Memorandum submitted by Ofcom, Office
of Communications
INTRODUCTION: THE
ISSUES RAISED
AND OFCOM'S
EVIDENCE
1. The Committee identified four issues
on which it seeks evidence:
(i) Whether self-regulation by the press
continues to offer sufficient protection against unwarranted invasions
of privacy.
(ii) If the public and Parliament are to
continue to rely upon self-regulation, whether the Press Complaints
Commission Code of Practice needs to be amended.
(iii) Whether existing law on unauthorised
disclosure of personal information should be strengthened.
(iv) What form of regulation, if any, should
apply to on-line news provision by newspapers and others.
2. The questions posed in this inquiry are
largely outside Ofcom's regulatory remit. However, as the statutory
regulator responsible for protection of audiences against infringement
of privacy by television and radio broadcasters, Ofcom is closely
concerned with the topics raised. The questions are lent further
significance by the current debate in Europe over the revision
of the Television without Frontiers Directive (renamed the "Audiovisual
Media Services" Directive), which proposes to extend regulation
to on-demand television services, regardless of the means of delivery.
This Directive will have a significant impact on UK media regulation
when it is implemented in the UK. In particular, it is almost
certain to require that Video-on-Demand services (VoD), currently
self-regulated in the UK, be brought into a statutory or a co-regulatory
framework.
3. The Directive does not include any requirements
for protection of privacy in relation to the newly regulated class
of VoD services. However, it is at least possible that the UK
implementation of the Directive will include regulatory protection
of privacy in relation to VoD. Such an inclusion would follow
the structure of privacy protection in relation to linear services,
which Ofcom regulates in the UK, but is the subject of general
law in most EU countries. In that case, clarity over the respective
domains of statutory regulation, and of the PCC, will be essential.
We examine this issue below in section 4.
4. Ofcom is reviewing the efficacy of co-
and self-regulatory institutions as a part of its overall programme
of work on the future of regulation, and to support the process
of implementing the AVMS Directive. The co/self-regulation study
will seek to establish a set of criteria by which Ofcom can judge
when and how it might be appropriate to delegate particular duties
and functions to industry-led bodies. Specifically in relation
to the first question posed by the inquiry, we have not undertaken
any research into the current self-regulatory model for privacy
protection in relation to the Press, and do not have a view as
to its sufficiency.
5. However, we do note that the media industry
is in a period of particularly rapid evolution at present, with
innovative new services, platforms, content and new players emerging.
Co- or self-regulatory institutions may be particularly well suited
to such dynamic environments, because these types of arrangement
involve industry and consumers taking on a central role in the
delivery of public policy goals and consumer protection.
6. An innovative new service may both create
new risks to consumers and new means through which those risks
may be mitigated. Under a co/self-regulatory arrangement, the
same industry players who create new services will be able to
develop an appropriate regulatory framework to secure consumer
protection. Typically, a statutory framework will be less flexible,
and offer more limited opportunities for innovation.
7. The recent announcement by the PCC that
it is extending its regulatory remit to cover the online services
offered by the newspaper and magazine providers is an example
of this. The PCC's member organisations have all committed to
this new, extended regulatory framework. We comment on aspects
of the PCC's proposal below; in this context, the point is that
it is to be welcomed that the PCC has been able act quickly to
co-opt industry into the adoption of a new expanded framework,
without the need for new legislation.
8. In our evidence below, we respond to
the inquiry with:
— an analysis of the current legal
position in relation to privacy;
— an account on the role Ofcom plays
in relation invasion of privacy; and
— comments on the boundaries of Ofcom's
responsibilities and that of the PCC, before and after the implementation
of the AVMS Directive.
