Joseph Pacini & Anor v Dow Jones & Company Inc.

In a data protection claim concerning media publications, personal data must be identified by reading the publication as a whole and considering the contextual meaning conveyed to the hypothetical reasonable reader. Defamation principles may guide that exercise, but they cannot be transposed indiscriminately into data protection law. The repetition rule applies when identifying the meaning of data, including reported allegations in court proceedings. Article 10 UK GDPR requires attention to the conduct actually imputed and whether ordinary readers would regard it as prohibited by criminal law. A report that a person has been accused in civil proceedings of receiving secret profits does not necessarily comprise criminal offence data, particularly where the publication presents the allegation as contested and refers only to civil proceedings.

The claimants, investment bankers and former senior executives of XIO Group, sued Dow Jones over two articles published in the Wall Street Journal in 2017 and 2018. They alleged that the articles contained inaccurate or misleading personal data, including data concerning alleged fraud, and sought remedies under the UK GDPR and the Data Protection Act 2018.

Following an unsuccessful strike-out application, the court was directed to determine two preliminary issues: the meaning of personal data relating to the claimants in the articles, and whether any such data constituted personal data relating to criminal convictions and offences within Article 10 UK GDPR.

1. Meaning of the data. The court adopted a contextual approach. It determined the single meaning of the data by reading each article as a whole and considering the meaning which the hypothetical reasonable reader would take from each element in its full context. The principles distilled in Koutsogiannis v Random House Group and the approach approved in Tinkler v Ferguson were applied.
2. The repetition rule was applied. The court declined to disapply it to material purporting to report court proceedings. The earlier reference in NT1 v Google LLC to paragraph 7 of Schedule 1 to the DPA 1998 did not justify creating an equivalent protection under later legislation.
3. Defamation principles provide useful guidance but cannot be applied indiscriminately. Data protection law may require a more literal, granular and faithful description of information held. Accuracy and fairness are distinct issues, and the meaning exercise should not be allowed to produce unnecessary complications concerning changing factual circumstances or later readership.
4. For the First Article, the relevant data meant that Xie Zhikun alleged in Cayman Islands civil proceedings that XIO executives had conspired to defraud him and that Joseph Pacini and Athene Li had received secret profits; Pacini denied the allegations and said Xie had never invested in XIO. The article did not convey that Carsten Geyer was one of the executives accused.
5. For the Second Article, the data meant that the source of XIO’s funding was unclear; that Pacini helped obtain support for XIO’s bid for J.D. Power and sought co-investment; that Geyer said XIO’s investors were not primarily Chinese; and that Xie had brought civil proceedings alleging that Pacini and Li had taken secret profits.
6. Criminal offence data. Applying Article 10 UK GDPR and section 11(2) of the DPA 2018, the court identified the conduct imputed by the text and asked whether ordinary readers would conclude that it was prohibited by criminal law. The First Article reported an allegation made in civil proceedings, denied by Pacini, and presented the true position as a mystery. It did not impute criminal conduct to him. Even if it did, ordinary readers would not conclude that receiving secret profits was prohibited by criminal law, especially since the article referred to civil proceedings and not criminal proceedings.
7. The Second Issue was therefore answered in the negative for both claimants. The court directed counsel to agree an order reflecting its determination of the preliminary issues.

The judgment determined preliminary issues ordered after HHJ Richard Parkes KC dismissed the defendant’s strike-out application. The present court did not determine the substantive data protection claim.