6 Dec 2023, 14:04

Balancing privacy and other interests in the social media age

Delivered by N A Moreham as the 2023 Sir Bruce Slane Memorial Lecture. Watch a video of the lecture being delivered.

[These remarks are speech notes. For a fuller treatment of the matters discussed, please see N A Moreham “Privacy, freedom of expression and legitimate audience interest” (2023) 139 Law Quarterly Review 412-435]

Introduction

I was in my second year of university when Sir Bruce Slane became New Zealand’s first Privacy Commissioner. Even though I was at Canterbury and a long way from goings-on in Crown entities in Wellington, his name made its way into my consciousness. In fact, I still associate Sir Bruce with the public recognition of both the importance of privacy and of the need to start doing something meaningful to protect it.  Sir Bruce was hugely successful in bringing those matters, and the Office of the Privacy Commissioner (the OPC) itself, into governmental and public consciousness at a crucial time. (In doing this, he had an advantage that would be the envy of leaders everywhere: his son, Chris, is a celebrated cartoonist. I still have a collection of Chris Slane-drawn OPC Christmas cards on display in my office – they are funny but also often poignant reminders of the importance of the privacy interest which Sir Bruce spent so much of his career promoting.)

Both the protection of – and means of interfering with – privacy have come a long way since Sir Bruce’s time. It was not that long ago that if you wanted to profile someone or discover their tastes, shopping preferences or general interests you had to run a census, do a survey or get to know them personally. And if you wanted to access a mass audience, you had to have a printing press, a broadcasting licence or some way of accessing somebody who did. Obviously, this has all radically changed.

But we have also seen tremendous strides in the protection of privacy since those years of OPC’s infancy. Of course, this year we celebrated 30 years since the enactment of the Privacy Act 1993. It was also nearly 20 years ago that our Court of Appeal first recognised the tort of giving publicity to private facts in Hosking v Runting [2004] NZCA 34. And it is over 10 years since New Zealand courts recognised the tort of intrusion which applies to unwanted watching, listening and physical incursions even without any subsequent publication (see C v Holland [2012] NZHC 2155). 

In fact, privacy protection has developed to such a degree that the talk I am going to give today is not about extending privacy protection but rather about when privacy needs to give way to other interests. When, I am going to ask, should a person’s desire to speak or find out about someone else outweigh that person’s desire to keep the matters in question to themselves?  Although Sir Bruce’s contribution was in the area of data protection and the Privacy Act, I’m going to discuss this question in the context of New Zealand and English common law, and in particular, the tort of giving publicity to private facts. 

The New Zealand tort of giving publicity to private information 

Before I turn to how we deal with these questions, I want to quickly introduce – or recap if you already know them – the requirements of the tort of giving publicity to privacy facts in New Zealand law. This tort has two main requirements. First, that the claimant had a reasonable expectation of privacy in the circumstances in question. Second, that any publicity given to that information was highly offensive to an objective, ordinary person. Essentially, the action protects against the publication of things about you which are nobody else’s business. These tend to be things like your sex life, your medical records, intimacies of your domestic life, visual access to your naked body, home and other spaces.  

Importantly for today’s purposes, there is a defence to the privacy tort if the private information or image in question reveals a matter of legitimate public concern. This is not just about things that the public are interested in – “public concern”, loosely, refers to matters that people need to know about in order to be active participants in civic society. As already foreshadowed, this talk is essentially about when that defence will be satisfied. But behind that question is a more general enquiry: the question of when freedom of expression interests will override rights to privacy.  

This question is particularly important because privacy is generally concerned with preventing the publication of information which is true. The law of privacy does not stop you from publishing information about John Doe’s extramarital affair, mental health struggles, or his late-night drinking antics because they didn’t happen – it stops you from talking about them even though they did happen. This means that when we say someone can’t publish something because it is private, we are potentially stopping them from telling a true story that they want to tell. We are also stopping the public from hearing it. So when we talk about free speech in this context, we are actually talking about two important, related interests: that of the speaker to say what they want to say and of the audience to hear the information in question.  

