and that is the distinction, metaphorically, between data and information. But it is, nevertheless, informative of something, albeit that you might have to assemble it with other data to get that information.

  • Thank you. And personal data? Maybe that's a more straightforward one. It relates to an identifiable live and natural person; in other words, not to a body corporate?

  • Not to a body corporate, not to somebody who has deceased, and then the issue is whether something relates to them, and there has been authority in relation to how close the nexus must be between the data and the individual said to be so identified.

  • Thank you. Certain species of data are in a special category owing to their higher sensitivity. Unsurprisingly, they are called "sensitive personal data". As you explain in paragraph 20, these relate to matters such as racial or ethnic origin, political opinions, religious beliefs, et cetera.

  • All the things you would expect to see treated more sensitively. In particular, health matters.

  • The activity related by Act is called "processing". Again, in a nutshell, what is processing?

  • In a nutshell, it's basically any activity, including the state in which data is. So it means holding, getting, receiving, disseminating, publishing, manipulating or using in any way. It's as wide as it possibly could be.

  • The Act bites on those responsible for the data in two ways. We have a data controller and a data processor. What's the difference between those?

  • The data controller is the guiding mind in relation to what is done or not done in relation to the data that is held. The processor is the one who may do the actual work but at the instruction of the data controller. So if, for example, the data was shifted off site from the particular entity -- the company, let us say -- it's the data controller who may tell the data processor what to do or what not to do in relation to those data and that's the difference between the two.

  • Thank you. And paragraph 28:

    "The standard of processing required by the Act is defined through the data protection principles."

    Of which there are eight. Then you go on in paragraph 24 and following to explain each of these principles. Most of them are self-explanatory, but the first data protection principle -- can I ask you, please, to amplify that one? As you say, there are three requirements: the requirement to process personal data fairly, to process it lawfully, and then to meet at least one of the schedule 2 conditions, and when we have sensitive personal data, it's one of the schedule 3 conditions as well. But the concepts, please, of "fairly", "lawfully" and then these scheduled conditions?

  • "Fairly" is spelled out in greater detail in part 2 of schedule 1, and essentially it means with some sort of consent from the data subject. The data subject is the person to whom the information relates. There are let-outs specified in part 2 of schedule 1, but in general terms, that is what is meant by "fairly".

  • "Lawfully" means that it doesn't otherwise contravene the law. For example, there may be provisions which prohibit certain dissemination of information. There may be provisions that prohibit other sorts of activity in relation to information. Breach of confidence is said to constitute not lawful processing of data, and indeed a breach of the DPA itself is said to be not lawful.

  • The schedule 2 conditions -- there are six of those, on my understanding. One we might focus on is condition 6(1), which, as you explain, embodies a balancing of the interest protected by the European Convention of Human Rights, in particular articles 8 and 10. So this is the balancing exercise we see in the realm of privacy more generally; is that right?

  • Yes. It brings into the mainstream of the first data protection principle that balancing between the two interests embodied in Article 8 and in Article 10.

  • Is it right to visualise data protection law as a detailed particularisation of Article 8 privacy law in the specific limited context of personal data?

  • It probably does more than just that, but certainly it does do that.

  • It does at least that?

  • It does at least that, I agree.

  • We're not going to look at the other principles; they'll speak for themselves. Those are the principles which bring one within the Act, and within the Act explain what a data controller and data processor must do, but there are also exemptions from those or some of those requirements. Paragraph 35 of your statement. You say, first of all, that the directive gave Member States latitude in defining the extent of exemptions. Can you please explain the degree of latitude?

  • Well, the example that I give specifically later on in my statement is the latitude given in relation to the press exemption, where it is left up to Member States as to how they choose to give effect to the broad principle which is stated in the directive. So the directive itself recognises a contest or competition between Article 8 and Article 10 rights. How that contest is to be resolved is left up to Member States, but contest there is, and a resolution is expected by the directive itself.

  • Could you explain, please, the difference between a pure class-based protected interest and a class-prejudice-based protected interest?

  • A class-based -- a pure class-based interest simply looks at the nature of the information itself and doesn't require that it's processing or, let's say, its disclosure cause any harm. For example, if I say that personal information is purely class-based if it gets released into the -- more widely.

    Class plus prejudice require it to belong to a class and if you do something with it, some harm will result. So, for example, you might have information that relates to the defence of the country, the disclosure of which would be harmful to national security interests. So there's the class defence, there's the prejudice harmful to national security interest. In fact, there isn't one in those terms -- there is a national security exemption -- but that is one which embodies class plus harm.

  • Can you give me an example from personal circumstances in relation to personal data?

  • Well, if we look at the exemptions themselves. I don't think all of them I've included -- in fact, I know I haven't included all of them in the schedule to my provision, but, for example, section 29 provides an exemption for the prevention or detection of crime or the apprehension or prosecution of offenders, where the disclosure of the information or otherwise prejudice -- or otherwise processing would be likely to prejudice any of the matters identified in this subsection. So it's of a nature and the processing is likely to harm what the protected interest, namely the detection of crime, the apprehension or prosecution of offenders.