PROTECTION OF
PRIVACY IN
UK LAW
9. The European Convention on Human Rights
was incorporated into domestic law under the Human Rights Act
1998. Under Article 8 of the European Convention on Human Rights,
the UK has an obligation to respect the individual's right to
a private life. Although the Convention creates obligations that
are owed only by the state and public bodies, judges have concluded
that they must also be articulated and enforced in actions between
private individuals. This follows from section 6(1) and 6(3) of
the Human Rights Act 1998 under which the court, as a public authority,
is required not to act "in a way which is incompatible with
a Convention right".
10. The effect of this is that citizens
can only invoke Article 8 directly in actions against public bodies
but not in actions between private parties in private law. In
the absence of a domestic law tort of privacy, judges have had
to enforce the Article 8 right in private civil actions by adopting
the long-established action for "breach of confidence"
as a vehicle. Whilst this is still not a fully-fledged "right
to privacy" in the sense recognised in many other legal systems,
it is spreading to cover a substantial proportion of the "privacy"
field. To this end, the four elements of breach of confidence
have each undergone some modification and as a result,[5]
the concept of a right to protection from the misuse of private
information has developed. This has now become clearly established
in English law. This new cause of action involves the following
elements:
(i) The information must be "private"—in
other words, there must be a "reasonable expectation of privacy"
in relation to the information concerned.
(ii) The defendant knows or ought to have
known that the information is private.
(iii) There is an actual or threatened misuse
of the information.
(iv) The Article 8 "right to respect
for private and family life" of the claimant must outweigh
the Article 10 "right to freedom of expression" of the
defendant. This is determined by carrying out a "parallel
analysis" of the position under each Article on the facts
of a particular case and then looking at the balance between them
(the "balancing exercise").
11. This right to protection from the "misuse
of private information" was first formally established in
the case of Campbell v MGN Ltd [2004] 2 AC 457 which went
to the House of Lords in May 2004 and is spreading to cover an
increasing scope of the individual's personal life and continues
to be a rapidly developing area of law. Under this new action,
a claimant is able to apply for both interim and final injunctions
pre-publication as well as damages for distress, anxiety and inconvenience
at full trial.
A "reasonable expectation of privacy"
12. In Campbell, Lord Nicholls stated
that "Essentially, the touchstone of private life is whether
in respect of the disclosed facts the person in question had a
reasonable expectation of privacy" (§21).
13. There are three important points to
note about this test. Firstly, Lord Hope in Campbell stressed
that the mind that must be examined is not that of the reader
in general, but of the person who is affected by the publicity
(§99). Secondly, in considering what falls within the scope
of a "reasonable expectation of privacy", the courts
will not only look upon the nature of the information itself but
also at the personal circumstances of the claimant and his or
her past conduct. In Douglas v Hello 2006 QB 125, the Court
of Appeal added that "private information is information
that is personal to the person who possesses it, and that he does
not intend shall be imparted to the general public. The nature
of the information or the form in which is it kept may suffice
to make it plain that the information satisfies these criteria".
Thirdly, the courts have now made clear that a reasonable expectation
of privacy may arise not only in private places but also in public
spaces (such as a park, beach or restaurant).
14. The main principle surfacing from case
law however is that "private life" is context-dependent
and that its nature may differ between individuals and their particular
circumstances ("It is a broad term not susceptible to exhaustive
definition" (Peck v UK (2003) 36 EHRR 41 at 57)).
Nonetheless particular categories of information have been recognised
by the courts as attracting protection by Article 8, such as:
gender identification, name, sexual orientation, sexual life,
a person's psychological experiences, address, health and diet,
personal relationships, finances, weddings and other private occasions.
"The defendant knows or ought to have known
that the information is private"
15. Unlike an action for breach of confidence,
which requires a "pre-existing relationship of confidence"
between the parties, an action for the misuse of private information
relies on the actual or imputed knowledge of the defendant that
the information is private. An obvious example of this is where
the defendant has acquired by unlawful or surreptitious means
information that he should have known he was not free to use.
This means that the primary focus will again be on the nature
of the information because it is the defendant's perception of
its private nature that imposes the obligation on him (McKennitt
v Ash [2006] EWCA Civ 1714 at §15).
