Tag Archives: Scottish Courts

Privacy, the common law and Scotland

In a recent opinion from Lord Bannatyne (B C and Others v Chief Constable Police Service of Scotland and others [2019] CSOH 48), sitting in the Outer House of the Court of Session, we have the first express statement that there is a right of privacy at common law in Scotland. Traditionally in Scotland, privacy law has been dealt with through the European Convention on Human Rights, the Human Rights Act and data protection law.

This case involved a number of police officers who are facing disciplinary proceedings by the Police Service of Scotland for alleged misconduct which is founded upon a number of messages sent via WhatsApp. The messages came into the possession of the professional standards department having been discovered on the phone of an officer who was being investigated in connection with alleged sexual offences.

The messages in question were characterised by Senior Counsel for the Police Service of Scotland in her written submissions as being “on any view, blatantly sexist and degrading, racist, anti-semitic, homophobic, mocking of disability” and included “a flagrant disregard for police procedures by posting crime scene photos of current investigations.” [para 166] Lord Bannatyne believed that it was “a characterisation which a reasonable person having regard to the content of the messages would be entitled to reach. I conclude that the content of the messages can be regarded as potentially informing the issue of breach of Standards in circumstances calling into question the impartial discharge of the petitioners’ duties.” [para 166]

In terms of the common law right to privacy, the starting point for Lord Bannatyne was the relationship between the Human Rights Act 1998 and the Common Law. He quoted Lord Reid, with approval, in R (Osborn) v The Parole Board at paragraph 57 of that judgment. From that passage Lord Bannatyne concluded that if the right to privacy exists at common law, Article 8 of the convention does not supersede it. Lord Bannatyne noted that the European jurisprudence could be used to help inform and develop a common law right to privacy.

He then went on to ask whether there was a justification for a right to privacy in the common law. He cited, with approval, the words of Lord Nicholls at paragraph 12 of the judgment in Campbell v MGN Ltd. Lord Bannatyne thought that the right to privacy could “be described as a core value and one which is inherent in a democratic and civilised state.” [para 106]. He continued:

“[it] seems to flow from the centrality of the role of privacy in a democratic society and particularly in a society where electronic storage of information and electronic means of intrusion into the private lives of a citizen by government, private organisations and individuals are growing exponentially the common law should recognise the right to privacy.” [para 107]

Lord Bannatyne considered that the English authority on the point was of assistance. In England and Wales the common law on privacy has been developed in the context of the development of the law on breach of confidence. Scotland also has a concept of breach of confidence, which is a well understood remedy and it has been explicitly accepted previously that the law in Scotland in respect of breach of confidence is the same as the law in respect of breach of confidence in England and Wales (see, for example, Lord Advocate v Scotsman Publications).

At paragraph 116 of his opinion, Lord Bannatyne observed “that given privacy is a fundamental right I think it highly likely that it exists in the common law of Scotland.” He also noted that it was “inherently unlikely” that Scottish and English law in relation to this fundamental matter are entirely different.

Finally, he considered the existing case law in Scotland (to the extent that there is any) tended to support the view that such a right exists in the law of Scotland. He also found it “noteworthy” that none of the cases to which he was referred expressly or implicitly stated that there was no common law right to privacy in Scotland.

Lord Bannatyne went on to consider that the Petitioners could have “no reasonable expectation of privacy” flowing “from the attributes which arise as a result of their position as constables.” [para 166] It is not the case that police officers, as a result of their position, have no right to privacy at all, but, rather, that this right is limited. Lord Bannatyne opines that the limitation can be defined in the following way: “f their behaviour in private can be said to be potentially in breach of the Standards in such a way as to raise doubts regarding the impartial performance of their duties then they have no reasonable expectation of privacy.” [para 168] A police officer, because of the attributes of a person holding the office of constable, is in a different position to an ordinary member of the public. [para 168]

The remaining issues that had to be dealt with by Lord Bannatyne were dealt with in, comparably, fairly short compass. Lord Bannatyne held that “there is a clear and accessible basis for the disclosure [by the police, as a public authority, to the professional standards branch of Police Scotland] in the circumstances of this case.” [para 192] He also held that the disclosure decision was not an arbitrary one. [para 192]

Lord Bannatyne also held the interference was necessary, in accordance with Article 8(2) of the Convention. He did not agree that all of the matters listed in Article 8(2) were engaged, but did hold that ‘public safety’ and ‘the prevention and detection of crime’ were engaged. [para 198] In terms of the balancing exercise to be carried out, Lord Bannatyne considered that the balance was“heavily weighted on the side of disclosure” and he was “unable to identify a less intrusive measure which could have been used without unacceptably comprising the objectives [he had] identified.” [para 201]

Finally, in respect of interdict, Lord Bannatyne held that even if he had been with the Petitioners he would nevertheless have held that the Petitioners were not entitled to the interdict which they sought. [para 202]

This is an important case as it is the first time that a Scottish court has expressly declared that there is a common law right to privacy in Scotland. That, however, has to be tempered with the fact that it is a decision of the Outer House and therefore only of persuasive authority in the Court of Session and lower courts. A different Lord Ordinary (or a Sheriff) may ultimately reach a different conclusion (although, I think that unlikely). Although, the Petitioners were right on this point, they ultimately lost the case and the petition was refused. Therefore there may well be a reclaiming motion (appeal) to the Inner House and this point may well be considered and decided upon by the Inner House. This would give us binding authority which all the lower courts in Scotland would be required to follow stating that there is a common law right to privacy in Scotland.

