Bill of Rights... and Wrongs?
Following a consultation launched in December 2021, on 22 June 2022 the Government introduced the Bill of Rights (Bill 117 2022/23) with the long title ‘A Bill to reform the law relating to human rights’. The Bill would repeal and replace the Human Right Act 1998 and “clarifies and re-balances the relationship between courts in the United Kingdom, the European Court of Human Rights and Parliament”.
In this post, Handley Gill considers the implications of the Bill’s provisions for the law relating to data protection, privacy and freedom of expression in the UK.
“The overall impact of the measures included in the Bill of Rights will be to make it less likely that human rights claims will be added as a separate cause of action in privacy and data protection claims against public authorities unless these add a significant strategic advantage, due to the additional hurdles put in the way of claimants and the diminishing returns on their efforts. ”
Article 8 of the European Convention on Human Rights protects the right to respect for private and family life, home and correspondence, which can only be interfered with where (i) in accordance with the law, and (ii) necessary in a democratic society for the purposes of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
The right protected by Article 8 has been held to encapsulate the protection of personal data, and “provides for the right to a form of informational self-determination, allowing individuals to rely on their right to privacy as regards data which, albeit neutral, are collected, processed and disseminated collectively and in such a form or manner that their Article 8 rights may be engaged” (Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland [GC] (931/13), 27 June 2017, para.137).
Displacing the European Court of Human Rights
The combined effect of clauses 2(a), 3(1) and (3)(b) of the Bill is to displace the primacy of the European Court of Human Rights and make clear that the UK Supreme Court is, indeed, supreme in determining the application of Convention rights to domestic law and is entitled to diverge from Strasbourg case law.
The European Court has repeatedly found violations of Article 8 where the UK’s domestic courts had not in areas including surveillance and interception, retention and disclosure of criminal records, DNA and other police data, and the disclosure leading to publication of CCTV footage depicting an individual harming themselves.
The displacement of the Strasbourg court may therefore result in a less expansive application of Convention rights under domestic law, with less protection than would otherwise be available.
The proposals also have the potential for a wider impact on data protection law in the UK, however. The European Commission’s adequacy decision in respect of the UK, which authorises the transfer of personal data from the EEA to the UK without the need for additional safeguards, was, uniquely, subject to a sunset clause resulting in its automatic expiry after 4 years, in June 2025. Announcing the adequacy decision, Věra Jourová, Vice-President for Values and Transparency, emphasised “…we have listened very carefully to the concerns expressed by the Parliament, the Members States and the European Data Protection Board, in particular on the possibility of future divergence from our standards in the UK's privacy framework… This is why we have significant safeguards and if anything changes on the UK side, we will intervene”.
In addition, the decision that UK law provided an adequate level of protection was explicitly stated to be “… based on both the relevant UK domestic regime and its international commitments, in particular adherence to the European Convention of Human Rights and submission to the jurisdiction of the European Court of Human Rights. Continued adherence to such international obligations is therefore a particularly important element of the assessment on which this Decision is based”.
There would therefore appear to be a real risk that the enactment of the Bill of Rights will result in the UK’s adequacy not being renewed, or even in the European Commission intervening in advance of the decision’s expiry to withdraw its decision and require a fresh analysis.
Balancing the competing Convention rights under Article 8 and Article 10
Clause 4(1) would require courts to afford “great weight” to the protection of the right to freedom of speech, i.e. the right to impart ideas, opinions or information by means of speech, writing or images in the context of Article 10 of the European Convention.
This is intended to enhance the existing protection afforded to freedom of expression under s.12 Human Rights Act 1998, which requires courts to have “particular regard” to the importance of the right. Notwithstanding this requirement, the courts have held that this provision does not grant precedence to the right to freedom of expression over the right to privacy (Douglas v Hello! Ltd [2001] QB 967, para.137)
If clause 4(1) was considered to be sufficient to grant freedom of speech presumptive priority over Article 8, a proposition which would itself be likely to be the subject of heavily contested litigation, this could make it more difficult for otherwise legitimate data protection and misuse of private information claims against authors and publishers, including social media platforms, to succeed.
It is worth noting that these measures will also interact with various provisions of the Online Safety Bill, which impose obligations on certain website operators including obligations to comply with codes of practice which are admissible in proceedings, and which give the regulator Ofcom the power to seek an injunction for non-compliance with its directions. The courts will also be obliged to afford great weight to the right to free speech in that context.
Standing to bring proceedings
Clause 15(3) will require that a person bringing proceedings against a public authority for acting incompatibly with a convention right must be (or would be) a victim of the relevant act and must either suffer a significant disadvantage or be able to demonstrate that there is a wholly exceptional public interest.