  • Yes. I understand what you are saying, but I'm just going back to the point that Mr Jay made at the beginning. It may be that those listening to your evidence will not be able to colour the language in which you have described the legislation with an example in their mind that explains precisely the point you are seeking to make. Now, there's a challenge. Can you think of an example that would --

  • Be pure class-based? Well, journalism is one of the pure class-based exemptions. I -- provided it falls within the definition of special -- sorry, journalistic, literary or artistic material, then it doesn't actually require any harm to those particular interests -- ie journalism, literature or art -- to result from the processing in order for the exemption to bite.

  • Thank you. The rights of the data subject against the data controller. The data subject, of course, is anybody whose data is held by a data controller. So it would be a private individual, ordinarily, but it could, I suppose, be a body corporate.

  • No, it's a private individual, alive and well. Well, alive, anyway.

  • Yes, sorry, you've told us that already. There's a right, first of all, under section 7. Could you, please, summarise the nature of that right, Mr Coppel?

  • The right is often termed the subject access right, but in fact it has four separate sub-rights within it, namely: to be informed by the data controller where the personal data of which the individual is the data subject are being processed by the data controller -- and to make that more intelligible, if we simply think of processing in this instance as being held by the data controller. So you write off to the data controller and essentially the first limb of the section 7 right is: "I hold or I do not hold any personal information relating to you." That's the first aspect of it.

    If yes to the first aspect or limb, to be given a description of those data -- it's self-evident what that means -- then thirdly, to be given a copy of those data and a statement of their source. Generally speaking, when people exercise their Section 7 right, that's actually what they're after. "I want to see what you, the data controller, have got in relation to me." And by giving that information, the data controller has effectively complied with the first three limbs in a single Act.

    Then fourthly, where those data are being used to evaluate a person's suitability needed for the making of the decision to be informed of the logic involved in that decision-making process. In my experience, very rarely are people interested in the fourth limb. Really, what they're interested in is just getting what the data controller holds on themselves.

  • Thank you. The courts have had a go at narrowing the apparent breadth of the right and the courts have acted in a similar way elsewhere. We might come back in due course to the possible policy reasons for that.

    The extent of the narrowing you explain in paragraph 40, but the detail of that I don't think we need address now. The second right in paragraph 41 is a right against the data controller who has breached the data protection principles, and that right, if successfully exercised, gives you a claim for compensation and a claim to rectify, block, erase or destroy the personal data which has been generated in violation of the right, if I can put it in those terms; is that correct?

  • Essentially, section 4(4) creates a statutory duty which -- we know where there's a statutory duty which an individual can enforce, it constitutes a tort and the Act describes what the remedies are for that tort.

  • Thank you. In terms of what the courts have done in relation to this right, paragraph 42, they've narrowly interpreted the matters for which compensation may be ordered -- so there isn't a claim for general damages, there's only a claim for pecuniary loss -- and also the levels of damages, as we can see from the examples given, have not been massive.

  • Yes. It's fair to say that this is where the efficacy of section 4(4) has been diminished. In particular, the requirement that damage be confined to pecuniary loss has obvious importance for an Act like this, which is concerned not necessarily with things that sound in pecuniary loss but are concerned with an individual's privacy.

  • In most circumstances, it's unlikely to cause pecuniary loss, isn't it?

  • Correct. Very rarely will it cause pecuniary loss, and only by, very often, imagining circumstances is that going to be the case. But it's the invasion which -- I make no bones about it; I say it's that invasion of privacy which falls to be compensated and that's very difficult, because unless you have a tariff which is generally stated and generally applicable, it's very difficult for an individual judge to say, "Well, how much is this worth?"

  • The level of damages may well be highly relevant when we look later on at your evidence as to the possible extension of the role of the Information Commissioner. Just remind us, please: the £50 awarded to Mr Douglas and Ms Zeta-Jones--- I think they were married at that stage, or was it their wedding?

  • It was their wedding which was disclosed through photographs.

  • In either OK! Magazine or Hello! magazine -- I don't recall which --

  • Why was it only £50, in a nutshell?

  • Because -- well, the explanation given, so far as one can ascertain, is that both of them were high -- sorry, were figures of a high public profile and true it was that their wedding was by invitation only and intended to be kept private. However, they -- having the profile they do, it was thought that this was the correct measure of the damage which they had suffered through breach of their rights under the Data Protection Act.

  • Fair enough. The third right, the right to compel a data controller to cease or not to start processing data, that's under section 10. It's necessary to go into that.

    Fourth right, section 11, the right to compel a data controller to cease or not to start processing personal data for the purpose of direct marketing. Again, we needn't going into that.

    The fifth right, section 12, a right to require a data controller to ensure he takes no evaluative decision concerning the individual based solely on automatic processing of the personal data. Again, that's unlikely to be of great relevance to journalism.

    Can we move to the position of Commissioner and explain first of all what the obligation is under the directive and what the United Kingdom has done in reaction to that obligation?

  • Well, the directive requires each member state to ensure that there is a public authority or a public officer who has both investigative and policing powers in relation to the implementation of data protection law within that member state, and they are characterised essentially as being guardians of the rights and freedoms which are embodied in the directive and which are supposed to find expression in domestic legislation.

