I. Introduction
A superficial look at the English law of privacy would suggest that privacy is all about the unwanted dissemination of private information. The Data Protection Act 1998 and actions for breach of confidence and misuse of private information focus on confidential information and high profile successful cases invariably involve the (actual or proposed) dissemination of personal information or images. In the one case in which the House of Lords considered the issue – Wainwright v Home Office – it declined to recognise a general right to privacy which would extend to physical privacy interferences such as the intrusive strip search to which prison officers subjected the claimants in that case.Footnote 1
There is more to privacy, however, than the unwanted collection and dissemination of private information. Privacy can also be breached by unwanted watching, listening or recording even if little information is obtained and none is disseminated. Peering through a person's bedroom window, following him or her around, bugging his or her home or telephone calls, or surreptitiously taking for one's own purposes an intimate photograph or video recording are all examples of this kind of intrusion. According to some commentators, it is the desire to protect against these interferences which “brings us to the core of our expectations and intuitions about privacy and hence of our rights to it”.Footnote 2 It is therefore unsurprising that US courts and, recently, both the Ontario Court of Appeal and New Zealand High Court have recognised that a tort is committed if a person intrudes upon “the solitude or seclusion of another or his private affairs or concerns” in circumstances where the “intrusion would be highly offensive to a reasonable person”.Footnote 3 Law reform bodies, both in England and abroad, have consistently recommended similar protections.Footnote 4
This article asks how effectively English law protects against these non-informational breaches of privacy. More particularly, it asks how English law protects against unwanted watching, listening, and recording and whether and how that protection should be extended. The discussion is divided into four sections. The first section deconstructs the concept of privacy, identifying two main components of the interest – one informational and one physical. The second examines the right to respect for private life in Article 8 of the European Convention for the Protection of Human Rights 1950 (the “Convention”) highlighting, in particular, the inclusion of both informational and physical privacy within that interest. Attention then turns to the adequacy of legal protections in English law. A survey is made of existing common law and legislative protections against unwanted observation and recording, including those provided by breach of confidence, misuse of private information, intentional infliction of emotional distress, the Data Protection Act 1998 and the Regulation of Investigatory Powers Act 2000. This survey shows that protection for physical privacy is currently patchy and uncomprehensive. The article therefore concludes by making the case for recognition of a specific, narrowly-focussed intrusion tort from within the misuse of private information action.
II. Theoretical Conceptions of Physical Privacy
Case law, scholarly writing and popular discourse abound with stories of people breaching one another's privacy. Analysis of these examples helps us to articulate our intuitive understanding of what privacy is and how it is interfered with. A list of common intrusions is therefore a useful starting point for an examination of the privacy interest.
The first way that X can breach Y's privacy is by obtaining access to private records that Y does not want X to see, such as his or her medical notes, banking details, emails, letters, tax returns or diaries. Secondly, X can breach Y's privacy by enabling others to find out about Y, for example, by uploading Y's personal records to the Internet or publishing a story revealing their content in the newspaper. Alternatively, X could file private material away to be re-examined on some future occasion or, if X is a former confidant, he or she could reveal Y's secrets or talk about intimate experiences they have both shared – X could kiss and tell, pass on a closely-held confidence, or tell the world intimate details of Y's day-to-day life. X could also disseminate consensually-taken images against Y's wishes; images of Y naked or engaged in sexual activity, for instance. In other cases, X might spy on people when they do not want to be seen – when they are using a shower, toilet, or changing room – or eavesdrop when they do not want to be heard, such as when they are talking on the telephone or in the confines of their home. And X could film, photograph or record these private activities with a view either to revisiting them later or sharing them with others – for example, by uploading photographs, videos or audio recordings to the Internet, broadcasting them on television, or publishing them in a newspaper.
Although each of X's privacy breaches is effected differently, they all prevent the subject from choosing, on his or her own terms, the extent to which he or she is accessed by others. All of them – whether they involve disclosure of a secret, publication of a photograph, or voyeuristic spying – also lead to feelings of affront, violation and indignity. To use Stanley Benn's words, individuals in these cases are being treated “as objects or specimens” to be looked at, listened to or found out about at whim, not as “subjects with sensibilities, ends, aspirations of their own”.Footnote 5 Distress, humiliation and, in some cases, mental harm can result.Footnote 6
It is therefore unsurprising that all of these activities have been held to be part of a right to privacy in at least some common law jurisdictions. In England, it is actionable to kiss and tell, to divulge secrets or other private information, to read or publish information contained in private records and to disseminate photographs or videos of intimate activities.Footnote 7 And in other common law jurisdictions, courts have upheld claims against defendants who bug their tenants; spy on people in toilets, showers or changing rooms; disseminate consensually-taken sex tapes to friends and family; or intercept people's telephone calls.Footnote 8 Academics have also identified as “typical invasions of privacy”:
the collection, storage, and computerization of information; the dissemination of information about individuals; peeping, following, watching, and photographing individuals; intruding or entering “private” places; eavesdropping, wiretapping, reading of letters; drawing attention to individuals; and forced disclosure of information.Footnote 9
All of these different modes of intrusion interfere with personal privacy. There are, however, important conceptual differences between them which need to be recognised if privacy is to be properly understood. It is suggested, in particular, that the examples listed above reveal two types of overlapping but distinct privacy interference: the misuse of private information (informational privacy) and unwanted sensory access (physical privacy).Footnote 10
The principal objection in the informational privacy cases is to the fact that someone is finding out something about you against your wishes. He or she is learning that you have a sexually-transmitted infection, that you enjoy cross-dressing in private, that you run your home in a particular way, that you are having relationship difficulties, or that you are the anonymous author of a popular blog. These informational privacy interferences, in turn, take three main forms. First, a person can breach your informational privacy by discovering things about you that you wish to keep to yourself (by acquiring your bank records, reading your diaries, or hacking your emails, for instance). Secondly, he or she can retain private records or information about you either for his or her own future reference or with a view to sharing the information with others (by building up a computer file or secret dossier, for example). And, thirdly, the person can disclose private information about you to others, by passing on gossip, uploading facts, photographs or other material to the Internet, or disseminating it in the media.Footnote 11 It follows that many of the examples outlined above fall within the informational privacy category – kissing and telling, reading somebody's personal records, uploading them to the Internet, assembling a secret dossier, and disseminating photographs or other recordings are all examples of this kind of interference.
