Law on Privacy
The law on privacy has developed significantly over the last 30 years. At common law, there is no specific tort which protects privacy. A number of torts indirectly protect privacy, such as the those in relation to trespass, defamation, injurious false and nuisance. Although, a breach of privacy in itself, is not actionable as a tort, the courts have awarded damages and injunctions based on breaches of a constitutionally protected right to privacy.
The Irish Constitution recognises an implied right to privacy, in certain contexts. There have been very few Irish cases which have dealt expressly with privacy. Accordingly, the extent of the right to privacy under the Irish Constitution remains unclear.
The European Convention on Human Rights provides that everyone has the right to respect for his private and family life, his home and his correspondence. There shall be no interference with the right to privacy family life and the home from unwarranted interference by the state. Principles have evolved in cases decided under the Convention which illuminate the nature and extent of the right to privacy which it protects.
Meaning of Privacy
Privacy raises difficult issues in relation to its scope and meaning. It is said to protect personal mental happiness, the development of diverse interpersonal relationships, the evolution of ideas opinions and beliefs and participation in a democratic and pluralistic society. It is said to be a fundamental social value. Intrusion on privacy may demean the dignity and spirit of the individual and the integrity of society as a whole.
Privacy implies a zone, around which a person requires to enjoy his individual freedom, free from scrutiny and intrusion. It protects personal choices in regard to the way a person lives his life and correspondingly restricts intrusion by the state and others.
Of necessity, the right to privacy must yield to other competing interests on the part of the State. In particular, it must be balanced against freedom of expression, which is also protected under the Constitution and the European Convention on Human Rights.
Data protection law is one of the most effective protections of personal privacy. It restricts the use of information which may identify a living person.
Sensitive personal data is that relating to an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, physical or mental health, sexual life, the allegations or the commission of an offence. Sensitive personal data is subject to a higher degree of protection under the Data Protection Act.
There are several exemptions under the Data Protection Act, including in for certain journalism, artistic and literary purposes. This activities of collecting, processing, keeping and using personal data for journalistic, artistic, or literary purposes only is exempt from certain obligations of the legislation, to the extent that having regard to the importance of the right of freedom of expression and information in a democratic society, compliance with the provision would be incompatible with such purposes.
Right under Irish Constitution
The Irish courts have recognised that the Constitution protects privacy and anonymity, to a certain extent. The right of privacy embraces a right of anonymity. However, the Constitutional right applies in relatively limited circumstances. Generally, it is available only against agents of the State.
The right to privacy was recognised as one of the implied rights or so called unenumerated personal rights, protected by Article 40.3.1 of the Constitution. In the famous McGee case, the Supreme Court recognised the right to marital privacy, as an unenumerated personal right, protected by the Constitution. The court indicated that the right of privacy inheres in an individual, by reason of their human personality. The State is not permitted to intrude, without good objective justification, in relation to decisions taken within the scope of the zone of privacy.
In Kennedy and others v Ireland, unlawful phone tapping by agents of the State, was held to be a breach of a journalist’s right to privacy. Damages were awarded against the State. The courts have suggested that the right to damages for breach of the constitutionally protected right to privacy may not be limited to claims against the State.
The right to privacy is subject to restrictions in the interests of the common good, the public interest and to limitation arising from other Constitutional freedoms. In a number of cases involving the media, the courts have given precedence to the right of freedom of expression, over the right to privacy. The balance between the competing interests will depend on circumstances of the particular case.
EU Charter of Fundamental Rights
The EU Charter of Fundamnetal provides that Everyone has the right to respect for his or her private and family life, home and communications. It specifically protects the privacy of data.
Everyone has the right to the protection of personal data concerning him or her. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. . Compliance with these rules shall be subject to control by an independent authority.
The Charter also provides that everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. The freedom and pluralism of the media shall be respected.
European Convention on Homan Rights
The European Convention has become part of domestic Irish Law under the European Convention on Human Rights Act 2003. Many cases challenge laws and State action in Ireland both under the Irish Constitution and the Convention. Considerable case law has also developed in the United Kingdom following the incorporation of the European Convention on Human Rights into domestic law under the Human Rights Act, 1998.
The European Convention on Human Rights provides that everyone has the right to respect for his private and family life, his home and correspondence. It provides that there should be no interference by a public authority with the exercise of this right, except in accordance with the law where it is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime or for the protection of the health or morals, rights and freedom of others.
