The Rich And Powerful Are Abusing ‘Privacy’ Laws To Silence Journalists And Authors

from the be-careful-what-you-wish-for dept

At a time when Russia and Russian oligarchs should be facing more scrutiny and careful work by investigative reporters, it is actually becoming that much more difficult to do so. And the main reason is that EU and UK “data protection” laws, passed in a flurry with promises of protecting your privacy from the greedy Silicon Valley Zuckerbergian overlords, is actually serving as a potent weapon in the hands of Russian oligarchs seeking to avoid scrutiny.

For many years now, we’ve been warning people to be careful what they wish for regarding so-called “privacy” laws. In fact, some of us specifically warned the EU not to kill free speech in the name of privacy with its GDPR. And the US is still exploring various privacy laws, with California leading the way with a rushed and messy CCPA law that is similar to the GDPR that was passed a few years ago, under the threat by a millionaire that if they didn’t pass that terrible law, he’d use the California referendum process to pass something even worse. Now, years after the CCPA became law, the state is finally trying to figure out what it actually means.

And California and others should look very closely at what is happening in the UK and how Russian oligarchs are massively abusing the UK’s data privacy law to silence journalists. (Just as a point of clarification in case people ask: post Brexit, the UK is no longer under the GDPR, but rather the UK Data Protection Act, which was passed to get the country into compliance with the GDPR — so it is effectively the same, just under the jurisdiction of the UK only, and not the wider EU. Also, some of the cases talked about below were brought prior to Brexit taking effect, meaning that they were using the GDPR.)

I first heard about one example of this a few weeks back, when Scott Stedman of Forensic News talked about how he was being sued in the UK for his reporting on a British-Israeli “security consultant” who has allegedly done work with a Russian oligarch, and was called to testify before the Senate Intelligence Committee. Despite being a US corporation, the lawsuit was filed in the UK, and had both libel and data privacy claims. The UK is well known for its ridiculous libel laws, that have opened it up to what’s known as libel tourism. While the country did tighten up those laws a bit nearly a decade ago, the UK is still a problem spot for libel cases that attack free speech.

But this case had an even more pernicious part: the GDPR claim. And while a lower court initially tossed that part, in December, an appeals court brought it back. The crux of the claim is that because the plaintiff in the case claims that Forensic News reported false information about him (which is the libel claim), it also means that the company is a “data processor” under the GDPR, and that requires some level of accuracy in the data it collects and processes. And so the judge effectively argues that basic acts of journalism — collecting data on a subject of interest and reporting on them — makes you subject to the GDPR.

Someone who uses the internet to collect information about the behaviour in the EU of an individual who is in the EU, and then assembles, analyses and orders that information for the purposes of writing and publishing an article about that behaviour in (among other places) the EU is thereby engaging in “… the monitoring of [the data subject’s] behaviour … within the Union” within Article 3(2)(b). The publication of personal data clearly is a form of “processing”. The preparatory activities are plainly integral to that processing. It follows that the GDPR applies in such a case on the footing that publication amounts to a “processing of personal data of [the data subject]” which is “related to” the monitoring.

For what are hopefully obvious reasons, this has every appearance of a SLAPP suit designed to intimidate reporters. While Stedman and Forensic News are making efforts to fight back in US courts, it seems like the SPEECH Act should hopefully protect them. That’s the important US law that says that foreign judgments that would not be legal in the US under the 1st Amendment cannot be enforced here. Though if California can somehow get approval for its local version of the GDPR… well… who knows what will happen.

But, at least in that case, it’s an American journalist who hopefully can use the powers of the 1st Amendment to protect himself. That’s not necessarily the case for reporters in the UK. Earlier this year it seemed that UK politicians finally woke up to the fact that Russian oligarchs were widely abusing data protection laws to stifle reporting on their activities and connections.

And more recently, Oliver Bullough wrote a thorough piece for the Economist looking at how Russian oligarchs are abusing data privacy laws to stifle reporting, noting that he is now “terrified” of the law that, in theory, is supposed to be protecting his privacy.