As is the case every time I stand up to do a talk about privacy, there is a topical example to illustrate these points. Just this week, questions have been asked about the privacy rights of the Wellington Mayor as she faces rumours that a video had been taken of her at a local bar one Saturday night. People were asking all last week if it is legitimate to talk about this or if we should leave her alone to let off steam as she pleases. This talk will address that question. But when I first conceived of it, I had in mind another set of examples which have been in the public consciousness for some years now: accuser-led public allegations. By this I mean situations in which someone makes an experience-based allegation of harm or impropriety – usually sexual impropriety – against a person occupying a powerful position. These situations exemplify the difficult balance that needs to be struck between people’s right to speak out about matters which are important to them or other people and others’ right to prevent the unwanted disclosures about themselves. The tort of privacy has found itself right at the centre of that debate.

The categories of public interest information 

I am going to return to these examples, but first, let’s go back to the story about the mayor of Wellington on her night out.  That example usefully illustrates two of the three situations where freedom of speech interests have been said to outweigh the privacy interests of the claimant in the tort of privacy.  

1. Where the information calls into question a person’s fitness for public office.

The first situation where the courts have said that freedom of expression will outweigh an individual’s privacy interest is where the private information calls into question the claimant’s fitness for some kind of publicly important role. A good example of this is the English case of Lord Browne v Associated Newspapers [2007] EWCA Civ 295, where the English Court of Appeal held that the CEO of BP could not have a privacy interest in respect of information suggesting he had allowed his romantic partner to misuse company resources. This was because the information suggested that he was abusing the trust which the company reposed in him.

This fitness-for-office category extends to all sorts of publicly important positions. At the top end of the scale are elected officials – the Prime Minister, leader of the opposition, the Minister of Finance, mayors and also less high-profile councillors, MPs, et cetera. Courts in multiple jurisdictions have held that the publication of private information about these people – even in some circumstances health information – can be justified if it questions their fitness for office.  

In England, this category has also been applied to captains of industry (like the CEO of BP in Browne), football captains, football managers, and other professional sportspeople.  In one New Zealand case “the executive principal of a high-profile Auckland school” had enough public standing for this fitness-for-office principle to come into effect (see Clague v APN News and Media Ltd [2012] NZHC 2898). I fear this category might also include a lot of people in this room: senior civil servants, judges, high-profile lawyers and probably university professors. If any of us here hold positions where the community has an interest in ensuring we do our job properly, and we do something that calls that into question, our privacy will probably be diminished at least to the extent that the disclosure in question relates to that alleged unfitness.

Now, this freedom to disseminate information which calls into question someone’s fitness for public office will be clearest where the behaviour in question relates directly to the person’s conduct in the role. The case law suggests that the further a person’s role goes down the “public importance” scale, the closer the connection needs to be between the private information in question and the job that the person is said not to be doing properly. So, whilst it might not be legitimate to publish the fact that a university professor has a drinking problem, it might become legitimate if there was evidence that they were habitually out in bars plying 18 to 21-year-olds with alcohol. At the top end of the importance scale, the connection between the job and the information doesn’t have to be as strong. In fact, English case law has said that if you’re important enough, it is enough that the information reveals a serious weakness of character. The following is a quote from AAA v Associated Newspapers Ltd [2012] EWHC 2103 (QB) at [118] in which a judge declined an application from the mother of one of Boris Johnson’s children to keep his paternity of her daughter a secret:

It is undisputed that there is a public interest in the professional and private life of the claimant's supposed father. His professional position speaks for itself. As to his private life, he is man who has achieved a level of notoriety as result of extramarital adulterous liaisons. Of itself, the fact of an extramarital affair does not render inevitable the publishing of information that, as a result, a child was conceived. However, the claimant is alleged to be the second such child conceived as a result of an extramarital affair of the supposed father… such information goes to the issue of recklessness… relevant both to his private and professional character, in particular his fitness for public office. I find that the identified issue of recklessness is one which is relevant to the professional and personal character of the supposed father.