The balancing exercise
16. In Campbell, it was clearly established
that neither Article 8 nor 10 has as such precedence over the
other. The test for balancing these two articles in specific cases
was refined in the House of Lords in In Re S (A Child)
2005 1 AC 593:
"First, neither Article has, as such, precedence
over the other. Secondly, where the values under the two articles
are in conflict, an intense focus on the comparative importance
of the specific rights being claimed in the individual case is
necessary. Thirdly, the justifications for interfering with or
restricting each right must be taken into account. Finally, the
proportionality test must be applied to each. For convenience,
I call this the ultimate balancing test."
17. There is no limit on the type of factors
that may be considered in carrying out the balancing exercise
and therefore the outcome of this stage will depend entirely on
the particular facts of each case. This could involve considerations
such as the public interest in the dissemination of the information,
public domain arguments, the triviality of the information and
the status and conduct of the claimant. In the recent case of
CC v AB [2006] EWHC 3083 Eady J emphasised that the considerations
under the balancing exercise could extend to matters such as the
defendant's motives for publication and even the feelings of individuals
who are not parties to the action.
18. The broad concept of "public interest"
has been considered a suitable justification for media intrusion
of privacy under appropriate circumstances. However, there is
no single definition of public interest. Article 8(2) of the Convention
identifies some considerations itself, including:
"[...] the interests of national security,
public safety or the economic well-being of the country, for the
prevention of disorder and crime, for the protection of health
and morals, or for the protection of the rights and freedoms of
others."
This list is not exhaustive and the courts will
be careful to have regard to the media's duty to inform the public
on matters of legitimate public interest, and the public's right
to receive such information. The media plays an important role
in putting matters of public interest onto the political agenda
and in bringing about necessary changes.
19. The court will consider whether the
reasons adduced to justify the disclosure were relevant and sufficient
and whether the measures were proportionate to the legitimate
aims pursued. In assessing the issue of proportionality, the courts
may limit the extent of disclosure by removing parts of the publication
to which no public interest attaches. The publication may be narrowed
down to include only aspects of the claimant's private life which
it is in the public interest to know (see for example, McKennitt
v Ash in which injunctions were granted in relation to specific
passages of the defendant's book that were particularly intrusive).
THE PROTECTION
OF PRIVACY
ON TV AND
RADIO
20. In addition to the developing law of
misuse of private information, there are two sector-specific regulatory
institutions responsible for considering and adjudicating on complaints
relating to unwarranted infringement of privacy: Ofcom, and the
PCC. This section describes the scope of Ofcom's responsibilities
and powers, and identifies the key differences between Ofcom and
the PCC.
21. From the 1960s concerns over media invasions
into privacy resulted in a number of draft privacy bills being
promoted; since the early 1970s, a number of committees have published
reports which have recommended greater regulation of the media.
Following this pressure, the Broadcasting Complaints Commission
was created, which was replaced by the Broadcasting Standards
Commission and whose functions were subsumed into Ofcom.
22. Under section 3(2) of the Communications
Act 2003, Ofcom has a duty to apply standards that ensure an adequate
protection from unwarranted infringements of privacy resulting
from activities carried on for the purposes of television and
radio services. Among the considerations to which Ofcom is required
to have regard in applying such standards are the vulnerability
of children and others whose circumstances put them in need of
special protection. Ofcom must also have regard to the need to
apply these standards in a manner that guarantees an appropriate
level of freedom of expression.
23. Ofcom's remit covers all UK television
and radio broadcasters including all commercial services, S4C
and the BBC (in certain areas including privacy). These broadcasters
are subject to a broad range of commitments relating to issues
such as potentially harmful or offensive content, due impartiality
in news, and the need to ensure that any infringement of privacy
is warranted,[6]
whether in programmes, or in connection with obtaining material
to be included in programmes. The conditions of the licence relating
to privacy are laid out in section 8 of Ofcom's Broadcasting Code
and related guidance notes. The relevant sections of the Code
are appended to this evidence (Appendices 1, 2).