If you’re someone who digs into the sources of oligarchs’ money – as I am – a data-protection claim can hit you even if you don’t publish a word. It doesn’t matter where you are in the world. It doesn’t matter if the person you’re investigating has a reputation too sullied to tarnish. It doesn’t matter if your research is scrupulously careful and in good faith. You’re still vulnerable.

The idea of being sued for libel by a rich Russian scares me, but at least the battle lines would be clear – and if I had truth and the public interest on my side I’d be in with a fighting chance. By contrast, the prospect of being tied up for years in the Kafkaesque intricacies of a data-protection case seriously makes me consider quitting journalism.

But it appears to be happening to lots of people, in part because the drafters of privacy laws never ever seem to consider how those laws might be used to stifle speech.

When the rules were first published, we assumed that “data” would mean the algorithmic index of our habits, interests and families stored by the likes of Facebook. The actual law, however, described data far more broadly, as “any information relating to an identified or identifiable living individual”. That definition can – and, indeed, does – apply to almost anything. The rules governing what should happen to this information were also wide-ranging. That was because gdpr wasn’t just a response to concerns about Facebook, it also codified long-standing principles that data other people hold about you should be transparent, secure, lawfully collected and – crucially for oligarchs – accurate.

The abuse of the GDPR and equivalents can take many forms, but merely starting with a “data subject access request,” can be a hassle. And from there it only gets worse.

Merely complying with the law is exorbitant. If an angry oligarch sends you a Data Subject Access Request it can take weeks, even months, to go through every email or text message you have that might contain information relating to that person (big tech companies – the ones the law was intended to inconvenience – have automated this process).

Defending yourself in court is potentially bankrupting. Thanks to the adversarial nature of Britain’s legal system, proceedings cost far more in Britain than in most European countries. One Dutch media lawyer told me that if she loses a case, her client might have to pay €1,500 ($1,600) to meet the other side’s costs; a British lawyer said this figure could easily hit £100,000 ($125,000) before hearings even begin.

The impact can be catastrophic for free speech and reporting, especially at a time where I think most of us recognize that investigative reporting on the activities and sources of wealth of Russian billionaires is kind of important:

An early victim of this new use of data-protection laws was Catherine Belton, a British journalist who published a book on Russia’s kleptocratic class, “Putin’s People”, in 2020. The book alleged that two Russian businessmen, Pyotr Aven and Mikhail Fridman, had links to the kgb during the 1980s. They said this was inaccurate and thus breached their rights under gdpr. They brought their claim against Belton and her publisher, HarperCollins, at around the same time that Roman Abramovich and Rosneft, an oil company, also accused Belton of defaming them. Collectively the suits could have cost Belton and HarperCollins about £10m in legal fees. Instead, they settled the cases and agreed to make some changes to the book.

There are many more examples in the article and it’s pretty damn terrifying for anyone who believes in reporting and the value of free speech. In a recent interview on NPR, Bullough admits that even as the focus of his reporting is on the activity of Russian oligarchs, there are some that he just doesn’t even bother with because he doesn’t think he can handle the legal intimidation that would come with it.

You know, when Roman Abramovich, the oligarch who owns – still owns, I think, time of I’m talking, Chelsea Football Club, one of the wealthiest and most high-profile Russian oligarchs – when he was sanctioned by the British government, a number of editors got in touch with me and asked me to write about him. And I had to admit that I’d never done any research into him at all just because it had never occurred to me I’d ever be able to get anything published. Yeah. I’m a freelance journalist. I’m not going to just do, you know, research into someone for an article which I can never, you know, make any money out of, obviously. And that is a problem that affects sort of every calculation we make. If you can’t get an article published, then you’re never going to start the process of researching it, which means that there have been people with reputations for being extremely litigious who have been able to avoid any kind of scrutiny from journalists.

That, right there, is the very definition of “chilling effects” that are common to SLAPP suits, but in this case many of those chilling effects are not coming from old defamation laws, but rather the new fangled “privacy” and “data protection” laws that many people, including open internet and free speech supporters cheered on.

