InView Autumn/Winter 2015

More documents

Info

8 InView | An independent eye on insurance Regina (Ingenious Media Holdings plc and another) v Revenue and Customs Commissioners [2015] 1 WLR 3183 related to an off-therecord briefing which the permanent secretary for tax at HMRC had given to two Times journalists, during which he had made a number of unflattering remarks about the claimant company (a promoter of film finance schemes) and its founder CEO. The claimants’ application for judicial review of the permanent secretary’s decision to disclose information relating to them was dismissed both at first instance and on appeal. Much of Sir Robin Jacob’s judgment in the Court of Appeal related to particular provisions in the Commissioners for Revenue and Customs Act 2005, but his conclusions on the CEO’s Article 8 claim are of more general interest: since the particular offending remarks had not been published in the Times, HMRC’s disclosure to the journalists had been to such a limited class that it involved no sufficient direct or grave interference with the claimants’ private life interests as to infringe the requirement of the right of respect for private life. In Vidal-Hall v Google Inc [2015] C.P. Rep. 28 the claimants sued Google (a Delaware corporation) over its collection of information about their internet browsing habits; they brought claims both for misuse of private information and for contravention of their rights under the Data Protection Act 1998. The Court of Appeal addressed two separate issues. First the Court held that (contrary to dicta in some earlier cases) a claim for misuse of private information is separate and distinct from the traditional equitable action for breach of confidence, and is a tort. Secondly, the Court considered section 13(2) of the Data Protection Act 1998, which purports to allow compensation under the DPA for distress only to those claimants who can also demonstrate some pecuniary damage. The Court held that section 13(2) was in this respect inconsistent with the rights granted by Article 23 of the relevant European data protection Directive (95/46), and accordingly disapplied it. Equity Judicial development of the traditional equitable principles of confidentiality has taken more of a back seat during 2015 thus far, but Warwickshire County Council v Matalia (a decision of Newey J, sitting in the Chancery Division in Birmingham District Registry, on 27 February 2015) was an interesting addition to the jurisprudence on the vexed question as to when information no longer qualifies as confidential because it has entered the public domain. Newey J granted an injunction to restrain the defendant from publishing on the internet some questions which had been set in an 11-plus test, at a time when some of the candidates had still not taken the test; he held that the contents of the test had not become so generally accessible that it could no longer be regarded as confidential. An appeal is due to be heard later this year. Procedure Finally, issues of confidentiality often arise in the context of procedural disputes. One frequently recurring phenomenon has been the judge-appointed “confidentiality club” to whom the disclosure of sensitive documents or information may be restricted. Recent decisions that demonstrate the very wide range of circumstances in which the possibility of confidentiality clubs may surface include Libyan Investment Authority v Societe Generale SA [2015] EWHC 530 (QB), Al Fawwaz v Secretary of State for the Home Department [2015] EWHC 469 (Admin), Secretary of State for Health v Servier Laboratories Ltd [2015] 4 CMLR 20, TalkTalk Telecom Group plc v British Telecommunications plc [2015] CAT 13, and Warner-Lambert Co LLC v Actavis Group [2015] EWHC 2123 (Pat). As these and other cases show, confidentiality clubs, even if convenient in practical terms, can often give rise to difficult questions of principle – especially as the relevant litigation progresses towards a final hearing. In re JR38 [2015] 3 WLR 155 was a decision of the Supreme Court, on appeal from the Divisional Court (QB) in Northern Ireland. The Police Service of Northern Ireland had published photographs of people who were present at riots in Derry, with a view to identifying them. One of the subjects was only 14 years old at the time and sought a judicial review of the decision to publish his photograph. The Supreme Court unanimously dismissed his claim, but their Lordships disagreed as to the legal test to be applied. The majority held that the touchstone for the engagement of Article 8 was whether the applicant, on the facts, had a reasonable expectation of privacy in relation to the subject matter of his complaint. (Lords Kerr and Wilson, dissenting, pointed to the effect that the publication of the photographs could have on the life of a child and considered that the test of “reasonable expectation of privacy” should not be regarded as an inflexible determinative test.) One frequently recurring phenomenon has been the judge-appointed “confidentiality club” to whom the disclosure of sensitive documents or information may be restricted. Charles Phipps, Barrister 4 New Square Chambers © Copyright. Weightmans 2015. All rights reserved.
