Tag: Article 10 ECHR

Are you thinking what I’m linking? Liability for hyperlinks

Posted on | by Leo Davidson

Many users of the internet know all too well the hidden dangers of hyperlinks.  Now the European Court of Human Rights has considered the extent to which those posting links are responsible for the third party content being linked to, in Magyar Jeti Zrt v Hungary (Case no. 11257/16).

In 2013, a Hungarian politician drew a link between racist assaults by football fans and Jobbik, a right-wing Hungarian political party.  A recording of his remarks was uploaded to YouTube.  When reporting the story, 444.hu – a news website operated by the applicant company – included a hyperlink to the recording, without repeating the defamatory content in the body of their article. Continue reading →

Personal data and politicians’ names

Posted on | by Julian Milford

 

Can the name of a local councillor who has defaulted on Council tax properly be withheld from disclosure under the exemption for personal data in s.40 FOIA? That was the issue for the Upper Tribunal (“UT”) in Haslam v (1) Information Commissioner (2) Bolton Council [2016] UKUT 0139 (AAC), 10 March 2016. Mr Haslam, a journalist on the Bolton News, had submitted a FOIA request to Bolton Council for disclosure of names of councillors who had received reminders for non-payment of Council tax since May 2011. The Council refused to name names, citing the exemption in s.40 FOIA. The Information Commissioner and First-Tier Tribunal (“FTT”) upheld the Council’s decision. The UT (Judge Markus QC) has now reversed the FTT’s decision, and held that the name of the individual councillor concerned should be released.

The UT held that releasing the name would not contravene the data protection principles, because processing was necessary for the purposes of legitimate interests pursued by Mr Haslam, and was not unwarranted because of prejudice to the councillor’s rights/legitimate interests. In substance, this involved carrying out an Article 8/Article 10 ECHR balancing exercise. It is apparent from the UT’s decision that the critical element in that balancing exercise was the councillor’s status as an elected official with public responsibilities, to which non-payment of council tax was directly and significantly relevant. In particular, a councillor is barred from voting on the Council’s budget if he has an outstanding council tax debt of over two months. So Council tax default, per the UT, “strikes at the heart of the performance of a councillor’s functions”. Voters would want to know whether the councillor was carrying out his duties. That in turn meant that (i) a councillor could not have any expectation that his name would be withheld, even if his identification intruded significantly into his private life; and (ii) on the other side of the balance, there was a compelling legitimate interest in the public knowing his name. Judge Markus QC said that there might be exceptional cases in which the personal circumstances of a councillor were “so compelling” that their name should be protected; but these were not such circumstances – even though disclosure might cause some distress to the councillor, and damage to his reputation. In short, elected officials are not in the same position as other members of the public when it comes to disclosure of their names. They can expect their names to be disclosed in circumstances where ordinary members of the public might expect the opposite.

 

Two other points of interest arise from the decision:

  1. The UT said that the relevant “legitimate interests” of the third party to whom data is disclosed were the interests of the requester, not the public at large. The fact that FOIA, in general, is “motive-blind”, and disclosure under FOIA is to the world, did not mean that the “third party” in question had to be treated as if it were the public as a whole, rather than the requester. However, in the present case, that made no practical difference, because Mr Haslam was a journalist, and his own interests elided with those of the public.
  2. The issue arose whether Mr Haslam should receive a gist of the closed material in the case. The closed material concerned the personal mitigating circumstances of the councillor in question. The UT applied the principle in Browning v Information Commissioner [2014] 1 WLR 3848 that information should not be withheld unless strictly necessary; but considered that nevertheless, it was not possible to provide a gist. Giving a gist would materially increase the risk of the councillor being identified, and that would defeat the purpose of the appeal.

Anya Proops QC of 11KBW acted pro bono for Mr Haslam; Robin Hopkins of 11KBW for the Information Commissioner, and Christopher Knight of 11KBW for the Council.

‘Plebgate’ and the protection of journalistic sources

Posted on | by Robin Hopkins

It has been a mixed day for the media’s entanglements with the judiciary. Chris Knight posted earlier today about the unhappy outcome for Mirror Group Newspapers before the Court of Appeal in the Gulati privacy damages litigation arising from phone-hacking.

News Group Newspapers, however – together with Sun journalist claims Tom Newton Dunn, Anthony France and Craig Woodehouse – had a happier outcome in another case about telephone privacy, though this time with the media as victim rather than perpetrator of the interference.

Judgment IPT/14/176/H saw the claimants succeed in part in their claim against the Metropolitan Police in the Investigatory Powers Tribunal (‘IPT’). Continue reading →

FOI and Article 10: life after Kennedy (and Kenedi)

Posted on | by Robin Hopkins

The right to freedom of expression under Article 10(1) of the European Convention on Human Rights includes “freedom… to receive and impart information and ideas without interference by public authority”. Does that mean that there is a human right to freedom of information?