The moral of the story is that if you are a senior politician – Boris Johnson was at that point the Mayor of London – and have not just one but two or more love children, that will be in the public interest.

2.    Correcting a false image which has been peddled by the plaintiff 

The second situation in which a public interest in information can override a privacy right is where it corrects a false image which has been peddled by the claimant. The most famous example is the leading English case of Campbell v MGN Ltd [2004] UKHL 22. In that case, the House of Lords held that the Mirror newspaper was entitled to disclose the fact that Naomi Campbell was seeking treatment for drug addiction in order to expose the falsity of statements she had made about staying away from drugs. This category has also been applied to justify the disclosure of the extramarital affairs of public figures (usually footballers) who have put themselves forward as reformed characters or as good family men. It is all about presenting yourself as one thing when in fact you are another.

It is not entirely clear if these decisions would be followed in New Zealand nor how far this principle would extend. But it was interesting to see the media suggest that it was at play in the story about the Wellington mayor last week. I think they’re right that there is something in the argument that she had put her drinking in issue by saying publicly, just a few months earlier, that she was going to avoid drinking in public from then on. It would be interesting to see if a court would agree with them.

Public figure status

You will no doubt have noted that the two categories I have discussed so far are likely to apply to people with public standing of some sort. You have to be in some kind of publicly important role for your performance in it to be a matter of public concern. And in order to correct a false image a person has been peddling, the person has to have had some kind of public image in the first place.

In my view, comments in New Zealand case law about public figures having a reduced private sphere need to be read in light of these two observations. Outside of them, there is no clear justification for saying that public figures have a reduced expectation of privacy. I am not entitled to know about Chris Luxon’s medical records or drinking habits simply because he is the Prime Minister. But I might well be entitled to discuss them if they call into question his ability to meet the requirements of his office or suggest that he has been painting a false image of himself.

This is a fine point but also an important one. Whilst public figures need to be accountable for what they say and do, we also need to be a wary of declaring open season on people in public life by saying that they have a reduced sphere of privacy for all purposes. We need to be more precise than that and, hence, to identify exactly when the public is – and is not – likely to have a legitimate interest in what they are up to.

This highlights a wider point which is important here. Whenever we are balancing privacy and freedom of expression interests, there is a need for certainty and precision in the rules that we are applying. It is important, first of all, that people like Chris Luxon, or the All Blacks or the principals of high-profile private schools know that they retain a right to privacy in some situations. But perhaps more important is the other side of the coin. If an individual or media organisation is going to publish something which it thinks the public needs to know, they don’t just need a defence that protects them in doing so – they need to know that that is the case. If the law is uncertain or unclear, then they are much more likely to take a defensive position and could end up declining to publish information which the public had a legitimate interest in hearing. As many of you will know, this is called the chilling effect. One of the most important ways to protect freedom of expression in all privacy contexts is therefore to be clear in the exposition of the rules and principles which define it, including its defences.

3. Exposure of harmful conduct or other serious wrongdoing

Now I want to move away from thinking about politicians and their drinking habits or family lives and on to allegations of a more serious nature. The third reason why we can publish private information about a person when they want to keep it private is because it exposes the fact that they are engaged in harmful conduct or other serious wrongdoing. You hopefully won’t be surprised to hear that there has been a long-standing rule that people cannot use the privacy tort – or its predecessor, breach of confidence – to hide evidence of their own serious wrongdoing.

In breach of confidence, this idea is captured in the epithet that “there is no confidence in an iniquity”. The cases establish that you could not claim confidentiality in respect of the fact that, for example, your alcohol breath test equipment was faulty, you were engaged in price-fixing in the laundry services industry, or you were mistreating people under your care in a care home (see, respectively, Lion Laboratories Ltd v Evans [1985] 1 QB 526, Initial Services Ltd v Puterill [1968] 1 QB 396 and Lakeside Homes Ltd v BBC QBD, 14 Nov 2000, Cresswell J).