24. When considering and adjudicating on
a complaint of unwarranted infringement of privacy Ofcom's starting
point is always whether a complainant has a "reasonable expectation
of privacy". Ofcom then determines whether in its view (and
on the evidence available) that person's privacy has been infringed.
Finally, Ofcom determines whether any infringement was warranted.
The greater the pubic interest in the disclosure of the information
the more the scales tilt against protecting the person's right
to privacy.
25. Ofcom's adjudications are normally published
fortnightly in a bulletin on its website. If a complaint is upheld
or partly upheld, then Ofcom may also direct the broadcaster to
broadcast a summary of its adjudication. Ofcom will normally make
such a direction where there has been an unwarranted infringement
of privacy in breach of the privacy section of the Ofcom Broadcasting
Code and where a complainant's legitimate interests have been
seriously damaged and Ofcom determines a remedy over and above
publication in the Ofcom broadcast bulletin to be appropriate.
26. For the most serious cases, Ofcom may
consider imposing a sanction on the broadcaster. This might include
a direction not to repeat a programme, imposing a financial penalty
and ultimately, in the case of commercial broadcasters, Ofcom
may consider revoking the broadcaster's licence.
27. It should be noted that Ofcom also provides
complainants and broadcasters with the opportunity to resolve
the complaint without the need for adjudication by Ofcom provided
the complainant is willing to consider an immediate proposal for
redress. Examples of such redress might include, but are not restricted
to, the editing of a programme for future broadcasts, an undertaking
not to repeat the programme or an apology or correction in writing
and/or broadcast.
28. Another important point to note is that
Ofcom does not have jurisdiction to deal with privacy complaints
prior to a programme being broadcast. The complainant would use
the courts for an injunction if they are seeking prior restraint.
Broadcasting regulation and press regulation
29. The role that Ofcom plays in relation
to broadcasters is very different to that played by the PCC. As
noted above, Ofcom oversees a very broad range of content guidelines,
through which it seeks to hold broadcasters to a different type
of editorial standards than applies for the press. Most important
among the differences is the requirement that news is presented
with "due impartiality". This is in contrast to the
press—where, for example, a newspaper may actively campaign
on a matter of political controversy.
30. The PCC is therefore considering complaints,
whether of accuracy or invasion of privacy etc., in a wholly different
context to that which Ofcom's Fairness and Privacy review process
operates.
On-demand TV Services
31. The Communications Act 2003 excluded
video-on-demand services from Ofcom's statutory control, in the
expectation that industry would take responsibility for oversight
of such services. The VoD industry subsequently created a self-regulatory
institution, the Association for TV on Demand (ATVOD), which oversees
consumer protection issues in relation to VoD services. The Association's
code does not refer explicitly to invasion of privacy, but does
require that content be provided "[...] in accordance with
the Broadcasting Regulatory Codes prevailing [...]" ATVOD
might, in principle, therefore consider complaints about invasion
of privacy.
32. In practice, because virtually all of
the programming provided on VoD services today will also have
featured on a broadcast channel, the issue may not arise: complainants
would be able to seek redress from Ofcom, in relation to the broadcast
of the relevant programme. In the event that a complaint was upheld
by Ofcom, ATVOD members would be required by the ATVOD code not
to offer on-demand access to the offending programme. ATVOD has
not to date received any complaint relating to invasion of privacy,
to Ofcom's knowledge.
AVMS Implementation and on-demand TV
33. The AVMS Directive is a modernisation
of 1989's EU Television without Frontiers Directive, developing
and extending the same basic framework. The goal of the 1989 Directive
was to protect some minimum standards for all TV services across
Europe, in areas including the protection of minors, and the requirement
of clear separation between advertising and programming. These
common standards were to apply all across Europe hence fostering
the development of a pan-European content market.
