“Hi Superintendent Halstead Further to our discussion on Thursday 17th March, would you be prepared to issue the following statement to the press ? ‘Lancashire Constabulary has undertaken a thorough investigation into allegations it received from Lancashire County Council and we can confirm that County Councillor Geoff Driver has been completely exonerated. We thank County Councillor Driver for his full co-operation throughout this inquiry.”
“Good afternoon Councillor, I have held a strategy meeting today with our Corporate Communications department and discussed the content of my briefing with you and your legal representatives last Thursday. I have reiterated to them that as the SIO of Operation Sheridan I have accepted the responsibility for ‘putting the record straight’ in relation to your role within the investigation, the fact that we have established your innocence and also that you have fully cooperated throughout. The professional advice I have been given, is that Lancashire Constabulary have never actually named, nor confirmed that you were part of the investigation, and I have been reminded that I have taken a strong stance on this by way of policy. Consequently it would be unique for the Constabulary to now proactively make a statement in which we name you, to every monitoring media outlet. Could I suggest by way of a compromise, that you choose the media platform you feel is most appropriate best deliver the message and you contact them directly, therefore accepting the personal responsibility of publicly naming yourself. I would then, as I suggested I would, make a formal reply to them including the suggested content listed below. I hope you appreciate the need for caution from the Constabulary perspective and see this as a way of ultimately delivering the same message but in a subtly but importantly different way.”
“Hi Superintendent Halstead, Thank you for your email. I understand your dilemma and I have therefore sent the attached press release to The Lancashire Telegraph, the Lancashire Evening Post, BBC North West and Radio Lancashire. I would be most grateful if you would respond to any enquiries they make along the lines set out in my email below.”
“PRESS RELEASE BY COUNCILLOR GEOFF DRIVER CBE I have been informed by Lancashire Constabulary that after their lengthy investigation into allegations made by Lancashire County Council, they are satisfied I am entirely innocent of any wrongdoing. I am now in discussion with my legal advisers as to the best course of action to take against those individuals who have knowingly made false, malicious and libellous allegations against me and I shall therefore not make any further comment at this time.”
“Tory chief takes legal advice after police probe dropped Conservative opposition leader is no longer subject to investigation over One Connect”
‘Lancashire County Council fraud investigation: four more involved.’
“FOUR more men are being investigated by police over claims of fraud at Lancashire County Council. The news was revealed as a file on the five-year ‘Operation Sheridan’ inquiry was sent to the Crown Prosecution Service in London. In May last year, four men were arrested in connection with the probe and bailed on suspicion of perverting the course of justice and witness intimidation. They were Cllr Geoff Driver, the leader of Lancashire County Council, the authority’s former Chief Executive Ged Fitzgerald; his successor Phil Halsall; and former One Connect chief executive David McElhinney. They were not arrested on suspicion of fraud and all four deny any wrongdoing. Operation Sheridan is an investigation into a£5m tender awarded to One Connect ltd, a joint venture between the council and BT. The file sent to the CPS today covers the whole scope of the inquiry and the police revealed today that it related to eight men between 56 and 73, not just the four arrested last year. It is understood that any decision on charging and prosecution is likely to take a considerable period of time. Cllr Driver said this morning: ‘I have no comment to make’. A police spokesman said today: ‘In September 2013 Lancashire County Council referred to Lancashire Constabulary some allegations of financial irregularity. ‘An investigation was launched and following a complex and lengthy enquiry a file of evidence has now been submitted to the Crown Prosecution Service for consideration. ‘The investigative bail period has now been suspended as a result of the file being submitted. ‘We have submitted evidence relating to eight individuals. We will not give any further details about those individuals other than to say they are all men aged between 56 and 73. Cllr Driver, Mr Fitzgerald, Mr Halsall and Mr McElhinney remains (sic) subject to bail conditions but are no longer required to attend police stations on a regular basis. A CPS spokesman said: ‘We received a file of evidence from Lancashire Police in relation to allegations of fraud. ‘This is a complex file which will now be considered in accordance with the Code for Crown Prosecutors and a decision will be made in due course.’”
