Wacks, Raymond --- "What has data protection to do with privacy?" [2000] PrivLawPRpr 11; (2000) 6(9) Privacy Law and Policy Reporter 143

• Privacy Commissioner wrong
• The appeal
• Collection or use?
• Intrusion or disclosure?
• Applying the analysis to data protection
• Conclusion

What has data protection to do with privacy?

Raymond Wacks

Murkiness abounds in the privacy jungle. The question of the relationship between data protection legislation and the right of privacy has long inhabited this murk. The two plainly overlap; indeed, the latter is normally invoked as the interest which animates the former. But even in our burgeoning information society, ‘privacy’ is not necessarily violated by what we once called ‘data banks’.[1]

To some extent, of course, data protection (fashioned to regulate some of the problems generated by the collection, use, storage and transfer of personal data) can and does protect individuals’ ‘privacy’. When this claim is made it normally means, I think, not that data protection laws can or should resolve the wider questions that, especially in the US, are accommodated under the ever expanding umbrella of ‘privacy’ (abortion, contraception, homosexuality and so on), but whether personal information obtained by intrusive conduct or gratuitously disclosed by the media lies outside the scope of such legislation.

This is not a matter of mere academic interest; the application of data protection to matters that are considered by many to lie beyond its orbit is now a reality. The collection and use of personal data by the media is the most conspicuous example of this development, though the European Directive on Data Protection explicitly exempts the press from its purview.[2] This article, while it may have wider application to data protection legislation in other jurisdictions, is confined to a problem that has arisen in my own.

Privacy Commissioner wrong

I recently reported in these pages[3] the first judicial review of Hong Kong’s Privacy Commissioner for Personal Data[4] under the Personal Data (Privacy) Ordinance.[5] The Commissioner survived the challenge, but that decision has just been reversed by the Court of Appeal.6

Attentive readers will recall that the defendant, a popular Chinese magazine, published a photograph of a young woman to illustrate an article on fashion. Her image, taken with a long range lens as she stood at a busy intersection, was used as an example of poor dress sense. She consented neither to the photograph nor to its subsequent unkind publication. Her successful complaint to the Privacy Commissioner was based on a breach of the first data protection principle (DPP 1) in Sch 1 of the Personal Data (Privacy) Ordinance requiring, inter alia, that personal data be collected by means that are ‘fair in the circumstances of the case’.

The learned judge rejected the magazine’s argument that since it wanted to capture the complainant’s picture in a ‘natural pose’, its non-consensual long range photograph was justified. And he gave short shrift to its claim that since the Commissioner had accepted that it would have been impractical to obtain the complainant’s prior consent to a candid photograph, such a picture could be taken without her knowledge.

This, he held, was an erroneous construction of the Commissioner’s decision, for he had not found the taking of the photograph to have been unfair solely on this ground:

What rendered the taking of the photograph unfair was the fact that it was taken without the complainant’s knowledge or consent at a time when (a) the photographer did not have reasonable grounds for thinking that he would be able to obtain her consent to its publication, and (b) the magazine did not have a policy of publishing someone’s photograph (obtained without the person’s knowledge or consent) in such a way that the person cannot be identified.[7]

The Court of Appeal (by a majority) has now held that the facts fell outside of the ambit of the legislation. Neither DPP 1 nor any of the data protection principles were ‘engaged’. The Privacy Commissioner had therefore been wrong to rule against the magazine.

The appeal

The judgment rests on four main grounds. First, the act of photographing the plaintiff did not constitute an act of data collection. This was because:

the essence of the required act of personal data collection [is] that the data user must thereby be compiling information about an identified person or about a person whom the data user intends or seeks to identify. The data collected must be an item of personal information attaching to the identified subject ... This is missing in the present case. What is crucial here is the complainant’s anonymity and the irrelevance of her identity so far as the photographer, the reporter and Eastweek were concerned. Indeed, they remained completely indifferent to and ignorant of her identity right up to and after publication of the offending issue of the magazine. She would have remained anonymous to Eastweek if she had not lodged a complaint and made her identity known. In my view, to take her photograph in such circumstances did not constitute an act of personal data collection relating to the complainant.[8]

Second, to apply DPP 1 to the facts of the case would unduly inhibit press freedom, since a newspaper may wish to publish photographs of unidentified persons to illustrate some social pheno-menon, such as teenagers smoking.

