On 16 February 2022, the UK Supreme Court in Bloomberg LP v ZXC [2022] UKSC 5 unanimously upheld the decisions of two lower courts that Bloomberg was wrong to publish an article identifying a US executive who was under investigation in relation to allegations of fraud, bribery and corruption as he had a reasonable expectation of privacy unless and until he was charged.

The court found that Bloomberg misused the executive’s private information when it reported on a confidential letter of request sent by a UK legal enforcement agency to its counterpart in a foreign state.

As a general rule or as a legitimate starting point, a person under criminal investigation has a reasonable expectation of privacy in respect of information relating to that investigation unless and until they are formally charged.

This judgment is significant not only in confirming the reputational protections available to individuals who are the subject of criminal investigation, but also in the development of English privacy law more generally. It shows an appetite by the courts to bolster (at least on an individual basis) the right to privacy in a world where that right is increasingly under challenge.

IN DEPTH

The executive (a US citizen) and his corporate employer were the subject of a criminal investigation by a UK law enforcement agency. During that investigation, the UK agency sent a confidential letter of request to its counterpart in a foreign state seeking, among other things, information and documents relating to the executive. The letter expressly requested that its existence and contents remain confidential.

Bloomberg obtained a copy of the letter and published an article reporting that information had been requested in relation to the executive and detailing the matters in respect of which he was being investigated. Bloomberg refused to remove the article from its website. Following an unsuccessful application for an interim injunction, the executive brought a claim against Bloomberg under the tort of misuse of private information.

This tort is relatively new to English law, having first been recognised as a distinct cause of action in the early 2000s in supermodel Naomi Campbell’s successful appeal to the House of Lords in her claim against The Mirror newspaper for publishing photos of her leaving a rehabilitation clinic following public denials that she was a recovering drug addict.

The executive succeeded at first instance, again on appeal to the Court of Appeal and also at the Supreme Court, with the Supreme Court confirming that the tort requires a two-stage test:

• First, whether the claimant objectively has a reasonable expectation of privacy in the relevant information considering all the circumstances of the case.

• Second, whether the expectation is outweighed by the publisher’s right to freedom of expression. This involves a balancing exercise between the claimant’s European Convention on Human Rights (ECHR) Article 8 right to privacy and the publisher’s ECHR Article 10 right to freedom of expression.

Bloomberg advanced four arguments challenging the lower courts’ suggestion that there may be a “general rule” or “legitimate starting point” that a person under criminal investigation has, prior to being charged, a reasonable expectation of privacy in respect of information relating to that investigation:

• Bloomberg argued that, because the public knows there to be a presumption of innocence under English law, the application of a general rule or legitimate starting point is unsound because it overstates the extent to which publication would in fact damage an individual’s reputation. The Supreme Court gave this short shrift, noting that it is undeniable that a person’s reputation will ordinarily be adversely affected if they are reported as being the subject of a criminal investigation – regardless of whether they are actually charged –  impacting their right to respect for private life.

• Bloomberg submitted that the lower courts were incorrect to rely on the human psychological tendency to presume that there is “no smoke without fire” as this runs contrary to well-established principles in defamation law that the ordinary reasonable reader can distinguish suspicion from guilt. However, the Supreme Court found that the tort of misuse of private information is a separate tort from defamation and, unlike the latter, its purpose is not only to protect an individual from the publication of untrue information, but also to protect their private life (regardless of the truth or falsity of the information).

• Bloomberg argued that information should not be protected on the basis that it is reputationally damaging, but instead on the basis that it belongs to that part of the claimant’s life that is of no one else’s concern. As such, Bloomberg argued that the executive’s business activities should not be protected. The Supreme Court found this unduly restrictive, holding that a person’s business reputation falls within the scope of ECHR Article 8, provided that the attack on reputation is serious enough to prejudice that individual’s right to respect for private life.