“The Code for Crown Prosecutors is a public document, issued by the Director of Public Prosecutions, that sets out the general principles Crown Prosecutors should follow when they make decisions on cases. Is there enough evidence against the defendant? When deciding whether there is enough evidence to charge, Crown Prosecutors must consider whether evidence can be used in court and is reliable and credible, and there is no other material that might affect the sufficiency of evidence. Crown Prosecutors must be satisfied there is enough evidence to provide a ‘realistic prospect of conviction’ against each defendant. Is it in the public interest for the CPS to bring the case to court? A prosecution will usually take place unless the prosecutor is sure that the public interest factors tending against prosecution outweigh those tending in favour.”
“Dear Mr Graham, Thank you for your correspondence of1 May 2019 . I apologise for the delay in this response. A charging file has been referred from the Operation Sheridan investigation team to the CPS for consideration. At this stage I am unable to provide you with any more detail.”
“Dear All, Firstly, please read below. This is a topic that grabbed my attention earlier this year after Geoff Driver put in a complaint against me to Lancashire Care NHS Foundation Trust. This was after I peacefully protested at County Hall regarding the cuts to the Lancashire Health and Well-Being Service. It could be that Geoff Driver is entirely innocent, as he claims. The fact is that millions of £’s have already been spent investigating the alleged fraud and witness intimidation. To my knowledge Geoff is still on bail; this is mainly because the CPS doesn’t have the resource (sic) to get this case to court. This needs to be resolved either Geoff is innocent or guilty. We cannot have the leader of Lancashire County Council on bail for fraud and witness intimidation. If elected, please can you do your part resolving this case once and for all. Best regards, Paul Graham”
“I refer to your email of16 December 2019 , and request for the CPS complaints procedure, where you have asked to make a complaint as to the conduct of Julia Graham. … I have treated your complaint as one amounting to a Data Protection Act breach, ie details of yourself, and your alleged involvement in Operation Sheridan, being sent to a third party. Due to the nature of your complaint, the matter was referred to the CPS Departmental Security Unit (DSU). … The particular breach which was referred was in relation to the response given by Julia Graham to an email from Mr Paul Graham, the Office Manager of Literacy Solutions. You have stated that she has no right to pass on information regarding your case to a third party and that this would be a serious breach of the Data Protection Act. In determining whether a matter should be referred thereafter to the Information Commissioners Officer (ICO) (sic), the DSU first need to consider whether or not a breach has occurred in the first instance. Thereafter, on considering the details of each breach on its own facts, a decision is made whether it should be referred to the ICO. The DSU has concluded, after reviewing this matter, that a breach has occurred, and that the email should not have been sent to Mr Paul Graham. On considering whether a matter should thereafter be forwarded to the ICO the DSU would need to establish the likelihood, and severity, of the breach and result of risk to a person’s rights and their freedoms. The adverse consequences of a breach needs to be considered and assessed as to how serious or substantial these are. DSU have carefully considered the breach and, as mentioned above, whilst they are satisfied a breach has occurred, the circumstances in this case do not meet the referral criteria to the ICO. I would like to assure you, however, that whilst this matter has not been referred to the ICO the breach has been taken extremely seriously. I have spoken directly to the reviewing lawyers dealing with Operation Sheridan and drawn their attention to this issue and have re-enforced the correct procedures which should take place. Any future correspondence will be handled appropriately in the future. I can only apologise for the breach occurring in the first instance. I hope that this letter explains the actions which has taken place and the decision as a result of this complaint.”