  • Presumably in line with general standards of EU law, the Commissioner must have a degree of independence; is that right?

  • As we've seen earlier in relation to the directive, there's nothing to stop Member States doing more than that which the directive requires in relation to the Commissioner.

  • His or her functions may be greater.

    Now, the powers of the Commissioner depend on whether we're within the special purposes of which journalism is an example or whether we're not. If we're not within the special purposes, then there are four main avenues of enforcement. These basic avenues of enforcement I ventured to take up with Mr Thomas when he gave evidence back in December, and I probably had another go with Mr Graham, but can you remind us, please, of the essential avenues starting with section 42?

  • Section 42 provides for assessment. That's initiated by an individual who believes that he's been directly affected by the processing of personal data relating to him or herself. Then, if that is done, the Commissioner is required to make the assessment but the manner in which that is done is left in the hands of the Commissioner himself.

    The outcome of that the Commissioner must obviously let the person who has made the request for an assessment know. Secondly, under section 41A, the Commissioner may serve on a public authority an assessment notice, and the object of that is to enable the Commissioner to determine whether the data controller is complying with the principles.

    Then thirdly, the Information Commissioner can serve what's known as an information notice, and this is to enable the Information Commissioner to understand more about what the data controller is doing. It's really as a prelude to taking further steps thereafter. The individual or the body which has been served with the information notice obviously has to supply the information which is requested in the notice.

    Then fourthly, and very often finally, the Commissioner can serve what's known as an enforcement notice and this is to compel the data controller to do things or to desist from doing certain things which the Information Commissioner considers to be non-compliant with the Act.

  • We know that the Commissioner didn't exercise any of those powers in relation to Operation Motorman. How often are these powers exercised?

  • Well, I don't have any first-hand knowledge, but it would appear on the ground very, very rarely indeed.

  • As you point out in paragraph 53, their general obligations under section 51 of the Act -- again, that was a provision that I took Mr Thomas to but that empowers the Commissioner, for example, to issue guidance and recommendations both in general and in particular; is that right?

  • A power to carry out audits? Or not?

  • I don't know one way or the other is the answer to that.

  • I think we've seen elsewhere in section 51, if my memory serves me right, a power to report to Parliament either annually or in a special case. Of course, the two reports in 2006, "What price privacy?" and "What price privacy now?", were issued in compliance with that power, weren't they?

  • What is the position in contradistinction, Mr Coppel, if we fall within the special purposes, in terms of what the Commissioner can do?

  • It results in a disapplication of the power to serve an enforcement notice -- that's the first important thing that it does -- and then secondly, where an individual has brought a claim, a section 4(4) claim for breach of statutory duty through the DPA, then the court must stay those proceedings until there has been a determination under section 45, and section 45 is a special procedure relating to the so-called special purposes, ie journalism, literature and art, to see whether in fact that is the case.

    In practice, what happens is that it becomes so convoluted -- the individual disgruntled has commenced proceedings under section 4(4). If they -- if the point is taken that these are special purposes, then a satellite set of proceedings is effectively launched, namely the section 45 one. That, if one ever gets to the end of it, reaches its end, it might come up with a conclusion. If the conclusion is in favour of the individual, then they resume their claim, by which time, of course, matters have marched on significantly and it may be of cold comfort, any such relief --

  • They may have lost interest in living by then.

  • Quite possibly, and particularly if one realises that at the end of it all one is going to get like, for example, Catherine Zeta Jones, £50, one can well understand why interest might be a little bit diminished.

  • The adjudicator of the claim is the Commissioner not the court; is that correct?

  • Under section 45; correct.

  • You explain in paragraph 55 the position under section 45, subsection 1:

    "Where it appears to be the Commissioner that the personal data are not being processed only for a special purpose or are not being processed with a view to the publication by any person of any journalistic, or artistic material, the Commissioner may make a determination to that effect."

    So the adverb "only" means what, Mr Coppel, in this context?

  • Exclusively. So if you have mixed special purposes and not special purposes, then the section 45 adjudication or determination is not made in favour of the data controller; is that correct?

  • Subject to paragraph (b) also of 45(1) being satisfied.

  • Yes. Can you explain now, please, the reach of the exemption in Section 32, because this is highly relevant in the context of lines of questioning I embarked on with Mr Thomas and with Mr Graham. It may be that I was a little bit boisterous in the context of some of the points I was taking because I overlooked and arguably did not know about an important Court of Appeal decision which is relevant here, but can you --

  • Only you know whether you knew about the decision.

  • Yes, well, to be frank, I did not know about it.

  • Or rather, had forgotten it, because I had, of course, read the Campbell case in the House of Lords. But anyway, we're in danger of digressing.

    First of all, please, the way in which the Data Protection Act has affected the requirements of Article 9 of the directive, paragraph 57 of your statement?

  • Is essentially through section 32. The first point that must be made in relation to the exemptions which are set out in part 4 of the Act is although there are a list of exemptions, what they exempt from varies from exemption to exemption, and the basic statement of what gets exempted is set out in section 27. So we see certain protections which are effected through the Act are disapplied and others remain in force.

