Damavand Media Limited – Court Ruling (United Kingdom, 2021)

The claimant, Mr. Farhadbahman through Damavand Media Ltd, entered into an employment agreement with the defendants, IITV. Throughout the existence of the contract the claimant made various publications on social media which were not in line with IITV’s editorial guidelines. The claimant alleged that he was not subject to these editorial guidelines due to the nature and scope of his employment and the contractual terms related thereto. Approximately one year after the conclusion of said contract the defendant terminated the contract on the grounds of a material breach having been committed by the claimant for not following the editorial guidelines on approximately six occasions. A third party who is a prominent voice on social media published internal correspondence (a “welcome email” exchange including various employees within IITV and undersigned by the claimant as the “creative director”) which showed the claimant’s involvement with the defendant. A leak was internally investigated but the investigation was inconclusive. The claimant alleged that this constituted a data breach as he had a reasonable expectation of privacy and that IITV could and should have prevented the leak. He relied on Article 5(1)(f) of the GDPR to support his argument that “his contact details and the content of the welcome note constituted personal data and IITV did not take appropriate technical and organisational measures to protect it against unauthorised leaks.” The High Court was referred to Various Claimants v Wm Morrison Supermarkets plc for guidelines on the application of ‘ensures, appropriate security... using appropriate technical or organisational measures’ to test a leak. However, it found that “[t]he mere fact of disclosure or loss of information is not sufficient for there to be a breach. An organisation is not vicariously liable for deliberate leakage. So it is a question of ‘appropriate’ risk management in all the circumstances of the case.” The High Court dismissed the argument of the complainant alleging that he was not subject to the editorial guidelines. It found that the contract was to be read holistically, and by doing so it became clear that the contract indeed created an obligation for Mr. Farhadbahman to adhere to the editorial guidelines through other obligations which were expressly agreed upon in the terms of the contract, such as an undertaking to promote the interests of IITV. In considering the arguments of both parties relating to the reasonable expectation of privacy in relation to the employment contract, the court noted that in order to uphold the claimant’s argument, it has to be satisfied that the claimant expected his employment contract with the defendant to be confidential and that such expectation is reasonable. The court further noted that employment contracts are not routinely or intrinsically a private matter and therefore this case is to be considered on its own merits. The court went ahead to look at various factors such as the contractual terms and the correspondence between the claimant and the defendant reflecting the claimant’s reaction or attitude toward the leaking of his particulars at the time. Noting that the onus is on the claimant “to discharge the burden of showing on the facts and evidence that he had a reasonable expectation of privacy as to the existence of his contract” the court found that “[t]he difficulty he faces in making out a claim for misuse of private information is the lack of contemporaneous evidence that he actively made clear to IITV he expected his contract to be kept private, or that IITV ought in all the circumstances to have inferred as much.” The court dismissed the claimant’s argument as he was not able to discharge his burden of proof. It is therefore clear that an expectation of privacy arising from contract (more specifically an employment contract) has to be expressly agreed upon between the contracting parties and if not, it should at the very least be made clear at some stage thereafter through written correspondence between the parties reflecting an unequivocal understanding of such privacy expectation by either or both parties.