Scope of ECHR Privacy
Cases under the Convention have indicated that privacy may encompass a person’s personal information, genetic information, photograph, identity, reputation and honour. It covers the physical, psychological or moral integrity of the person. It embraces aspects of his physical and social identity. It encompasses the right to maintain and establish relationships with others. It includes the social dimensions of private life, including ties to family and community. Privacy may apply in the home, workplace or in public. Cases under the Convention emphasise the centrality of personal autonomy in the concept of privacy.
The European Court of Human Rights has held that States are obliged to vindicate their citizens’ Convention rights to privacy. This is not limited to actions against the State itself. The nature of the State’s obligation, depends on the aspect of privacy concerned. States have a certain leeway and discretion in relation to the measures which they take to protect the right to privacy. However, they must ensure that interference with the right to privacy is justified in the interest of a democratic society in accordance with the above-mentioned criteria.
Scope of Privacy Right
There are a number of dimensions to the right to privacy. It appears that the right protects privacy of information in itself and intrusion into private space. In the United States the test for intrusion into privacy, refers to actions which are highly offensive to a reasonable person of ordinary sensibility. However, some intrusion may not be protected against, notwithstanding that it may be offensive. Others may constitute a breach of the right to privacy, even though they are clearly not offensive.
The European Court of Human Rights has emphasised the reasonable expectation of privacy as a defining criterion for the protected zone or area. The English courts have applied this test in the context of breach of privacy claims under the Convention. The question is what a reasonable person of ordinary sensibilities would feel, if placed in the same position and it faced with the same publicity.
Where there is intrusion into the protected zone of privacy, balancing may be required between different interests. Regard is had to the attributes of the claimant, the nature of the activities, the place, the nature of the intrusion, the absence of consent, whether it is known or could be inferred and the effect on the claimant.
Basis of Privacy Rights
A number of factors affect the extent to which a person may have a reasonable expectation of privacy. Where a person is cast in the public limelight involuntarily, different considerations may arise to those which would apply where he seeks publicity. They should not be subject to the same lessened expectation of privacy, as the latter category.
Formerly, the courts based the protection of confidence on a pre-existing relationship of confidence. The matter is still relevant in many cases, such for example, where a person is entrusted with confidential material.
Similarly, where persons are in a sexual or personal relationship, there may be an expectation that they do not reveal private or intimate information. However, it does not follow that because a relationship existed between the parties, that all information shared between them becomes confidential, in the sense of creating an expectation of privacy
Inherently Private Information I
The courts have indicated that the right to privacy may be derived from the nature of the information. Matters which are entirely private to an individual, may be wholly immune from disclosure to the public. In other circumstances, a person may not be able to insist that the information be kept private unconditionally, where there are competing interests
Certain information is regarded as an inherently private. This would include medical information, intimate sexual information and sexual relationships. The disclosure of such private information is likely to be justified, in exceptional circumstances only, where there is a clear and demonstrable public interest.
These categories of protected information are likely to include private diaries, letters, e-mails and equivalent intimate and private matters, in respect of which there is a reasonable expectation of privacy. Privacy attaches because of the nature of the information and in some cases because of the relationship between the person disclosing it and the person receiving it.
Inherently Private Information II
There are difficulties in defining the extent which information of a particular type of category, is automatically protected. Emerging case law suggests that there are certain types of information, which are likely to be protected in almost all circumstances.
Medical information and records are subject to a high degree of protection. It will rarely be sufficient justification for the disclosure of such information. The fact that the information is medical, may not necessarily mean that it is inherently private. Some matters, such as broken legs are likely to be public and there is unlikely to be a legitimate expectation of privacy in relation to them.
The right to privacy is likely to embrace most areas of sexual relationship and sexual orientation. It covers the most intimate part of a person’s private life.
There may be circumstances, where the protection of the young and vulnerable require limitations of the right. However, as between consenting adults, a high degree of privacy would prevail. Intimate information in relation to children and vulnerable persons, is likely to enjoy a high degree of protection. Their reduced capacity to consent is material in this regard.
Higher Expectation of Privacy
Certain types of material carry a higher expectation of privacy. This may be the case with a private diary, journal or other confidential records. It may apply to electronic information, which is protected by confidentiality or security. Where a person has requested a particular level of privacy, this will be taken into account.
Parties may make an occasion private by making it clear that they do not consent to pictures being taken. he taking of security precautions to prevent photography is likely to be a strong indication that there is an expectation of privacy. Even in the case of media stars, where they have requested that family photographs are not published, this may assist in demonstrating an expectation of privacy. Restraining injunctions and damages have been granted in the case of breaches.