    What is notable about Section 32 is its complete exemption from the larger part of the protections which are given by the Act, and thus we see in 32(2), which enumerates what gets disapplied, it's the data protection principles, except the seventh data protection principle, which for most people doesn't loom large, whereas the other exemptions will very often simply exempt a lesser number or fewer number of the data protection principles.

    So that's the first thing to note about Section 32, is its almost complete disapplication of all of the protection which is effected by the Act itself.

    Then secondly, in order for the exemption to be engaged, the three paragraphs in 32(1) have to be satisfied, of which two of them are the belief of the individual themselves -- so in other words, the press being a judge in its own cause, it might be said -- and it's only the first -- that is to say, the processing that's undertaken with the view to the publication by any person of any journalistic, literary or artistic material -- which is purely objective.

  • That's not very much of a hurdle if you're concerned with a journalist.

  • I agree. Very much so. I've expressed a view in relation to the effect of Section 32 but undoubtedly once you're in Section 32 territory, then the protection which is given to an individual's privacy almost entirely falls away. All you have to do is touch Section 32 in some way, shape or for form, and the contest which the Act is supposed to embody between the right of expression, freedom of precision, and an individual's personal privacy has all been tilted one way.

  • Because it's the subjective opinion of the journalist?

  • It's "reasonably believes".

  • "Reasonably believes".

  • So there's an be objective --

  • Colour which is introduced, but nevertheless it's not difficult, I would have said, for most journalists -- and certainly that's what the authorities have indicated, and one which seems to have been missed for a point, that it is very much for the press to make their own judgment in relation to Section 32 --

  • But that judgment -- you say it's objective. In one sense, it's objective, but it's objective based upon facts within the knowledge of the journalist, which might include, for example, information that he's received from a source which is unidentified.

  • "I have heard this from my source, which of course I'm not going to tell you about, which actually brings me within all these protections."

  • And in any event, it may be that when you drill down to that source itself, it is found to be not a good source, but nevertheless the belief which is held by the journalist themselves, who has not had the opportunity of drilling down, is that: "I think it's a decent source", and therefore reasonably believes is satisfied --

  • But you never get the ability to drill down into it.

  • Because once you ask the journalist to provide further and better particulars of his or her source, you'll be met with an Article 10 argument.

  • Well, you'll probably be met with the argument that this is within section 45 territory, namely relating to special purposes, and so the whole thing goes off for the special assessment procedure, which we've spoken to ten minutes ago, and by the time you get to the end of it, to use your words, the will to carry on is a little bit diminished.

  • Yes. I think I didn't quite express it like that. All right.

  • The first criterion, that the processing is being undertaken with a view to the publication, that is an objective test, isn't it? It doesn't depend on the assessment of the data controller; it depends on the assessment of the Commissioner. Is that right?

  • It's -- well, if a claim is being made for a breach of the section 4(4) statutory duty, the way this would come forward, assuming one had cleared the Commissioner's involvement, would be that would be a matter for the court. The question is: is the processing undertaken with a view to the publication of any person of any journalistic et cetera material? So that issue, at the end of the day, would come before a court, as we've seen in the proceedings that have come before the courts themselves.

    There's a slight subjective element insofar as the view is the view of the journalist, so the journalist can say --

  • How do you get behind it? The journalist is a journalist, employed to publish material, and the journalist asserts, "Well, I was doing this in order to publish a story." Well, of course, one could imagine circumstances in which that couldn't possibly be so -- for example, if it touched the journalist's private life, and therefore it might have some oblique motive -- but in the general course of events, that's going to be unchallengeable, isn't it?

  • Yes, and that's why the Campbell decision, which said that "with a view to publication" didn't stop at the moment of publication but carried on beyond that, effectively made the thing run forever and give the press a complete protection under Section 32, not just up to the moment of publication but ever thereafter.

  • We'll look at that in a moment. You've told us earlier that Member States were given considerable latitude in relation to the directive, but at the very least had got to meet its basic standards but could do more.

    If one looks at the directive, Article 9 in this context. You set it out at paragraph 56 of your statement. Where do we get the "with a view to" restriction, looking at the language of Article 9? Because that refers to "only for processing of personal data carried out solely for journalistic purposes". So the concept there is "for journalistic purposes", not "with a view to the publication by a person of journalistic material".

  • Yes. I mean, one could argue the phrase "journalistic purposes" carries on to the publication itself. My point that I make in relation to Article 9 and its translation into Section 32 is that Article 9 recognises the contest between the right to privacy and freedom of expression, but Section 32 is all one way. It does not recognise any right to privacy. It's there, its sole objective is to cut away at the right of privacy, and at the end of it, certainly after the decisions of the court, there is nothing left of that right.

  • The directive says "only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression". Now, the necessity test might suggest a wholly objective yardstick, yet the Act refers, as we've seen, to a part subjective/part objective test, namely "reasonably believes". So hasn't the United Kingdom done less than Article 9 requires?

