Tag Archives: Court Decisions (Scotland)

Privacy, the common law and Scotland

In a recent opinion from Lord Bannatyne (B C and Others v Chief Constable Police Service of Scotland and others [2019] CSOH 48), sitting in the Outer House of the Court of Session, we have the first express statement that there is a right of privacy at common law in Scotland. Traditionally in Scotland, privacy law has been dealt with through the European Convention on Human Rights, the Human Rights Act and data protection law.

This case involved a number of police officers who are facing disciplinary proceedings by the Police Service of Scotland for alleged misconduct which is founded upon a number of messages sent via WhatsApp. The messages came into the possession of the professional standards department having been discovered on the phone of an officer who was being investigated in connection with alleged sexual offences.

The messages in question were characterised by Senior Counsel for the Police Service of Scotland in her written submissions as being “on any view, blatantly sexist and degrading, racist, anti-semitic, homophobic, mocking of disability” and included “a flagrant disregard for police procedures by posting crime scene photos of current investigations.” [para 166] Lord Bannatyne believed that it was “a characterisation which a reasonable person having regard to the content of the messages would be entitled to reach. I conclude that the content of the messages can be regarded as potentially informing the issue of breach of Standards in circumstances calling into question the impartial discharge of the petitioners’ duties.” [para 166]

In terms of the common law right to privacy, the starting point for Lord Bannatyne was the relationship between the Human Rights Act 1998 and the Common Law. He quoted Lord Reid, with approval, in R (Osborn) v The Parole Board at paragraph 57 of that judgment. From that passage Lord Bannatyne concluded that if the right to privacy exists at common law, Article 8 of the convention does not supersede it. Lord Bannatyne noted that the European jurisprudence could be used to help inform and develop a common law right to privacy.

He then went on to ask whether there was a justification for a right to privacy in the common law. He cited, with approval, the words of Lord Nicholls at paragraph 12 of the judgment in Campbell v MGN Ltd. Lord Bannatyne thought that the right to privacy could “be described as a core value and one which is inherent in a democratic and civilised state.” [para 106]. He continued:

“[it] seems to flow from the centrality of the role of privacy in a democratic society and particularly in a society where electronic storage of information and electronic means of intrusion into the private lives of a citizen by government, private organisations and individuals are growing exponentially the common law should recognise the right to privacy.” [para 107]

Lord Bannatyne considered that the English authority on the point was of assistance. In England and Wales the common law on privacy has been developed in the context of the development of the law on breach of confidence. Scotland also has a concept of breach of confidence, which is a well understood remedy and it has been explicitly accepted previously that the law in Scotland in respect of breach of confidence is the same as the law in respect of breach of confidence in England and Wales (see, for example, Lord Advocate v Scotsman Publications).

At paragraph 116 of his opinion, Lord Bannatyne observed “that given privacy is a fundamental right I think it highly likely that it exists in the common law of Scotland.” He also noted that it was “inherently unlikely” that Scottish and English law in relation to this fundamental matter are entirely different.

Finally, he considered the existing case law in Scotland (to the extent that there is any) tended to support the view that such a right exists in the law of Scotland. He also found it “noteworthy” that none of the cases to which he was referred expressly or implicitly stated that there was no common law right to privacy in Scotland.

Lord Bannatyne went on to consider that the Petitioners could have “no reasonable expectation of privacy” flowing “from the attributes which arise as a result of their position as constables.” [para 166] It is not the case that police officers, as a result of their position, have no right to privacy at all, but, rather, that this right is limited. Lord Bannatyne opines that the limitation can be defined in the following way: “f their behaviour in private can be said to be potentially in breach of the Standards in such a way as to raise doubts regarding the impartial performance of their duties then they have no reasonable expectation of privacy.” [para 168] A police officer, because of the attributes of a person holding the office of constable, is in a different position to an ordinary member of the public. [para 168]

