It provides that: (1) no one shall be subjected to arbitrary or unlawful interference with

his privacy, family, home or correspondence, nor to unlawful attacks on his honour and
reputation; and (2) everyone has the right to the protection of the law against such
interference or attacks.

In addition to its existence as an independent right, the right to privacy included an

individual’s rights to freedom of expression and movement and was essential to satisfy

the constitutional aims of liberty and fraternity which ensured the dignity of the

individual.

There is no standard procedure with regard the collection of third party information,

which in this case is X’s personal information, as such was brought about by A and B

during a police interrogation.

Neither has it the flexibility of such expressions as admissible, ordinary, useful ,

reasonable or desirable

Although, it may be argued that due to the prevalence of a crime, how a crime is carried
out, and how many people it affects are key factors in determining the severity of a
pressing social need, such must still be in context with the evidence supporting
justification.

In July 2013, the UK DPA took formal enforcement action against a police force for their
use of Automatic Number Plate Recognition (ANPR) covering all roads into and out of a
small rural town in Hertfordshire, England. In this case, the processing of personal data
was generally compliant with the requirements of national data protection law, and the
processing the personal data collected was for a policing purpose and was not processing
irrelevant or inaccurate data in relation to that purpose. However, in this case, the EctHR
ruled that,

There was lack of evidence to properly demonstrate how the introduction of ANPR on

such a large scale in such a low crime area would significantly aid in addressing the
issues which the force had identified. With the foregoing, it was ruled that the measure

was an unjustified interference with the individuals’ privacy rights under the

Charter/ECHR, and unlawful for the purposes of data protection law.

Simply, they failed to provide relevant and sufficient reasons to justify the encroachment

to prevent a great evil.

It was erroneous for the prosecutor to contend that the right to remain anonymous does
not extend to X in the context of a criminal offence.

The decision in this case was based on the 1995 Data Protection Directive, and the EU

Charter on Fundamental Human Rights. Also, the right to personal data protection seeks

to protect one’s anonymity in the online world and to enable a person to control how such

data is processed by those to whom it is voluntarily shared.

The disclosure of personal data contained in those registers amounted to “data

processing.”

The European Convention on Human Rights and Fundamental Freedoms provides: 1)

Everyone has the right to respect for his private and family life, his home and his

correspondence; 2) There shall be no interference by a public authority with the exercise

of this right except such as is in accordance with the law and is necessary in a democratic

society in the interests of national security, public safety or the economic well-being of

the country, for the prevention of disorder or crime, for the protection of health or morals,

or for the protection of the rights and freedoms of others.

“Personal data shall be: a) processed lawfully, fairly and in a transparent manner in
relation to the data subject (‘lawfulness, fairness and transparency’); b) collected for
specified, explicit and legitimate purposes and not further processed in a manner that is
incompatible with those purposes; further processing for archiving purposes in the public
interest, scientific or historical research purposes or statistical purposes shall, in
accordance with Article 89(1), not be considered to be incompatible with the initial
purposes (‘purpose limitation’); c) adequate, relevant and limited to what is necessary in
relation to the purposes for which they are processed (‘data minimisation’); d) accurate
and, where necessary, kept up to date; every reasonable step must be taken to ensure that
personal data that are inaccurate, having regard to the purposes for which they are
processed, are erased or rectified without delay (‘accuracy’); e) kept in a form which
permits identification of data subjects for no longer than is necessary for the purposes for
which the personal data are processed; personal data may be stored for longer periods
insofar as the personal data will be processed; f) processed in a manner that ensures
appropriate security of the personal data, including protection against unauthorised or
unlawful processing and against accidental loss, destruction or damage, using appropriate
technical or organisational measures (‘integrity and confidentiality’).

48. The EU Charter on Fundamental Human Rights also provides that everyone has a
right to the protection of personal data concerning him or her and such data must be
processed fairly for specified purposes and on the basis of the consent of the person
concerned or some other legitimate basis laid down by law. Here, we see again that
generally, consent is required and that there needs to be a legitimate basis for the release
of personal data in the law. In this case no consent was acquired by Hiya from X and Y
nor was there a legitimate basis laid down by law for the release of information.

the directive applied when the State activity involved providers of electronic
communications services, and therefore the personal data processing by those providers.
It offered users of electronic communications services protection against risk to their
personal data and privacy arise from new technology and the increasing capacity of data
storage.

The Court set out guidelines on the procedure to be followed by national authorities to
ensure that those conditions were fully respected. I

42. Clearly, there was a violation of the right to privacy, since: (1) A and B did not
consent to the release of their personal data; and (2) there is no law that permits Hiya!’s
release of personal data or sufficient justification as to encroach upon A and B’s privacy

43. Both the Government and Hiya! failed to demonstrate a legitimate aim or any
necessity for the interference, and with the disclosure of X’s personal information
constituted unjustified interference with the right to respect private life and resulted in
violations of laws.
29. It may be gleaned from different legal frameworks, that by its very nature, it is a

fundamental right that is at the same level as other rights.

With the advancement of technology, threats to individual privacy are greater now than
ever envisaged.

Also, sensitive and private information should not be available to the public indefinitely,
unless the publisher receives consent to do so from the concerned person.

38. The owner of the data must give his consent to the processing of data and there

must be a specific purpose. However, in this case, A and B did not give their consent, and

when Hiya! released the personal data, there was neither criminal charges filed against A

and B nor was there a legal basis allowing it.

Authorities to whom access to the retained data had been granted, had to notify the
persons affected, under the applicable national procedures, as soon as that notification
was no longer liable to jeopardize the investigations being undertaken by those
authorities.