  • That is my view and I would also go further in saying that the word "necessary" implies that something must be shown that this is needed in order for the reconciliation, and that is difficult to see in the Section 32 provision, which is supposed to give effect to Article 9.

  • That's a debate that they had in the House of Lords, as you explain, with Lord Lester of Hearne Hill taking the point that you are making, and Lord Williams of Mostyn, Lord Wakeham and the then Solicitor General, Lord Falconer, endorsing the contrary view.

  • Yes, and the passages which I referred to in the end note from the Hansard, which were included as attachments, show that the concerns which were articulated by Lord Lester were very prescient indeed. He anticipated many of the difficulties which have been shown to have resulted from Section 32.

  • We don't know on this occasion whether Lord Wakeham was speaking for the press or speaking for the PCC or was speaking on his own behalf. We've seen his contributions in relation to section 12 of the Human Rights Act where he expressed himself as, I think, speaking for the press.

    May we move on to authority, paragraph 62 of your report. The main authority on this is the decision in the Court of Appeal, possibly the House of Lords. It depends on how you interpret the House of Lords decision --

  • -- whether it bears on this issue or whether they didn't decide it. It's the well-known case of Campbell v MGN. Could you remain us, please, of the essential facts of that case?

  • Campbell was the model who most people know. She was photographed leaving a -- her therapy for drug addiction and the photographs were published in the newspaper. She brought a claim against the newspaper for that. She brought the claim both as a breach of confidence and also under the Data Protection Act. Again, her claim was based on section 4(4) statutory duty which was owed to her, and in the High Court -- so in the first instance, so far as the Data Protection Act claim was concerned -- it was found that the published information, namely the nature and details of her therapy, had constituted sensitive personal data, and we'll remember that that includes medical matters. It was not lawful because it constituted a breach of confidence. It was not fair, as it had been obtained surreptitiously through a long-range lens. It didn't satisfy any of the conditions in schedule 2. It didn't satisfy any of the conditions in schedule 3.

    So just pausing there, it offended at every level the first data protection principle --

  • Was this Mr Justice Morland?

  • Yes, and the view taken by Mr Justice Morland was that the Section 32 exemption -- we'll remember we were looking at the phrase in paragraph A -- only applied to processing with a view to publication, so up to that moment, and not to the processing involved in the publication itself, and then he went forward and assessed the damages to her in the sum of £2,500, with aggravated damages in the sum of £1,000.

    So that's where she got on the first stage. In the Court of Appeal on the Data Protection Act claim, she was unsuccessful insofar as his ruling was overturned. The court accepted that processing including publications, so she was in that far, but it reversed Mr Justice Morland by extending the duration of Section 32 to cover processing on and after publication. So if publication constitutes processing, they said that the 32(1)(a) exemption applied to that as well, and as a result of that, the DPA claim failed.

    You mentioned about how the matter proceeded in the House of Lords. Essentially, what took place is that the appellant, now Ms Campbell, majored on her breach of confidence claim and very little, other than a few sentences, were said about the Data Protection Act itself, and all that we get is a short statement that that claim itself stands or falls with the breach of confidence claim.

    Now, since she stood with the breach of confidence claim, there is an argument that what's happened is that there has been a restoration of Mr Justice Morland's treatment of the DPA claim, but the fact remains that the greater treatment that is to be found reported is that of the Court of Appeal in Campbell v MGN.

  • Which went the other way.

  • But there was no consideration in the Lords of the temporal point, that whether the adjectival phrase "with a view to" ended at the instance just before publication or whether it continued to the moments of publication and beyond, so arguably the House of Lords have not impacted on the Court of Appeal's reasoning; is that right?

  • I would agree with that.

  • The point which was exercising us -- me indeed -- when we were looking at Mr Thomas was not this subtle temporal point, "with a view to ending at the moment just before publication", but a rather different point on the Operation Motorman material, which, as you're probably aware -- for example, obtaining personal data with the intention of asking the target of a story for his or her version of events before the story is published, so to find out the person's contact details -- whether that is with a view to publication, which is a slightly different point from the one which exercised the courts in the Campbell v MGN case, and I think I, rightly or wrongly, expressed some scepticism that it could be with a view to publication because that was stretching the language of "with a view to publication" in the Act. I don't know whether you can assist us one way or another, whether my scepticism, in the light of the Campbell decision, was justified or not.

  • Well, in Campbell you've had the stretching of the end of the process. The part of the process you're now considering is at the beginning, and arguably if it's stretched at the end of the process, it should equally be stretched at the beginning of the process, and the reasoning behind the Court of Appeal's approach in Campbell v MGN would probably be supportive of that. It was obviously not directed to the beginning of the process, it was directed to the end of the process, but there was a genre receptiveness to the concerns of the press that they be given wide latitude in what they do because they move in a very fast operating environment and they can't be hamstrung by having DPA principles applying to them.

  • I can see that, though. But it might be said if the press want to contact the subject of a story to find out his or her version of events, and that version of events is given, it may or may not find its way into the story which is eventually published. The journalist may say, "Well, that's very interesting, I'm going to ignore it", or he may say, "I'll take it into account", but "with a view to publication" does presuppose, doesn't it, that the version of events will be taken into account, not might be taken into account. So could it be said it's still too remote, even though it's anterior in time to the publication?