The significant disadvantage criterion is intended to import a minimum severity threshold and to be interpreted in accordance with Article 35 of the Convention, which considers both subjective and objective factors and is not determined solely by pecuniary loss or damage.
This increases the threshold from the existing requirement under s.7 Human Rights Act 1998 which provides that claims alleging that a public authority has acted unlawfully by acting in a manner incompatible with a Convention right may only be brought by a victim of the unlawful act. This has been interpreted to prevent organisations such as Reprieve from bringing a human right claim (see R (on the application of Reprieve and others) v Prime Minister [2021] EWCA Civ 972).
The amendment will further restrict the ability of NGOs including civil liberties and human rights organisations to bring proceedings in their own right.
In proceedings in connection with unlawful data processing activities, we have often seen claims brought in reliance on multiple causes of action including the applicable data protection legislation, a misuse of private information claim and, where a public authority is involved, an infringement of the Human Rights Act 1998. Article 80 UK GDPR provides a power for a data subject to nominate a body to represent them in data protection proceedings. Since there is no equivalent provision in the Bill of Rights, the new restrictions will make it more difficult to bring a multi-headed claim such as this against public authorities.
Permission to bring proceedings
Clause 15(1) will require permission to obtained from the courts in order to bring proceedings against a public authority under the Bill of rights in respect of an act which is unlawful as being incompatible with a Convention right.
This will align claims under the Bill of Rights with the procedure for bringing judicial review claims, and would require permission to be obtained in a claim that a public authority has conducted unlawful surveillance in violation of Article 8, for example.
Compensation
Clause 17(3) would permit the Lord Chancellor to amend Tribunal rules to allow for compensation to be granted as a remedy in respect of unlawful acts by public authorities under the Bill of Rights. If implemented, this could result in claims for compensation being included in proceedings against public authorities in the First-Tier Tribunal (Information Rights) in connection with failings under the Freedom of Information Act 2000 which amount to a violation of Article 10 or appeals against decisions of the Information Commissioner which engage human rights.
However, clause 18(5) makes an award of damages less likely, since it requires the courts to take into account additional factors including the efforts taken by the public authority to avoid violating the right, and the conduct of the victim. Taking an example of the use of facial recognition technologies by a public authority, clause 18(1) may make it less likely for compensation to be awarded in respect of the violation of the Bill of Rights if the authority could demonstrate that it had conducted appropriate balancing exercises, provided appropriate transparency information and tried to act lawfully and proportionately even if it had in act failed to do so.
Trial without a jury
Clause 9(2)(d) would afford Parliament the right to circumscribe the circumstances in which an individual prosecuted for a criminal offence would be entitled to be tried by jury.
Since offences under the Data Protection Act 2018 are summary only offences, this potential restriction would not have an impact in relation to those.
Certain offences under the Online Safety Bill are triable either way, however, and defendants, which can include nominated senior managers, could therefore potentially lose the right to jury trial if relevant regulations were made under this provision.
Protection of journalistic sources
Clause 21 increases the threshold for enabling a court to order the disclosure of a journalistic source, which is currently set out in s.10 Contempt of Court Act 1981, by introducing an additional requirement that “there are exceptional and compelling reasons why it is in the public interest for the disclosure to be made”, in addition to requiring “great weight” to be given to the public interest in the protection of journalistic sources.
However, the enhanced protection would not avoid the situation which arose in Sir Cliff Richard v (1) BBC and (2) Chief Constable of South Yorkshire Police [2017] EWHC 1291 (Ch), where despite it being recognised that Article 10 was engaged and that an order to require disclosure of the workplace of the journalist’s source would have a chilling effect, the court ordered the disclosure of this information including on the basis that the protection of s.10 Contempt of Court Act 1981 was not engaged as it considered there to be a low likelihood of the source actually being identified as a consequence of the disclosure.
An expansion of the protection to matters relevant to the identify of a source would be a valuable amendment.
In addition, there are a number of legislative provisions which afford rights to public authorities and which on their face fail to identify the limits of such powers in connection with journalistic sources (see, for example, our blog post ‘Exclusive: Information Commissioner’s Office Kisses Source Protection Goodbye’). An amendment to clarify that such powers are always subject to limitations in connection with journalistic sources would flag the need for public authorities to have regard to Article 10 rights in the exercise of their powers.
Prior restraint and other forms of relief
Clause 22 largely replicates the provisions of section 12 Human Rights Act 1998 which prohibits the grant of relief which might affect the right to freedom of expression (such as an injunction, reporting restriction, production order or compliance order under section 167 Data Protection Act 2018) unless the respondent is represented (i.e. the hearing is conducted on an inter partes rather than ex parte basis) or all reasonable efforts have been made to notify the respondent or the court is otherwise satisfied that there are compelling reasons, and under the Bill of Right “exceptional and compelling reasons”, why the respondent should not be notified.