This rule has also been carried over into breach of privacy. In fact, the fact that information exposes wrongdoing does not just mean there is a public interest in it, it will often stop it from being private in the first place. In Brake v Guy [2022] EWCA Civ 235 at [72] the English Court of Appeal said:

[I]f you know you are doing something wrong, it may not be reasonable for you to have an expectation that information about that wrongdoing will be kept private. Misconduct is relevant to the question whether a claimant has a reasonable expectation of privacy as well as to the balancing exercise if he does.

We have also seen this in operation in New Zealand.  It helped justify, for example, disclosure of the fact that a principal at a high-profile private school was being investigated for domestic violence (see discussion of Clague below).

Courts have made two things clear about this rule. First, something does not need to be proven for the protection of disclosures about wrongdoing to come into effect.  In confidence, the “no confidence in an iniquity” maxim applies as long as there is credible evidence of wrongdoing.  The same is true in the privacy tort.  In Browne, the English Court of Appeal held that it didn’t matter that allegations of misuse of company resources by the claimant’s romantic partner had not yet been investigated; the public interest defence would still apply.  

Second, this line of cases makes clear that a person who has information about wrongdoing is not required simply to take the information to the relevant investigative authority – rather, they are at liberty to take it to the public directly (see Initial Services and Browne).

Making public allegations

This wrongdoing-focused category of public interest is particularly important for #metoo-type situations where a person makes an allegation of sexual harassment or sexual offending against a powerful person, either in the media or online, based on their own experience. The cases I have just been discussing would suggest that the public interest in these cases would be fairly clear-cut. Where a disclosure involves a credible allegation of serious wrongdoing, then the law would appear to say that neither breach of confidence nor privacy will protect it. The defendant is therefore left to a remedy in defamation. But recent case law has begun to suggest that maybe privacy law has its own role to play in keeping allegations of wrongdoing away from the public eye when it harms a person’s reputation.  

Privacy and police investigations

Both in New Zealand and England and Wales, the big issue in privacy law at the moment is whether a person can bring a privacy claim in respect of the fact that they are being investigated by the police. In New Zealand, we have two competing interlocutory decisions on the matter. As I have foreshadowed, in Clague, the executive principal of Kristin School in Auckland was denied a privacy injunction to suppress information about police investigations into allegations of domestic violence which had been made against him, partly because of the public role he played in the community. In contrast, in Driver v RNZ, Stuff, TVNZ & others [2019] NZHC 3275 the claimant’s privacy action in respect of information about an Indian police investigation into her conduct was successful. The lack of public profile distinguished Driver’s situation from Clague, but Justice Clark also held that the privacy action could potentially be used to protect reputation in some circumstances. There will be a third decision shortly – the issue is currently before the Court of Appeal in Dew v Discovery NZ Ltd.  [This decision has since been released: see [2023] NZCA 589.]

In England and Wales, the law is rather more settled. In the recent case of ZXC v Bloomberg, the UK Supreme Court considered a claim by a man, anonymized as ZXC, who had extensive business interests overseas. A law enforcement body in the United Kingdom was investigating him for corruption in a foreign state. As part of their investigation, they sent something called a Letter of Request to the foreign state asking for information and assistance. That contained details about the allegation and the investigation. In spite of the high level of confidentiality attached to that letter, it ended up in the hands of the media organisation Bloomberg, and they published an article on their website outlining its contents and the details of the investigation.  

The claimant sued for breach of privacy saying that the Letter of Request was plainly confidential and that he had a reasonable expectation of privacy in respect of its contents. All nine judges, all the way up to Supreme Court said this claim in privacy should succeed. They held that in the usual course of things a person will have a reasonable expectation of privacy in respect of the fact that they are being investigated by the police, up to the point of charge. So, this means that in England, if a police officer comes to your house and asks you to accompany them to the police station so they can investigate allegations of drug dealing against you, there would be a presumption that you have a right of privacy in respect of the fact that they are investigating and the details of that investigation. If someone published that, they would risk a privacy action.

