The relatively recent introduction in the UK of data privacy laws (the Data Protection Act 2018 (the “DPA”) and the UK GDPR (the “GDPR”)) has led to numerous claims concerning a data controller’s requirement to ensure that the personal data it holds is accurate and kept up to date. Claims are therefore being advanced that data controllers are unlawfully processing data subjects’ personal data by failing to keep accurate information about its data subjects which has caused harm to the reputation of the data subject when published, whether that be intentionally or not.

Such claims are a 21^st century phenomenon that reflect the exponential increase in the volume and value of personal data in the digital age. But a number of recent high-profile claims highlight the evolution of such claims – and their centuries-old roots.

Scandalum magnatum

In 1275 the law of scandalum magnatum made it a criminal offence to publish defamatory speech or writing to the ‘great men of the realm’. From this seed the law of defamation grew, but it is far from a standalone tort.

More recently, England’s first privacy law dates from the 14^th century, but it was not until the 1990s that the Human Rights Act introduced (or perhaps reintroduced) into UK law the concept of a right to respect for a person’s private life, family life, home and correspondence. This led to the establishment of the tort of misuse of private information the following decade, following the judgment in Campbell v Mirror Group Newspapers Ltd [2004] UKHL 22.

Two ongoing, high-profile cases concerning individuals in the public eye highlight the further evolution of the law in this area and the increasing role of 21^st-century data protection law in parties seeking to protect their reputation from damaging statements that have been published about them.

Noel Anthony Clarke v Guardian News & Media Limited

In April 2021, The Guardian published an article with the headline “Harassment, naked auditions and Bafta’s highest accolade” in which Mr Clarke was accused of sexual misconduct, harassment and bullying between 2004 and 2019. The article reported that Mr Clarke denied the allegations.

This article was published after an announcement that BAFTA planned to give Mr Clarke an award. Following the publication of the first article, BAFTA immediately suspended Mr Clarke and stated that the award he was due to receive was put on hold until further notice.

The Guardian subsequently published seven more articles which included allegations from 20 women of sexual misconduct, bullying and harassment by Mr Clarke. Each article references Mr Clarke’s denials of the allegations.

Mr Clarke is seeking damages estimated at around £10 million from The Guardian due to its publication of eight articles about his conduct which he claims is untrue and inaccurate and is therefore (i) defamatory, and (ii) in breach of the DPA and GDPR.

To date, the Court has been concerned with the defamation aspect of the claim, deciding at a preliminary issues trial that:

• In respect of the natural and ordinary meaning of the articles, each of the first seven articles give the impression to the hypothetical reasonable reader that there are strong grounds to believe that Mr Clarke is guilty of the conduct alleged and the eight article means that there are grounds to investigate Mr Clarke.
• That each article was defamatory of Mr Clarke at common law (i.e. that each article lowers the opinion of Mr Clarke in the eyes of the public and it substantially adversely affects his reputation).
• Each article contained a statement of fact rather than a statement of opinion (such that the Guardian would not be able to advance a defence of ‘honest opinion’).

From a defamation perspective the case highlights the critical distinction between statements of fact and statements of opinion. In the event that The Guardian pursues a public interest defence, this may also bring into the spotlight the difference between the single meaning determined by the Court and the (potentially different) intended meaning of the defendant which was one of the key features in the recent case of Banks v Cadwalladr [2023] EWCA Civ 219.

There has been no real consideration as yet by the Court of the impact of the data breach element of the claim – this ongoing case serves to highlight, however, the potential and actual overlap between these different causes of action.

Donald J. Trump v Orbis Business Intelligence Limited

Former President of the USA, Donald Trump, brought a data protection claim against Orbis Business Intelligence – a consultancy founded by former MI6 officer Christopher Steele, seeking compensation for distress.

The claim related to the Steele Dossier published in early 2017, by Mr Steele, which contained allegations that the former president had taken part in various sexual acts while in Russia . Mr Trump claims these “false, phoney [and] made up allegations” are “egregiously inaccurate” as well as “perverted”.

Mr Trump did not, however, pursue a defamation claim against the defendant, presumably because such a claim would have been time-barred (as the limitation period for defamation claims is usually one year from the date of publication, rather than six years for data breach claims).

Instead, Mr Trump’s pleaded claim is that as a data subject within the meaning of Article 4(1) of the GDPR and, s.1(1) of the DPAfor the purposes of processing which occurred up to 25 May 2018, Orbis unlawfully processed his personal data, causing him “serious distress and reputational damage”, because the personal data contained in the Steele Dossier:

• was inaccurate; and
• was not processed lawfully as it was the disseminated to third parties without Mr Trump being given notice of the processing of the personal data nor the opportunity to comment on the accuracy of the data.

Mr Trump was seeking damages, compensation and an order requiring Orbis to remove and/or restrict further processing of his personal data. Orbis was seeking strike out on the basis that the dossier was published without its permission, that Mr Trump’s claim has no realistic prospect of success and was filed too late.

On 1 February 2024, the court rejected Mr Trump’s claim ruling that he “has no reasonable grounds for bringing a claim for compensation or damages, and no real prospect of successfully obtaining such a remedy”.

The court agreed with Orbis’ argument that the claim was filed too late and found that his claim for damages was made outside the six-year period of limitation for Data Protection claims.

Conclusion

Mr Trump’s claim highlights once again that data protection law, whilst very much a product of its era, is in many ways the latest iteration of principles that, in English law, date back almost 750 years.

Any potential party in a reputation management claim should therefore carefully consider all the potential legal areas that may be involved.