Third, other provisions of the Ordinance (such as access rights and the use limitation requirement in DPP 3) point to the necessity for a data subject whose identity is known or sought to be known by the data user as an important item of information. In other words, the right of access, for example, makes sense only if the data user holds the data collected in relation to each identified data subject. This was of course not the case here.

Fourth, the Ordinance protects only personal data; it is not intended to create a general right of privacy against all forms of intrusion into the private domain.

The court stressed that it was not deciding that taking someone’s photograph could never be an act of personal data collection. It depended on the circumstances:

Thus, if someone’s photograph is taken with a view to its inclusion as part of a dossier being compiled about him as an identified subject, the act of photography would clearly be an act of personal data collection. For example, the portfolio of photographs of particular actors, entertainers or fashion models maintained by a theatrical impresario or fashion modelling agency would clearly constitute personal data collected in relation to the individuals in question. Similarly, law enforcement agencies are likely to have databases including photographs of wanted persons whose identities may or may not be known. If unknown, their identities would be considered important and sought-after items of information. Such photographs clearly would constitute part of the personal data collected in relation to such wanted persons.[9]

Moreover, none of the three judges doubted either that a photograph could constitute ‘personal data’ (an issue upon which the trial judge had expressed uncertainty)[10] or that the press or other media organisations fell beyond the scope of the Ordinance. ‘On the contrary, it is clear that they are caught by its provisions if and to the extent that they engage in the collection of personal data.’[11]

Collection or use?

What was the complainant’s grievance? She was in a public place when her photograph was taken without her knowledge or consent. It is doubtful that the ‘privacy’ laws of any jurisdiction would regard her as having, on these facts, a reasonable expectation of privacy. Even the American common law tort of ‘intrusion’ would be of little help — unless perhaps she exhibited by her conduct a desire to preserve her privacy and this was reasonable in the circumstances.[12]

Ironically, therefore, DPP 1 (which requires the collection of personal data to be ‘fair’) may provide greater protection to ‘privacy’ than the US tort that exists for this very purpose. But the matter is not so simple. First, as already mentioned, the court rejected the view that this was collection of personal data at all. Second, the relationship between what may be called (even in the present context) ‘intrusion’ and ‘disclosure’ is problematic.

I shall not deal here with the first point, though I hope to do so in a future article.[13] The second issue has long bedevilled the literature of ‘privacy’; its analysis is, however, neglected in the data protection setting.

In short, there is normally little point in taking my photograph unless it is to be used for some purpose. My objection to being photographed, whether in a public or private place, usually resides in the frustration of my legitimate expectation that my image should not be used without my consent.[14] There is therefore a symbiotic relationship between use and disclosure or, to use the language of data protection, collection and use. The Court of Appeal proceeds on the (common) assumption that the two are, in effect, inseparable. But caution is required.

Intrusion or disclosure?

A similar presumption is to be found in common law ‘privacy’ cases and literature, where there is a tendency to conflate the intrusion practised by the prying journalist or photographer with the publication of the information thereby acquired. I want to suggest that, as far as possible, the two be kept separate.[15]

Hence, to make an obvious point, the intruder may not always be the ‘discloser’. Thus in Pearson v Dodd[16] employees and ex-employees of a US senator surreptit-iously removed papers from his files, copied them and handed the duplicates to two newspaper columnists. The journalists, with full knowledge of the circumstances of its acquisition, included the information in their column. The court, dealing separately with disclosure and intrusion, held that, in respect of the former, the First Amendment protected the revelation of such information and, as to the latter, the columnists could not be liable for the intrusion merely upon proof of their knowledge of its occurrence.