“4. These events generated a considerable amount of media interest both locally and nationally ranging from newspaper articles, online publication, radio and television reports. My involvement and arrest have therefore been in the public domain for some time. There was a judicial review in the High Court brought by one of the suspects, into the lawfulness of search warrants. A number of the articles referred to the file being passed from the police to the Defendants. At no stage was it ever suggested that I was to be charged with any offences. I was extremely concerned about the possibility of being charged. Being a suspect and having been arrested was worrying but I was able to continue with my life and work knowing I was only under investigation and confident that the police would eventually recognise that I had not committed any criminal offence just as they did in March 2016. The fact that the investigation had been ongoing since 2013 and some considerable time had passed since my original arrest, no charges had been brought which confirmed my view that the Police recognised I had not committed any criminal offences. The lengthy delay with no progress also led the public to believe that the matter had concluded and I was concerned that this leak by the CPS would bring it into the public domain again. 5. It therefore came as a disappointment when I was copied into an email dated5th December 2019 , which had been sent from Julia Graham … to Paul Graham at an organisation called Literacy Solutions on the5 June 2019 . I have no idea whether they are related.”
“6. The email to Mr Graham was providing him with an update on the progress of Operation Sheridan, which stated that a ‘charging file had been referred from the Operation Sheridan investigation team to the CPS for consideration’. The reference to a ‘charging file’ led me to fear that formal charges were likely to be brought against me. 7. Although my arrest and the investigation had been published widely in the media there had never been any suggestion that I would be formally charged, and that remains the case. The reference to a ‘charging file’ was a significant development in the investigation. The information had been sent to other Election candidates in the Pendle constituency, who I considered to be political opponents. It was also sent to Jeremy Vine a BBC journalist and another journalist called Inspector Digit. 8. There has been a lot of interest in the investigation, which has been reported widely in the media, radio and television. I have protested my innocence throughout, both my friends, acquaintances, colleagues and the media. The prospect of being charged and facing a lengthy trial was a significant change and was very worrying and distressing to me and my family. I was ashamed it had come to this and brought to the attention of my political opponents. It was acutely embarrassing. The prospect of this getting out into the wider media and onto national television was terrifying.”
“10. In April 2020 I consulted my GP who prescribed daily medication to relieve the anxiety and depression I was suffering from the original arrest and investigation followed by the CPS leak. After regular consultations, my doctor advises that I still need the medication, which I continue to take.”
“In September 2013 Lancashire County Council referred to Lancashire Constabulary some allegations of financial irregularity. An investigation was launched and following a complex and lengthy enquiry a file of evidence has now been submitted to the Crown Prosecution Service for consideration. The investigative bail period has been now been suspended as a result of the file being submitted.”
‘They did not name me but they did not need to.’
“I understood this meant a file had gone from the police. It was public knowledge as a consequence of the August 2018 articles that a file had gone to CPS. I understood ‘for consideration’ meant that a charge might be imminent because this was the first time I had seen ‘charging’ as an adjective against the file. This was the first time that had been used. The word ‘for consideration’ was more significant because of the word ‘charging’. Until I saw this I was certainly fairly confident I was not going to be charged when I saw this it eroded my confidence. It did add something different – it eroded my confidence about not being charged. It was the use of the word ‘charging’ in an email from a Senior Specialist Prosecutor, it suddenly worried me significantly.”
“First, is the information private in the sense that it is in principle protected by article 8? If 'no', that is the end of the case. If 'yes' the second question arises: in all the circumstances, must the interest of the owner of the private information yield to the right of freedom of expression conferred on the publisher by article 10 ?”
“For the purposes of this Part, ‘the law enforcement purposes’ are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.”
“the competent authority which, alone or jointly with others – (a) determines the purposes and means of the processing of personal data, or (b) is the controller by virtue of subsection (2).”
“Where personal data is processed only – (a) for purposes for which it is required by an enactment to be processed, and (b) by means by which it is required by an enactment to be processed, the competent authority on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.”
“(3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to – (a) an identifier such as name, an identification number, location data or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”
“The important issue is whether the data can be related to a living individual, not whether that person can be identified from any particular part of the data.”
“It follows from what I have said that not all information retrieved from a computer search against an individual's name or unique identifier is personal data within the Act. Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated. In short, it is information that affects his privacy, whether in his personal or family life, business or professional capacity. A recent example is that considered by the European Court in Criminal Proceedings against Lindquist,Case C-101/01 (6th November 2003 ), in which the Court held, at para. 27, that "personal data" covered the name of a person or identification of him by some other means, for instance by giving his telephone number or information regarding his working conditions or hobbies.”