There are a few bases on which English courts could have kept this information out of the public domain – defamation, contempt of court and breach of confidence are obvious alternatives – but they chose privacy.  And in the course of doing this, they set up an important more general principle. They accepted that the claimant was bringing the action in order to protect his reputation. But despite a number of lower court authorities arguing the opposite, the Supreme Court said that this wasn’t a problem. They were quite happy to say that the fact that something harms your reputation will make it more likely that you have a reasonable expectation of privacy in respect of it. So, if you disclose the fact that I am a workplace bully or have a drinking problem then the fact that that makes me look bad will weigh in favour of my having a reasonable expectation of privacy in respect of that information.

The court put a number of limitations on the way this general rule played out in the context of police investigations into misconduct. In particular, they were at pains to say that the reasonable expectation of privacy only relates to the facts and details of the police investigation and not into the underlying misconduct itself. So, the court said if the defendant had run an article about the alleged corruption that ZXC was engaging in, there could have been no complaint.  

However, in almost no time, the reasonable expectation of privacy in ZXC was applied to an allegation of wrongdoing where the information was not about a police investigation but about the conduct itself. The case in question, BVC v EWF [2019] EWHC 2506 (QB), was an application for an interim injunction in respect of online allegations of sexual offending which was alleged to have taken place in the course of the defendant’s relationship with the claimant.  The judge in that case said:

The Defendant's allegations are currently no more than his word against the Claimant's… they have not been disclosed to the competent authorities, let alone made the subject of investigation by them. It would be remarkable if a claimant accused of wrongdoing by a former lover, with (the Claimant would say) a palpable axe to grind, should be in a worse position than a person under proper investigation by an efficient and independent police force or public authority. I therefore conclude that the Claimant's reasonable expectation of privacy extends to those allegations.

In other words, this judge asks, why should there be a reasonable expectation of privacy in respect of allegations where police have decided that there are grounds to investigate but not where courts are considering completely untested allegations made on the Internet?

At first glance, this argument is appealing. But the answers to this rhetorical “why not?” are easily found.  The first answer is, as I have already said, provided in ZXC.  The court there talked about the particular nature of a police investigation – not just the stigma attached to it but also the various obligations of confidentiality that the police owe to the accused.  We can question, as I have in other contexts, whether privacy is the right way to protect that information, but even if you believe that it is, it is clear that the very particular relationship created in a police investigation was supposed to make the finding of a privacy right in that case exceptional. And, as I have already mentioned, the court was careful to make clear that the media was still free to report on the alleged corruption that was subject of the investigation. It was striking how quickly the supposed limitations on ZXC were disregarded in BVC.

The second answer to why mere allegations of sexual offending aren’t private is because the allegations might be true. The truth or falsity of the claims that became the subject of a privacy injunction in BVC were never tested (nor at the time of judgment, were the allegations in ZXC). It will be remembered that we have a lot of case law saying that evidence of wrongdoing should not be suppressed by breach of confidence or privacy. This is because people are not allowed to use those actions to stop people making robust allegations against them.

These cases were not mentioned in ZXC, in the New Zealand cases on police investigations, nor in any other police investigation case that I’m aware of. But they seem relevant. There is at least some argument that information about police investigation into the claimant’s alleged corruption in ZXC is evidence of wrongdoing on his part. The allegations in BVC were too. 

I think this raises a question about whether privacy is the right action to protect against disclosures about police investigations. As I said at the beginning of this talk, privacy in the common law is designed to protect information from disclosure because it is nobody else’s business. It is not clear that that is the case if the information in question is the fact that somebody has complained to the police that someone has engaged in seriously harmful criminal conduct. I think it is difficult to say, “I know that I’m being investigated by the police for sexual assault of my employees, but that is none of your business”. There might be other reasons why we think that information about these investigations should be kept out of the public domain (to preserve the integrity of the police and court processes, for example) but that doesn’t mean we should call it private.