• Bloomberg argued that the lower courts failed to apply the correct legal test at stage one, as a consideration of “all the circumstances of the case” should have included the nature of the alleged activity (i.e., fraud, bribery and corruption) and that executives involved in the affairs of large public companies knowingly lay themselves open to close scrutiny by the media. However, the Supreme Court found that the private nature of the information was not affected by the specifics of the activities being investigated and, while the executive’s status might mean that the limits of acceptable criticism are wider than for a private individual, there is still a limit.

Comment 

Whilst, as a matter of legal principle, individuals are presumed to be innocent unless proven otherwise, it is widely accepted that an innocent person’s reputation, and therefore their right to respect for private life, can be seriously and permanently damaged by the publication of the fact that they are subject to a criminal investigation. This is why state investigatory bodies generally do not identify those under investigation prior to charge and partly why, in this case, the UK agency asked for the existence and content of the letter to be kept confidential.

This point was made in the Leveson Inquiry Report, has been endorsed by the Government and the Judiciary, and has arisen in a string of cases in the lower courts.  In 2016, an independent review into the Metropolitan Police Service’s handling of non-recent sexual offence investigations alleged against persons of public prominence found:

Present arrangements […] have caused the most dreadful unhappiness and distress to numerous suspects, their families, friends and supporters. Those consequences were avoidable by protecting anonymity. Nobody is safe from false accusation and damaging exposure under present arrangements. A reputation built on a lifetime of public service or popular entertainment can be extinguished in an instant.

The judgment against Bloomberg in the present case is therefore important in providing confirmation from the highest court in the land that there does indeed exist a “general rule” of pre-charge anonymity.

While the decision will be unwelcome for the British media (which might argue that the decision prevents journalists from putting the conduct of companies and individuals under appropriate scrutiny), it is a positive development for those under investigation (and, by association, their employers) given the protection it gives to their reputations prior to charge. It is likely that if such individuals are not charged, the fact of their involvement in the investigation may never reach the public eye.

In terms of wider consequences:

• It will be interesting to see whether this judgment lowers the bar for law enforcement officers to include individuals in their investigations, given the reduced likelihood that such individuals’ identities will be revealed prior to charge.

• The question of whether there is a reasonable expectation of privacy is fact-specific and a balancing exercise must be undertaken between the right to privacy and the right to freedom of expression.  As a result, in certain cases, it may still be appropriate for the media to publish the identity of individuals under investigation prior to charge. Such circumstances are likely to be rare (the court identified a possible example being where the press alleges inadequacies in the conduct of the investigation). Except in the most obvious cases, the press would therefore be at significant risk of being sued.

• As non-governmental corporates are also able to benefit from the protections under ECHR Article 8, there is perhaps some scope for argument that they too should benefit from pre-charge anonymity, at least until the relevant agency announces that it has opened a formal investigation. However, this argument may struggle at both stage one and stage two of the test, given that there would not normally be a reasonable expectation of privacy in relation to non-confidential corporate information and, even if there were, the balancing exercise for a corporate may well come out on the side of freedom of expression.

• Finally, it is interesting to see this judgment in the context of the evolving landscape of data privacy law in the UK and the increased activism of the courts in cementing such rights. As discussed above, it was the predecessor to the Supreme Court (the House of Lords) that in the early 2000s first distinguished the tort of misuse of private information. This tort, together with the rights accruing to individuals under the General Data Protection Regulation (GDPR) and the investigatory powers of the Information Commissioner’s Office, now provides the bedrock for the enforcement of individuals’ data privacy rights, with significance not only for corporate investigations but also for civil litigation more generally. While the Supreme Court may have reduced the scope for group claims in the UK for breach of data privacy laws in its recent decision in Lloyd v Google [2021] UKSC 50 (given that the need to bifurcate proceedings between liability and damages makes such cases unsuitable for litigation funding), it nevertheless found that the tort of misuse of private information would likely have been available for claims brought on an individual basis and expressly did not comment on whether such claims could be brought under the GDPR.