Bryony Hurst and Theo Rees-Bidder from our Dispute Resolution team look back at this summer’s judgment on the novel data protection claims used by three claimants as a method of protecting their reputations.

This summer, the UK High Court handed down judgment in a case which significantly blurred the lines between defamation and data protection law.  This speed read provides a summary of the key points that came out of the judgment, which are of particular relevance to data controllers who compile reports on individuals which may need to be disclosed to third parties.  For a detailed analysis of this case, see Bryony Hurst’s article here.

Essentially, the background to this case was a private investigation by Orbis into links between Donald Trump and Vladimir Putin, which included the production of various dossiers relating to the relationship between Vladimir Putin and Alfa Group, a Russian company owned by the three claimants.  One such dossier was the “Steele Dossier”. The Steele Dossier was disclosed to various third parties, all in high-ranking government positions or security organisations.  However, one such individual leaked the dossiers to BuzzFeed News who subsequently published them.

Rather than seeking to protect their reputations via the well-worn defamation road, the claimants took a scenic route and brought claims under the Data Protection Act 1998 (the “DPA”).  This included claims that the statements made about them in the dossiers: (1) contained their personal data (including sensitive personal data); (2) breached the principle that processing of data should be lawful, fair and transparent; and (3) breached the need to ensure that personal data processed is accurate.  In terms of remedies, the claimants sought a declaration that the personal data was inaccurate and compensation for distress they had suffered.

So what did the Court make of this attempt to dress defamation proceedings up as a data protection claim?

1. Defamation Protection law: Elements of traditional defamation proceedings were borrowed by Warby J when reaching his judgment. Part of Orbis’ defence was that two of the statements complained of were opinion and not fact, falling outside of the DPA’s definition of inaccuracy as a result.  Warby J conducted a balancing exercise which he adopted from defamation law, in an attempt to find the balance between the right to protection from false factual statements and the need to safeguard freedom of opinion.  There were also extensive arguments about the meaning of the term “illicit cash”, which one would be forgiven for thinking came straight out of the transcript of a defamation trial.
2. Comparable remedies are available: The Court ordered that the dossier be marked up to correct inaccuracies and a significant damages award (by data protection standards) was made, which specifically recognised (albeit tentatively) that damages for reputational harm are recoverable under data protection law. It appears, therefore, that constructing a claim based on the Fourth Principle of the DPA/GDPR (accuracy) can help claimants to achieve their desired goals whilst avoiding elements of a defamation claim that are becoming increasingly difficult to get home on (e.g. serious harm post-Lachaux).
3. Accuracy’s the name of the game: The judgment makes clear that where inaccuracy of personal data is in issue, the defendant’s ability to show it took reasonable steps to verify the accuracy of that personal data will be key to avoiding liability. Orbis succeeded in demonstrating it took reasonable steps in relation to 4 of the 5 statements complained of.  However, the statement referring to “illicit cash” was a more serious allegation which Warby J decided required a more thorough level of verification.  Orbis failed to meet this standard for various reasons, including that the author had been aware that his source did not have direct knowledge of the underlying facts and was relying on hearsay evidence; as such, Warby J felt that the allegation required further investigation in order to establish whether it was appropriate for inclusion in the dossiers.

Media lawyers may already have heard rumours that data protection law is the new defamation – but this case really hammers home that point.  Another claim against Orbis, arising out of the same circumstances but brought as a defamation claim rather than a data protection claim, was recently judged by Mr Justice Warby to be unconvincing. It should be noted that, in neither case, did the claimants target the news publisher involved in disseminating the damaging content more widely, and arguably the real harm is therefore ongoing; however, for claimants seeking merely moral vindication and money in their pocket, this case is no doubt encouraging.