There is good news though. We have a tort which is all about suppressing untrue information about a person – the law of defamation. Indeed, this tort has been developed over centuries to strike the balance between the reputational damage caused by the publication of falsehoods and the protection of freedom of expression.  Unsurprisingly in light of that, absence of truth is central to this action. Truth is a complete defence. And the “rule in Bonnard v Perryman” ([1891] 2 Ch 269) makes it very difficult to get an injunction if the defendant is going to plead truth. Defamation also has other free-speech protections built into it including a defence for responsible journalism which is in the public interest (see Durie v Gardiner [2018] NZCA 278) and short limitation periods – a two-year limitation period in New Zealand and a one-year limitation period in England and Wales (compared to a six-year norm in both jurisdictions).  

None of this will stop a person from successfully suing in defamation if someone publishes the fact they are being investigated for a crime which they did not commit.  Importantly, the defendant can’t satisfy the truth defence in defamation simply by showing that an investigation into a person’s conduct is in fact taking place. Rather, the defendant has to meet the actual sting of the publication – which will usually be, at the very least, that there are reasons to suspect the claimant of wrongdoing. It follows that the claimants in cases like ZXC and Driver will have a claim in defamation, if they are not guilty of the matter being investigated. It is notable that in Driver and at least one of the high-profile English cases, the privacy claim was only started after the limitation period in defamation had expired (see Sicri v Associated Newspapers Ltd [2020] EWHC 3541 (QB) [57]).

I think that this highlights a real danger that cases like ZXC, and perhaps Driver, allow claimants to circumvent the free-speech protections in defamation. Because if serious reputational harm makes it much more likely that you have a reasonable expectation of privacy, then why would anybody ever bother suing in defamation? Why would you bother with all the annoying free speech protections in that action if you can just sue in privacy and avoid them – including difficult questions about truth?  I am already hearing reports that, in the UK, genuine public interest reporting is being held up in weeks of legal wrangles based on rather liberal interpretations of ZXC. And I wonder what sort of chilling effect this is this having on victims. It is not hard to imagine a junior employee making a true allegation of sexual harassment against a powerful person only to be met by intimidating lawyers’ letters claiming that allegations of that nature are a breach of privacy.

This brings us back to the point where I started – thinking about the need carefully to balance free-speech and privacy interests as we take these actions forward. There are important interests on both sides of the ledger here. Information about police investigations like that disclosed in ZXC, Clague and Driver can devastate a person’s reputation in a way that is hard to restore. So too, of course, can #metoo type allegations like the one in BVC. Many organisations will remove people from their jobs before any investigation has been made. Everyone in society loses if false allegations of serious wrongdoing can be made with a degree of impunity. It is easy to see why the judge in BVC, believing those allegations to be vexatious, wanted to extend privacy protection to them.

But on the other side of the coin, it is important to recognise the wider context in which decisions like ZXC are being made. As acknowledged in the privacy and “no confidence in an iniquity” cases, the ability for people to expose serious wrongdoing – and problems in our systems which enable it – is also a significant public good.  Movements like #metoo and whistleblowing in government and in tech have allowed  people to demand accountability for behaviour which has gone unchecked, often because of systemic failure to address them. 

In my view the allegations at the heart of cases like ZXC, Clague and Driver need to be considered in this wider context. In particular, it is important to be alive to the risk that using privacy to protect against disclosures about police investigations can lead to the successful suppression of allegations of wrongdoing when the police are not involved at all. Our response to this problem needs to focus on ensuring that true allegations of seriously harmful behaviour are protected, whilst false ones are suppressed. Privacy – which as Sir Bruce Slane knew is important for many things – is not designed to do that. Rather it is designed to let you keep to yourself things which are nobody else’s business, even if they are true.