The remaining issues that had to be dealt with by Lord Bannatyne were dealt with in, comparably, fairly short compass. Lord Bannatyne held that “there is a clear and accessible basis for the disclosure [by the police, as a public authority, to the professional standards branch of Police Scotland] in the circumstances of this case.” [para 192] He also held that the disclosure decision was not an arbitrary one. [para 192]

Lord Bannatyne also held the interference was necessary, in accordance with Article 8(2) of the Convention. He did not agree that all of the matters listed in Article 8(2) were engaged, but did hold that ‘public safety’ and ‘the prevention and detection of crime’ were engaged. [para 198] In terms of the balancing exercise to be carried out, Lord Bannatyne considered that the balance was“heavily weighted on the side of disclosure” and he was “unable to identify a less intrusive measure which could have been used without unacceptably comprising the objectives [he had] identified.” [para 201]

Finally, in respect of interdict, Lord Bannatyne held that even if he had been with the Petitioners he would nevertheless have held that the Petitioners were not entitled to the interdict which they sought. [para 202]

This is an important case as it is the first time that a Scottish court has expressly declared that there is a common law right to privacy in Scotland. That, however, has to be tempered with the fact that it is a decision of the Outer House and therefore only of persuasive authority in the Court of Session and lower courts. A different Lord Ordinary (or a Sheriff) may ultimately reach a different conclusion (although, I think that unlikely). Although, the Petitioners were right on this point, they ultimately lost the case and the petition was refused. Therefore there may well be a reclaiming motion (appeal) to the Inner House and this point may well be considered and decided upon by the Inner House. This would give us binding authority which all the lower courts in Scotland would be required to follow stating that there is a common law right to privacy in Scotland.

The decision will certainly add an additional tool to the armory of individuals who are concerned about their privacy and breaches thereof; it will also be another angle which those advising on issues of privacy will have to consider. We may begin to see more cases proceed on the basis of a breach of the common law right to privacy as opposed to cases proceeding on breaches of convention rights and data protection law.

Alistair Sloan

If you would like advice in connection with any privacy matter, or any other information law matter; contact our team on 0141 229 0880 or by E-mail. You can also follow our dedicated Information law twitter account.

Information Law Review of 2018

It does not seem as though it was a year ago since I sat down to write my review of Information Law in 2017 and to have a brief look ahead into 2018; but somehow we now appear to be in 2019. It was always going to be the case that 2018 was going to be a big year for information law; with the General Data Protection Regulation becoming applicable on 25th May 2018. The 25th May 2018 came and went without the millennium bug style apocalypse that seemed inevitable from the amount of sensationalist writing that was taking place in late 2017 and early 2018.

My review of 2017 started off with the English and Welsh High Court decision on vicarious liability for data protection breaches in Various Claimants v WM Morrisons Supermarket PLC  [2017] EWHC 3113 (QB)This case rumbled on in 2018 and it was considered by the Court of Appeal. The Court of Appeal heard the appeal and (in remarkably quick time) dismissed the appeal. It is understood that Morrisons have sought permission to appeal to the Supreme Court and if permission is granted it is possible that it will feature in a review of Information law in 2019.

In February, the English and Welsh High Court issued an interesting privacy judgment when it considered an action for compensation arising out of “Can’t Pay? We’ll Take it Away’; a fly-on-the wall documentary following High Court Enforcement Officers in their work enforcing court orders relating to debt and housing cases. The Court had the tricky job of balancing the privacy rights of individuals against the rights of television companies in respect of freedom of expression; however, the High Court decided that the balance in this particular case fell in favour of the claimant’s privacy rights. The High Court’s decision was appealed to the Court of Appeal; looking specifically at the issue of quantifying the level of damages. That appeal was heard by the Court of Appeal in early December and should provide useful guidance on calculating damages in the privacy sphere.