34. The new AVMS Directive will clarify
some of these basic objectives and, critically, extend the Directive's
scope to include Video-on-Demand services. Under the current proposals
for the new Directive VoD services must in future be subject either
to statutory control—for example by Ofcom—or to a
co-regulatory model. The UK's self-regulatory approach to VoD
services is not consistent with the likely requirements of the
Directive.
35. There are two aspects to the co-regulatory
models allowed under the Directive, which distinguish them from
the current UK approach:
(i) The state must have a formal role in
relation to the regulated services. The details of this can vary.
One model is illustrated by the regulation of broadcast advertising
today. Ofcom has formal powers in relation to advertising, but
has contracted out the management of its day-to-day regulatory
responsibility to the Advertising Standards Authority. In the
main, the ASA handles all broadcast advertising complaints and
directions to remove such advertising, however, Ofcom retains
backstop powers, for instance in areas of more serious sanctions
(eg fines) and approval of broadcast codes. Alternatively, the
state's role can be more limited—for example, defining the
duties of the relevant co-regulatory body, and granting accreditation
to a satisfactory institution.
(ii) The co-regulatory system must be comprehensive.
ATVOD is a voluntary body—a UK on-demand service-provider
is under no legal obligation to join, and may simply decide not
to do so. A co-regulatory architecture must capture all relevant
services, either through some direct legal requirement that operators
join an accredited co-regulatory body, or though a backstop requirement—for
example that operators who do not join an accredited body will
be subject to direct statutory regulation.
36. We anticipate that the debate over how
the Directive will be implemented in the UK will start early in
2007, and run through into 2008. Implementation must be completed
by late 2009, assuming that the Directive is in place in early
2008, as seems most likely.
37. One of the issues which must be resolved
during the implementation debate is over the approach taken over
content regulation in relation to VOD services and in particular
relating to complaints of unwarranted infringement of privacy.
The AVMS Directive does not cover privacy infringement, possibly
because most EU states protect privacy through general law rather
than sector-specific regulation. This means that the new regulatory
arrangements need not cover privacy for the Directive to be appropriately
implemented.
38. However, it will be necessary to choose
what privacy protections should exist in relation to on-demand
services. There are three options:
(i) Privacy protections could be limited
to those arising from case law findings (possible whatever approach
is taken to AVMS implementation generally).
(ii) Privacy issues could be included among
the responsibilities of an on-demand co-regulatory body, if one
is created.
(iii) Privacy issues could sit with Ofcom,
even if other aspects of the regulation of on-demand services
were the responsibility of a co-regulatory body.
39. This is one of the many difficult issues
which must be addressed during the Government's examination of
AVMS implementation options, over the next year.
THE PROTECTION
OF PRIVACY
IN RELATION
TO ONLINE
NEWS
40. Ofcom's privacy remit is defined in
the Communications Act 2003 to include only television and radio
services, however they are delivered. It does not therefore include
non-broadcast services like online news. The Act defines Television
Licensable Content Services (TLCS) and Radio Licensable Content
Services (RLCS), as the subject of Ofcom's oversight. For the
purposes of this analysis, we will focus on TLCS, although the
same broad framework applies in respect of radio.
41. The definition of TLCS is set out in
sections 232 and 233 of the Act (below in Appendix 3). The table
below lays out the criteria as a decision tree.
42. The account of these sections most relevant
to the current debate comes in the Explanatory Notes, section
526:
"The aim of these provisions is, broadly,
to maintain licensing obligations in respect of services which
are or equate to broadcasting while excluding Internet services,
such as websites or web-casting, from Ofcom's regulatory powers."
43. It is possible that there could be a
service offered exclusively on the internet which is captured
by the TLCS criteria, and which therefore does require licensing.