The decision will certainly add an additional tool to the armory of individuals who are concerned about their privacy and breaches thereof; it will also be another angle which those advising on issues of privacy will have to consider. We may begin to see more cases proceed on the basis of a breach of the common law right to privacy as opposed to cases proceeding on breaches of convention rights and data protection law.

Alistair Sloan

If you would like advice in connection with any privacy matter, or any other information law matter; contact our team on 0141 229 0880 or by E-mail. You can also follow our dedicated Information law twitter account.

Environmental Information request appeals and prohibitive costs: new Court of Session rules

The Court of Session has made new rules with a view to preventing court actions relating to the environment from being “prohibitively expensive”. The new court rules introduced orders which will be known as “prohibitive expenses orders”. These new rules are of relevance to readers of this blog as they will apply to appeals against decisions of the Scottish Information Commissioner to the Court of Session where the decision being appealed relates to a request for environmental information under the Environmental Information (Scotland) Regulations 2004 (EIRs).

The EIRs give effect in Scotland (in relation to environmental information held by Scottish public authorities – environmental information held by UK public authorities is covered by the Environmental Information Regulations 2004) to Directive 2003/4/EC of the European Parliament and of the Council of 28 January 2003 on public access to environmental information. [pdf] This European Directive in turn gives effect to the UN/ECE Convention on Access to Information, Public Participation in Decision-Making and Access to Justice in Environmental Matters [pdf] (‘the Aarhus Convention’). Article 9 of the Aarhus Convention requires that individuals have access to justice in respect of environmental matters and that this should not be “prohibitively expensive”.

With some of the background to these new rules (briefly) explained, what exactly do these new rules mean? In short, they mean that anyone who brings an appeal to the Court of Session against a decision of the Scottish Information Commissioner in respect of a request for environmental information (whether or not the requester knew at the time of making their request that the request was a request for environmental information or not – knowing exactly what is environmental information under the EIRs can be very difficult) can make a motion to the court to have their liability in expenses limited should they ultimately be unsuccesful in their appeal.

A person bringing an appeal to the Court of Session against a relevant decision of the Scottish Information Commissioner will be required to make a motion for a prohibitive expenses order as soon as is reasonably practicable after becoming aware that the appeal is defended. In essence, an appellant will need to make a motion relatively quickly after Answers to the Note of Appeal are intimated to them and any unreasonable delay in doing so is likely going to have an impact upon whether the court makes an order.

The new rules provide that proceedings are to be considered prohibitively expensive if the costs and expenses likely to be incurred by the applicant are likely to exceed the financial means of the party or where are objectively unreasonable having regard to six factors set out in the rules; including whether the applicant has reasonable prospects of success; the complexity of the relevant law and procedure; and whether the case is frivolous.

Where the court is satisfied that the proceedings are prohibitively expensive, it must make a prohibitive expenses order (in otherwords, if the test is met then the court has no discretion over whether an order is made or not). The order will limit the appellant’s expenses to the respondent to £5,000 (or such other sum as may be justified) and will limit the respondent’s expenses to the appellant to £30,000 (or such other sum as may be justified). It therefore seems as though it will be possible for a requester who intervenes in an appeal brought by the scottish public authority to apply to have their liability capped in line with the £5,000 figure rather than the £30,000. It also seems as though the court will have the discretion to cap the laibility at a lower or higher figure than £5,000 or £30,000.

It remains to be seen just how these new rules will operate in practice, but this is a good step forward. Appeals to the Inner House of the Court of Session are expensive and an unsuccessful appellant could face an expenses bill of many tens of thousands of pounds (in addition to their own legal fees). These new rules do not affect the availability of legal aid (or the rules that apply to expenses where an unsuccessful appellant is in receipt of legal aid). However, these rules will help people who are financially ineligible for legal aid, but are still financially unable to risk losing an appeal. Furthermore, legal aid can be difficult to obtain and therefore this provides a potential route for a person whose application for legal aid has been refused (although, it remains to be seen whether the timeframe for making a motion for a “prohibitive expenses order” is flexible enough to deal with situations where someone has applied for, but ultimately been refused, legal aid). It also remains to be seen how the court will deal with an application for a prohibitive expenses order where legal aid has been refused on the basis of the merits of the appeal rather than on financial eligibility (the tests do, at first blush, appear to be different with perhaps a lower threshold applying to the question of merits in a motion for a prohibitive expenses order as opposed to an application for legal aid).

