Stunt v Associated Newspapers Ltd

A stay under section 32(4) of the Data Protection Act 1998 protects journalistic activity only at the pre-publication stage. It does not prevent claims concerning the publication of personal data, or the processing which culminated in that publication.

This restricted interpretation accords with the provision’s purpose of preventing data-protection proceedings from chilling investigative journalism or restraining publication. It is also required by the EU principle of consistent interpretation because a literal, potentially indefinite stay would exceed what was necessary to reconcile privacy and freedom of expression.

The court was divided on whether even the restricted stay complied with the governing EU directive. The majority considered it compatible; the minority disagreed. The question was referred to the Court of Justice of the European Union.

The appellant brought claims against a newspaper publisher alleging unlawful processing of his personal data. The claims sought compensation and orders for access, cessation of processing, erasure and destruction under the Data Protection Act 1998.

Popplewell J, in [2017] EWHC 695 (QB), stayed the statutory claims under section 32(4). He held that the stay formed part of the substantive balance between data protection and journalistic freedom of expression and was compatible with EU law.

The appeal concerned the scope of section 32(4), its compatibility with articles 9 and 22 of Directive 95/46/EC, and the remedy for any incompatibility. The Information Commissioner intervened. The central questions were whether the stay extended to previously published personal data and whether the restricted stay permitted by the court’s interpretation complied with EU law.

1. Restricted construction of the stay. Section 32(4) of the Data Protection Act 1998 was to be construed purposively. The stay does not cover claims concerning the publication of journalistic material or the processing of personal data which culminated in that publication. It is confined to the processing of unpublished personal data with a view to future publication.

2. A literal construction could create an effectively permanent barrier whenever a controller asserted that previously published data continued to be held for new journalistic material. That restriction would go substantially beyond the provision’s purpose: preventing pre-publication injunctions and the chilling effect of data-protection proceedings on investigative journalism. The restricted construction was consistent with Campbell v Mirror Group Newspapers Ltd [2002] EWCA Civ 1373 and with the parliamentary materials.

3. The restricted construction was also required by the EU duty of consistent interpretation. Article 9 of Directive 95/46/EC permits journalistic derogations only where necessary to reconcile privacy with freedom of expression. The court could adopt the restricted construction without altering a fundamental feature of the legislation or going against its grain.

4. Majority view on compatibility. Sir Terence Etherton MR and McFarlane LJ considered the restricted stay compatible with articles 9 and 22. Member states enjoyed a significant margin of appreciation when reconciling the competing rights. Parliament could protect the gathering and preparation of unpublished journalistic material from litigation, particularly given the chilling effect of prior restraint. The stay formed part of the statutory delineation of the data subject’s rights, while post-publication remedies remained available.

5. Minority view. Sharp LJ considered that even the restricted stay probably exceeded what was necessary. It arose automatically upon the controller’s untested assertion; the Commissioner’s review was discretionary and confined; and the data subject could face a lengthy or permanent exclusion from judicial remedies. In her view, this also presented a strong case of incompatibility with article 22.

6. The compatibility question was not acte clair. The court directed that a reference be made to the Court of Justice of the European Union and invited further submissions on its form and content.

1. Court of Appeal (Civil Division): In [2018] EWCA Civ 1780 , the court construed section 32(4) of the Data Protection Act 1998 restrictively and directed a reference to the Court of Justice of the European Union on compatibility with Directive 95/46/EC.
2. High Court, Queen’s Bench Division: Popplewell J, in [2017] EWHC 695 (QB) , ordered a stay of the appellant’s data-protection claims under section 32(4) and held the provision compatible with EU law.