The second category – physical privacy – is all about unwanted access to the physical self. The interference in these cases is sensory: the intruder interferes with your physical privacy by watching, listening to or otherwise sensing you against your wishes.Footnote 12 It is this aspect of the interest which is at stake when X spies on Y in the shower, hacks Y's telephone calls, or videos Y in his or her bedroom. And this physical privacy interest can, again, be interfered with in three main ways. It is a breach of your physical privacy, first, to observe you against your wishes (including with technological aids), for instance, by spying on you as you get changed, filming you in the bathroom, or bugging you during an intimate telephone call. Secondly, physical privacy is compromised when a person photographs or otherwise records your private activities.Footnote 13 And finally, it is a breach of physical privacy to enable others to see or hear you engaged in private activities by disseminating photographs or recordings of those activities to others. In all of these situations, the concern is primarily physical: the observer is, through the use of the senses, physically experiencing something of you against your wishes and/or allowing others to do the same.
There is, of course, overlap between the two categories. A person who hacks another's telephone will obtain sensory access to the speakers and, sometimes also information about private matters. Likewise, a landlord who installs a camera in his or her tenant's bathroom will find out what the tenant does there as well as seeing him or her naked. Nonetheless, both these components of the privacy interest – physical and informational – need to be recognised if privacy is to be comprehensively protected. This is because it is possible to commit a serious breach of privacy without obtaining any meaningful information. Little “information” is obtained, for example, when a person is spied on in the shower, bugged having an anodyne conversation in his or her bedroom, watched in a toilet, or videoed whilst having a shower. Further, even if some meaningful information is obtained, it is unlikely to be the sole reason for the subject's objection. As Raymond Wacks has said:
What is essentially in issue in cases of intrusion is the frustration of the legitimate expectations of the individual that he should not be seen or heard in circumstances where he has not consented to or is unaware of such surveillance. The quality of the information thereby obtained, though it will often be of an intimate nature, is not the major objection.Footnote 14
Thus, a person watching a surreptitiously-obtained video of a woman giving birth, not only obtains medical information about her, he sees intimate parts of her body, hears her crying out and generally insinuates himself into an intimate occasion.Footnote 15 All these aspects of the interest need to be vindicated if the woman's privacy is to be protected. A notion of privacy which focussed just on the information obtained – about the nature of the labour, the interventions received and the medical decisions made – would only tell half the story.
It follows that conceptions of privacy which, like the current English common law, focus exclusively on the acquisition or dissemination of private information, fail to accommodate physical privacy interests effectively.
III. Physical Privacy in Strasbourg
This two-part – physical and informational – conception of the privacy interest is consistent with Strasbourg's articulation of the right to respect for private life in Article 8 of the Convention.Footnote 16 Numerous decisions of the European Court of Human Rights confirm that it is an interference with Article 8(1) not only to publish private information but also to collect or store it, even if it is not subsequently used or disseminated.Footnote 17 In addition, “private life” encompasses wide-ranging protection of an individual's “physical and psychological integrity” and a right to “personal development”.Footnote 18 These concepts extend to many of the physical intrusions discussed above, including intrusive body searching, search of residential or work premises, and surveillance or recording in, for example, a person's home, garage or prison cell.Footnote 19
The European Court has also expressly recognised positive obligations on Member States to protect citizens from unwanted photography and video surveillance. In the recent case of Söderman v Sweden, the Grand Chamber held that Sweden breached its positive obligations to a 14-year-old girl by failing to provide civil or criminal sanction against her step-father after he surreptitiously filmed her changing in the bathroom.Footnote 20 This is consistent with the First Chamber's decision, in Reklos and Davourlis v Greece, that Greek domestic courts failed to protect the private life interests of a day-old child who was photographed without his parents’ consent whilst in a sterile unit in hospital, even though there was no suggestion that the photographs had been or were to be disseminated.Footnote 21 The court in that case said that:
Whilst in most cases the right to control [the use of one's image] involves the possibility for an individual to refuse publication of his or her image, it also covers the individual's right to object to the recording, conservation and reproduction of the image by another person. As a person's image is one of the characteristics attached to his or her personality, its effective protection presupposes, in principle and in circumstances such as those of the present case … obtaining the consent of the person concerned at the time the picture is taken and not simply if and when it is published. Otherwise an essential attribute of personality would be retained in the hands of a third party and the person concerned would have no control over any subsequent use of the image.Footnote 22
In other words, the disclosure of private material is not a prerequisite for an Article 8 claim: physical intrusion effected by filming, photographing or recording is in some circumstances actionable per se.
The broad scope of the Article 8 right to private life articulated in Strasbourg case law reinforces the view that privacy (which is closely related to private life) includes protection of both physical and informational privacy interests. It also has direct implications for the development of English private law. As a signatory to the Convention, the United Kingdom has (in addition to its negative obligation to avoid breaching Article 8) a positive obligation to protect citizens against Article 8 interferences by private actors. As the Grand Chamber has recently confirmed, this obliges Member States to “maintain and apply in practice an adequate legal framework affording protection” of a citizen's private life rights.Footnote 23 The nature of the State's obligation “will depend on the particular aspect of private life that is at issue”Footnote 24 but the Member State must provide, as a minimum, some kind of civil protection against the interference in question.Footnote 25 As just discussed, the European Court has already found that, in at least some circumstances, failure to protect against unauthorised photography and surreptitious filming by private actors breaches these obligations. There is no obvious reason why private acts of surveillance or recording by other means (audio recording or telephone hacking, for example) should be treated any differently.
