How the wealthy use privacy laws to keep out of the news

The Duke of Wellington, hero of the Napoleonic wars, took an unusual approach to his own privacy. When prospective blackmailers were threatening to expose his extramarital love life in a courtesan’s memoir, he told them to “publish and be damned”. (They did, and were smothered in libel suits by other husbands named in the book.) But today’s faithless husbands, made of less stern stuff than the Iron Duke, and assorted wealthy individuals who wish to keep their name out of the press, have a powerful weapon at hand — one that grows even stronger this month.

The traditional approach in England to protecting your reputation has been to seek amends after being defamed: the injury — libel in the media, slander in person — had to occur before reparations were due. Cure, not prevention, was the rule. The complex, onerous law limited the freedom of the press, however, and the Defamation Act 2013 slightly reformed it, making it in some cases a less attractive route to retribution. In their search for other strategies to maintain clients’ good names, lawyers have more frequently resorted to a perhaps less obvious area of the law.

“There’s been a trend of people using privacy and data protection over the past three or four years,” says Niri Shan, a partner in the intellectual property and media group at law firm Taylor Wessing. “It’s very effective . . . Data protection is probably the thing that keeps media companies awake at night.”

The most publicised recent example of an individual attacking newspapers with data protection laws is Max Mosley, former boss of Formula 1 and son of wartime fascist Oswald Mosley. British newspapers keep referring to a sadomasochistic orgy Mosley took part in a decade ago, the cause of protracted privacy litigation, and he would like to stop them on the grounds, he says, that it is not in the public interest.

He is proceeding on the basis of existing law: the Data Protection Act 1998 requires that personal data should be accurate, up to date, not excessive and only retained for as long as needed. Whereas since 2014, a defamation claim requires an individual to show they have suffered or are likely to suffer “serious harm”, under privacy laws there is no need to show any harm at all.

A new EU law that comes into operation on May 25 not only reinforces the right to privacy but will also inform (or remind) the wealthy that the best way now to protect their reputation is to look not to defamation, but to data.

This legislation, the General Data Protection Regulation, is the biggest reform to the handling of personal data in a generation. It streamlines and codifies a variety of rules from across the 28 EU countries, although some aspects have still been left to each member state to legislate on.

Any company established in the EU that processes the data of someone resident in the EU falls under it. It prescribes serious punishments — tiered fines of up to 4 per cent of annual global turnover or €20m (whichever is greater) — for anyone who mishandles this information, whether by not obtaining consent to have it, losing it in a data security breach or keeping it too long. However, important exemptions exist for data that is being processed for certain “special purposes”.

The reason why wealthy individuals should be interested, and those keen to avoid being in the papers especially so, is that GDPR clarifies a suite of rights: the right to know if, how and why a company is processing data about them; the right to see the data; and the right to have the data deleted, to be forgotten. If you can force a journalist to delete from their records what they know about you, you can severely curtail their ability to write about you.

It is a strategy Nicola Cain, a media specialist at law firm RPC* — which is acting for DMG Media, publishers of the Daily Mail, one of the objects of Mosley’s recent ire — is already seeing more of.

Claimants’ lawyers “are starting to make more and more complaints, some more considered than others; often someone will chuck in a data protection claim without really having thought it through. You’re definitely seeing some of the more sophisticated claimant firms start to try and use the Data Protection Act in new ways and try to push it on behalf of clients.”

This worries her: “Anything that presents a new way to hit the media and hammer them is certainly a bad thing.” If someone files a subject access request to obtain their data and prevent a story from being written, she adds, not every media organisation will have sufficient resources to oppose it. Existing law, reinforced by GDPR, gives an exemption for journalism in the public interest, but this has yet to be extensively tested in court.

Data protection and privacy claims are on the rise, lawyers say, and John Kelly, a partner at law firm Harbottle & Lewis, which has acted for the royal family, agrees that London has become the privacy-claim capital of the world. “The damages for privacy claims are now being awarded at a similar level to those that are awarded in defamation claims,” he says. “I think London [is] an international centre for protecting personal rights and privacy rights in particular.”

The lawyers also agree that GDPR will not necessarily change individuals’ rights, so much as bring them to the fore. However, from this bundle of rights is emerging a strategy for protecting reputations — or stifling journalism and freedom of expression — which even the wealthiest newspapers are likely to find difficult to defend against.

When you Google a person, the text, “Some results may have been removed under data protection law in Europe” can appear under the results. This stems from the right to be forgotten, a facet of privacy law that allows people to ask search engines to delete links to information about them. GDPR reiterates and reinforces this right, which was established in the EU by a case from Spain in 2014.

Two cases addressing, and potentially weaponising, this right were heard in the English High Court in late February. Known anonymously as NT1 v Google and NT2 v Google, their aim was simple: if you could not stop newspapers publishing stories you did not like, you could stop people being able to find them on search engines.

Anya Proops QC, a media barrister at 11 King’s Bench Walk, says both claimants, NT1 and NT2, were people with spent convictions and the stories they objected to referred to their crimes. Google contended, in Proops’ words, that the claimants were “seeking to use the right to be forgotten to curate their online reputation”. She adds: “This is an important case because, of course, the right to be forgotten is a right which individuals undoubtedly use to try and control access to news stories about them” where they cannot force the publisher to remove the story.

When the verdicts were delivered, it was a split: NT2 won, but NT1 lost. John Kelly says this shows judges will approve this strategy “only in meritorious cases”. The damage to the public’s right to know is thus far uncertain. But it is clear the Iron Duke’s approach to brazening it out is long gone.

* RPC acts for the Financial Times on media matters

@joshspero

This is one of a series of articles published in advance of the appearance of the May 4 edition of FT Wealth.