Prior to the Supreme Court’s judgment in Lloyd v Google [2021] UKSC 50, numerous representative claims – akin to opt-in class actions – were afoot in the data protection arena. Most seem, understandably, to have fizzled out following Lloyd. But not all. Following this week’s judgment in SMO v TikTok Inc. and Others [2022] EWHC 489 (QB), the claim against TikTok has more or less scraped through its first procedural hurdle, and now is now gearing up for a summary judgment hearing in the months ahead. Continue reading
Bloomberg v ZXC – the Supreme Court decides
The central question for the Supreme Court in Bloomberg v ZXC [2022] UKSC 5 was, as Lords Hamblen and Stephens put it (with Lord Reeds, Lloyd-Jones and Sales agreeing): “whether, in general, a person under criminal investigation has, prior to being charged, a reasonable expectation of privacy in respect of information relating to that investigation”. The short answer was “yes”.
Duchess of Sussex v Associated News Ltd – the Court of Appeal Rules
The Court of Appeal has today refused an appeal by Associated News against the decision of Mr Justice (now Lord Justice) Warby to grant the Duchess of Sussex summary judgment in respect of her claim for breach of privacy rights and breach of copyright against Associated. This is an important judgment on the interplay between privacy and free speech rights, not to mention the application of copyright law, and so bears some detailed consideration. Continue reading
Data in the sporting arena – LawInSport Conference next week
In case of interest, LawInSport’s Annual Conference is running a panel session next Tuesday morning on the subject of the use and commercialisation of player data in the sports arena (I am speaking alongside Hugh Tomlinson QC and Jorge Oliveira, Head of Data Protection at FIFA). The entire two-day conference is now being run remotely. You can purchase tickets here.
Anya Proops QC
Substance Abuse: Section 166 Applications and the End of the Road
One of the conspicuous failures of the DPA 2018 has been the right to apply to the Tribunal under s166 for an order that the ICO progress a complaint made to it. Data subjects assume that this allows them to ask the Tribunal to overturn how the ICO has resolved their complaint. They perhaps not unreasonably assume the process would be of limited value if it were limited to the sort of procedural steps set out in s166(1), and they are instead left having to sue the controller under ss167-169. Some very well-regarded commentators have expressed the view that s166 ought to be interpreted more generously. They may think all of those things. But they would think wrong. Continue reading
Personal Data and Identifiability
It is a common problem encountered by data controllers that a dataset is in principle anonymous, but where the numbers within that dataset are sufficiently small, the individual data subject(s) to which they relate may be identifiable, particularly when taken with other publicly available information. Datasets released often refuse to provide the specific number where it is below five for that reason. In NHS Business Authority v Information Commissioner & Spivack [2021] UKUT 192 (AAC), the Upper Tribunal reviewed and revisited that issue. Continue reading