In addition, and partly in response to the United Kingdom's positive obligations under the Convention,Footnote 26 English domestic courts have recognised the horizontal effect of Article 8 of Schedule 1 to the Human Rights Act 1998 (the “HRA”). Although the HRA only has direct effect in disputes between citizen and the state, courts have, for a variety of reasons, held themselves bound to act consistently with the Convention when developing the common law.Footnote 27 This horizontal effect does not create new causes of action between private persons but obliges courts to develop any “applicable” causes of action consistently with Convention principles.Footnote 28 The exact scope of this obligation remains unclear but it is perhaps best articulated as a duty to “in so far as possible, develop the common law in such a way as to give effect to Convention rights”.Footnote 29 In other words, as Gavin Phillipson and Alexander Williams put it, “the courts must develop the common law compatibly with the Convention, but only where such development can be achieved by ‘incremental’ development”.Footnote 30
All this means that English courts should incrementally develop the common law to protect private life interests identified in Strasbourg. Those rights include the right to be free from unjustified surveillance, search, and recording.Footnote 31 This, as will be discussed below, has significant implications for the protection of physical privacy in English private law.
IV. Physical Privacy in English Law: The Gaps in Protection
So, physical privacy is an essential part of both theoretical conceptions of privacy and the Article 8 right to private life. It follows that if English law is to protect privacy comprehensively, both physical and informational privacy need to be protected. The House of Lords’ decision in Wainwright v Home Office that there is no general right to privacy in English law means that there is no all-encompassing common law action which does this. Lord Hoffmann, with whom other members of the House concurred, said that although privacy values might underpin common law actions such as breach of confidence, recognition of a “high-level principle” of privacy was neither desirable nor necessary to comply with the United Kingdom's obligations under the Convention.Footnote 32 Privacy protection, then, has had to develop incrementally. In order to articulate the scope of privacy protection in English law, one therefore has to examine a range of legislative protections and common law actions. This section does that, asking how effectively those various measures protect informational and physical privacy and identifying the gaps that remain.
A. The Scope of Breach of Confidence and Misuse of Private Information
As is well known, the breach of confidence action has been the main vehicle for the development of English privacy rights. But how far has that vehicle taken us towards comprehensive privacy protection.
The breach of confidence action traditionally focussed on the wrongful disclosure of – usually commercial – information which had been voluntarily divulged to the defendant.Footnote 33 Continuous development of its requirements meant, however, that by the end of last century, duties of confidence could attach to personal as well as commercial informationFootnote 34 and to information which was not divulged but deliberately, or even adventitiously, taken.Footnote 35 These developments, bolstered further by the horizontal effect of Article 8 of Schedule 1 to the HRA, eventually led to the emergence of a specific informational privacy action.Footnote 36 The touchstone of this new action – labelled “misuse of private information” – is whether the person in question had a reasonable expectation of privacy in respect of the disclosed facts.Footnote 37 This question has, in turn, been incorporated into a “new methodology” under which courts ask, first, whether Article 8 is “engaged” (determined by applying the reasonable expectation of privacy test just outlined) and if so, whether the Article 8 interest in privacy should yield to the defendant's Article 10 right to freedom of expression.Footnote 38
As with breach of confidence, the primary concern of the misuse of private information action is the unwanted disclosure of private information.Footnote 39 The action therefore protects against disclosure of facts about a person's private life (the details of an extra-marital affair or drug addiction treatment, for example)Footnote 40 and against disclosure of private “information” contained in photographs or other recordings of private activities (such as sexual activities or family outings).Footnote 41 With regard to the latter, courts have recognised that publication of such images can intrude into private life “in a peculiarly humiliating and damaging way”,Footnote 42 but no protection is given against the making of a photograph or other recording without subsequent publication.Footnote 43 So, although misuse of private information protects against the third of both the informational and physical privacy categories identified above – the disclosure of private information and of photographs or other recordings, respectively – it does not protect against the act of recording.
The relationship between “traditional” breach of confidence and the new action for misuse of private information is not entirely clear, but the latest Court of Appeal authority, Tchenguiz v Imerman, confirms that breach of confidence operates alongside misuse of private information and provides an alternative avenue for redress if the traditional requirements of breach of confidence are met.Footnote 44 The significance of this alternative option for redress has been greatly enhanced by an expansive interpretation, in Tchenguiz, of the requirement that the information be “misused” by the defendant.Footnote 45 The defendants in that case were concerned that the claimant was hiding his assets from their sister, with whom he was engaged in matrimonial proceedings. To thwart these attempts, the defendants accessed, copied and passed on to their sister's solicitor, documents which the claimant kept on a computer server in their shared office. The Court of Appeal held that obtaining the information, without more, was enough to breach the confidence of the defendant. Speaking for the court, Lord Neuberger M.R. said:
intentionally obtaining information [in respect of which the defendants must have appreciated that the claimant had an expectation of privacy] secretly and knowing that the claimant reasonably expects it to be private, is itself a breach of confidence. The notion that looking at documents which one knows to be confidential is itself capable of constituting an actionable wrong (albeit perhaps only in equity) is also consistent with the decision of the Strasbourg court that monitoring private telephone calls can infringe the Article 8 rights of the caller: see Copland v United Kingdom … In our view, it would be a breach of confidence for a defendant, without the authority of the claimant, to examine, or to make, retain, or supply copies to a third party of, a document whose contents are, and were (or ought to have been) appreciated by the defendant to be, confidential to the claimant.Footnote 46
The claimant was therefore able to restrain the defendants from looking at the documents again even though there was no evidence that they intended to reveal the contents to any third party.Footnote 47
This conclusion means that the first and second informational intrusions identified above – the discovery and retention of private information – are also covered by breach of confidence. It is clear from Tchenguiz that the acts of acquiring the information and copying/retaining the documents were enough on their own to establish an obligation of confidence, even if no further use was made of the material. It follows that in England, repeatedly accessing (but not disseminating) the banking records of one's partner's former wife, as the bank clerk did in the Ontarian intrusion case of Jones v Tsige, would be a breach of confidence.Footnote 48
It follows that common law protection of informational privacy is reasonably comprehensive. All of the informational privacy intrusions identified above – discovering private information, retaining it and disseminating it – potentially fall within the actions for breach of confidence, misuse of private information or both. Both actions also provide redress for the dissemination of photographs, videos or other recordings of a person engaged in private activity, i.e. the third of the physical intrusions identified above.Footnote 49 Neither breach of confidence nor misuse of private information, though, protects against the non-disclosure aspects of physical privacy. The remainder of this section will look at whether these intrusions – unwanted watching, listening and recording – are actionable elsewhere in English law or whether, as suggested above, there is indeed a gap in current privacy protection.
