English court determines the “meaning” of personal data

Background

By way of recap:

• In 2017 and 2018, the defendant (Dow Jones) published two articles in the Wall Street Journal relating to the activities of XIO Group (a global investment firm) and naming the two claimants (senior XIO Group executives). The articles remained available to Wall Street Journal subscribers. In 2020, the two claimants left XIO Group and set up their own investment firm.
• In 2023, the claimants commenced proceedings alleging that the articles contained inaccurate or misleading personal data about various matters of fact, including that the claimants were party to a fraudulent conspiracy. The claimants sought compensation and erasure of the personal data, alleging breaches of Articles 5(1)(a) and (d) UK GDPR.

The claimants claimed that the articles had been an obstacle to investment in their new firm, entitling them to compensation under Article 82 GDPR and/or s168 DPA 2018.

After an unsuccessful strike out application, two preliminary issues were ordered to determine (1) the meaning of the articles and (2) if the articles contained criminal offence data within the meaning of Article 10 UK GDPR.

The judge’s findings

On the first preliminary issue, a considerable part of the judgment was dedicated to the judge’s analysis of the relevant data protection and defamation authorities, in order to identify the correct approach. This consisted of the following elements:

• First, determining the “single meaning” of the personal data, by considering the articles as a whole, and interpreting each element of them by reference to the meaning that the hypothetical reasonable reader would take from them, in their full context.
• Second, the “single meaning” should also be determined by applying established principles in defamation law for determining the natural and ordinary meaning of the words used, having first read the articles before the parties’ submissions on them.
• Third, the “repetition rule” in defamation law should be applied, whereby a party who repeats a defamatory statement is treated as if they made the original statement, even though the articles concerned reports of court proceedings.

Adopting this approach, the judge proceeded to determine the meaning of the articles. A full analysis of the judge’s detailed findings and their implications for the case are beyond the scope of this post.

On the second preliminary issue, the judge found that the personal data in the articles were not criminal offence data within the meaning of Article 10.

Comment

As outlined in our previous post, this is an important case which traverses the boundary between data protection and defamation law. It also creates new law, in that it is the first time that a court has considered (1) the meaning of personal data in a data protection context alone;¹ and (2) the related application of the “repetition rule”. Notably, the judge expressed some disquiet about the scope of the first preliminary issue, observing that whereas data concerns matters of fact, “meaning” concerns the message conveyed by the material in question. He also noted the risk of unsatisfactory consequences, including that the intrusion of English defamation law into data protection could affect the UK’s adequacy status in relation to the EU, and that in this type of case, a decision on meaning based on principles developed in defamation law (i.e. based on the natural and ordinary meaning of the relevant words) may be at odds with the way in which a court approaches inaccuracy and unfair data processing claims, where the reaction of readers and other parties may also be material.

Footnote

1. See paragraphs [1] and [81] of Pacini & Anor v Dow Jones & Company Inc [2024] EWHC 2714 (KB)