 Okay, so it's my very great pleasure to welcome you to this simple seminar and particularly to welcome our speaker Christopher Knight from 11 Kings bench walk. Very well known in information law and data protection circles are very much I think a bridge between the academic world has written a lot in an academic context but very much also. And primarily, a practitioner in fact going through his cases today are preparing for this. It's incredible what cases Chris you've been involved in. The Shrems case and Facebook recent litigation, the privacy international litigation, please both in the court of justice, some very interesting tribunal cases including one involving leave dot EU and elder insurance and various marketing or were they and messages to do with the Brexit referendum. And also another very interesting one which was only recently been published through vision productions, which I think you're probably going to be focusing on to some extent in your talk itself which is going to look at the ever interesting I think topic which is how data protection and protecting personal information intersects with freedom of expression and whether we really have a coherent system for engaging with that fundamental sometimes synergy but very much more often tension in so many of the cases and in so much of life. So, you can by the way submit any questions and answer quick, not the answers maybe the questions as you want. The answers, submit the answers. You can try on the answers as well and we do want to real discussion in this. But we'll let Christopher go first in terms of the answers and over to him. Thank you very much, David, and just feel and note, those of you who are interested in the privacy electronic communications regulations, the leave dot EU appeal decision came out from the upper tribunal just a couple of days ago, upholding the first rule in all respects. But good evening everyone. Thank you very much for inviting me to participate in this excellent series of webinars. This center didn't exist when I started as an undergraduate in Cambridge which now feels a lifetime ago and I don't think anyone taught me about data protection law for reasons which remain slightly unclear to me I now practice quite heavily in days protection or begun and began to do so before the GDPR was even a twinkle in the milkman's eye. And I'm now basking in the sudden public awareness of the existence and importance of data protection law. Well, I'm not sure data protection law has ever been sexy, but I did do a pub quiz in 2018 to which the answer to one question was the GDPR, and that would have been unthinkable just a few years earlier. Data protection has, however, a much more venerable history and a considerably higher degree of public and legal awareness and understanding it's a convention right and a common law right with an extensive body of jurisprudence. Data protection is not a convention right, although there are increasing aspects of it in the treatment of the art glate case law, see in particular cat and the UK and Gokran and the UK recently, and it most certainly is not a common law right. But how one balances freedom of expression concerns with data protection issues is a vexed question, and which seems to me at least has been the subject of relatively limited direct case law. And I wanted in this seminar to discuss that limited case law release of it in the time and consider whether and to what extent the law is able to balance free expression rights with data protection rights and obligations. Article nine of the 1995 data protection directive. Contained the sole not to freedom of expression rights. It provided that member states shall provide for exemptions or derogations from the provisions of this directive. For the processing of personal data carried out solely for journalistic purposes, or the purpose of artistic or literary expression, only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression. The same appears in article 85 of the GDPR member states shall by law reconcile the right to the protection of personal data pursuant to this regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic artistic or literary expression. And then in 85 to the processing carried out for journalistic purposes, or the purpose of the other special purposes member states shall provide for exemptions or derogations, if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and make the addition of and information there. But that is on any view in both forums a somewhat hands off approach in a legislative scheme which is otherwise extremely prescriptive. The scope of journalism in EU law is a broad one, just as it is under the convention. It extends beyond the activities of media undertakings, and encompasses other activities, the object of which is the disclosure to the public of information, opinions and ideas. See, for example, the Finnish Saturn case in the court of justice. The case and a second is one of two main court of justice decisions on the role of freedom of expression in the data protection context and it's the second one I want to focus on. The second case is the Buavitz case, in which the court of justice indicated that a Latvian man who had filmed police officers taking a statement in a police station and uploaded it to YouTube to draw attention to alleged malpractice could fall to article nine of the directive. If the sole purpose of doing so is for the disclosure to the public of information, opinions or ideas, citizen bloggers, citizen journalists, citizen YouTubers, potentially protected. We know of course that the concept is not unlimited Google Google failed to convince Mr Justice Warby, as he then was in the right to be forgotten case of NT one, that their publication of such results to third party articles was processing for solely for the purposes of journalism and that was always an ambitious argument. But the real crux of the issue I want to focus on comes a few paragraphs later in the Buavitz judgment a paragraph 63 to 66. The court of