B. Intentional Infliction of Emotional Distress
So, is there any other common law action which effectively protects against unwanted watching, listening and recording in the absence of actual or threatened dissemination of private material? On first appearances, the tort of intentional infliction of emotional distress is well placed to provide such protection. The action is unconstrained by the information/disclosure focus of breach of confidence and misuse of private information, focussing instead on the distressing and harmful effects of a defendant's conduct. This is precisely the thing at stake when unwanted observation or recording occurs. A closer look at the requirements of intentional infliction of emotional distress, however, reveals a number of limitations.Footnote 50
In Wilkinson v Downton, the case in which intentional infliction of emotional distress was established, the claimant suffered “a violent shock to her nervous system” after a practical joker told her that her husband had broken both his legs and was lying injured waiting for her to fetch him.Footnote 51 Finding that the claimant had a cause of action against the defendant, Wright J said:
The defendant has, as I assume for the moment, wilfully done an act calculated to cause physical harm to the plaintiff – that is to say, to infringe her legal right to personal safety, and has in fact thereby caused physical harm to her. That proposition without more appears to me to state a good cause of action, there being no justification alleged for the act. This wilful injuria is in law malicious, although no malicious purpose to cause the harm which was caused nor any motive of spite is imputed to the defendant.Footnote 52
Two requirements emerge from this judgment. This first is that the act was “calculated” or “intended” to cause physical harm. The second is that the claimant suffered actual damage in the form of physical harm or a recognised psychiatric illness. Courts applying the first element do not require proof of actual intention or calculation; an intention to produce the harm will be imputed if the defendant intended to do an act which was “sufficiently likely” to lead to the harm suffered.Footnote 53 And this test is usually expressed objectively so the defendant will be liable if he or she intended to do an act which could obviously lead to the physical harm which was suffered.Footnote 54
So might there be some physical privacy situations in which both Wilkinson v Downton requirements will be met? It might be possible, in some circumstance to impute an intention to cause harm against a person who instals a listening device in his or her tenant's bedroom, films his or her work colleagues getting changed, follows his or her ex-partner around for days, or films his or her neighbours’ children in their bedrooms. And such conduct might occasionally lead to physical harm as stipulated by the second requirement: post-traumatic stress disorder, depression, anxiety or paranoia are all potential responses to intrusions of this nature.Footnote 55
But physical privacy cases in which the requirements of Wilkinson v Downton are satisfied will be rare. It would be difficult, for example, to establish even an imputed intention to cause harm if the defendant intended his or her intrusion to remain undetected – it is difficult to say that the defendant's spying would “obviously” lead to physical harm when, if it had been up to the defendant, the claimant would have known nothing about it. Further, some judges have held that an intention to cause physical harm should only be imputed if the defendant actually knew that such harm was likely to result from his or her conduct.Footnote 56 On this subjective approach, an insensitive or unintelligent intruder could escape liability for even the most egregious intrusion simply by failing to consider the impact of his or her actions. The harm requirement is also problematic. Feelings of humiliation, indignity, distress and mistrust are typical consequences of breaches of privacy effected by unwanted observation and recording. Whilst harmful to one's peace of mind, relationships, and sense of self – and, therefore, worthy of compensation in their own right – they do not in themselves amount to physical injury as required by Wilkinson v Downton.
It follows that intentional infliction of emotional distress could only provide comprehensive protection against unwanted observation and recording – and hence plug the physical privacy gaps under discussion – if its requirements were substantially relaxed. Courts would need to abandon the requirement of intention (or at least favour an objective, over a subjective, approach) and allow recovery for distress and upset falling short of physical harm. There is perhaps an argument that the courts’ obligation to develop the common law consistently with Article 8 would now justify extensions of this nature: as in breach of confidence, this argument would go, courts are obliged to develop Wilkinson v Downton incrementally to protect physical privacy interests.Footnote 57
The trend, however, is not in that direction. Lord Hoffmann showed some willingness to relax the physical injury requirement when he said, in Hunter v Canary Wharf, that he saw “no reason why a tort of intention should be subject to the rule which excludes compensation for mere distress, inconvenience or discomfort in actions based on negligence”.Footnote 58 But the injury requirement has been confirmed by superior courts on numerous occasionsFootnote 59 and Lord Hoffmann read down his own comments when he revisited the issue in Wainwright.Footnote 60 Further, as outlined above, some judges support a narrower, not broader, reading of the intention component and therefore require actual knowledge of the likelihood of harm. The general approach has therefore been to regard Wilkinson v Downton as an anomaly in the law of torts and to read its requirements accordingly.Footnote 61 It seems unlikely then, even in the post-HRA context, that courts would be willing to make the significant extensions required to turn intentional infliction of emotional distress into a useful physical privacy action. Claimants seeking redress for physical privacy interferences should therefore pursue other, more favourable, options.