First Amendment protection extends only to disclosure. Hill points out, in regard to the protection afforded to the media by the newsworthiness defence to otherwise actionable disclosures of private facts, that ‘[t]he values of the First Amendment would be seriously subverted if such protection were withdrawn on the ground of knowledge on the part of the media that the truth had come to light through legally reprehensible means employed by others’.[17]

Should such protection be accorded to intrusion? I think not. The justifications for free speech do not apply to cases of intrusion. Thus, as Dietemann correctly held, the media should be liable for intrusive investigative activities. Accord-ingly, the central question becomes whether mere knowledge on the part of the columnists in Pearson ought to have been sufficient to hold them liable for the tort of intrusion.

Where the ‘discloser’ is also the intruder, liability should be imposed for the intrusion even though the disclosure is safeguarded by free speech consider-ations. Dietemann protects the journalists’ disclosure of newsworthy information to the public at large, while reproving their intrusive newsgathering. This seems a sensible approach.[18]

In most mixed intrusion/disclosure cases, but for the reprehensible newsgathering techniques, the defendants would not have got their story. And equally, but for those techniques, not only would the plaintiff not have suffered a violation of his seclusion but he also would have been spared the trauma of being named in the newspaper. However, in Barber the Missouri Supreme Court declined to protect the journalist, and thus the plaintiff recovered damages for both intrusion and disclosure.

Applying the analysis to data protection

Does this approach have any purchase in respect of the data protection principles regulating collection and use of personal data? Each is, of course, targeted at a rather different mischief than the privacy considerations deployed in the cases mentioned above. Thus, the latter, for example, includes not merely ‘disclosure’ of information, but any use of it. Moreover, and perhaps more significantly, it embodies the principle that data collected for one purpose should be used for another purpose only with the prescribed consent of the data subject. I have argued that this is a core ‘privacy’ right, but this view may not be widely shared.[19]

In any event, the reference in DPP 3 to ‘the purpose for which the data were to be used at the time of the collection of the data’ demonstrates a similar inter-connectedness between this principle and DPP 1. Nevertheless, the argument in support of treating the wrongfulness of each form of conduct discretely remains. This means that the act of data collection should be evaluated independently of the use to which the data are put.

In addition, though the complainant’s objection was to the use rather than the collection of the data,[20]where a data protection regime is applied to the media, it may be necessary to treat the notion of collection in a less restrictive manner.[21]

It is hard to dispute the reasoning of Ribiero JA that led him to conclude that if no complaint had been made to the Commissioner and, a year later, Eastweek had been requested to provide any information that it had relating to the complainant, the magazine would have responded that it had no records relating to such an individual, even if the offending photograph and article remained available in its electronic and print archives. The information ‘would not have been collected in or intended to be retrievable from such archives as personal data relating to the complainant’.[22]

But there may well be circumstances in which a data subject may seek access to data that identify him only by his image. Suppose, for example, that my activities in public are — as increasingly is the case —monitored by means of closed circuit TV. I fear that the video recording may have captured me in an embarrassing situation and I wish to obtain a copy of this piece of personal data. Leaving aside the nice question of how access might operate in practice, the mere fact that I am identified on the tape is not conclusive of the question of whether the law protects that right.

Similarly, if I know that my photograph has been taken, even if my name is not revealed in the accompanying article (as occurred in this case) the offending newspaper, though it has no interest in my identity, ought to be able to retrieve the picture when I inform them when and where it was shot. Anonymity of the data subject need not be the death knell of fair collection.

Conclusion

I believe that the data protection principles provide a sound basis for the protection of individual privacy. Placing control of personal information at the heart of our deliberations about privacy achieves what the orthodox analysis has conspicuously failed to do: it postulates a presumptive entitlement accorded to all individuals that their personal data may be collected only lawfully or fairly and that once obtained, it may not be used, in the absence of the individual’s consent, for a purpose other than that for which it was originally given.

This approach is not, of course, a panacea. The challenge of striking a balance between privacy and competing interests remains, but we need to rethink the conceptual underpinnings of privacy if we are to arrest its relentless decline.

Raymond Wacks, Professor of Law and Legal Theory, University of Hong Kong.