Issue 2 | Autumn/Winter 2015 9 VIEWPOINT The Court of Appeal’s ruling that three UK domiciled individuals can pursue a privacy claim against Google (Vidal–Hall et al v Google [2015] EWCA Civ 311) has a number of implications to the insurance industry. The court held that “what is alleged to have been the secret and blanket tracking and collation of information, often of an extremely private nature” raised serious issues meriting a trial. The case has potentially huge ramifications for online privacy and data protection law – as well as for data breaches and how the Data Protection Act 1998 is interpreted. Claims relating to breaches of data security are now achieving an increasingly significant profile which is likely to attract more interest from law firms willing to deal with these claims on a ‘no win, no fee’ basis. This could lead to a spate of compensation claims for data security breaches, particularly if and when notification of a breach becomes compulsory under the EU General Data Protection Regulation. There are serious concerns amongst some commentators that companies breaching their data protection obligations could potentially face compensation claims amounting to many hundreds of thousands of pounds. Individual claims may not be for enormous sums, but the multiplier effect (think of the recent events involving Ashley Madison where, reportedly, millions of accounts have been compromised) could magnify an organisations exposure beyond that which may have been originally envisaged. This in turn could see an increase in settlements just to avoid the additional costs associated with litigation. The general legal principle is that anonymised data is not personal data. This raises the question, to what extent data can be filtered before data subjects become identifiable and the data becomes “personal data”? So what does this mean for insurers? The most important legal point emerging from this case may be that misuse of private information is a tort (unlike breach of confidence). Whilst this is an important legal distinction it is unlikely to have much impact on the bottom line for insurers. That said, parties entering into commercial contracts would be well advised to expressly set out in their contracts the manner and purpose for which personal data may be used. An example of the widespread use of an individual’s personal data would be store loyalty cards where customers buying habits are used to target advertising. The potential claims arising in the event of a data protection breach could be significant and insurers will be well advised to carefully consider their policy wording so they do not expose themselves to an unintended risk of loss. The outcome of the case against Google may well determine a number of legal issues which currently give rise to well-founded concerns in relation to information and data security. For those businesses whose interests are likely to be impacted, further clarity cannot come soon enough. Bavita Rai, Partner 0121 200 3499 bavita.rai@weightmans.com Claims relating to breaches of data security are now achieving an increasingly significant profile which is likely to attract more interest from law firms willing to deal with these claims on a ‘no win, no fee’ basis. Market Affairs Group Weightmans’ Market Affairs Group (MAG) is responsible for all forms of market affairs activity on behalf of the firm. MAG can report and inform insurers on the latest market developments and translate this into actions, objectives and strategies providing real value.
Page 1 and 2: Autumn/Winter 2015 Issue 2 HOW TO S
Page 3 and 4: Issue 2 | Autumn/Winter 2015 3 INTR
Page 5 and 6: Issue 2 | Autumn/Winter 2015 5 CYBE
Page 7: Issue 2 | Autumn/Winter 2015 7 RECE
Page 11 and 12: Issue 2 | Autumn/Winter 2015 11 Pro
Page 13 and 14: Issue 2 | Autumn/Winter 2015 13 The
Page 15 and 16: Issue 2 | Autumn/Winter 2015 15 Tec
Page 17 and 18: Issue 2 | Autumn/Winter 2015 17 In
Page 19 and 20: Issue 2 | Autumn/Winter 2015 19 Ins
Page 21 and 22: Issue 2 | Autumn/Winter 2015 21 Vic
Page 23 and 24: Issue 2 | Autumn/Winter 2015 23 Soc
Page 25 and 26: Issue 2 | Autumn/Winter 2015 25 5.
Page 27 and 28: Issue 2 | Autumn/Winter 2015 27 Mer

InView Autumn/Winter 2015

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?