justice emphasize that in order to achieve a balance between those two fundamental rights, the protection of the fundamental right to privacy requires that the derogations and limitations in relation to the protection of personal data must apply only as far as is strictly necessary, more or less what the directive says with a slight gloss, particularly with a reference to strictly necessary. In other words, national freedom of expression exemptions and derogations must not be interpreted and applied. So as to undermine the very purpose of the directive to protect the privacy and personal data rights of data subjects. So I want me to be crucially important because it's a very different approach on its face to that established in the case law considering the balance to be struck between articles eight and 10 of the convention. In the usual context of media publications about private matters. It's been long held that neither article has in principle priority over the other. What is required is a fat sensitive balancing exercise see classically Lord stains judgment in res. But that lack of priority is decidedly not the language of the court in Buavitz, the data protection regime is to protect personal data and any derogation from that is to be limited and must be strictly necessary. There's little sense of moral equivalence in the reasoning. For example, until spring or in Germany, the Grand Chamber of the Court of Human Rights famously identified a number of criteria that must be considered when balancing the relevant article 10 and eight rights, in a case where the disputes information has been published, and most of those transpose to a pre publication context to the court of justice read those criteria across in paragraph 66 of Buavitz where it cited them and set them out with approval. And this is a significant but indeed a Kardashian sized but the CJU added at the end of that list. Similarly, the possibility for the controller to adopt measures to mitigate the extent of the interference with the right to privacy must be taken into account. Now why is that problematic is problematic seems to me because it is fundamentally contrary to an important aspect of the article 10 case law, namely, that it is not for the courts to substitute their views for those of the press. The techniques of reporting should be adopted in a particular case article 10 protects not just the content of what is but also the form in which it is said it says in BBC at paragraph 25 courts are not digits. But if to consider whether a journalistic exemption is applied only so far as strictly necessary, one must consider whether they could have mitigated the extent of the interference. Then that does sound a lot like placing the courts in the editors chair in the name of data protection rights. And so reversal of the focus on the very substantial degree of protection given to journalistic expression and editorial decision making under article 10 of the convention by requiring close scrutiny of the privacy proportionality of those decisions and authoritative emphasis added without without one must add any indication from the court of justice that it is aware that it's doing anything problematic or potentially novel. So some of those issues were ventilated, but by no means all decided in the recent decision that David mentioned at the outset and many of you won't have read because it's a decision the first here tribunal information rights only. So in the case in which I acted for the information commissioner it's worth taking through in a little detail. It was an appeal against a monetary penalty notice issued under the 1998 acts in the sum of 120,000 pounds. And what's unusual about this notice is that it was not the usual data loss incident with which almost all MPNs have been concerned. About the filming of documentary on stillbirth by a very reputable TV production company called true vision productions. If you've ever watched a Stacey Dooley documentary you've probably seen something they produced for example, TVP wanted to make a documentary about stillbirth to raise awareness of its risks and the traumatic experience mothers have to go through when in a very in a small but significant number of cases they find that their baby is still. And in particular they they have to give birth to, which is often not something that's understood. One of the strands of the documentary they wanted to have was to capture the moment a stillbirth was diagnosed by a clinician. They wanted to capture what TVP had been told by clinicians was a primal primal guttural groan of despair on the part of the mother. But what they've done to try and achieve this was to place fixed CCTV cameras in the examination rooms of a clinic in Adam Brooks Hospital down the road from many of you, which was where pregnant women went if worried about a decrease in movement of their unborn child in their third trimester in particular. TVP had worked with the trust on the plan and on some of the details. The cameras were to be running constantly, as well as sound recording, but the footage would only be accessed if the diagnosis had occurred. And if the woman involved agreed to it, she'd need to agree again later at a later stage for the footage to be used in the broadcast. Patients attending the clinic were not told directly that the cameras were there, or precisely what they were doing, but there were some notices up on the walls and generic letters on tables. If a patient noticed these and raised a concern there was one room without a camera which might or might not be free. The cameras could not be turned off, even if it was felt clinically necessary to do so to avoid distress to the patient. And indeed, when adverse news coverage broke about the filming, the clinic's own nurses had to cover the cameras with plastic bags to obscure them and to prevent footage being taken until the documentary team could arrive to remove them. At this time, in fact, no footage of a diagnosis had been captured. In the end, the documentary was broadcast on Channel 4 to a wider claim, as sweet as child of mine, without any diagnosis footage but lots of other content obtained using handheld cameras filming patients dealing or having dealt with a still birth. The Information Commissioner issued a monetary penalty notice in the sum of £120,000 for breach of the first data protection principle, finding that the way TVP had gone about the processing of the unquestionably sensitive personal data of the thousands of women filmed was unfair, was contrary to their privacy rights and therefore unlawful, and did not meet a condition in either schedules two or three to the 1998 act. TVP argued that the special purposes exemption in section 32 applied, so they didn't have to comply with the first data protection principle, in any extent to which they had failed to do so. And it was certainly common ground that they could not rely on a condition in schedule three and relied, needed to rely on section 32 at least to that extent. TVP also argued that imposing a penalty at all was an infringement of their article 10 rights as journalists, and there were various other arguments about whether the conditions for the imposition of a penalty were met. It's worth pausing here to note section 32 of the 1998 act, which as an exemption is retained in very similar form in paragraph 26 of schedule two to the 2018 data protection act. Article nine of the directive and article 85 GDPR respectively section 32 one provided that personal data which are processed only for the special purposes. And so the journalistic processing in this context are exempt from any provision to which this subsection relates, which includes the first stage protection principle. If a the processing is undertaken with a view to the publication by any person of any journalistic literary or artistic material. The data controller reasonably believes that having regard in particular to the special importance of the public interest in freedom of expression publication would be in the public interest. And see the data controller reasonably believes that in all the circumstances compliance with that provision is incompatible with special purposes. And so it must as well be explained in NT one and Google that each of sections 32 one B and C has a subjective and an objective element. The controller must establish that it held a belief that publication would be in the public interest, and that this belief was objectively reasonable. The controller must establish a subjective belief that compliance with the provision from which it sought exemption being compatible with the special purpose in question, and that this was an objectively reasonable belief. And that seems to me must be right. The tribunal dismissed TVP appeal, although the commissioner agreed at the hearing that because of the impact of the pandemic in particular, the fine should be heavily reduced to 20,000 pounds. The reasoning of the tribunal, not least because I may well have to defend it on an appeal, but the case as a whole is an interesting cauldron of some of those tensions between freedom of expression principles derived from the article 10 case law, on which TVP heavily relied, and the primacy given in data protection law to the protection of privacy address, which the commissioner emphasized. The calibration of that balance away from the protective instincts of that source bringer and that behind authority can be seen in the tribunal's decision that it was not objectively reasonable for TVP to believe that the best way to produce their documentary was by the use of fixed CCTV cameras running at all times with no off button and about which patients were not specifically informed in a transparent way. They should, thought the tribunal have used handheld cameras, as they had in the rest of the documentary, so that data subject understanding would have been clear. TVP had not processed the data fairly, particularly in the sense of transparently, and it was reasonably possible for it to have done so. The tribunal's judgment doesn't express the engage with the courts are not editors line of authority, which was raised before it, but it's hard not to see the decision as a rejection of that stricter in the context of data protection law. Nothing in the directive or the GDPR says that journalists are to be absolutely exempt from compliance. It can't be right that no journalist could ever be the subject of a monetary penalty. And we know from the left side inquiry what happened if media organizations that believe that they're effectively immune from a significant area of individual rights, including specifically data protection rights. In other respects, the domestic implementation of the freedom of expression exemptions is very generous to those engaged in the special purposes, including for the purpose of journalism. The stay mechanism contained in section 32 and four is a notorious example that imposed an automatic stay on all proceedings for breach of the DPA against journalists where the processing in question was only for the purposes of journalism and was with a view to publication. The Court of Appeal in stunt and associated newspapers unanimously construed that to mean that post publication, the state did not apply, holding with a wider interpretation will be incompatible with the directive. And that's as to whether such a blanket rule even so interpreted, which could only be lifted following a determination from the commissioner that in effect the conditions weren't in fact met was a legitimate interpretation of the directive, or whether it's the balance too far in favor of journalists, providing a de facto pre publication immunity from data protection enforcement. And the Court of Appeal found the same mechanism was compatible with the you know, but the arguments are clearly finally balanced and they referred it to the Court of Justice. Unfortunately that reference was withdrawn following the bankruptcy of Mr stunt. The government had intervened making forceful submissions about the importance of free expression rights, and to those rights of preventing pre publication interference, potentially stymie or having a chilling effect on public interest stories and investigations. See, for example, mostly in the UK in Strasbourg. And it's fair to say that the questions communicated to the parties before the oral hearing from the Court of Justice gave the strong impression, asking pointed questions about whether similar restrictions apply to privacy and harassment claims, which of course they do not. The Court of Justice questions didn't necessarily accept an accept and indicate an acceptance of the proposition that data protection law is different. Perhaps because, for example, of its very wide application and lack of any equivalent to a triviality threshold, or a reasonable expectation of privacy test. The issues likely to arise again, because a very similar mechanism is now in place in section 176 of the 2018 act, determinations of the ICO can be appealed to the tribunal. But that's a slow moving along winded series of hurdles to claims being bought before the courts, and only one such appeal has ever been purportedly bought. And that was withdrawn after it was pointed out by the commissioner that they had not in fact being a special purposes determination at all. In one important respect, particularly highlighted by TVP in their appeal, the 2018 act increases the protection to journalistic controllers. It provides that the commissioner may not issue an information notice or enforcement notice or penalty notice with respect to the processing of personal data for the special purposes. And unless a section, unless a determination has been made under section 174, that in effect the same mechanism provisions do not apply. See sections 143, 152, 156 one respectively. And in the context of the enforcement and penalty notice provisions, the commissioner must obtain the approval of the court before issuing one against a journalistic controller. And that is for that reason, unlikely that the TVP penalty notice could occur again under the GDPR and the 2018 act. In my view, there's been a legislative and policy failure properly to address the critical interplay between freedom of expression rights and data protection rights under the EU regime and the UK's implementation of it. There are very difficult balancing exercises to be struck, not least because personal data will often fall well short of the sort of private information protected by misuse of private information claim or by ask later for convention. But there's little indication, not least because of a lack of direction at the EU legislative level as to whether the data protection regime is intended to fundamentally recalibrate the balancing exercise struck by the convention. What is meant to do so, and in what circumstances, and whether the protections afforded to public interest journalism under the article 10 jurisprudence are simply to be paired down or dispensed with altogether. One known example of Europeans EU silence on freedom of expression issues is the rights we've gotten case or at least its first iteration. The CJU's decision in Google Spain is notorious for its total failure to recognize any freedom of expression interests, which might be involved in delisting requests. Interests are with respect obvious. They are not so much Google's interest necessarily, but those of third parties to him search results link and which may often be journalistic products and interests of the public whose article 10 rights include the receipt of the information they are interested in. In the recent case of GC and the canal, the French equivalent of the information commissioner. The Court of Justice sought to correct that course somewhat accepting a paragraph 57 by reference to the more expressed text of article 17 of the GDPR that the circumstance that article 17 three of the GDPR now expressly provides that the data subject rights to erasure is excluded where the processing is necessary for the exercise of the right of information. Guaranteed by article 11 of the charter is an expression of the fact that the right to protection of personal data is not an absolute right. But as recycle for the regulation states must be considered in relation to its function in society and be balanced against other fundamental rights in accordance with the principle of proportionality. The current and incomprehensible language of the Court of Justice. That is a bit of a mayor culpa. The Court of Justice went on to recognize that even in the context of the publication of special category data and criminal conviction data, a balance had to be struck between the rights to a razor of historic material, and the freedom of information of Internet users, note that language of freedom of information of Internet users picked up from article 85. Potentially interested in accessing that particular web page by means of such a search. And even that even that recognition and GC though contained a caveat that search engines were still required, even if they've refused to do list to reorder their search results to better show the current legal position. And what that seems to mean is that, if for example an article about an article about a successful appeal should appear higher in the search results than an article about the original conviction. That would be of consideration given by the court to the wide array of circumstances in which the right to a racial the right to be forgotten might apply that go well beyond commercially extremely well resourced search engines. For example, I have in the past had to advise clients who operate databases, including legal databases legal research databases or due diligence databases about how the right to be forgotten might apply in their context, and where it is not a publicly accessible source, but it is a sort of mini database or along search engine lines. The courts approach has its problems in GC undoubtedly but it's a welcome indication that the Court of Justice tacitly recognize the