Data Protection and Home CCTV
According to the CJEU, the Data Protection Directive applies to a video recording made with a surveillance camera installed by a person on his family home and directed towards the public footpath.
The Court ruled in Case 212/13 František Ryneš v Ú?ad pro ochranu osobních údaj? that those installing domestic CCTV cameras are subject to the duties associated with data protection legislation. It should be noted however that, contrary to some extreme interpretations of the judgment, the Court has not banned such CCTV but has emphasised that its use may be permissible in pursuit of the controller’s legitimate interests. However, the case raises all sorts of data protection scares, and it has been persuasively argued that it may affect all sorts of image gathering in the public sphere.
In the case before the CJEU, Mr Ryneš and his family had been subjected to a number of attacks by unknown persons, and on several occasions the windows of their house were broken. In response to those attacks, Mr Ryneš installed a surveillance camera on the family home, which filmed the entrance, public footpath and the entrance to the house opposite.
During the night of 6 to 7 October 2007, a window of the family home was broken by a shot from a catapult. The recordings made by the surveillance camera were handed over to the police and made it possible to identify two suspects, who were subsequently prosecuted before the criminal courts.
However, one of the suspects disputed before the Czech Office for the Protection of Personal Data the legality of the processing of the data recorded by Mr Ryneš’ surveillance camera. The Office found that Mr Ryneš had in fact infringed the personal data protection rules and fined him. One of the points made by the Office was that the data on the suspect had been recorded without his consent while he was on the public footpath in front of Mr. Ryneš’ house.
The Nejvyšší správní soud (Supreme Administrative Court, Czech Republic), hearing the appeal in the dispute between Mr Ryneš and the Office, referred to the CJEU the question of whether the recording made by Mr Ryneš for the purposes of protecting the life, health and property of his family and himself (ie the recording of personal data relating to the individuals launching an attack on his house from the public footpath) constituted a category of data processing that is not covered by the directive, on the grounds that that recording was made by a natural person in the course of purely personal or household activities.
The CJEU held that the term ‘personal data’ as used in the Directive encompasses any information relating to an identified or identifiable natural person. An identifiable person is anyone who can be identified, directly or indirectly, by reference to one or more factors specific to his physical identity. Consequently, the image of a person recorded by a camera constitutes personal data because it makes it possible to identify the person concerned.
Similarly, video surveillance involving the recording and storage of personal data falls within the scope of the Directive, since it constitutes automatic data processing.
Secondly, the Court held that the exception provided for in the directive in the case of data processing carried out by a natural person in the course of purely personal or household activities must be narrowly construed. Accordingly, video surveillance which covers a public space and which is directed outwards from the private setting of the person processing the data cannot be regarded as an activity which is a ‘purely personal or household activity’.
In applying the directive, the national court must bear in mind the fact that that directive makes it possible to take into account the legitimate interest of the person who has engaged in the processing of personal data (‘the controller’) in protecting the property, health and life of his family and himself.
One of the situations in which personal data processing is permissible without the consent of the data subject is where it is necessary for the purposes of the legitimate interests pursued by the controller. Secondly, the data subject need not be told of the processing of his data where the provision of such information proves impossible or would involve a disproportionate effort. Thirdly, Member States may restrict the scope of the obligations and rights provided for under the Directive if such a restriction is necessary to safeguard the prevention, investigation, detection and prosecution of criminal offences, or the protection of the rights and freedoms of others.
Data Protection, Peerage and Privilege
A High Court judgment has rejected a claim under the Data Protection Act 1998 for disclosure of letters sent to the House of Lords Appointments Commission.
In Ranger v The House of Lords Appointments Commission [2015] EWHC 45 (QB), Dr Ranger sought to rely on the Data Protection Act 1998, s 7 so as to discover the contents of letters written to the House of Lords Appointments Commission which he believed related to his nomination for a peerage.
