Information Privacy and the Public-Private Divide in Article 8

Oliver Butler, PhD Candidate, University of Cambridge

“The public-private divide in Article 8 has been overlooked by the literature on positive obligations”

This paper analyses the extent to which a public-private divide has been developed or eroded in the jurisprudence of the European Court of Human Rights in relation to Article 8 of the European Convention on Human Rights (ECHR) in the context of information privacy. Information privacy here refers to controls over the collection, retention and disclosure, for various purposes, of information about individuals. Public-private divide here refers to a difference in treatment between public authorities and private actors. Most straightforwardly, the ECHR imposes obligations on the contracting parties. As such, there is a fundamental public-private divide in that the obligations it imposes are those of the state alone. I am concerned with the conceptual framework and jurisprudence that governs the state’s international obligation and the extent to which that obligation requires contracting parties to regulate public authorities and private actors differently. I argue that, although positive obligations have significantly eroded the public-private divide in Article 8, a remedial and regulatory divide has survived this change and has been overlooked by the literature on positive obligations, which suggests that there has been a more comprehensive erosion of the divide.

Article 8 was originally drafted with a public-private divide and was understood to impose a negative obligation on public authorities with little consideration given to private interference.[i]

The substantive interests protected by Article 8 contain little that is in principle distinctive of the state, save for limited exceptions concerning legislation permitting secret surveillance.[ii] The substantive interests protected, although they have become broader and more inclusive over time, have not manifested a distinctive public-private divide. The Article 8 jurisprudence has developed a doctrine of imputation but its development has been limited.[iii]

“To secure respect for private life even in the sphere of relations of individuals between themselves”

The Court has, however, significantly eroded, but not fully removed, the public-private divide through the development of positive obligations of the state to secure Article 8 rights, even between private individuals. This requires the regulation of private actors. The Court first stated that Article 8 could contain “positive obligations” in Marckx v Belgium.[iv] In X and Y v Netherlands, it held that positive obligations could include “the adoption of measures designed to secure respect for private life even in the sphere of relations of individuals between themselves.”[v] The positive obligation considered in relation to information was considered by the Commission in the same year as X and Y v Netherlands in Winer v United Kingdom.[vi] This case decided that the “absence of an actionable right to privacy under English law [did not show] a lack of respect for the applicant’s private life and his home”. The way in which the state met its positive obligations was “largely within its discretion”. This weak obligation was later reconsidered by the Commission in Earl Spencer v United Kingdom, which, although decided on the basis of a failure to exhaust domestic remedies, refused to “exclude that the absence of an actionable remedy in relation to the [publication of personal and family details]… could show a lack of respect for [the applicants’] private lives.”[vii] In Von Hannover v Germany, the Court held that in relation to personal or intimate information the state’s positive obligations may “involve the adoption of measures designed to secure respect for private life even in the sphere of relations of individuals between themselves”, that “regard must be had to the fair balance that has to be struck between the competing interests of the individual and of the community as a whole”, and that the state enjoyed “a certain margin of appreciation”.[viii] In Mosley v United Kingdom, the Court accepted generally that an ex post facto compensation action is in principle sufficient to discharge the positive obligations of the state in the context of media publication of private information.[ix] This has not been successfully challenged or expanded to date. More recently, the Court, in Von Hannover v Germany (No. 2), reiterated that “the choice of the means calculated to secure compliance with [Article 8] in the sphere of the relations of individuals between themselves is in principle a matter that falls within the contracting states’ margin of appreciation”, subject to “European supervision” to review, and not replace, the decisions of national courts. Where the national courts carried out a balancing exercise in conformity with the criteria laid down in the Court’s case law, only “strong reasons would enable it to substitute its view for that of the domestic courts.”[x]

In relation to medical information, the Court has held that practical and effective protection is required to exclude any possibility of unauthorised access occurring” through “appropriate safeguards”.[xi]

Positive obligations share much in common with negative obligations, especially a concern for balancing substantive interests through a fair balance test or proportionality as part of interference “necessary in a democratic society” respectively.[xii] However, there remain two important distinctions between positive and negative obligations which form the basis of the present public-private divide.