If we’re going to keep passing new privacy laws — and there are good reasons to do so — can we at least, maybe, possibly, take the time to carefully look at how these laws interact with speech and reporting? Because, otherwise, all we’re doing is handing yet another massive weapon to the rich and the powerful to punish anyone trying to provide some transparency and hold them to account.

Filed Under: , , , , , , , , , , , , ,
Companies: forensic news

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “The Rich And Powerful Are Abusing ‘Privacy’ Laws To Silence Journalists And Authors”

Subscribe: RSS Leave a comment
Anonymous Coward says:

British libel laws have always been used by the rich to protect them by journalists who wish to report on tax evasion , russian oligarchs buying property’s or certain illegal acts , even if the journalist is doing nothing but investigating someone they can by tied up in expensive legal action the uk law should have exceptions for journalism who are simply reporting on a person or company

Jasonn says:

who's got the stick

all libel/slander/defamation laws are an unjust government restriction on Free Speech
EU politicians are more authoritarian in this area than US politicians, but they are all bad from a Free Speech perspective
All people deserve strong Free Speech rights; journalists are frequent targets of abuse, but they are not some special privileged class of citizens with extra free speech rights — basic Free Speech rights are satisfactory for all

as usual, the basic problem is government politicians and the unjust powers we tolerate them exercising over us.
the private Rich and Powerful people have no such police power over us.

This comment has been deemed insightful by the community.
Anathema Device (profile) says:


“all libel/slander/defamation laws are an unjust government restriction on Free Speech”

Okay. So if I put up a blog post or a review or an entire website claiming you defrauded your parents, raped your children, and murdered your missing ex-wife, you should have no redress?

Because it’s the law that allows you to sue me for destroying your reputation and/or your livelihood.

It’s not the basic premise that defamation is a legal wrong which is the problem. It’s who gets to use it (ie who can afford it), what is the redress available (ie that rich people are suing people without means and ruining them financially, often for many years) and who is it being used against (proper accredited responsible journalists, not people monetizing hate on youtube).

Defamation law desperately needs reform, not least of all here in Australia where a number of prominent politicians and public figures funded by wealthy media owners have sued to stop publicly important information from being released (not always with success, but enough to make sure a lot of good voices have been suppressed). Simply removing all legal controls is not the answer (do you really want someone like Alex Jones to be able to do what he’s done to the Sandy Hook parents without them being able to do a single thing about it?)

Robust freedom of speech laws help, as does protection of actual journalists. But protection of the weak who are attacked by malicious and wealthy companies and individuals is also needed.

I don’t know how you thread that needle. All I know is that the current system is broken 🙁

discussitlive (profile) says:

Side note

I was discussing FlightAware (FA), for those not up on that it tracks the ADS-B beacon of aircraft and plots their position on a map. Almost all aircraft of larger than a personal puddle hopper have this. FA allows people to “opt out” of their public tracking. The tracking is done by volunteers setting up small systems, usually SOCs such as Raspberry Pi’s, and a Software Defined Radio (SDR). Total cost (before the chip shortage) was about $100.

Some law enforcement have opted out, and quite a few of the 1% have as well. However, the beacons are still there (for all but LEO OPSEC) and a simple program called Dump1090 (it transmits on 1090Mhz) will give you the GPS coordinates. A small bit of API magic, an on line map with an API, and bob’s your uncle.

discussitlive (profile) says:

Re: Re: ADSBExchange

Thus the discussion I was having that I wrote about. One advantage to FA is that running one does give you an account with privileges you’d otherwise need to purchase. A friend put an FBO lady with me, we’re trashing out things that are possible vs. desirable vs. cost. I happen to have quite a few pi’s on the shelf from before the chip shortage hit. Scalping them just sticks in my craw, so a good home for what I have in ’em sits better with me.

glenn says:

Those who think people have a right to privacy even as they’re out in public and on the properties of others doing all manner of good/evil (well, not so much good) clearly must be most interested in keeping their [evil] deeds hidden. Of course, lawmakers have a vested interest in keeping their sources of “revenue” flowing to their open pockets.

That Anonymous Coward (profile) says:

This is one where even 'won't someone think of the children' has no power.