In practice Ofcom has not yet identified such a service (even
though there are many online services which market themselves
as "television"). Generally, it is clear that the Government's
intention is that online services should not be subject to statutory
oversight unless they are actually television channels as defined
by the TLCS criteria. Of course, it is possible that an existing
television channel is also distributed on-line—but in that
circumstance the service is already under an Ofcom licence and
subject to Ofcom's code.
The PCC and on-line news
44. In this context, we welcome the PCC's
recent announcement to extend its self-regulatory oversight to
include on-line news services provided by newspaper and magazine
operators, as it provides an additional layer of privacy protection
in a domain which is currently covered only by the provisions
of case law discussed above.
45. We also support much of the detail of
the PCC's proposal, particularly the points made in relation to
regulatory overlaps. The PCC states that "[...] content pre-edited
to conform to the on-line or off-line standards of another regulatory
body [...]" will remain outside its oversight. For example,
it is possible that a newspaper publisher creates and distributes
a TLCS, as defined in the Communications Act—as stated above,
this would clearly be subject to Ofcom's statutory control whether
it were distributed online or on a traditional television platform.
46. The position is slightly different in
relation to a video-on-demand service developed by a newspaper
publisher. At present, both ATVOD and the PCC are voluntary schemes,
and the publisher could in principle choose whether to operate
under the PCC code or that developed by ATVOD.
47. In practice, these issues may not arise,
because the services presently offered by newspaper publishers
are clearly neither TV channels nor on-demand services.
48. In the future, however, this situation
will change as a result of the implementation of the AVMS Directive
discussed above. All video-on-demand services, including any offered
by a newspaper publisher, would necessarily fall under statutory
regulation or under a co-regulatory body, but not the PCC in its
current form. This would, of course, have no other impact on the
reach of the PCC, which could continue to cover all services from
newspaper and magazine publishers other than those singled out
for specific oversight by the Directive.
The PCC Code and Live Video
49. Finally, Ofcom has identified a particular
issue in the framework proposed by the PCC, relating to live services.
The current draft of the PCC framework states that it excludes
from their oversight, and therefore from their privacy rules,
services which may be "streamed or broadcast or otherwise
disseminated live, and incapable of the sort of controls editors
normally apply".
50. It is clear that a live camera feed
on television or on the Internet presents particular risks to
a broadcaster or publisher—the video distributed is not
easily subject to editorial review, and may therefore include
material which infringes an individual's privacy or is otherwise
inappropriate. Nonetheless, under Ofcom's guidelines for broadcasters,
live coverage of an event does not create a blanket exemption
from compliance with the Broadcasting Code. In considering a complaint,
the fact that the issue arose as part of live coverage of an event
can be a mitigating factor, but is not an excuse for a breach
of the Code. It must be the case that an editorial decision has
been taken to redistribute a live camera feed; in doing so, an
editor is making some form of editorial judgement, and should
take into account the risk that privacy-infringing content be
distributed.
51. The issue is that the same live camera
feed might be treated differently if offered on a newspaper website,
under PCC oversight, and on a TV service under Ofcom control.
We have raised this issue with the PCC, who were sympathetic to
our concerns. Ofcom have agreed with the PCC that further work
will be required to ensure that there is appropriate consistency
on relevant boundary issues such as this.
5 As set out in Coco v AN Clark (Engineers)
[1969] RPC 41 at p 47. Back
6
In fact, under the Television Without Frontiers Directive (Directive
89/552/EEC, as amended by 97/36/EC) television services available
in the UK will either be licensed by Ofcom (or in the case of
the BBC and S4C operate in accordance with Ofcom's regulatory
oversight) or be regulated by the originating EU member state's
national regulatory authority (NRA). In practice, all but around
20 of the 500+ channels on Sky, in the largest UK TV platform,
are OFCOM licensees or covered by the BBC Trust. Furthermore,
channels operating from EU states will typically be covered by
legislative rights to privacy, as exist in Germany, France, Italy
etc; or where such protection is not in place, as in Ireland,
through a specific duty of the regulatory authority. Back
| 