The courts have protected linking adoption information, on an application to the Information Commissioner on the basis that the records where confidential and carried an expectation of privacy.
The nature of the activities will always be relevant. Intimate and personal details are much more likely to attract privacy. The European Court of Human Rights has emphasised the person’s private life, inner circle or personal life, from which he chooses to exclude the outside world. Respect for private life includes the right to establish and develop relationship with others.
Protection in Public Zones
A person has a lesser expectation of privacy, when he is in a public zone. Photographs of persons in public are less likely to attract a right of privacy. In contrast, photographs within the home will usually carry a very high expectation of privacy.
A number of celebrities have successfully taken legal action in respect of intimate photographs taken while in a private location, such as at home, within a hotel or on holiday. In contrast, photographs taken in public or semi-public place, will enjoy a significantly lesser reasonable expectation of privacy.
The European Court of Human Rights has upheld the privacy of video footage of a person attempting to commit suicide in a public place, on the basis that the matter was of a highly private nature. The English courts have recognised the right to privacy in relation to photographs, even in public places, in some cases.
Protection in Public Zones II
The European Courts of Human Rights regards publication of photographs and pictures as a greater interference with the right to privacy, than publication of information. As with sound and visual records, they can have a permanent effect.
A person may who walks down the street may reasonably expect not to have his image published and exploited.Photographs may be particularly intrusive and allow the public to see what is otherwise sought to be kept private.
However, even here there are limits. In the famous Douglas v Hello cases, the Court of Appeal that the couple could not expect privacy in respect of all photographs at a wedding with 250 guests. The claim succeeded in other respects
The means of intrusion may be relevant. Intrusion by phone tapping and covert surveillance is likely to be inherently objectionable in most circumstances. The view has been expressed in some English cases that the use of phone tapping, hidden cameras, long distance lens and recording devices may of themselves constitute a civil wrong, in relation to persons engaged in private acts. It is not clear whether the propositions in these cases will develop further.
The fact that the person is a public figure, does not deprive him of a reasonable expectation of privacy in relation to intimate personal affairs. Such persons may enjoy a lower degree of protection than others. This is particularly so, where that person has sought publicity, particularly in that sphere, or where he has held himself out as a public personality.
It does not mean that mere allowance of access to one’s private life disclaims all rights to privacy. However, the person has a lesser degree of privacy in respect of the areas in which they have courted publicity. The courts distinguish between persons who have courted publicity, and those who are thrust into the public limelight unintentionally.
The European Court of Human Rights case law appears to establish that public figures in particular in government positions will enjoy a reduced right of privacy. However, they retain protection in respect of intrusions into private matters, which are not relevant to their professional life.
Substantive and Procedural Limits on Interference
The more intrusive and intimate the intrusion of privacy, the more rigorous the justification must be. Interference with fundamental rights must be for the purpose of an objective social need and be proportionate. It need not be necessary, in the sense of being absolutely necessary, but they must be reasonable and proportionate. This proportionality may be exercised within the states’ margin of appreciation.
Laws which interfere with privacy must meet minimum standards of due process. For example, the laws on surveillance must have sufficient protective mechanisms built in, so that they ensure that interference with the right goes no further than necessary, in order to achieve a legitimate objective. They interference must not be arbitrary and must be protected by appropriate procedures.
The courts have also given expression to freedom of expression, which is also protected under the Convention. They have emphasised the parity of freedom of expression and the right to privacy. The weight to be given to each depends on the balance between competing rights. In the case of intrusion on privacy, there must be some sufficiently important countervailing consideration in the public interest, which is sufficient to justify it.
Damages / compensation may be awarded for breach of a person’s right to privacy. The breach may constitute a breach of constitutional rights for which aggravated or exemplary damages may be granted. In the alternative, an award of account of profits may be granted, particularly where there has been a deliberate breach.
Damages for breach of privacy may based on breach of constitutional law or the ECHR. Other laws may apply in respect of breaches of privacy. The laws on trespass may, in some cases, protect privacy. Behaviour and states of affairs that constitute the tort of nuisance may protect a person in the quiet enjoyment of his property. If there is a substantial and unreasonable interference, then there may be an actionable nuisance.
The courts have indicated that a right of damages will be available to protect Constitutional rights, which are not otherwise protected by the law of torts/ civil wrongs. Although there is very little case law on the subject, a civil right of action exists against the State at least in some circumstances for breach of the constitutional right to privacy.