Remedial public-private divide

First, there is a remedial public-private divide. Positive obligations in the context of information privacy have, to date, accepted the adequacy of an ex post facto compensation remedy as discharging the core positive obligation and information security provisions in relation to personal health information. Negative obligations have developed with the assumption of judicial review of whether legislation is, among other things, “in accordance with the law” and says nothing of ex post facto compensation.

Regulatory public-private divide

Secondly, there is a regulatory public-private divide. The requirement that interference by a public authority be “in accordance with the law” has developed to impose a rigid set of legality requirements on public authorities. These do not exist in relation to private actors, which are controlled instead by balancing exercises conducted in the context of the ex post facto compensation action. In particular, the jurisprudence denies or calls seriously into question the validity of reliance on broad discretionary powers,[xiii] implied powers[xiv] or “common law” powers.[xv] This is significantly more onerous and rigid than the adoption of measures required by positive obligations. Discretion, implied power and common law power are three ways in which administrative flexibility can be granted to public authorities under national judicial review standards in the United Kingdom. These are not available in relation to interference with information that falls within the scope of Article 8. Although the scope of the relevant authorities is uncertain, they require a dependence on narrowly drafted express provisions in relation to public authority powers relating to private information. This necessarily makes public authorities less responsive to changing circumstances and demands, due to the pace of the legislative process. By contrast, private bodies may proceed if they are content that the appropriate balance has been struck and so the decision will not be vulnerable to an action for compensation.

Despite the erosion of the public-private divide through the development of a doctrine of positive obligations, the remedial and regulatory public-private divide remains. This is significant because it imposes differing levels of flexibility or rigidity in regulation. In a mixed economy of service provision, characterised by rapid change and increasingly governed by a market logic, these may prove to be important differences in relation to the delivery of modern public services. It makes public authorities more cumbersome in adapting to changing information needs in the context of public procurement and commissioning, and less competitive than more flexible (because less regulated) private bodies. Insufficient attention has been paid in the literature to this surviving divide and its implications.

 

[i] See, for example, Pitkänen, “Fair and Balanced Positive Obligations – Do They Exist?” (2012) EHLR 538, 539

[ii] Contrast Malone v United Kingdom (1985) 7 EHRR 14, paragraph 84 and P.G . and J.H. v United Kingdom (2008) 46 EHRR 51, paragraph 42, although see also Heglas v Czech Republic (2009) 48 EHRR 44, paragraphs 60 to 61 for a narrowing of that contrast. See also Klass and others v Germany (1979-1980) 2 EHRR 214, paragraphs 41 and 42.

[iii] See Storck v Germany (2006) 43 EHRR 6, paragraph 146; M.M. v Netherlands (2004) 39 EHRR 19, paragraphs 36 to 40; Van Vondel v Netherlands (2009) 48 EHRR 12, paragraphs 48 to 49.

[iv] (1979) 2 EHRR 330, paragraph 31

[v] (1985) 8 EHRR 235, paragraph 23

[vi] App. No. 10871/84

[vii] (1998) 25 EHRR CD105

[viii] (2005) 40 EHRR 1, paragraphs 57 and 58

[ix] (2011) 53 EHRR 30, paragraph 120

[x] (2012) 55 EHRR 15, paragraphs 104 to 107

[xi] I v Finland (2009) 48 EHRR 31, paragraphs 38 to 47

[xii] See, for example, Peck v United Kingdom (2003) 36 EHRR 41

[xiii] See Herczegfalvy v Austria (1993) 15 EHRR 437, paragraph 91; Natoli v Italy (2003) 37 EHRR 49, paragraph 44; Gillan and Quinton v United Kingdom (2010) 50 EHRR 45, paragraphs 78 to 87; Shimovolos v Russia (2014) 58 EHRR 26, paragraph 68

[xiv] See Copland v United Kingdom (2007) 44 EHRR 37, paragraph 47

[xv] See Malone v United Kingdom (1985) 7 EHRR 14, paragraphs 79 to 82