October 25, 2021
The defendant, Jon Woodard, had installed a floodlight and sensor, together with a video and audio surveillance camera with integrated motion sensitive spotlight, on the shed in his back garden (the Shed Camera) pointing in the direction of a car park used by the residents of the terraced houses in front, including the claimant, Dr Mary Fairhurst.
Mr Woodard had also installed a combined doorbell and video and audio surveillance system known as a “Ring” video doorbell on his front door, which pointed in the direction of the street (the Doorbell Camera).
On the gable end wall of the house next to his, Mr Woodard had also installed a second video and audio surveillance camera with integrated motion sensitive spotlight, which pointed towards the direction of the car park and the driveway that Mr Woodard shared with Dr Fairhurst (the Driveway Camera).
All the cameras were connected to the internet and Mr Woodard was able to view and hear footage from them via an app on his mobile phone.
Following a dispute between Mr Woodard and Dr Fairhurst in relation to the cameras, in which Mr Woodard said he had installed the cameras due to the attempted theft of his car, Dr Fairhurst issued proceedings in the County Court against Mr Woodard for: (i) breach of the Data Protection Act 2018 and the General Data Protection Regulation (2016/679/EU); (ii) breach of the Protection from Harassment Act 1997; and (iii) nuisance.
Dr Fairhurst said that Mr Woodard had consistently failed to be open and honest with her about the cameras, had unnecessarily and unjustifiably invaded her privacy by his use of the cameras and had intimidated her when challenged about that use. Dr Fairhurst said that Mr Woodard’s actions had caused her such distress that she had left her home and had not been able to return to live there again. She sought damages and injunctive relief mandating the removal of the cameras and forbidding the installation of further surveillance cameras.
Mr Woodard denied all of Dr Fairhurst’s claims.
Her Honour Judge Melissa Clarke found that, generally speaking, the cameras surveyed some of Dr Fairhurst’s property, including some of her garden and the area around her parking space, as well as some of Mr Woodard’s property. The cameras also captured audio so that conversations on the shared driveway, in Dr Fairhurst’s garden, in the car park, outside her front door and on the pavement in front of her house, were susceptible to being heard and recorded. Both the video and audio feeds were recorded and uploaded to cloud storage hosted by Amazon until automatically deleted after 30 days.
HHJ Clarke dismissed the claim in nuisance, but in relation to the harassment claim, she found that:
- Mr Woodard had clearly engaged in a course of conduct on at least two occasions;
- Mr Woodard had caused Dr Fairhurst alarm and distress through his activities, including when he had falsely told her that he had sent her image to the police as an unknown suspicious person (which HHJ Clarke said amounted to intimidation), and making threatening phone calls that were designed to deliberately scare Dr Fairhurst and in which he threatened to set up more cameras and to call the police; HHJ Clarke found that some of the threats were oppressive and likely to cause alarm and distress; HHJ Clarke also took into account the lies that Mr Woodard had told about some of the cameras being non-operational dummy cameras, and the lies he had told to support those lies; taking all the behaviour into account, HHJ Clarke was satisfied that it crossed “the boundary between that which is unattractive and even unreasonable and that which is oppressive and unacceptable”;
- the reasonable person, in possession of the same information, would consider that the conduct amounted to harassment; to go from living in the neighbourhood in seeming harmony with the other neighbours for 20 years to the level of belligerence, dishonesty, threats and oppressive behaviours that Mr Woodard had exhibited over the course of a few days was unusual and alarming behaviour amounting to harassment; and
- the course of conduct was not pursued for the purposes of preventing or detecting crime, nor were the particular circumstances reasonable; HHJ Clarke dismissed Mr Woodard’s claims that Dr Fairhurst had showed Mr Woodard “no understanding or compassion” in relation to the attempted theft of his car, which he claimed was the true motive in installing the cameras; HHJ Clarke said that this was “victim blaming”. She strongly disagreed with Mr Woodard’s submission that his actions were reasonable within the factual matrix of his car nearly being stolen.
Accordingly, the claim in harassment succeeded.
As for the data protection claim, HHJ Clarke noted that ICO Guidance on the meaning of “transparent processing” states that “Transparent processing is about being clear, open and honest with people from the start about who you are, and how and why you use their personal data”. Given the manner in which Mr Woodard had sought to mislead Dr Fairhurst about how and whether the cameras operated and what they captured, HHJ Clarke was satisfied that Mr Woodard had breached: (i) the first data protection processing principle under Article 5(1) of the GDPR, as he could not be said to have processed data fairly or in a transparent manner; and (ii) the second principle, as he had not collected data for a specified or explicit purpose but rather had sought to mislead Dr Fairhurst that: (a) the Shed Camera was focused only on his car parking spaces when, in fact, on many occasions it had a very wide field of view and captured Dr Fairhurst’s personal data as she drove in and out of the car park; and (b) that the Driveway Camera was not collecting her personal data at all, when in fact it was.
Mr Woodard said that all his data collection and processing was necessary for the purposes of crime prevention. Dr Fairhurst said that her right to privacy in and around her home overrode that purpose. HHJ Clarke considered that the balance between these competing interests was met in relation to the processing of video personal data from the Doorbell Camera because any video personal data of Dr Fairhurst was likely to be collected only incidentally as she walked past, unless she stood on Mr Woodard’s doorstep and rang his doorbell, and his legitimate interest in protecting his home was not overridden by her right to avoid such incidental collection on a public street, albeit in the vicinity of her home.
However, in relation to the Driveway Camera, which was trained on Dr Fairhurst’s property including her side gate, garden and her car parking spaces, HHJ Clarke found that this was not necessary for the purposes of his legitimate interests. It was not legitimate for him to carry out video and audio surveillance of a road leading to a car park used by others, when his cars and property could be protected in a lesser way that did not sacrifice Dr Fairhurst’s privacy. In any event, Mr Woodard’s interests were overridden by Dr Fairhurst’s right to privacy.
As for the audio personal data collected by the cameras, HHJ Clarke noted the third principle, which states that personal data “shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”. HHJ Clarke was satisfied that the extent of range to which these devices could capture audio was well beyond the range of video that they captured and could not be said to be reasonable for the purpose for which they were used, since crime prevention could be achieved by not using audio at all.
The extent of the range meant that personal data could be captured from people who were not even aware that the device was there, or that it recorded and processed audio personal data, or that it could do so from such a distance away, in breach of the first principle. Dr Fairhurst had fallen into each of these categories during the relevant time. The individuals whose conversation it captured may well be identifiable from the data itself or from other information that could be obtained from the data controller. Therefore, the processing of such audio data by Mr Woodard as data controller was not lawful.
Accordingly, Mr Woodard had breached the DPA 2018 and the UK GDPR, as well as the Protection from Harassment Act 1997, and Dr Fairhurst was entitled to compensation and orders preventing Mr Woodard from continuing to breach her rights in the same or a similar manner in the future. (Dr Mary Fairhurst v Mr Jon Woodard (Case No G00MK161) (12 October 2021) — to read the judgment in full, click here).