Purely for the purposes of argument, Knowles J assumed that the material sought was personal data within the meaning of the Act (although he expressed some doubts about that). Even with that considerable leg-up, Dr Ranger faced a formidable hurdle in that para 3 of sch 7 to the Act includes an exemption in respect of any honour or dignity, as follows:
‘Personal data processed for the purposes of—
(a) assessing any person’s suitability for judicial office or the office of Queen’s Counsel, or
(b) the conferring by the Crown of any honour or dignity,
are exempt from the subject information provisions.’
It was argued that a peerage is a public office in its own right and that ‘honour or dignity’ should be interpreted narrowly to exclude peerages. That argument was doomed and rejected on a number of grounds (see [16]-[19]). It was also suggested that, as a limited exemption applies in similar circumstances under the Freedom of Information Act 2000 where the public interest in maintaining the exemption outweighs the public interest in disclosing the information, a matching exemption could be implied under the Data Protection Act. Readers will not be surprised to learn that Knowles J did not think that statutory interpretation worked like that (at [22]). The third basis for argument was marginally more credible in that it was suggested that the implementation of the Data Protection Directive was defective insofar as para 3 of sch 7 restricted a data subject’s rights. Such a restriction was consistent with the Directive only if it was ‘a necessary measure to safeguard … (g) the protection of the … rights and freedoms of others‘. Knowles J accepted that such a restriction had to satisfy the principle of proportionality but, in his view (at [28]-[29]), para 3 of sch 7 ‘helps ensure the confidentiality of information provided to the Commission concerning those being considered for appointment to the House of Lords. The measure serves the objective of helping protect the rights of those who have provided the information in confidence. More broadly, because at least some information will only be provided if its source or content is kept confidential, the measure also serves the objective of helping ensure the protection of the rights of all members of the public to have the fullest information provided, with full candour, to the Commission in its work in connection with appointments to the House of Lords.‘ Knowles J was not persuaded that a less intrusive measure, such as under the FOIA, was workable.
The full judgment deals with, and dismisses, a couple of even more hopeless arguments.
Airlines Database and Screen-scraping
In Case C-30/14 Ryanair Ltd v PR Aviation BV the Court of Justice had to consider a reference from a court in the Netherlands. The Hoge Raad der Nederlanden referred just one question:
‘Does the operation of [Directive 96/9 – the Database Directive] also extend to online databases which are not protected by copyright on the basis of Chapter II of [that directive], and also not by a sui generis right on the basis of Chapter III, in the sense that the freedom to use such databases through the (whether or not analogous) application of Article[s] 6(1) and 8 in conjunction with Article 15 [of Directive 96/9], may not be limited contractually?’
The background to the case is that PR Aviation operates a web site which allows consumers to search flight data of low-cost air companies, compare prices and, on payment of commission, book a flight. PR Aviation responded to any consumer query relating to a Ryanair flight by automatically accessing data on the Ryanair web site, which is of course accessible to consumers. But access to that web site was conditional and the terms and conditions included the following:
The use of automated systems or software to extract data from this web site or www.bookryanair.com for commercial purposes, (‘screen scraping’) is prohibited unless the third party has directly concluded a written licence agreement with Ryanair which permits it access to Ryanair’s price, flight and timetable information for the sole purpose of price comparison.
The CJEU felt that the restriction on limiting the use of a database by contract where the Database Directive applied fell away where a database was not protected by either copyright or the sui generis database right. The mere fact that a set of data could properly be described as a database did not prevent the adoption of contractual clauses concerning the conditions of use of such a database. The CJEU ruled:
Contrary to PR Aviation’s submissions, that interpretation of Directive 96/9 is not capable of reducing the interest in claiming legal protection instituted by that directive in that the author of a database protected by that directive, unlike the author of a database which is not so protected, does not have the contractual freedom to limit the rights of users of its database.
Such arguments ignore the legal and economic interest that the system of automatic protection represents for a person who has invested in the creation of a database, harmonised in the Member States, which attaches to the exclusive right under copyright to reserve the right to perform the various acts referred to in Article 5 of Directive 96/9 and the right to prohibit under the sui generis right the acts referred to in Articles 7(1) and (5) and 8(2) thereof. …
That being the case, if the author of a database protected by Directive 96/9 decides to authorise the use of its database or a copy thereof, he has the option, as confirmed by recital 34 in the preamble to that directive, to regulate that use by an agreement concluded with a lawful user which sets out, in compliance with the provisions of that directive, the ‘purposes and the way’ of using that database or a copy thereof.