“27. It is fair for Mr Millar to submit that the claim is one that calls for the faithful interpretation and application of a statutory code (construed in the light of the Directive). But the statutory definition of personal data on which he relies, does not provide the answer to the question. I quote the relevant parts of s 1(1): ‘data’ means information which – (a) is being processed by means of equipment operating automatically in response to instructions given for that purpose … ‘personal data’ means data which relate to a living individual who can be identified - (a) from those data or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller … and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;” 28. This wording identifies some criteria, such as “relate to”, and “can be identified from …”, but it contains nothing that assists on the question of how to approach the identification of the data to which those criteria are to be applied. It certainly does not demonstrate or indicate that where a claimant complains of a document, an item-by-item approach to the contents of that document must be adopted. In those circumstances, the Court must look to the DPA and Directive as a whole for guidance, and may also look to extraneous sources for approaches that have been adopted in other, related contexts. That is what I did when a similar issue arose in the “de-listing” case, NT1 v Google LLC[2018] EWHC 799 (QB) [2019] QB 344 . The claimant sought an order requiring the defendant to remove from search results returned by using the claimant’s name information contained in newspaper articles and book extracts about an old, rehabilitated criminal conviction. One aspect of the claimant’s case was that the information was inaccurate, contrary to the Fourth Principle. Mr Tomlinson QC, appearing for the claimant, initially argued that for this purpose that the Court should look, not at the natural and ordinary meaning of a document, but rather at each discrete “item of information”
“It’s important to be aware that information you hold may indirectly identify an individual and therefore can still be personal data. If so, this means that the information is subject to the UK GDPR.” and further that: “Sometimes, whether someone can be identified may depend on who may have access to the information and any other information that can be combined with it. It’s important to be aware that you may hold information, which when combined with other information held outside of your organisation, could lead to an individual being indirectly identified or identifiable.”
“34 Overview and general duty of controller (1) This Chapter sets out the six data protection principles as follows - (a) section 35(1) sets out the first data protection principle (requirement that processing be lawful and fair); (b) section 36(1) sets out the second data protection principle (requirement that purposes of processing be specified, explicit and legitimate); (c) section 37 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive); (d) section 38(1) sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date); (e) section 39(1) sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary); (f) section 40 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner). (2) In addition - (a) each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and (b) sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing. (3) The controller in relation to personal data is responsible for, and must be able to demonstrate, compliance with this Chapter.”
“35 The first data protection principle (1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair. (2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either - (a) the data subject has given consent to the processing for that purpose, or (b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority. (3) In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5). (4) The first case is where - (a) the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and (b) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42). (5) The second case is where— (a) the processing is strictly necessary for the law enforcement purpose, (b) the processing meets at least one of the conditions in Schedule 8, and (c) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42). (6) The Secretary of State may by regulations amend Schedule 8 - (a) by adding conditions; (b) by omitting conditions added by regulations under paragraph (a). (7) Regulations under subsection (6) are subject to the affirmative resolution procedure. (8) In this section, ‘sensitive processing’ means - (a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; (b) the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual; (c) the processing of data concerning health; (d) the processing of data concerning an individual’s sex life or sexual orientation.” 36. The second data protection principle (1) The second data protection principle is that— (a) the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and (b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected. (2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4). (3) Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that - (a) the controller is authorised by law to process the data for the other purpose, and (b) the processing is necessary and proportionate to that other purpose. (4) Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law. … 40. The sixth data protection principle The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, ‘appropriate security’ includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).”