  • It certainly could be argued and I'd be prepared to argue it. The contrary would be that there's a difference between the phrase "with a view to" and "for the purpose of". "For the purpose of" has that definiteness that you are referring to. "With a view to" contemplates that it's possible but nevertheless you have a change of heart along the path to publication.

  • Mm, I can see that. Yes.

  • There's always room for argument.

  • Mm.

    I think the better view, contrary to the scepticism I expressed six or seven months ago, is the broad view which the press would wish to advance, the difference between "with a view to" and "for the purpose of". It does have to depend on the contact with the target actually yielding to you words in the publication itself.

  • The phrase "with a view to" is problematic for that very reason.

  • Mm.

    Paragraph 68 of your statement, personal privacy protection after the case. You point out that people have lost the appetite, following Campbell, to pursue DPA claims. They now pursue Article 8 claims; is that it?

  • The appetite was limited to begin with. It's diminished to the point of nonexistence, almost, I would have said, post Campbell.

  • It's never-ending litigation with no reward at the end.

  • Correct. Just the opposite, I would suggest, from what it should have been.

  • The explanation that you give -- it's end note Number 102, but the citation there beginning:

    "Data protection law is technical and unfamiliar to most judges."

    Judges preferring the fluidity and flexibility, I suppose, of the Human Rights Act, which most of them are more familiar with, than the arcane corners of the Data Protection Act, which, although very important, is not well understood by everyone; is that a reasonable summary?

  • My experience is that whenever the Data Protection Act is raised in court, it doesn't get a very favourable reception because it is daunting to most. The concepts are unfamiliar and the way in which the Act is worded and structured doesn't help to that level of understanding, so one immediately is confronted which difficulties, which it's very often impossible to overcome.

  • I don't need to resolve what the law is, do I, and I don't need to go into --

  • -- the rights or wrongs of the decisions either of Mr Justice Morland or the Court of Appeal, even if I was minded to do so. It just doesn't advance the process. We are where we are. The question is whether it's the best place to be.

  • You inform us, Mr Coppel, of forthcoming changes to the directive. The Commissioner has proposed a new regime for regulation and a new directive. What's the upshot of that, in a nutshell?

  • The regulation will be directly applicable in Member States, replacing the directive, and therefore the Data Protection Act 1998. However, the proposed regulation -- and that's all it is at the moment -- itself leaves it to individual Member States to provide for exemptions or derogations from the general principles which it articulates, and that in particular relates to the processing of personal data for journalistic purposes. So we get back to the very issue which was presented by the directive that led to the 1998 Act. It's for the Parliament of this country to come up with a formulation which respects the requirements, in this case of the regulation itself, but how it does that is a matter for Parliament itself.

  • Would that mean that Parliament would have to revisit this topic in any event?

  • So it's worthwhile looking at this area, because if a regulation is coming up the lift, then Parliament might as well have the benefit, if benefit it is, of any consideration of the exemptions within the context of the terms of reference of the Inquiry?

  • Can we look at your conclusions now, Mr Coppel? I think the first three are self-explanatory. The fourth is clear from what you've told us already, but the way the courts have interpreted the Section 32 exemption is that the measure of protection is less than that provided under Article 8 of the ECHR.

  • Just for those who don't have the statement, you'll summarise these propositions in this way:

    "The DPA provides a code to protect the privacy of an individual's personal information, in whatever form recorded other than in an ad hoc manual record. The protection required by the directive and provided by the Act begins from the moment a person handling personal information acquires it and only ends once that person no longer holds it. The directive -- to which the DPA is intended to give effect -- permits Member States to relieve the press of obligations otherwise applicable to the processing of personal information where that is required to reconcile the convention right of privacy and with the convention right of freedom of expression. Freed from judicial authority, the Act provides an individual with a measure of protection against press invasions of personal information privacy, but, because the exemption does not provide for any balancing of the fundamental right to privacy against the fundamental right to freedom of expression, the measure of protection is less than that provided under the Article 8 provisions."

    Of course, "judge-made authority" properly so interpreted is judges trying to make sense of the provisions, not just making it up on the hoof.

  • Your fifth point, Mr Coppel, is that you point out that in principle, at least, if you prune away, I suppose, at the judge-made authority, we have here a sophisticated and a predictable regime which in many ways is better than the uncertain regime afforded by Article 8 and privacy or breach of confidence claims; is that right?

  • That is right. The point I make has two sides to it. There's the side of the individual, who knows where he or she stands and has certain rights which are protected. But it also assists the bodies that are processing the data themselves to know what it is they can do with an individual's personal data and to do so in a fashion which is compliant with the law and compliant with the contest between Article 8 and Article 10 rights, rather than leaving it to the idiosyncratic world of an ECHR action.

  • Can we look at the eighth point. The point about the way the judges have cut away the DPA to the point that it arguably doesn't give full effect to the directive -- that, I think, is clear from what you've told us already. The eighth point is on page 01195:

    "The practicality, ease and economy of remedying press mishandling of an individual's personal information would be enhanced by ..."