C. Legislative Protections
So, there is no clear common law right protecting against unwanted observation and recording where subsequent dissemination of material has not occurred. The final question for this section is whether legislative measures fill that gap.
There is no doubt that the importance of physical privacy has been recognised by the legislature. Numerous legislative measures provide some protection against unwanted watching, listening and audio and visual recording. Section 67 of the Sexual Offences Act 2003 (“SOA”), for example, makes it an imprisonable offence to observe and/or record for sexual gratification a person doing a private act, knowing that he or she does not consent to being observed for that purpose.Footnote 62 In addition, the Protection from Harassment Act 1997 (“PHA”) creates civil and criminal liability for stalking and shadowing, spying, unwanted photography and video recording which form part of a harassing course of conduct;Footnote 63 the Regulation of Investigatory Powers Act 2000 (“RIPA”) prohibits interception of telephone calls or messages awaiting collection;Footnote 64 and the Data Protection Act 1998 (“DPA”) protects against, inter alia, observation or recording with digital devices.Footnote 65
There is no legislative measure, however, which comprehensively protects against unwanted watching, listening or recording in all circumstances. The PHA, for example, only protects against physical intrusion if it forms part of a “course of conduct” which means that there must have been harassing behaviour on at least two occasions.Footnote 66 Similarly, the SOA voyeurism offence is only committed if the person spied on was using a toilet, engaged in sexual activity or had intimate body parts exposed and the prosecution can establish a sexual motivation. An individual who spied on a person in a toilet out of spite, curiosity, artistic interest, suspicion of malpractice, or even a desire to blackmail could therefore avoid a voyeurism conviction.Footnote 67 And, although at first glance the provisions of the DPA seem far-reaching, they do not apply to the use of non-digital recording or surveillance devices, to people gathering data for the “special purposes” of journalism, art or literary endeavour (at least as far as the Privacy Principles and protections against distress are concerned),Footnote 68 nor to data being processed for the purposes of “personal, family or household affairs (including recreational purposes)”.Footnote 69 And, no offence is committed under RIPA if a person installs a listening device outside the telecommunications network, in the home or car of another or on the outside of a telephone, for example.Footnote 70
Even when considered collectively, legislative protection of physical privacy is uncomprehensive. To take visual recording as an example, filming a person who is engaged in an intimate act or in a state of undress can be criminal but defendants will escape liability if, inter alia, their motive was not sexual. Perpetrators could also fall foul of the DPA but not if they used a non-digital filming device or made the film for their own domestic purposes. The PHA will not apply if the filming was a one-off event. Protection against eavesdropping is similarly patchy.Footnote 71
All this means that there is no obvious criminal or civil sanction against an individual who, for his or her own recreational purposes, videos his or her tenants in their living room, films the neighbours’ children in their bedrooms, installs bugging devices in a former friend's car, or films his or her ex-spouse in the toilet in case he or she wants to use the footage for blackmail on some future occasion. Even where criminal sanction exists, it is rare to find corresponding civil liability. This means that, often, victims are inadequately compensated for the distress and harm caused by the intrusion. And, of course, except in the unusual case of a private prosecution, criminal sanction depends on police willingness to investigate and prosecute. The tabloid telephone hacking scandal has infamously shown that this is a process over which victims have little control.
V. Filling the Gaps: Enhancing Protection Against Unwanted Observation and Recording
Current legal protections against unwanted watching, listening and recording are therefore inadequate. There would be no clear basis in English law for compensating the claimant in C v Holland who suffered significant distress after being filmed in the shower by her boyfriend's flatmate, for the claimants in Hamberger v Eastman and Roach v Harper whose landlords installed listening devices in their homes, nor for the women in Harkey v Abate and Benitez v KFC National Management who were watched using bathroom facilities.Footnote 72 The claimants in Reklos v Greece, who brought a successful action in Strasbourg after their baby was photographed without their permission, would also fail in a privacy bid in the United Kingdom.Footnote 73 Even the civil claim of the tabloid telephone hacking victims is not straightforward in cases where publication did not result; at the moment, claimants are relying on a broad interpretation of the breach of confidence action.Footnote 74 It is clear, then, that neither the right to privacy nor its Article 8 counterpart, the right to respect for private life, is being comprehensively protected in English law. This section will consider how the common law might remedy that shortcoming.
