Gulati and others – Court Ruling (United Kingdom, 2015)

Eight prominent individuals (including actors, a BBC executive, and a footballer) sued MGN Limited, publisher of the Daily Mirror and Sunday Mirror newspapers. Over approximately 7 years, MGN journalists and private investigators systematically accessed the claimants' voicemail messages without authorization using various techniques including exploiting default PIN codes and "farming" (accessing contacts' voicemail boxes for additional information). One claimant (Alan Yentob) had his voicemail hacked at least twice daily for 7 years. The hacked information was then used to publish articles about the claimants, with sources disguised as "friends" or "pals." Additionally, private investigators employed "blagging" techniques, using deception to obtain personal information from third parties. The claimants suffered distress and damage to personal relationships, as published articles revealed confidential information that only a select few knew, causing those individuals to suspect each other of leaking information to journalists. The Court of Appeal upheld the first instance judgment and rejected all four grounds of appeal. The court established several key principles for damages under the tort of misuse of private information: First, damages are not limited to distress and injury to feelings. The court held that compensation can be awarded for the invasion of privacy itself and loss of control over private information, independent of any distress caused. The court stated: "misappropriating (misusing) private information without causing upset is still a wrong." Second, the court rejected arguments that damages should be limited by reference to personal injury tariffs or discrimination/harassment bands. While such references provide a "sanity check," the court found that each invasive act may give rise to a separate cause of action, and the "atomized" approach of awarding separate damages for each article and each act of hacking was appropriate. Third, the court rejected comparisons to European Court of Human Rights awards, finding that English law is developing its own independent tort of misuse of private information that may warrant different levels of compensation. Fourth, the court found no double-counting in the awards, as the judge had explicitly directed himself to avoid this risk. The court affirmed damages ranging from £72,500 to £260,250 to the eight claimants. The court emphasized that compensation must be adequate to vindicate privacy rights, particularly where there is loss of control over private information and profound effects on personal relationships.