The question has haunted the courtrooms of the UK and other EU member states in recent years. In England and Wales, the last domestic word has been Kennedy v Charity Commission [2014] UKSC 20. The answer in Kennedy was ‘no’: Article 10 ECHR does not impose a positive, free-standing duty on public authorities to disclose information upon request.

That is not, however, the final word. Kennedy is to be heard by the European Court of Human Rights in Strasbourg – but the case has been stayed. This is because the Grand Chamber accepted another case raising essentially the same question.

The case is Magyar Helsinki Bizottság v Hungary (18030/11). The applicant, a human rights NGO, asked police forces to disclose information about ‘public defenders’, i.e. defence counsel appointed in criminal proceedings. The police forces refused, and the Hungarian court refused to order disclosure. The applicant complains that the refusal interferes with its rights under Article 10.

The case Bizottság was heard by the Grand Chamber today.

The UK government was an intervener. It urged the Court to conclude that Article 10 ECHR does not create a right to receive information from a public authority, in accordance with a line of authority (Leander v Sweden (1987) 9 EHRR 433, Gaskin v United Kingdom (1990) 12 EHRR 36, Guerra v Italy (1998) 26 EHRR 357 and Roche v United Kingdom (2006) 42 EHRR 30).

The Hungarian government’s position was to the same effect. It contended that concessions made in cases supporting the link between Article 10 and freedom of information (such as Társaság a Szabadsagjogokert v Hungary (2011) 53 EHRR 3 and Kenedi v Hungary 27 BHRC 335) were fact-specific.

Statutory rights to freedom of information in England and Wales are currently under threat of curtailment. Kennedy introduced (or confirmed) that, at least in certain circumstances, freedom of information also has a common law foundation. The Grand Chamber’s judgment in Bizottság will reveal whether, in addition to its statutory and common law pillars, freedom of information has a human rights basis as well.

Jason Coppel QC, Karen Steyn QC and Christopher Knight of 11KBW represented intervening parties in Bizottság.

Robin Hopkins @hopkinsrobin

Some results may have been removed under data protection law in Europe. Learn more.

Posted on | by Robin Hopkins

This is the message that now regularly greets those using Google to search for information on named individuals. It relates, of course, to the CJEU’s troublesome Google Spain judgment of 13 May 2014.

I certainly wish to learn more.

So I take Google up on its educational offer and click through to its FAQ page, where the folks at Google tell me inter alia that “Since this ruling was published on 13 May 2014, we’ve been working around the clock to comply. This is a complicated process because we need to assess each individual request and balance the rights of the individual to control his or her personal data with the public’s right to know and distribute information”.

The same page also leads me to the form on which I can ask Google to remove from its search results certain URLs about me. I need to fill in gaps like this: “This URL is about me because… This page should not be included as a search result because…” 

This is indeed helpful in terms of process, but I want to understand more about the substance of decision-making. How does (and/or should) Google determine whether or not to accede to my request? Perhaps understandably (as Google remarks, this is a complicated business on which the dust is yet to settle), Google doesn’t tell me much about that just yet.

So I look to the obvious source – the CJEU’s judgment itself – for guidance. Here I learn that I can in principle ask that “inadequate, irrelevant or no longer relevant” information about me not be returned through a Google search. I also get some broad – and quite startling – rules of thumb, for example at paragraph 81, which tells me this:

“In the light of the potential seriousness of that interference, it is clear that it cannot be justified by merely the economic interest which the operator of such an engine has in that processing. However, inasmuch as the removal of links from the list of results could, depending on the information at issue, have effects upon the legitimate interest of internet users potentially interested in having access to that information, in situations such as that at issue in the main proceedings a fair balance should be sought in particular between that interest and the data subject’s fundamental rights under Articles 7 and 8 of the Charter. Whilst it is true that the data subject’s rights protected by those articles also override, as a general rule, that interest of internet users, that balance may however depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life.”

So it seems that, in general (and subject to the sensitivity of the information and my prominence in public life), my privacy rights trump Google’s economic rights and other people’s rights to find information about me in this way. So the CJEU has provided some firm steers on points of principle.

But still I wish to learn more about how these principles will play out in practice. Media reports in recent weeks have told us about the volume of ‘right to be forgotten’ requests received by Google.

The picture this week has moved on from volumes to particulars. In the past few days, we have begun to learn how Google’s decisions filter back to journalists responsible for the content on some of the URLs which objectors pasted into the forms they sent to Google. We learn that journalists and media organisations, for example, are now being sent messages like this:

“Notice of removal from Google Search: we regret to inform you that we are no longer able to show the following pages from your website in response to certain searches on European versions of Google.”

Unsurprisingly, some of those journalists find this puzzling and/or objectionable. Concerns have been ventilated in the last day or two, most notably by the BBC’s Robert Peston (who feels that, through teething problems with the new procedures, he has been ‘cast into oblivion’) and The Guardian’s James Ball (who neatly illustrates some of the oddities of the new regime). See also The Washington Post’s roundup of UK media coverage.

That coverage suggests that the Google Spain ruling – which made no overt mention of free expression rights under Article 10 ECHR – has started to bite into the media’s freedom. The Guardian’s Chris Moran, however, has today posted an invaluable piece clarifying some misconceptions about the right to be forgotten. Academic commentators such as Paul Bernal have also offered shrewd insights into the fallout from Google Spain.

So, by following the trail from Google’s pithy new message, I am able to learn a fair amount about the tenor of this post-Google Spain world.

Inevitably, however, given my line of work, I am interested in the harder edges of enforcement and litigation: in particular, if someone objects to the outcome of a ‘please forget me’ request to Google, what exactly can they do about it?

On such questions, it is too early to tell. Google says on its FAQ page that “we look forward to working closely with data protection authorities and others over the coming months as we refine our approach”. For its part, the ICO tells us that it and its EU counterparts are working hard on figuring this out. Its newsletter from today says for example that:

“The ICO and its European counterparts on the Article 29 Working Party are working on guidelines to help data protection authorities respond to complaints about the removal of personal information from search engine results… The recommendations aim to ensure a consistent approach by European data protection authorities in response to complaints when takedown requests are refused by the search engine provider.”

So for the moment, there remain lots of unanswered questions. For example, the tone of the CJEU’s judgment is that DPA rights will generally defeat economic rights and the public’s information rights. But what about a contest between two individuals’ DPA rights?

Suppose, for example, that I am an investigative journalist with substantial reputational and career investment in articles about a particular individual who then persuades Google to ensure that my articles do not surface in EU Google searches for his name? Those articles also contain my name, work and opinions, i.e. they also contain my personal data. In acceding to the ‘please forget me’ request without seeking my input, could Google be said to have processed my personal data unfairly, whittling away my online personal and professional output (at least to the extent that the relevant EU Google searches are curtailed)? Could this be said to cause me damage or distress? If so, can I plausibly issue a notice under s. 10 of the DPA, seek damages under s. 13, or ask the ICO to take enforcement action under s. 40?

The same questions could arise, for example, if my personal backstory is heavily entwined with that of another person who persuades Google to remove from its EU search results articles discussing both of us – that may be beneficial for the requester, but detrimental to me in terms of the adequacy of personal data about me which Google makes available to the interested searcher.

So: some results may have been removed under data protection law in Europe, and I do indeed wish to learn more. But I will have to wait.

Robin Hopkins @hopkinsrobin

GCHQ’s internet surveillance – privacy and free expression join forces

Posted on | by Robin Hopkins

A year ago, I blogged about Privacy International’s legal challenge – alongside Liberty – against GCHQ, the Security Services and others concerning the Prism/Tempora programmes which came to public attention following Edward Snowden’s whistleblowing. That case is now before the Investigatory Powers Tribunal. It will be heard for 5 days, commencing on 14 July.

Privacy International has also brought a second claim against GCHQ: in May 2014, it issued proceedings concerning the use of ‘hacking’ tools and software by intelligence services.

It has been announced this week that Privacy International is party to a third challenge which has been filed with the Investigatory Powers Tribunal. This time, the claim is being brought alongside 7 internet service providers: GreenNet (UK), Chaos Computer Club (Germany); GreenHost (Netherlands); Jimbonet (Korea), Mango (Zimbabwe), May First/People Link (US) and Riseup (US).

The claim is interesting on a number of fronts. One is the interplay between global reach (see the diversity of the claimants’ homes) and this specific legal jurisdiction (the target is GCHQ and the jurisdiction is the UK – as opposed, for example, to bringing claims in the US). Another is that it sees private companies – and therefore Article 1 Protocol 1 ECHR issues about property, business goodwill and the like – surfacing in the UK’s internet surveillance debate.

Also, the privacy rights not only of ‘ordinary’ citizens (network users) but also specifically those of the claimants’ employees are being raised.

Finally, this claim sees the right to free expression under Article 10 ECHR – conspicuously absent, for example, in the Google Spain judgment – flexing its muscle in the surveillance context. Privacy and free expression rights are so often in tension, but here they make common cause.

The claims are as follows (quoting from the claimants’ press releases):

(1) By interfering with network assets and computers belonging to the network providers, GCHQ has contravened the UK Computer Misuse Act and Article 1 of the First Additional Protocol (A1AP) of the European Convention of Human Rights (ECHR), which guarantees the individual’s peaceful enjoyment of their possessions

(2) Conducting surveillance of the network providers’ employees is in contravention of Article 8 ECHR (the right to privacy) and Article 10 ECHR (freedom of expression)

(3) Surveillance of the network providers’ users that is made possible by exploitation of their internet infrastructure, is in contravention of Arts. 8 and 10 ECHR; and

(4) By diluting the network providers’ goodwill and relationship with their users, GCHQ has contravened A1AP ECHR.

Robin Hopkins @hopkinsrobin