A. Support for Enhanced Physical Privacy Protection
Although the proposition from Wainwright v Home Office that there is no general right to privacy in English law still stands, there is considerable judicial support for a conception of privacy which extends beyond the protection of private information.Footnote 75 As early as 2001, Mustill L.J. recognised the physical aspects of the privacy interest when he said:
To my mind the privacy of a human being denotes at the same time the personal “space” in which the individual is free to be itself, and also the carapace, or shell, or umbrella, or whatever other metaphor is preferred, which protects that space from intrusion. An infringement of privacy is an affront to the personality, which is damaged both by the violation and by the demonstration that the personal space is not inviolate.Footnote 76
Similar breadth can be found in some of the judgments in Campbell v MGN Ltd. Footnote 77 Lord Nicholls held that the misuse of private information action affords respect for just “one aspect of an individual's privacy”: “An individual's privacy can be invaded in ways not involving publication of information. Strip searches are an example”.Footnote 78 Lord Hoffmann also said that the focus of the action had shifted away from “the duty of good faith applicable to confidential personal information and trade secrets alike” to the “protection of human autonomy and dignity”.Footnote 79 The action, he said, now encompasses both “the right to control the dissemination of information about one's private life and the right to the esteem and respect of other people”.Footnote 80
Taking this one step further, some courts have suggested, consistently with Reklos v Greece and Söderman v Sweden, that the taking of a photograph can itself be an actionable breach of privacy.Footnote 81 In Mosley v News Group Newspapers Ltd., Eady J. said that, although the pleaded claim was confined to publication of information, “[n]aturally, the very fact of clandestine recording may be regarded as an intrusion and an unacceptable infringement of Article 8 rights”.Footnote 82 The Court of Appeal in Murray v Express Newspapers plc also declined to rule out the possibility that merely taking a photograph of a child in a public place could engage Article 8.Footnote 83 Other cases have recognised the negative effects of being watched and followed when imposing liability for publication of intrusive images. For example, the fact that the young boy in Murray was expressly targeted by photographers acting surreptitiously bore directly on the Court of Appeal's decision not to strike out his claim for a misuse of private information.Footnote 84 And, in Campbell, Baroness Hale held that publication of a photograph of the claimant outside a Narcotics Anonymous meeting “added to the potential harm, by making her think that she was being followed or betrayed, and deterring her from going back to the same place again”.Footnote 85
The concept of “intrusion” has also been recognised in name suppression cases. In Goodwin v News Group Newspapers Ltd., for example, Tugendhat J. began his discussion of the reasonable expectation of privacy by saying:
The right to respect for private life embraces more than one concept. [There are] … two core components of the rights to privacy: “unwanted access to private information and unwanted access to [or intrusion into] one's … personal space” … I shall refer to the two components of the right as “confidentiality” and “intrusion”.Footnote 86
He then went on to consider “confidentiality” and “intrusion” separately and, significantly, concluded that although publication of the claimant's mistress's name would not be a breach of her reasonable expectation of “confidentiality”, it would be an actionable intrusion.Footnote 87 Eady J. took a similar approach in CBT v News Group Newspapers Ltd. to the continued suppression of the name of an adulterous footballer who had been identified on social networking sites. He said that “[i]t is important always to remember that the modern law of privacy is not concerned solely with information or ‘secrets’: it is also concerned importantly with intrusion”.Footnote 88 Both judges used the term “intrusion” to refer to the effects of publication on the individuals concerned and not just to interference with the physical privacy interests which are being discussed here.Footnote 89 However, both also expressed concern about the “cruel and destructive media frenzy” likely to engulf the claimants and their families if the injunctions were lifted.Footnote 90 Such a frenzy would inevitably have included unwanted surveillance, photography and following. A desire to protect the claimants against such activity was clearly part of the judges’ reasoning.
B. Extending Breach of Confidence
The dicta just outlined suggest that there is judicial support for a wider conception of the privacy interest and at least some willingness to extend physical privacy protection in the right circumstances. The next question is how courts might provide such protection where spying, eavesdropping and recording are concerned.
Although the legislature has often recognised the need to protect individuals from eavesdropping, spying and unwanted recording, enactment of a specific physical privacy action seems unlikely. Breach of confidence and misuse of private information could however be developed to provide such protection. Post-Tchenguiz, the best argument available to a claimant who has been a victim of telephone hacking, spying, or surreptitious filming, without subsequent or threatened publication, is that he or she has suffered a breach of confidence. As outlined above, the Court of Appeal held in Tchenguiz that a person will breach another's confidence if he or she “looks at a document to which he has no right of access and which contains information which is confidential to the claimant”.Footnote 91 In other words, the claimant in that case was able to recover because the defendants had acquired private information about him without his consent. As the Court of Appeal said, this is unacceptable because:
It is of the essence of the claimant's right to confidentiality that he can choose whether, and, if so, to whom and in what circumstances and on what terms, to reveal the information which has the protection of the confidence.Footnote 92
Courts can therefore restrain defendants from looking at the documents again, even if they have no intention of revealing their contents to others: this is because “given that the information is confidential, the defendant should not be seeing it” and “whatever the defendant's intentions, there would be a risk of the information getting out”.Footnote 93 Further, the Court of Appeal's formulation of the action made it clear that privacy as well as confidentiality was at stake in Tchenguiz. Lord Neuberger M.R. held that in cases where Article 8 interests are being considered, “whether the claimant had a ‘reasonable expectation of privacy’ in respect of the information in issue, is … a good test to apply when considering whether a claim for confidence is well-founded”.Footnote 94 That test was then applied to determine whether there was a breach of confidence in that case.Footnote 95
It follows that Tchenguiz has significant implications for protection against unwanted watching, listening and recording without subsequent publication. If a person can be liable for acquiring private information by looking at or copying confidential documents, then why not also for acquiring private information by other means? More particularly, if it is breach of confidence to obtain private information by reading a document, can it not also be a breach of confidence to obtain private information by watching, listening or recording people; by intercepting their telephone calls, bugging their private conversations or watching them in their homes, for example? The Court of Appeal's reliance on the Strasbourg telephone monitoring case of Copland v United Kingdom supports this reading of the case. Liability for merely looking at confidential documents is, according to the Court of Appeal in Tchenguiz, consistent with the European Court's conclusion that monitoring private telephone calls could be a breach of Article 8.Footnote 96 The Court of Appeal therefore clearly thought that Copland and Tchenguiz were addressing the same issue – the unwanted acquisition of private information – irrespective of differences in the way the information was obtained (the state in Copland was tracking telephone usage, not accessing private documents). Support for a broad interpretation of Tchenguiz is also found in the observation that the claimant's right to “choose whether … to whom and in what circumstances and on what terms, to reveal the information” is the essence of the breach of confidence action.Footnote 97 These same choices are undermined when someone obtains confidential information through the use of the senses.