criticisms of the apparent absolutism of Google Spain, and we're prepared to adjust course to reflect more expressly the need to balance competing rights and interests. The one decision mentioned in the High Court here had sought to carry out that course correction more expressly, holding that the balancing exercise mandated was to be done with the scales empty. And that the Court of Justice has not prescribed anything else in Google Spain, the contrary to the classical article eight article 10 balancing exercise that the court was familiar with from the convention. That's the paragraph 132 to 133 in particular. And there's the subsequent decision in GC probably means that that approach is unlikely to be materially altered. But it remains unsatisfactory the guidance on these difficult questions of balancing have to be dragged from the CJU and that here as in other areas. There's the willingness to properly confront and grapple with the apparent different priorities of the case law of the Strasbourg Court on the one hand, and the Luxembourg Court on the other. And to give one example from experience of those different approaches. And in the context of the privacy international line of case law, and indeed the trends to line of case law. The Court of Justice is supremely uninterested, despite member states repeatedly referring to it supremely uninterested in the approach of the Strasbourg Court to the national security and the wide margin of appreciation that Strasbourg court tends to afford to ask a price in the national security context, the CJU thinks that that balance needs to be struck in a very different way by it. So that that comes out very clearly from the questions and the approach of the court in oral session is much more reluctant to pin its colors to the last and say so directly in its judgments and that provide that that is a degree of opacity, which is very important and causes problems, particularly for domestic courts attempting to reconcile different strands of approach and fundamentally different policy priorities. There are potentially good reasons of legal policy why in the context of a legislative scheme intended to protect personal data rights of all data subjects. The approach might must be taken from the high watermark of the article 10 case door. In particular, it's important to recognize that data protection law across applies across a much wider array of contexts than the typical article 810 balancing exercises tended to arise in the data protection complaints are not usually about publications in newspapers, although, as per stunt, they sometimes are. One practical example of how data protection law can be used as a weapon in private party litigation. It could be found in the recent even an obvious decision of Mr Justice Warby, which concerns certain parts of the notorious Trump dossier produced by the former SS operative Chris steel. Every Russian businessman objected to how they were described in the dossier, which was perhaps not entirely surprisingly, not to remark upon their renowned integrity. The judgment deals with a lot of data protection issues and is an extremely interesting read but for present purposes. It's just useful to note the complaint of the complaint of breach of the accuracy principle was allowed in substance to be run and determined in a manner very much akin to defamation law. Now that that was not a wholly new development. Mr Justice Warby had emphasized the read across between accuracy and defamation in the context of complaints of inaccurate data processing in NT one and Google. In even an all this will be applied across defamation principles to discern between facts and opinions on the basis that they reflected the experience of generations, I think this is language. There was, for example, reference to the changes level of meanings, which is very much a defamation concept. There was also extensive cross examination of witnesses about how they went about reaching the conclusions and expressing the conclusions that they did in the dossier. There was not a very particular discussion of freedom of expression concerns, and perhaps there needs to be. Because again the accuracy principle can be engaged in an array of context in which defamation law may not be able to be. Without some of the procedural protections against claims afforded by the defamation act, including the various thresholds and hurdles that are imposed by the defamation act. And the practical point that all controllers are potentially at risk in relation to any data processed by them, not just generous, and that your data protection GDPR action can be bought in the county courts as a small claim, which can be bought in the county of defamation actions, where the irrecoverable cost defending may mean that settlement unwarranted settlements are more likely. All of this has a potential free expression impact, at least as a chilling effect, which the legislative framework doesn't address, which the jurisprudence hasn't really considered, but which proceeds on the basis that rights and the data protection principles are imperative. Ultimately, it seems to me that balances are there to be found, and maybe being slowly worked through. But the present state of the law leaves much in a practical void. There has been insufficient focus in the minds of legislators and in courts on how to reevaluate the array of data protection tools and their intersection with freedom of expression rights. And what are the competing priorities and the policy just judgments and justifications that need to be made in making those selections, including outside the limited category of permitted protections for processing of the purposes of journalism, literature and academia. There is it seems to me much more work and more thinking to be done. Well, thank you very, very much, Christopher for for a really rich and interesting presentation it's incredible all the issues which I've been noting down and you've got through during during that. So, the questions are very much open.