These new rules might see an increase in EIR appeals to the Court of Session (indeed, we might see an appeal be brought – none have ever been brought, at least so far as I’m aware, in the almost 14 years that people have been able to request environmental information in Scotland). People who are unable to financially risk losing an appeal will now be able to know what their liability in expenses will be in advance of expenses mounting up. This could have financial implications for the Scottish Information Commissioner if his office starts to see an increase in litigation and also for Scottish public authorities who may ultimately decide to become involved in appeals brought by requesters against decisions of the Commissioner.

Alistair Sloan

If you would like advice or assistance in respect of requests for environmental information or any other information law matter, you can contact Alistair Sloan on 0141 229 0880 or by E-mail.

Update 28/11/2018 – The Scottish Information Commissioner’s office has advised that there was one appeal brought against one of their decisions relating to a request for environemntal information. The appeal was brought by a public authority and was abandoned by the public authority.

Compensation in Data Protection law

Section 13 of the Data Protection Act 1998 makes provision for a data subject to raise court proceedings for payment of damages where there has been a breach of the Data Protection Act 1998 which has caused them damage and/or distress.  The provisions in Section 13 have not been used as often as they might otherwise have; this may have been partly down to the way in which the legislation was initially drafted, but that was rectified (in England, at least) by the English Court of Appeal in Google Inc v Vidal-Hall and ors [2015] EWCA Civ 311.

The General Data Protection Regulation, which is due to become applicable in the UK from 25th May 2018, makes provision for data subjects to obtain compensation from controllers and processors in Article 82.  The right is for “any person who has suffered material or non-material damage as a result of an infringement of [the GDPR]” to be compensated.  Clause 159(1) of the Data Protection Bill (which is still in the early stages of the parliamentary process), provides that this “includes financial loss, distress and other adverse effects.”

A Data Subject is not limited to claiming compensation from the controller.  The GDPR provides that a processor will “be liable for the damage caused by processing only where it has not complied with the obligations…specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.”

Article 82(3) of the GDPR introduces a defence to such a claim for compensation, but it is an exceptionally high test.  No liability arises where the controller or processor “proves that it is not in any way responsible for the event giving rise to the damage.”  The burden of proof falls on the controller or process and liability attaches even where the processor or controller is responsible for the event causing the damage in the most minor of ways.

The terms of Article 82(3) create joint and several liability for controllers and processors.  In a situation where multiple controllers and/or processors are all partially responsible for the event giving rise to the damage; the data subject could elect to sue any one of them (or indeed, all of them).  Where the data subject elects to sue just one controller/processor who is responsible, controller/processor is entitled to recover from the other controllers/processors “that part of the compensation corresponding to their part of responsibility for the damage.”

Where the data subject elects to sue more than one controller/processor then Recital 146 of the GDPR explains that, in accordance with Member State law, compensation may be apportioned by the court according to the responsibility of each controller or processor for the damage caused by the processing.

The GDPR does not stipulate any maximum amount of compensation that can be awarded to data subjects; however, Recital 146 of the GDPR explains that data subjects should receive full and effective compensation for the damage they have suffered.  Quite what “full and effective compensation” mean is something that will be worked out as the courts grapple with the new provisions.  There have been almost no published decisions from the Scottish courts in respect of claims for compensation under Section 13 of the Data Protection Act 1998, but where there have been decisions the compensation awarded has not been particularly high.  For example, Sheriff Ross awarded the each of the Pursuers £8,364 in Woolley v Akbar [2017] SC Edin 7.  That case concerned the use of CCTV at private dwellings and the compensation figure was calculated on a nominal rate of £10 per day that the Defender was in breach of the Act.

The GDPR only applies to processing of personal data in areas which are within the competence of the European Union; however, the Data Protection Bill extends the scope of the GDPR to areas beyond the competence of the European Union.  Clause 160 of the Bill provides for compensation where it cannot be claimed under Article 82 and the clause mirrors the terms of Article 82.

In Scotland both the Sheriff Court and the Court of Session will have jurisdiction to hear claims under Article 82 of the GDPR and Clause 160 of the Data Protection Bill (as is the case with claims under Section 13 of the Data Protection Act 1998).  In practice it is likely that the vast majority of claims will be heard in the Sheriff Court given that it is unlikely that any claim will exceed £100,000 and will therefore be within the privitive jurisdiction of the Sheriff Court.  However, with the advent of Group Proceedings (see Section 17 of the Civil Litigation (Expenses and Group Proceedings) (Scotland) Bill [pdf]) it is possible the Article 82 claims will end up the Court of Session as the Bill only provides for a group proceedings procedure in the Court of Session.

Those who process personal data should be aware that the right of a data subject to claim compensation, whether that be under the Data Protection Act 1998, the GDPR or the Data Protection Bill (when it becomes an Act), arising out of a data protection breach is in addition to any enforcement action that the Information Commissioner takes, such as the issuing of an administrative fine.

Alistair Sloan

If you would like to pursue a claim for compensation for a data breach, or if you require to defend such a claim; or if you would like advice and assistance with any other Information Law matter we would be pleased to hear from you. You can contact Alistair Sloan on 0345 450 0123.  Alternatively, you can send him an E-mail.