However, as regards a database to which Directive 96/9 is not applicable, its author is not eligible for the system of legal protection instituted by that directive, so that he may claim protection for his database only on the basis of the applicable national law.
Having regard to all of the foregoing considerations, the answer to the question referred is that Directive 96/9 must be interpreted as meaning that it is not applicable to a database which is not protected either by copyright or by the sui generis right under that directive, so that Articles 6(1), 8 and 15 of that directive do not preclude the author of such a database from laying down contractual limitations on its use by third parties, without prejudice to the applicable national law.
Online Air Fares
In Case C-573/13 Air Berlin v Bundesverband der Verbraucherzentralen und Verbraucherverbände the CJEU was faced with a reference from the Bundesgerichtshof that concerned Regulation (EC) No 1008/2008 on common rules for the operation of air services in the Community. The German Federal Union of Consumer Organisations and Associations had challenged the way in which air fares were presented in Air Berlin’s computerised booking system, as configured in November 2008.
The CJEU held that, in the context of a computerised booking system such as the system at issue, the final price to be paid must be indicated whenever the prices of air services are shown, including when they are shown for the first time. This applies not only to the air service specifically selected by the customer, but also to each air service in respect of which the fare is shown.
The Spam Defamation Case
In Ames & Anor v The Spamhaus Project Ltd & Anor [2015] EWHC 127 (QB), the High Court was dealing with an application by the defendants for an order dismissing all of the claims or summary judgment as well as a cross-application for permission to amend the statement of case. Warby J described the proceedings as ‘a case about spam‘, which may be true in relation to the broader proceedings but the main issues covered on the application to which judgment at this stage applies were whether the proceedings amounted an abuse of process, whether the claimants had a significant reputation in England and Wales, the extent of publication within the jurisdiction and whether the claimants had suffered or are likely to suffer any or any substantial or serious harm as a result of the alleged wrongs.
Background
The claimants are two entrepreneurs, Craig Ames and Robert McGee, who are both resident in California. Between them they set up and until about December 2013 were involved with a bulk email marketing services business, initially through a US corporation called Blackstar Media LLC, and latterly as employees of Blackstar Marketing. Readers will be familiar with the first defendants, the Spamhaus Project, which tracks and reports on sources of spam on the internet. The second defendant, Stephen Linford, is the founder of the Project and its chief executive.
Between December 2013 and May 2014, the claimants were named as spammers, and for most of this period were on the first defendant’s Register of Known Spam Offenders and at the top of its list of the Top 10 world’s worst spammers. Addresses relating to the claimants and a photograph of Mr McGee were also published by the Project. The claim was that the words used by Spamhaus to describe the claimants were libellous, and that the disclosure of their addresses was a misuse of private information. Mr McGee also complained that the reproduction of the photograph was an infringement of copyright.
Law
Warby J considered the Jameel jurisdiction (see Jameel (Yousef) v Dow Jones & Co Inc [2005] QB 946), essentially the issue of whether a real and substantial tort had been committed within the jurisdiction. This was relevant both to the defamation claim and the claims relating to misuse of private information and breach of copyright.
The proposition expressed by Simon J in Karpov v Browder was broadly endorsed by Warby J:
‘A claimant may be able to show a reputation sufficient to demonstrate a real and substantial tort within the jurisdiction in cases where, although he had no reputation at the time, such reputation was created and destroyed by the publication. However, such cases will usually arise where he or she has some form of prior or imminent connection with the jurisdiction.’
‘A publisher is responsible for damage caused by republications which are the natural and probable or reasonably foreseeable consequence of its own publication, and it is a feature of the internet that material once published may remain accessible for a considerable time, even if removed from the original site.’
