Equifax, one of the world’s leading credit rating agencies is hacked. Personal information of individuals is accessed and many of these individuals have not consciously consented to Equifax holding their data, but have no choice in the modern world. No respectable media outlet, if offered this stolen personal data, would publish it.
The position is different in some circumstances and the media is only too happy to publish stolen material, such as the Panama Papers, the Paradise Papers and material hacked from the Sony organisation.
The media’s complicity with the hackers is speciously justified as in the public interest. It is apparently OK to steal Sony executives’ emails which make derogatory remarks about President Obama and Angelina Jolie. It is also fair game to reveal information about the offshore tax affairs of individuals, despite the fact that this material is known by the media to be confidential and may also be subject to legal privilege.
The victims of these attacks are largely without redress and when Appleby, the legal firm hacked in the Paradise Papers case, sues the BBC and The Guardian, it is characterised as an attempt to ‘undermine responsible public interest journalism’.
It will be interesting to find out if the English court accepts this argument. To date, other jurisdictions have offered only limited, if any, redress. In Bartnicki v Vopper [2001], the US Supreme Court held that no liability attached where a radio presenter broadcast an illegally recorded conversation left in his mailbox, in which union leaders threatened violent action if their demands were not met; the radio host had not intercepted the conversation himself and claimed not to know it was illegally recorded. The conversation was newsworthy and the right to free speech provided a defence where the illegality was occasioned by an unknown third party.
In the Paradise Papers case, The Guardian and the BBC knew or should have known the relevant material was stolen and that it was confidential and possibly subject to legal privilege. However, they still took the decision to publish. The Ontario Court of Appeal in Jones v Tsige, a 2012 case, recognised the right of a civil action for damages for invasion of personal privacy, without any evidence of economic harm to the claimant. The claimant’s ex-husband’s new wife, a bank employee, regularly hacked into the former wife’s account. The tort of intrusion upon seclusion on an individual can be compensated for by between $10,000 and $20,000. It is also suggested that aggravated and punitive damages may be recoverable in an exceptional case.
Justice Sharpe posed the major dilemma for the future in this type of case. ‘Foremost are claims for the protection of freedom of expression and freedom of the press… no right of privacy can be absolute and many claims for the protection of privacy will have to be reconciled with, and even yield to, such competing claims’.