Facebook, Cambridge Analytical and Aggregate AIQ all featured quite heavily in 2018 in terms of privacy and data protection matters. Facebook was served with a monetary penalty in the amount of £500,000 for breaches of the Data Protection Act 1998 and Aggregate AIQ was also the recipient of the first Enforcement Notice under the Data Protection Act 2018 (which was narrowed in scope by the Information Commissioner following an appeal by AIQ; which was subsequently dropped). Facebook lodged an appeal against the Monetary Penalty Notice with the First-Tier Tribunal (Information Rights) in November 2018. If and when a decision is reached by the Tribunal in respect of that appeal, it will feature on this blog.

Arising out of the same wide-ranging investigation by the ICO as the Facebook penalty and the AIQ Enforcement Notice was an Information Notice served on the United Kingdom Independence Party (UKIP), which was appealed to the First-Tier Tribunal (Information Rights). The Tribunal dismissed the appeal by UKIP in July.

In April there was yet another important decision from the English and Welsh High Court in respect of Privacy and Data Protection. A little over four years after the European Court of Justice decision on the Right to Be Forgotten in Google Spain, Mr Justice Warby handed down his judgment in NT1 & NT2 v Google; this represented the first decision of a UK Court in respect of the Right to Be Forgotten. An appeal was lodged in respect of this case and was due to be heard just before Christmas; however, it was reported that the case was settled on the day of the appeal.

The issue of compensation to identifiable third parties in the context of data protection breaches was considered by the English and Welsh Court of Appeal. This case adds to the helpful privacy and data protection case law emanating from the English and Welsh courts.

Another interesting development that we saw during the course of 2018 was a director being disqualified indirectly in connection with privacy and data protection matters. It does show that directors can be held personally liable for privacy and data protection transgressions of limited companies. This was underlined by the amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 which now enable the Commissioner to serve a monetary penalty on directors (and others associated with companies) in certain circumstances.

In Scotland, the Court of Session made new rules which should make appealing decisions of the Scottish Information Commissioner in respect of requests for environmental information more financially viable.

Litigation in respect information law matters in Scotland remains limited. The majority of litigation on these areas arises out of England and Wales. Perhaps in 2019, we will begin to see more litigation in Scotland on information law matters. Hopefully the new rules in the Court of Session will see more appeals in respect of the Environmental Information (Scotland) Regulations 2004 and hopefully the introduction of Group proceedings in the Court of Session through the Civil Litigation (Expenses and Group Proceedings) (Scotland) Act 2018 will help with an increase in data protection and privacy litigation in Scotland.

In terms of 2018 Scottish cases, not long before Christmas the Court of Session treated us to a judgment in an appeal concerning vexatious requests under the Freedom of Information Scotland Act 2002. Beggs v Scottish Information Commissioner considered the correct approach to be taken when applying section 14(1) of the Freedom of Information (Scotland) Act 2002.

Looking ahead to 2019; the big issue on the horizon is Brexit. Much of what is discussed on this blog as “information law” derives from European law and so Brexit will likely have an impact upon that. We are still unsure as to the terms that we will be leaving on. A withdrawal Agreement has been negotiated between the European Union and the United Kingdom; however, there is  still a way to go with that – and it looks quite likely that the UK Parliament will rejected the Withdrawal Agreement in its current form. If we end up leaving with no Withdrawal Agreement in place then this will cause considerable difficulties for UK business which rely upon the transfer of personal data from elsewhere within the European Union; it will also cause problems for public bodies.

In terms of making the law work after Brexit, we were treated by the Government (in between Christmas and New Year) to a draft of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. These Regulations will make changes to the GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 in light of the United Kingdom no longer being a member of the European Union. I will, of course, look at these draft Regulations in more detail soon.

I will attempt to address information law matters as they unfold in 2019 on the Information Law Blog from Inksters Solicitors.

Alistair Sloan

If you would like advice or assistance with Privacy and Data Protection matters or with UK and Scottish Freedom of Information requests contact Alistair Sloan on 0141 229 0880 or you can E-mail him.