As Warby J pointed out, the Spamhaus Project’s words were republished on a number of third party sites and on Google and remained on third-party sites for months after the Project had taken down the relevant postings (indeed, snippets were stored and remained available via search engines for a lengthy period, and the content is archived and remains accessible via the Internet Archive and Wayback). Warby J stated (at [47]) that:
‘It is also important to bear in mind that in a world of globalised business and swift, easy and cheap international communications a business person can more easily build up a reputation in a foreign place without visiting it, and the creation of a bad reputation in a foreign place is more likely to be of significance.’
The Defamation Act 2013, s 1, which states that ‘A statement is not defamatory unless its publication has caused or is likely to cause serious harm to the reputation of the claimant’ was then considered. That requirement does not replace the Jameel tests but is an additional barrier.
Decision
Having reviewed the facts, Warby J concluded (at [92]) that each claimant had a real prospect of establishing that publication of the words complained of within the jurisdiction during 2014 had caused serious harm to his reputation:
i. The claimants may very well establish that the web site publication bore the meaning they complain of, or a similar meaning, not only to readers of the Main Info and other sub-pages on the Spamhaus site but also to anyone who read the main ROKSO list or Top Ten list pages, and to those who read the republications of the sting of the Spamhaus allegations on third party web sites.
ii. Such meanings impute unlawful conduct in the course of business and, in the case of the full pleaded meaning, seriously unlawful, deceitful conduct over a period of years. That is inherently seriously harmful to reputation, that is to say it has a tendency to cause serious harm to reputation.
iii. The communication of that meaning is likely in every sense of the word to deter the reader from dealing with or associating with the claimants, provided the reader believes the meaning conveyed to be true.
iv. On present evidence, what Spamhaus says about those on the ROKSO and Top Ten lists is very likely indeed to be taken as true and relied on by readers, except perhaps by those so close to and trusting of the claimants that they would know or believe the allegations to be untrue. It is common ground that Spamhaus is considered authoritative and reliable. The republications relied on by the claimants support that view. The defendants’ own evidence makes clear that Spamhaus customers or readers rely and act on information provided by Spamhaus, when it comes to the claimants.
v. It is not possible to say at this stage that there was only insubstantial publication within the jurisdiction of these seriously harmful allegations. The extent of publication within the jurisdiction for which Spamhaus is responsible has yet to be fully established. …
vi. Moreover, there are those who read the claimants’ names on the ROKSO or Top Ten lists but did not delve further. There may have been more than 2,300 of these. It is not fanciful to suggest that the relevant audience includes these publishees. Beyond this there are the republications complained of, made in at least some cases on apparently authoritative web sites, though again the extent to which these flowed from and were made within this jurisdiction is as yet uncertain. (I leave out of account the Internet Archive).
vii. It is not possible to say, either, that publication in this jurisdiction was clearly inconsequential. …
viii. … though they are foreign, the claimants do have past and present business connections here that their evidence suggests may be substantial and material. I have in mind in particular their roles as managers within Blackstar Marketing for what I understand to be some 18 months (from April 2011 to December 2013), at a time when the company was conducting email marketing for UK businesses. This could turn out to lack significance but it is not obviously insubstantial.
ix. As importantly, or more so, the claimants say they wish and intend to do business here in future, and are on the verge of launching a start-up business with a UK presence. Again, the claimants have questions to answer about this new venture. It may prove that this does not in fact have the significance which it presently appears it may have. But I cannot simply reject their evidence on these issues. It is not obvious at this stage that there is a bright line between the readership of the Spamhaus web site and those whose opinion of the claimants could be of real significance for their business prospects. Already, the claimants are able to identify among the publishees a number of ISPs, a newspaper publishing company, and a company with which they have previously done substantial business. They attribute significance to these publishees and are not obviously wrong to do so.
x. In my judgment, therefore, although they might fail on the issue after full disclosure and a full examination of the evidence, the claimants have a real prospect of establishing that those within the jurisdiction who read and are likely to have believed the words complained of (and the republications of their sting) include people whose opinion of the claimants is of serious consequence to them and their business prospects. Proof of that much could be sufficient to establish that serious harm to reputation has been caused, even if no such individual was called to give evidence.