The State also has a positive obligation to protect the right of privacy under the Convention. The High Court has indicated that a right to damages may lie against private parties, for invasion of the Convention right to privacy. The High Court has accepted that there should be an action for damages for breach of privacy where there has been an unjustifiable violation of private information.
Against the above position is the general principle that private (non-State) entities are not liable for breach of Constitutional or Convention Human Rights. However, the right of action for privacy has developed on the basis that the State must vindicate and protect the right so that the right is required, because of its absence in statute or common law. The Supreme Court has not yet considered the proposition.
References and Sources
Data Protection Act 1988
Data Protection (Amendment) Act 2003
Data Protection Act 2018
Communications (Retention of Data) Act 2011
Criminal Justice (Surveillance) Act 2009
Criminal Justice (Surveillance) Act 2009 (Written Record of Approval) (An Garda Síochána) Regulations 2009, S.I. No. 275 of 2009
Criminal Justice (Surveillance) Act 2009 (Written Record of Approval) (Revenue Commissioners) Regulations 2009, S.I. No. 290 of 2009
Criminal Justice (Surveillance) Act 2009 (Written Record of Approval) (Defence Forces) Regulations 2010, S.I. No. 80 of 2010
Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (Official Journal L 8 of 12.1.2001, pp. 1-22)
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).
Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending (declared invalid by Court of Justice ruling, see below).
Directive 2002/58/EC (Official Journal L 105 of 13.4.2006, pp. 54-63)
Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009
Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications (Official Journal L 173 of 26.6.2013, pp. 2-8).
European Communities (Directive 2000/31/Ec) Regulations 2003
European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011
EU Data Protection Law Kelleher & Murray 2018
Information & Technology Communications Law Kennedy & Murphy 2017
Social Networking Lambert 2014
Law Society PPG Hyland Technology & Intellectual Property Law 2008
Information Technology Law in Ireland 2 Kelleher & Murray 2007
Data Protection Law in Ireland: Sources & Issues 2 Lambert 2016
Privacy & Data Protection Law in Ireland Kelleher 2015
Data Protection: A Practical Guide to Irish & EU Law Carey 2010
Practical Guide to Data Protection Law in Ireland A&L Goodbody 2003
Privacy and Data Protection Law in Ireland 2nd ed Denis Kelleher 2015
EU and UK Texts
Privacy and Legal Issues in Cloud Computing Privacy and Legal Issues in Cloud Computing Edited by: A. S. Y. Cheung, R. H. Weber 2016
Privacy and Legal Issues in Cloud Computing Privacy and Legal Issues in Cloud Computing Edited by: A. S. Y. Cheung, R. H. Weber 2015
Information Rights: Law and Practice Information Rights: Law and Practice 4th ed Philip Coppel 2014
Cloud Computing Law Christopher Millard 2013
Transborder Data Flow Regulation and Data Privacy Law (eBook) Christopher Kuner 2013
Consent in European Data Protection Law Consent in European Data Protection Law Eleni Kosta 2013
A User’s Guide to Data Protection A User’s Guide to Data Protection Paul Lambert 2013
Confidentiality (Book & eBook Pack) Confidentiality 3rd ed The Hon Mr Justice Toulson, Charles Phipps 2012
Binding Corporate Rules: Corporate Self-Regulation of Global Data Lokke Moerel 2012
Property Rights in Personal Data: A European Perspective Property Rights in Personal Data: A European Perspective Nadezhda Purtova 2011
Global Employee Privacy and Data Security Law 2nd ed Morrison & Foerster LLP 2011
Computers, Privacy and Data Protection: An Element of Choice Computers, Privacy and Data Protection: An Element of Choice Edited by: S. Gutwirth, Y. Poullet, P. De Hert, R. Leenes 2011
Information Rights: Law and Practice Information Rights: Law and Practice 3rd ed Philip Coppel 2010
Data Protection: Legal Compliance and Good Practice for Employers Data Protection: 2ed Lynda Macdonald 2008
The Law of Personal Privacy David Sherborne, Mark Thomson, Hugh Tomlinson Due August 2019
Tort Law and the Protection of Privacy John Hartshorne April 2019
The Privacy, Data Protection and Cybersecurity Law Review The Privacy, Data Protection and Cybersecurity Law Review 5th ed Edited by: Alan Charles Raul 2017
International Cybersecurity and Privacy Law in Practice International Cybersecurity and Privacy Law in Practice Charlotte A. Tschider 2017
Determann’s Field Guide to International Data Privacy Law 3rd ed Lothar Determann
The Law of Privacy and The Media 3rd ed Edited by: Nicole Moreham, Mark Warby 2016