“8. Part 3 of the 2018 Act makes provision about the processing of personal data by competent authorities for “the law enforcement purposes” and implements the European Union’s Law Enforcement Directive (Directive (EU) 2016/680) (“the LED”) (section 1(4)). That Directive is therefore a legitimate aid to the interpretation of the 2018 Act. The law enforcement purposes listed in section 31 include the investigation, detection and prosecution of criminal offences. Chapter 5 of Part 3 deals with the transfer of personal data to third countries or international organisations. Sections 73 to 76 set out the general conditions which apply to such transfers (section 72(1)(a)). The data controller cannot transfer personal data unless three conditions are met (section 73(1)(a)). Condition 3 need not concern us, because Condition 1 was not met and it is arguable that Condition 2 could never be met. 9. Condition 1 is that the transfer is necessary for any of the law enforcement purposes (section 73(2)). In Guriev v Community Safety Development (UK) Ltd[2016] EWHC 643 (QB) , Warby J held (in the context of restricting the subject’s right of access to his personal data) that: “The test of necessity is a strict one, requiring any interference with the subject’s rights to be proportionate to the gravity of the threat to the public interest” (para 45). The parties agree that the same test applies in this context. This obviously requires the data controller to address his mind to the proportionality of the transfer.”
“41. No one would disagree that the address of each individual's private residence is personal data, and represents an aspect of private and family life, but a residential address is an aspect of private life which may not be very private at all. So, for example, MPs are required to disclose an address when seeking nomination for election. This address is published in the electoral process. Usually it will be the constituency address of the candidate and its publication inevitably diminishes its private nature. Other professions and occupations may require notification of and public access to a residential address. Thus, company directors are required to provide a residential address available to those who search the register of companies. Everyone eligible to vote must have his or her address recorded in the register of electors, full versions of which are available for public scrutiny in local libraries and local government offices. The reality is that an individual who is determined to discover a residential address of an adult law-abiding citizen is likely to be able to do so by one legal means or another, and where the person concerned is the holder of a public office and in the public eye, such an inquiry is likely to be easier. 42. None of this is intended to suggest that the disclosure of an individual's private address under FOIA does not require justification. In the present case, however, there was a legitimate public interest well capable of providing such justification. Thus, for example, there is evidence which suggests that one MP claimed ACA for a property which did not exist, and yet further evidence may demonstrate that on occasions MPs claiming ACA were letting out the accommodation procured from the ACA allowance. 43. In essence Mr Giffin's argument was that the justification relied on was not sufficiently weighty to make the disclosure of these addresses necessary in all circumstances. It was common ground that "necessary" within schedule 2 para 6 of the DPA should reflect the meaning attributed to it by the European Court of Human Rights when justifying an interference with a recognised right, namely that there should be a pressing social need and that the interference was both proportionate as to means and fairly balanced as to ends. We note the explanation given by the court in The Sunday Times v United Kingdom(1979) 2 EHRR 245 paragraph 59: ‘The court has already had the occasion …to state its understanding of the phrase "necessary in a democratic society" the nature of its functions in the examination of issues turning on that phrase and the manner in which it will perform those functions. The court has noted that, while the adjective ‘necessary’, within the meaning of article 10(2) is not synonymous with ‘indispensable’, neither has it the flexibility of such expressions as ‘admissible’, ‘ordinary’, ‘useful’, ‘reasonable’ or ‘desirable’ and that it implies the existence of a ‘pressing social need.’” ‘The court has already had the occasion …to state its understanding of the phrase "necessary in a democratic society" the nature of its functions in the examination of issues turning on that phrase and the manner in which it will perform those functions. The court has noted that, while the adjective ‘necessary’, within the meaning of article 10(2) is not synonymous with ‘indispensable’, neither has it the flexibility of such expressions as ‘admissible’, ‘ordinary’, ‘useful’, ‘reasonable’ or ‘desirable’ and that it implies the existence of a ‘pressing social need.’”
“60. It is clear in this case – and is conceded on behalf of Mr Stone at this stage of the argument – that a condition in Schedule 2 is satisfied: viz. paragraph 5(2) of Schedule 2 ("The processing is necessary… for the purpose of any other functions of a public nature exercised in the public interest by any person"). It is common ground that the word "necessary", as used in the Schedules to the 1998 Act, carries with it the connotations of the European Convention on Human Rights: those include the proposition that a pressing social need is involved and that the measure employed is proportionate to the legitimate aim being pursued.”