It is suggested then that courts could legitimately decide that it is a breach of confidence to acquire private information through the use of the senses (by hacking a person's telephone calls, bugging a private dinner conversation or videoing an intimate encounter, for example) even if no further use is made of the material.Footnote 98 It follows that limited redress for physical privacy breaches can be provided by breach of confidence: as long as confidential information is obtained in the course of the intrusion, liability could be imposed on those who eavesdrop, spy on or record other people even if no dissemination or other misuse of the information results.
Extending breach of confidence would not, however, fill the conceptual gap which has been identified in this article. This is because, in order to establish a breach of confidence, the claimant must be able to point to private information which was obtained as a result of the intrusion. In some cases, this will be unproblematic; if, for example, a telephone hacker hears callers discussing a secret affair, an unannounced miscarriage, or confidential marital difficulties. But in other cases, the information obtained will be anodyne, unimportant or already widely known. The hacker might hear, for example, discussion of celebrity gossip or plans for a holiday which have already been publicised in the media. In these cases, even if the intrusion is serious, the value of the information is low. Further, although it is a serious breach of privacy secretly to spy on a person in the shower, to film a child changing at a swimming pool, or to record a father playing with his children in their bedroom, it is unintuitive to say that private “information” is obtained by the intruder. The objection is, instead, to the fact that the voyeur is looking at the claimant when he or she does not wish to be observed; that the watcher has insinuated himself or herself in at a private moment.Footnote 99
Courts could possibly skirt around these difficulties by saying that the intrusive way that information is acquired can, without more, make it confidential. In other words, the fact that the information was acquired by eavesdropping or spying could, on its own, be enough to make it confidential. But courts have so far shown little willingness to take this approach. In Coogan v News Group, for example, the Court of Appeal held that “[w]here a person's voice messages are intercepted, particularly over a period, there will often be some messages which contain confidential information and some which do not”.Footnote 100 The fact that the information was obtained by unauthorised telephone hacking was not enough on its own to establish confidentiality.
Alternatively, it might be possible to recharacterise as “information” the subjective impressions one gets when looking at or listening to a person engaged in private activity. For example, the voyeur could be said to get “information” about how the person goes about showering, about what the child looks like naked, and how the father interacts with his children. And the telephone hacker gets information about what the participants were talking about, the exact words used, tone of voice, intimacy or lack thereof. Again, though, there is no evidence that courts would be prepared to interpret “information” in this artificial way and it would be regrettable, even if they were, to place physical privacy protection on such flimsy foundations. It would be too easy on this approach to dismiss as insignificant the amount and quality of the “information” obtained by hackers and voyeurs. What information would be obtained, for example, if the intruder had already seen the child or the woman naked many times before? Further, and more fundamentally, it is artificial to speak of the “information” obtained by unwanted observation. The sensory objection at the heart of these cases – that it is inconsistent with individual dignity and autonomy to look at, listen to or record a person without leave – is obfuscated if courts are forced to shoehorn them into information-based actions.
So, although it is possible to extend breach of confidence to protect against information obtained by unwanted watching, listening or recording without subsequent dissemination, this will only protect claimants if their objection is to the acquisition of private information and not the act of spying or eavesdropping itself. Whilst there might be situations where this is the case – where the intruder finds out about a previously secret abortion, medical condition, or romantic affair, for example – it will not always be so. As a result, breach of confidence cannot provide principled, coherent protection for physical privacy interests.Footnote 101
C. Extending Misuse of Private Information
The remaining question, then, is whether misuse of private information can be extended to protect physical privacy interests instead of breach of confidence.
It will be recalled that courts considering misuse of private information ask two main questions: whether the claimant had a reasonable expectation of privacy in respect of the information and, if so, whether that privacy interest should yield to the defendant's Article 10 right to freedom of expression.Footnote 102 Could courts, in an appropriate case, recognise that a reasonable expectation of privacy is breached by unwanted looking, listening or recording without subsequent dissemination of the material?
It is suggested that they should. As Whata J. said when justifying a similar extension to the New Zealand privacy tort in C v Holland:
a tort of intrusion upon seclusion is entirely compatible with, and a logical adjunct to, the Hosking tort of wrongful publication of private facts. They logically attack the same underlying wrong, namely unwanted intrusion into a reasonable expectation of privacy.Footnote 103
So, in both physical and informational privacy cases the fundamental objection is the same: the defendant is obtaining unwanted access to a person by interfering with his or her reasonable expectation of privacy. And both physical and informational privacy breached undermine the claimant's dignity, autonomy and relationships, leading to feelings of distress, mistrust and violation. As Lord Hoffmann has recognised, it is these underlying values of autonomy and dignity which lie at the heart of the misuse of private information action, not “the duty of good faith applicable to confidential personal information and trade secrets alike” which underpinned the breach of confidence interest.Footnote 104 It follows that there would be nothing to stop courts from extending the reasonable expectation of privacy test to include situations where the claimant has simply been looked at, listened to, or recorded without leave.
