Our Commercial Disputes trainee solicitor, Catriona Connor, looks at the complications of data protection law. 

While on the campaign trail In August 2016, Labour leader Jeremy Corbyn was filmed sitting on the floor of a Virgin Train on his way from London to Newcastle. He complained that the train was ‘ram-packed’ and made a case for renationalisation of Britain’s railways.

Virgin Trains responded by taking the unusual step of releasing CCTV images to disprove the allegation that there weren’t any available seats. The images show Mr Corbyn walking past free seats and sitting down shortly after filming the footage. They also show several other passengers on the train.

The Information Commissioners Office (‘ICO’), which is responsible for investigating breaches of the privacy rights of UK citizens, investigated the release of the images.

Virgin Trains’ argument

Personal data (like CCTV images) can only be published if one of the conditions in Schedule 2 of the Data Protection Act 1998 (‘DPA’) is met (see section 4 and paragraph 1 of Schedule 1 to the DPA). Virgin Trains argued that it had a legitimate interest in publishing personal data under paragraph 6(1) of Schedule 2 to the DPA. The legitimate interest was to correct misleading news reports which were potentially damaging to its reputation and commercial interests.

The ICO’s findings

The ICO agreed that Virgin Trains had a legitimate interest in publishing Mr Corbyn’s image and that it was impossible to show that there were seats available on the journey in question without showing Mr Corbyn on that journey.

It found that Mr Corbyn would have had different expectations to other passengers about his privacy on this journey. Firstly, because he had also filmed footage during the journey, and secondly because he could reasonably expect that Virgin Trains would wish to respond to his video once it was released to the media.

However, the ICO found that Virgin Trains had no legitimate interest in publishing pictures of the other passengers on the train. By doing so, it infringed on the privacy of people who could not have reasonably expected their images to be published. There were only three people recognisable in the images, as most of the passengers’ faces were pixelated.

Next steps

The ICO did not take formal action against Virgin Trains. This was because it felt that the people identified were unlikely to suffer serious distress or detriment. In reaching this view, it noted that none of the affected passengers had contacted it.

Virgin Trains has pledged to strengthen its data protection training for all staff, amend its CCTV policy and ensure that it has easy access to pixelation services in future.