“… it is denied that the email of5 June 2019 contained any personal data of the Claimant, that the Claimant’s personal data was thereby disclosed or that the Defendant acted unlawfully as alleged or at all. If which is denied, the email of5 June 2019 contained any personal data of the Claimant or involved the processing of the same, such processing was lawful for the legitimate purpose of maintaining public confidence in the investigation and prosecution of alleged criminal offences. The Defendant maintained adequate safeguards including that it did not name the Claimant, it did not otherwise confirm that the charging file that it had received related to him, and it did not disclose any information that was not already in the public domain.”
“… re-enforced the correct procedures which should take place. Any future correspondence will be handled appropriately in the future.”
“Right to respect for private and family life 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”
“Freedom of expression 1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This article shall not prevent states from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.”
“First, is the information private in the sense that it is in principle protected by article 8? If 'no', that is the end of the case. If 'yes' the second question arises: in all the circumstances, must the interest of the owner of the private information yield to the right of freedom of expression conferred on the publisher by article 10 ?”
“26. It has at all times been common ground that liability for misuse of private information is determined by applying a two-stage test. Stage one is whether the claimant objectively has a reasonable expectation of privacy in the relevant information. If so, stage two is whether that expectation is outweighed by the publisher’s right to freedom of expression. This involves a balancing exercise between the claimant’s article 8 right to privacy and the publisher’s article 10 right to freedom of expression.”
"The question is what a reasonable person of ordinary sensibilities would feel if she was placed in the same position as the claimant and faced with the same publicity."
‘... there is potentially an important distinction between information which is made available to a person's circle offriends or work colleagues and information which is widely published in a newspaper …’
“57. If PJS’s case was simply based on confidentiality (or secrecy), then, while I would not characterise his claim for a permanent injunction as hopeless, it would have substantial difficulties. The publication of the story in newspapers in the United States, Canada, and even in Scotland would not, I think, be sufficient of itself to undermine the claim for a permanent injunction on the ground of privacy. However, the consequential publication of the story on websites, in tweets and other forms of social network, coupled with consequential oral communications, has clearly resulted in many people in England and Wales knowing at least some details of the story, including the identity of PJS, and many others knowing how to get access to the story. There are claims that between 20% and 25% of the population know who PJS is, which, it is fair to say, suggests that at least 75% of the population do not know the identity of PJS, and presumably more than 75% do not know much if anything about the details of the story. However, there comes a point where it is simply unrealistic for a court to stop a story being published in a national newspaper on the ground of confidentiality, and, on the current state of the evidence, I would, I think, accept that, if one was solely concerned with confidentiality, that point had indeed been passed in this case. 58. However, claims based on respect for privacy and family life do not depend on confidentiality (or secrecy) alone. As Tugendhat J said in Goodwin v News Group Newspapers Ltd [2011] EMLR 27, para 85, “[t]he right to respect for private life embraces more than one concept”
“The role of the concept of the ‘public domain’ in misuse of private information has been a matter of much deliberation, culminating in an important ruling of the Supreme Court in PJS v News Group Newspapers Ltd. Even if seemingly private in nature, there will usually be no reasonable expectation of privacy in information that is already in the public domain. This principle has carried over to some extent to the claim for misuse of private information from that for breach of confidence. The determination as to precisely when information will be deemed already to be in the public domain is more nuanced in this new context, however; it is less automatic in the context of privacy than confidentiality of government secrets. The matter will often be a question of degree. There is a qualitative difference, for instance, between information being in the public domain by reason of an individual appearing physically in a public place with the natural exposure to others present that this brings, and the publication of photographs disclosing that information in newspapers or on a social media account with millions of followers, such as to render it universally accessible and, in effect, known. Similarly, the fact that information is known to some people does not mean that wider publication would have no significant effect. Another similar factual scenario arises increasingly often in the context of the reproduction in the mainstream media of personal information published on social networking websites. At some point, however, it appears to be accepted that the