As with the development of misuse of private information, the horizontal effect of Article 8 could provide the impetus for making this change. As discussed above, courts developing “applicable” common law principles – including misuse of private information – are bound to develop the law consistently with the Article 8 right to respect for private life. That right extends well beyond the protection of private information; citizens also have a right to protection from, inter alia, visual and audio surveillance, bodily searches and unwanted photography. The United Kingdom has positive obligations to protect against interference with these interests. It is therefore entirely defensible – indeed, some would say, necessary – for courts to extend the reasonable expectation of privacy to cover these wider private life interests.Footnote 105
If courts are prepared to read it expansively, Tchenguiz provides further support for broadening the privacy action to protect physical privacy. As outlined above, in breach of confidence cases involving personal information, courts use the reasonable expectation of privacy test to determine whether confidence has been breached.Footnote 106 And, as the Court of Appeal said in Tchenguiz, “the law should be developed and applied consistently and coherently in both privacy and ‘old fashioned confidence’ cases, even if they sometimes may have different features”.Footnote 107 It follows that if the mere acquisition of private information can interfere with a claimant's reasonable expectations of privacy in breach of confidence, it will also breach the claimant's reasonable expectations in misuse of private information. Reading a person's diary, hacking his or her emails or copying his or her medical records is therefore highly likely to be an actionable breach of privacy. Once courts reach this conclusion, it is – as discussed in the breach of confidence context above – a small step to conclude that it is also a misuse of private information to acquire information by other means; by spying on a person as he or she attends a medical appointment, by bugging a private dinner conversation, or installing a video in his or her home. It is suggested that courts should take this small step and go one further – they should drop the language of information altogether and recognise that unwanted watching, listening and recording are breaches of privacy in themselves.
Wainwright v Home Office would not prevent courts from doing this. Although Lord Hoffmann was opposed to recognition of a broad-ranging right to privacy, he did contemplate the incremental development of privacy protection.Footnote 108 Extension of misuse of private information would be such a development; no general right to privacy would be created. And to the extent that recognition of physical privacy is inconsistent with the specific conclusion reached in Wainwright – that there was no right of action available to prison visitors who were strip-searched in contravention of prison rules – things have moved on. Article 8 of Schedule 1 to the HRA would now provide the Wainwrights with a cause of actionFootnote 109 and Lord Hoffmann's doubts about whether the intrusive strip-search would have breached Article 8 were shown to be ill-founded in Strasbourg.Footnote 110 Protection of physical privacy is, then, a logical next step in the development of the right to privacy in private law.
VI. A New Physical Privacy Action
So, when a suitable case arises courts should recognise that it is an actionable breach of privacy deliberately to watch, listen to and/or record a person who has a reasonable expectation of privacy, irrespective of whether “information” is obtained or disseminated. The focus of the action should be on the intrusiveness of unwanted watching, listening and recording itself. The language of “confidence” and “information” should therefore be abandoned in favour of the label “physical privacy”.Footnote 111 As in misuse of private information, a variety of factors should bear on the existence of a reasonable expectation of privacy: the attributes of the claimant; the nature of the activity in which the claimant was engaged; the place at which the activity occurred; the nature of the intrusion; the absence of consent and whether it was known or could be inferred; and whether the observation was surreptitious or open.Footnote 112
The action should not be overly broad. The archetypal case would involve observing or recording an intimate conversation, domestic life, or activities (such as sexual activity, medical procedures, changing, or using a bathroom) during which private body parts are exposed. Since the action is predicated on the need to protect the human values of autonomy and dignity, it should only avail natural persons – corporations, companies and other artificial persons should not be able to rely on it. But the action could potentially be relied on by people who suffer serious physical intrusions in public places: it could, for example, provide redress to those who are closely and deliberately filmed in public whilst their intimate body parts are involuntarily exposed or bugged in public during an otherwise inaudible conversation.Footnote 113
It is important though that the new physical privacy action does not interfere with legitimate attempts to expose harmful or wrongful behaviour or with the appropriate reporting of newsworthy events. Courts should therefore ensure that claimants cannot use the physical privacy action to circumvent the balance between privacy and freedom of expression which has been negotiated in misuse of private information cases. Physical privacy should thus only cover the sensory observation and recording of an individual. Unwanted access to personal digital or paper files – being informational in nature – should remain part of an extended misuse of private information/breach of confidence action. A defence should also be available to a defendant who reasonably believed, at the time that it was undertaken, that the unwanted spying, listening or recording was necessary to expose harmful or wrongful behaviour.Footnote 114 As with misuse of private information, the more intrusive the conduct, the more compelling must be the justification for it. It should be almost impossible, for example, to justify the filming of a person using a toilet but relatively easy to justify the surreptitious recording of an otherwise consensual encounter such as a telephone call or face-to-face meeting. Liability for criminal offending would, of course, remain. Finally, where the claimant is recorded in a public place, a defence should be available if the recording was part of an appropriate attempt to capture a disaster or other newsworthy event.Footnote 115
A physical privacy action, thus formulated, could coexist happily with misuse of private information. In the usual case, liability for breach of physical privacy and misuse of private information would converge. For example, a claimant who had his or her telephone hacked and the contents of the conversation disclosed would succeed in both actions and be compensated accordingly: in the first place, for any feelings of vulnerability, violation and mistrust engendered by the eavesdropping; and then for the embarrassment, violation and possible pecuniary damage caused by the disclosure.Footnote 116 A right to watch, listen or record will not, however, always lead to a right to disseminate. Whilst a concerned son might be permitted to install a camera in his mother's home to investigate suspicions that her carers were neglecting her, he might not be entitled to broadcast the footage obtained. As long as the actions are kept analytically distinct though, problems of compatibility, overlap or double-compensation need not arise. Indeed, greater understanding of the values at the heart of the privacy action should, eventually, be fostered.
VII. Conclusion
Significant progress has been made over the past two decades in the protection of privacy in England and Wales. English law now protects against the acquisition and retention of private information, and against the dissemination of private facts, images and recordings. Courts have also recognised that autonomy and dignity are at stake in these cases. Until physical privacy is brought into the mix, however, vital aspects of the privacy interest will remain unprotected. This article suggests that courts are poised to provide that protection. With just a small conceptual shift sideways, the misuse of private information action can be extended to protect against unwanted watching, listening and recording per se. This would bring English law into line with the jurisprudence of the United States and the European Court of Human Rights and with recent developments in Ontario and New Zealand.
As these jurisdictions have recognised, physical privacy is an important, but increasingly fragile, right. It is hoped that when an appropriate case presents itself, English courts will protect it.