    And then you come up with four proposals. Could you explain each of those to us, please?

  • The first is a redrafting of Section 32 to address what I consider to be the shortcomings in the provision as it is currently worded and also as magnified through judge-made authority. In so doing, what I've suggested is to actually articulate the contest between the Article 8 rights and the article 10 rights.

    Secondly -- and this picks up the point that I made about damage -- for the Commissioner to set a tariff of how much ought to be paid to an individual who brings a section 4(4) claim, and that should be referable to the duration, the extent, the gravity and the profitability of contravention -- a bit like one has, for example, in personal injury. There are tariffs set for losses of limbs and other disabilities which an individual sits(?), and in that way, again, it moves away from the idiosyncratic, it becomes more fixed, and enables the parties more easily to reach settlement.

    The third suggestion I made is that instead of going through the court system, there could be the opportunity for the Information Commissioner to administer these tariffs, freed of legal cost and all the rest of it, quicker, one would hope.

    Fourthly, I said removing all of the provisions in the enforcement sections relating to special information notices and so forth, and simply bring it into line with the enforcement regime which applies to everyone else, and of course prevent section 4(4) claims from being tied up with special information notices.

  • I understand. Then subparagraph 9 sets out the advantages of bringing into being your recommendations. Could you tell us about those, please?

  • Well, my view is that were these amendments to be effected -- or amendments along these lines to be effected -- then what would happen is the DPA would be restored to its right position, namely as the primary mechanism of remedying press mishandling of personal information. It would provide proper and predictable recompense for mishandling of personal information. It would simplify the bringing of those complaints and cheapen them. It would unify the enforcement regimes so that there wasn't a special regime which applied to the press, and possibly, most significantly, would bring the DPA really into line with what the directive required of this country.

  • To what extent does it protect the legitimate activities of the press acting in the public interest? In other words, investigative journalism and the like?

  • It wouldn't impair that at all, and there certainly wouldn't be anything behind my submission that that would be impaired. Indeed, freed of all of the other stuff, what would come out is that it is that which is being protected and having paramountcy over personal privacy in that sort of a contest.

  • Can we just understand how that would work in relation to your proposed amended Section 32(1)(a)? Your wording now is far closer to the language of Article 9 of the directive. Indeed, I think it precisely replicates it:

    "... the processing is necessary for the publication."

    Can we just look at a paradigm case of investigative journalism, that there's a lot of preparatory work efficiently before the publication. If the journalist can show that all the work is necessary for the publication, then he or she is protected both in relation to the preparatory work and to the publication itself.

  • Is that the correct analysis?

  • If recognises that particularly for investigative journalism, in which there may be a long trail leading up to the publication itself -- and some of those sub-trails may turn out to the be fruitless in themselves but are nevertheless necessary in order to explore all the avenues to produce the article itself. That will be captured by my proposed 32(1) paragraph (a).

  • Thank you. In relation to (b), we still have reasonable belief, but this is in the context now -- because these are cumulative requirements, as we can see the "and" between (b) and (c):

    "... the reasonable belief that publication would be or is in the public interest."

    So that would reflect what may be, if the statutory instrument is brought in, the amendment to Section 55 through, I think, Section 78 of the criminal justice -- sorry, it's the 2008 Act.

  • The object of paragraph (b), as I've expressed it, is to bring in essentially the article 10 right of the press, the freedom of expression, recognising the public Watchdog function which they carry out, and yes, it keeps it as a reasonable belief because necessarily, to be effective, it seemed to me that that is what is required, rather than being able to show it objectively.

  • How is (c) different from (b)?

  • (c) is concerned with Article 8, so it's looking at the individual. So (b) and (c) set up the contest which articles 10 and 8 respectively contain. It's concerned with the likely interference with the privacy of the data subject, and it looks to how that occurs from the publication of that journalism material. So it's not concerned in a sense with the journalist, as it were, beavering away to make the story; it's concerned with the invasion which happens upon the publication of that journalistic material.

  • So to provide some colour to that provision, what you're saying is you're recognising that in order to get to what is or may be a legitimate story, there may be all sorts of processing of data necessary, but at the end of the day one also has to look at what was actually published, because it may not be justifiable to publish some of the data which you've had to process to get to the end story, because that data -- the publication of that data may not be in the public interest.

  • Correct. That's exactly what I've sought -- I've striven, with the suggested wording of (a), (b) and (c), is to recognise that the process of getting to the end of an investigative journalistic story may involve picking up material which ought not form part of the publication itself. What one looks to is: what comes out of the investigative story at the end and does it justify what has been done along the way?

  • Because we don't get to (c) if there isn't a publication; that's right, isn't it?

  • (b) is looking at all stages up to and including publication?

  • So (b) is -- the privacy issue is not relevant because one's just considering the wider question of public interest. Privacy only comes in if there's publication because then the whole world can see the article published and you logically must weigh up privacy rights against freedom of expression.