general availability of some given information will preclude the possibility of any reasonable expectation of privacy. For instance, in Mosley v News Group Newspapers Ltd - a case in which the online article containing the offending information had already been viewed several hundred thousand times and a video more than 1.5 million times before the claimant sought an interim injunction—both items were held to be incontrovertibly in the public domain such that no interim order enjoining further publication was available. In contrast, in Weller v Associated Newspapers Ltd, the court was presented with a complaint regarding the publication in a newspaper and online of the unpixellated faces of the children of a well-known musician. Evidence showed that there had previously been an array of publications concerning the children, including some reference to the children in newspaper and other interviews, personal tweets regarding the family (some of which had been picked up and republished by national newspapers), other online publications by different members of the family circle, publication of photographs in a book, and a single modelling appearance of one of the children in a teen magazine. Despite this, Dingemans J concluded that the children retained a reasonable expectation of privacy over publication of photographs showing their faces, “one of the chief attributes of their respective personalities”
“First, neither article (8 or 10) has as such precedence over the other. Secondly, where the values under the two articles are in conflict, an intense focus on the comparative importance of the specific rights being claimed in the individual case is necessary. Thirdly, the justifications for interfering with or restricting each right must be taken into account. Finally, the proportionality test must be applied to each.”
“(i) neither article has preference over the other, (ii) where their values are in conflict, what is necessary is an intense focus on the comparative importance of the rights being claimed in the individual case, (iii) the justifications for interfering with or restricting each right must be taken into account and (iv) the proportionality test must be applied: see eg In re S (A Child) (Identification: Restrictions on Publication)[2005] 1 AC 593 , para 17, per Lord Steyn, with whom all other members of the House agreed; McKennitt v Ash[2008] QB 73 , para 47, per Buxton LJ, with whom the other members of the court agreed; and Mosley v News Group Newspapers Ltd[2008] EWHC 687 (QB) at [28] per Eady J, describing this as a 'very well established' methodology. The exercise of balancing article 8 and article 10 rights has been described as 'analogous to the exercise of a discretion': AAA v Associated Newspapers Ltd[2013] EWCA Civ 554 at [8].”
“… looking first at the comparative importance of the actual rights being claimed in the individual case; then at the justifications for interfering with or restricting each of those rights; and applying the proportionality test to each.”
“2.39. I would endorse the general views of Commissioner Hogan-Howe and Mr Trotter on this issue [viz the police briefing the press on suspects]. Police forces must weigh very carefully the public interest considerations of taking the media on police operations against Article 8 and Article 6 rights of the individuals who are the subject of such an operation. Forces must also have directly in mind any potential consequential impact on the victims in such cases. More generally, I think that the current guidance in this area needs to be strengthened. For example, I think that it should be made abundantly clear that save in exceptional and clearly identified circumstances (for example, where there may be an immediate risk to the public), the names or identifying details of those who are arrested or suspected of a crime should not be released to the press nor the public.”
“The courts below were correct to hold that, as a legitimate starting point, a person under criminal investigation has, prior to being charged, a reasonable expectation of privacy in respect of information relating to that investigation and thatin all the circumstances this is a case in which that applies and there is such an expectation.”
“169 Compensation for contravention of other data protection legislation (1) A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the GDPR, is entitled to compensation for that damage from the controller or the processor, subject to subsections (2) and (3). (2 )Under subsection (1)— (a) a controller involved in processing of personal data is liable for any damage caused by the processing, and (b) a processor involved in processing of personal data is liable for damage caused by the processing only if the processor - (i) has not complied with an obligation under the data protection legislation specifically directed at processors, or (ii) has acted outside, or contrary to, the controller’s lawful instructions. (3) A controller or processor is not liable as described in subsection (2) if the controller or processor proves that the controller or processor is not in any way responsible for the event giving rise to the damage. (4) A joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities are determined in an arrangement under section 58 or 104 is only liable as described in subsection (2) if the controller is responsible for compliance with the provision of the data protection legislation that is contravened. (5) In this section, ‘damage’ includes financial loss and damage not involving financial loss, such as distress.”