Insights High Court dismisses claims that leak of emails showing association with TV channel was misuse of private information or breach of UK GDPR


On 11 September 2018 the claimant, Mr Panah Farhadbahman, who was a senior broadcast journalist with BBC Persian, resigned from the BBC and joined Iran International TV (IITV), a Persian language TV channel based in London that broadcasts by satellite to Iran. Mr Farhadbahman entered into a contract with IITV under which he was to provide certain media services to the company managing the channel, DMA Media Ltd, on a consultancy basis. Mr Farhadbahman began working with IITV on 17 September 2018.

On joining IITV, Mr Farhadbahman engaged in a warm exchange of emails with the CEO of DMA Media, Mr Beynon. The emails were copied to everyone working there. Mr Beynon welcomed Mr Farhadbahman on board, explaining his background and role. Mr Farhadbahman’s response looked forward to working with his new colleagues. He signed off with the title “Creative Director” and his contact details.

The following month, Mr Beynon told Mr Farhadbahman that a Mr Alizadeh, who is a UK-based Iranian social media commentator opposed to Western intervention in Iranian affairs, had published the exchange on social media. A leak was the assumed explanation. A subsequent leak investigation within IITV proved inconclusive. There was no evidence of anyone in the organisation forwarding the emails out of the organisation.

DMA Media terminated its contract with Mr Farhadbahman on 6 September 2019 on the ground that Mr Farhadbahman had breached editorial guidelines in his personal social media activity.

Mr Farhadbahman issued proceedings against DMA for wrongful termination or breach of the contract, and for misuse of private information and breach of Article 5(1)(f) of the UK GDPR as a result of the leak into the public domain of the email exchange revealing his association with the channel and his contact details, which meant that the Iranian Government were aware of his position. Mr Farhadbahman said he had a reasonable expectation of privacy as to his contractual relationship with IITV and that IITV could and should have prevented the leak. He also said that his contact details contained in the email exchange and the content of the emails constituted personal data and that IITV did not take appropriate technical or organisational measures to protect it against unauthorised leaks.

Mrs Justice Collins Rice said that the fact of a workplace contract was not routinely or intrinsically a private matter. Therefore, whether it could properly be regarded as a matter protected by Mr Farhadbahman’s personal privacy rights would have to be sought in the circumstances of the case.

There was no provision in the contract that indicated that it had an essential quality of privacy and there was no mention in any of the pre-contract email exchanges between the parties of an expectation of privacy. Given that the quality of privacy attaching to the existence of a contract of this kind was an unusual proposition, it needed to be established by clear evidence, but there was no evidence that Mr Farhadbahman had made clear to IITV that he expected the contract to be kept private or that IITV should have inferred as much. Therefore, Mr Farhadbahman had not established that he had a reasonable expectation of privacy as to the existence of the contract.

Collins Rice J noted that both the privacy and data protection claims relied on fixing IITV with legal responsibility for the leak. However, the evidence showed that IITV senior managers were alive to the endemic problem of infiltration and surveillance by hostile agents reporting to the Iranian Government and had actively engaged in trying to manage it, including with external help and advice. It was Mr Farhadbahman’s responsibility to establish that DMA Media had failed to comply with its legal duties in relation to his personal data and that that failure was causative of the leak. Something more than the fact of the leak needed to be established. Collins Rice J was not satisfied that he had discharged that burden of proof.

Accordingly, the claims in privacy and data protection were dismissed. (Damavand Media Ltd v DMA Media Ltd [2021] EWHC 3164 (QB) (25 November 2021) — to read the judgment in full, click here).