  • Although, that said, paragraph (c) will still operate -- if, for example, a journalist embarks upon an investigation which is thought to be of massive importance but, a little way down the track, realises that all of these threads aren't going to justify the publication of anything, nevertheless, the fact that he has in mind, reasonably, a story at the end of it which of is important public interest will justify what has been done, provided that the journalist stops at the point when the threads make it obvious that there is no story along the lines anticipated --

  • If you've picked up a different story, which has no public interest and you publish that, then you wouldn't be able to satisfy the requirements of the provision?

  • Yes, so it's an elegant solution, which -- whether or not it goes slightly further than Article 9, the United Kingdom would be entitled to do that because the directive sets out a minimum standard not a maximum standard. Some would say this meets precisely what Article 9 is contemplating.

  • Yes. I mean, my object wasn't to go further than is required of the directive but really to express what the directive requires.

  • The only other point -- the rest of this is drafting which meets the principles you've articulated before -- when we come to compensation, you're contemplating the Commissioner sets tariffs. These are, as it were, akin to general damages for distress and it might include pecuniary damage as well but that would be special damage and separate. Are you contemplating reasonably modest levels of compensation but slightly higher than those that we've seen to date? What's the sort of policy?

  • It will depend entirely on the extent of the breach of the principles themselves. What I had in mind -- one can anticipate, for example, that if something has a very wide dissemination of very sensitive personal information -- let's say a person's medical reports were disseminated in a national newspaper. I find it difficult to see why that should be only modestly compensated. That, it seems to me, is a fundamental breach of what the Act is there to protect. In particular, sensitive personal data has been disseminated abroad, and the fact that the individual doesn't break out into boils or doesn't show some other physical manifestation of -- in a sense, the nakedness of that individual's personal medical details being put in a public forum is, so far as I'm concerned, neither here nor there. What we are concerned with is the deviation from the principles which the Act and the directive require.

  • There is a problem here, which we would have to find a way of resolving, and that is the way in which we commensurate that which is incommensurable.

    Let me give you the example from personal injuries, although there are others in the law as well. In personal injury litigation, the figures awarded for pain, suffering, loss of ability(?) are conventional, in the sense that there isn't a logical analogy between the loss of an eye or the loss of a leg and a sum of money. There has to be an assessment made -- which, of course, in Hyall v Rank(?) and other cases was increased -- to provide some measure of compensation, but there is no logical basis for saying, "Well, it's X thousand pounds as opposed to Y thousand pounds."

    What the judiciary then do is they can create a shopping list, if you like, of values for different claims, comparing and contrasting the pain, suffering and loss involved. So on the one end, a tetraplegic, on the other, a comparatively modest injury, which might itself range from whiplash through to a broken arm or a broken leg, and putting everything in between. There are, as you know, four volumes of a book that reduce the decisions of the court into researchable format.

  • And the judicial studies or the judicial college have produced booklets on it. Exactly the same problem for sentencing -- I won't develop that analogy -- but therefore the problem is going to be trying to find an appropriate touchstone against which to make this assessment.

  • I agree. What I've suggested is the things that, let us say the Information Commissioner, he being charged with coming up with this assessment, should look to are the extent of deviation from the data protection principles, the period of time over which there has been that deviation, the manner of deviation -- has it had wider publicity than others, for example -- and also the profitability to the breaching data controller.

    One of the differences between this sort of tariff and the one for personal injury is that in this situation there's a greater degree of deliberateness than there will normally be in personal injury. Personal injury will normally result from an act of negligence by the defendant. Here there's a greater degree of deliberateness by the defendant to any such claim, so that needs to be reflected, I think, in the tariff.

    I've called it a tariff of solace. It's intended to give solace to the wronged individual through the invasion of their personal privacy.

  • Rather than being intended to be punitive?

  • No, not intended to be punitive, although I suspect individuals get solace from the fact that the wrongdoer has been punished.

  • I understand that. You're suggesting this tariff or regime should be prescribed by the Commissioner. What would the role of the Tribunal be, if any?

  • What the court would do is look at the tariff which has been set by the Commissioner, see where the events that are described and shown to have occurred fall within that tariff, and make an award accordingly.

  • So that would be a judicial assessment?

  • If one went down the judicial route. I've also made the suggestion that a disgruntled individual should have the option of simply going to the Information Commissioner and saying, "Here's what's happened, I want an award, you give me an award", in a process which doesn't involve going to court. Obviously, the Commissioner would take the views from the would-be defendant themselves -- let's say, in this case, the press -- and make an award accordingly, and that would be a simpler, more straightforward method of proceeding which won't result in the publicity of a judgment itself.

  • But would have to be appealable or challengable in some way.

  • Thank you, Mr Coppel. Those were all the questions I had on your evidence.

  • Mr Coppel, I'm very grateful to you for the thought you've put into this. Is there any other aspect of this area of the law which you yourself have described might be thought of by some as somewhat arcane that you'd like to draw to my attention?

  • No. I think if one works one's way through the document which I've provided, the written document, and particularly all of the links and the end notes, that's more than ample for the purposes of this Inquiry and indeed what I would wish to say in relation to it all.

  • Thank you very much at all.

  • Not at all. I'm grateful.

  • (A short break)

  • The next witnesses are being taken together. Mr Macintosh and Dr Unger, please.