Lets look at the sheer number of rich/powerful people in the UK who have been diddling kids for DECADES, but no one dare ever mention it for fear of a lawsuit, while children are still being diddled.

Lets look at Oz where reporting the name of a convicted pedophile church asshole, who diddled for decades, was made into a crime until some other cases could be settled. As if knowing that he’d been convicted of diddling children & covering it up, would somehow mean that the public would have no ability to consider the case on its merits. Meanwhile they print the name of those who have done the few mass shootings they’ve had.

Pretty sure that no ones done shit to close the loophole that allowed Epstein to get a sweetheart deal & avoid any punishment for diddling kids from a government attorney.

One of the princess’s of the Walmart fortune is a notorious drunk driver, shes still driving around & drinking, magically there is next to no coverage or reports on these events.

DeathSantis’s antics lead to people dying on his watch who didn’t need to die, yet anyone seeing much critical coverage in FL or any records, that the law requires be kept & available, getting into the hands of media who might not engage in fellation of his ego.

This is happening everywhere & yet despite the crimes and horrors eventually revealed there is no will to change the laws that allow them to hide their bad actions, this should change.

That Anonymous Coward (profile) says:

Re: slower so you can keep up...

“the plaintiff in the case claims that Forensic News reported false information about him”

The case has not been decided, its a claim.
I point you at the number of people Trump claimed he would sue for liable and never did.

“the judge effectively argues that basic acts of journalism — collecting data on a subject of interest and reporting on them — makes you subject to the GDPR.”

So attempting to gather ANY information about someone you might report upon opens you up to all sorts of extraneous bullshit making it impossible to be a reporter.

As a reporter wrote…

If you’re someone who digs into the sources of oligarchs’ money – as I am – a data-protection claim can hit you even if you don’t publish a word. It doesn’t matter where you are in the world. It doesn’t matter if the person you’re investigating has a reputation too sullied to tarnish. It doesn’t matter if your research is scrupulously careful and in good faith. You’re still vulnerable.

The idea of being sued for libel by a rich Russian scares me, but at least the battle lines would be clear – and if I had truth and the public interest on my side I’d be in with a fighting chance. By contrast, the prospect of being tied up for years in the Kafkaesque intricacies of a data-protection case seriously makes me consider quitting journalism.'

This isn’t they made stuff up and they should be punished.
This is the rich guy, who will keep them in court just short of forever without making a dent in his pocket change, launched a libel suit & then made a complain that they weren’t follow GDPR which unleashes a bureaucracy that demands record keeping and filings and oh hey you should name your sources in these records that can be demanded.

Anonymous Coward says:


Based on the text above, Belton was sued because her book was inaccurate? And the GDPR case ensured that she fixed those inaccuracies?

No, Belton was sued because the subjects of the book claimed it was inaccurate. The publisher chose to settle and change the book rather than incur the cost of litigation.

IndoorHygenics (profile) says:

Water Filtration Systems

“Here at INDOOR HYGENICS, we are proud to focus on offering our customers only the best in Water and Air Purification solutions. If you suffer from asthma, allergies COPD or any other breathing-related concern check out our whole-home air purifier. The RPS (Respiratory Protection System) whole-home central photocatalyst UV system will improve your IAQ (Indoor Air Quality). Combined with the RPS (Respiratory Protection System) whole-home central HEPA system you will breathe easier and live better and longer.

Here at Indoor Hygenics, we believe this to be the VERY BEST 1-2 PUNCH for most IQA (Indoor Air Quality) concerns. The RPS whole-home air purifier utilizes UV (Ultra Violet) & PCO (Photocatalytic Oxidation) these powerful technologies help destroy Viruses, Bacteria, Chemical Pollutants, and Material Pollutants.

This also includes germs, mold spores, tobacco smoke, pet odors, and cooking smells. The RPS Whole-home air purifiers also employ Pre filtration, Charcoal/Carbon filtration as well as Hepa Filtration to keep your air as dust-free as possible. Here at Indoor Hygenics, we like to say. The RPS UV “kills” everything while The RPS HEPA removes all the “dead bodies” bacteria.”

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »