Privacy and Misuse of Private Information: UK Press Law | UK JournoHub

Last reviewed: 17 May 2026Next review due: 17 November 2026

What is misuse of private information?

Misuse of private information is a civil tort recognised by English and Welsh courts since Campbell v MGN Ltd [2004] UKHL 22. It developed from the equitable action for breach of confidence and now incorporates the framework of the European Convention on Human Rights. Article 8 ECHR protects the right to private and family life; Article 10 ECHR protects freedom of expression. UK courts are required by the Human Rights Act 1998 to balance these rights when determining whether publication of private information was lawful.

The tort of misuse of private information is distinct from defamation: it does not matter whether the information is true or false. What matters is whether the subject had a reasonable expectation of privacy in the information, and whether publishing it was justified by a competing interest — typically the public interest in free expression and press freedom. The claimant does not need to show that any statements were false; they need to show that private information was used without justification.

Key cases every journalist should know

Campbell v MGN Ltd [2004] UKHL 22

Naomi Campbell succeeded in a claim against the Mirror for publishing photos of her leaving a Narcotics Anonymous meeting. She had put her drug-free status into the public domain; the detail of her treatment was private. Established the two-stage test.

Mosley v News Group Newspapers [2008] EWHC 1777

Max Mosley won damages against the News of the World for publishing video of his private sexual activities. No prior notification requirement was established, but the judgment underlined the weight of Article 8 in sexual conduct cases.

Bloomberg LP v ZXC [2022] UKSC 5

The Supreme Court confirmed that individuals under criminal investigation before charge have a reasonable expectation of privacy in that fact. A letter from a foreign law enforcement authority to Bloomberg was private information; publishing it was misuse.

Murray v Express Newspapers plc [2008] EWCA Civ 446

J.K. Rowling's young son, photographed by paparazzi in a public street, was found to have a reasonable expectation of privacy. Children of public figures have stronger privacy rights than their parents.

HRH The Duke and Duchess of Sussex v Associated Newspapers [2021]

The Mail on Sunday was found liable for misuse of private information and breach of data protection rights for publishing Meghan Markle's private letter to her father. Established the weight of epistolary (letter) privacy.

When this matters for journalists

1Publishing photos taken of a celebrity at what appeared to be a public event that was in fact a private occasion.
2Reporting on the medical condition of a public figure who has not put their health into the public domain.
3Publishing details of a person's sexual orientation, relationship, or sexual conduct without their consent.
4Running a story about a person under criminal investigation before they have been charged — Bloomberg v ZXC.
5Using information passed to you by a source who obtained it in breach of their own confidentiality obligations.
6Doorstepping someone at their home address — location of home is generally private.
7Publishing the home address of a public figure in a way that could enable harassment.
8Reporting on the children of public figures who have not themselves entered public life.

Red flags before publication

The information is about someone's health, sexuality, home life, or finances and they have not made it public.
Your information came from a source who had access to it in a professional or confidential capacity.
The subject is under police investigation but has not been charged or arrested.
You are publishing details that identify the home address or regular movements of any individual.
The story concerns the private life of a child, even a child of a public figure.
You used covert methods to obtain the information — filming, recording, or surveillance of private spaces.
The information concerns someone's sexual life that has not been voluntarily put into the public domain.
A source tells you this information was obtained from hacked emails, devices, or systems.

Pre-publication privacy checklist

I have identified whether the subject has a reasonable expectation of privacy in the information I plan to publish.
If there is a reasonable expectation of privacy, I have identified a public interest justification for overriding it.
I have documented the public interest reasoning in the editorial file before publication.
I have considered whether the story is about the subject's public function or role, or their genuinely private life.
Where the subject is under investigation but uncharged, I have taken advice on Bloomberg v ZXC risk.
I have checked whether any information came from a source who had a confidentiality obligation.
I am not publishing home addresses, precise location data, or information enabling surveillance of an individual.
I have applied the DPA 2018 s.174 journalism exemption where I am processing personal data, and documented the basis.

Tools for privacy and public interest

Use our public interest test builder to document your justification for publishing private information, and the right-of-reply generator to record your approach to the subject.

Public Interest Test Builder Right of Reply Generator

Common mistakes

Assuming that because information is publicly available somewhere online, it can be freely published — context matters.
Treating everything a public figure does as fair game — their children, their medical care, their private relationships are not automatically public.
Publishing the location or address of any individual without considering the safety and privacy implications.
Using information from a source who obtained it by hacking, blagging, or breach of confidence — you may inherit liability.
Failing to document the public interest justification before publication — "we thought it was important" is not enough post-litigation.
Assuming that a denial from the subject removes the privacy interest — it does not.
Conflating the public interest test for defamation (s.4 Defamation Act 2013) with the balancing exercise for privacy — they are different.
Not applying the DPA 2018 journalism exemption properly when processing personal data for a story.

Related guides

Defamation Risk Checklist

The serious harm test and defamation defences for UK journalists.

Sexual Offence Anonymity

Pre-charge privacy, Bloomberg v ZXC, and complainant anonymity.

UK GDPR for Journalists

The DPA 2018 journalism exemption and lawful processing.

UK Media Law Hub

Master hub for all areas of UK media law.

Primary sources

Frequently asked questions

What is the two-stage test for misuse of private information?

Courts apply a two-stage test. Stage 1: does the claimant have a reasonable expectation of privacy in the information? Stage 2: if yes, does the public interest in publication outweigh that expectation? Both stages matter. A public figure cannot have a reasonable expectation of privacy in their voting record; but even a notorious criminal may retain a reasonable expectation of privacy regarding their medical condition. The test is applied to the specific information, in the specific context.

Does a person in public life have reduced privacy rights?

Public figures accept reduced privacy expectations in relation to the exercise of their public functions. A politician's voting record, a chief executive's business decisions, and a public authority's exercise of power are all matters where privacy expectations are low. But even public figures retain privacy rights in domains they have not opened to public scrutiny — their children, their medical conditions, their private relationships (unless they have made these public). The more a public figure has cultivated a specific public image, the more they may be held to have reduced privacy expectations in information that contradicts it.

Is secret recording always unlawful?

Not automatically. Recording a conversation without telling the other party is not automatically unlawful under UK law — there is no general prohibition equivalent to US wiretapping statutes. However, covert recording raises significant risks under the Investigatory Powers Act 2016 (if a telecommunications system is involved), misuse of private information law, data protection law, and IPSO/NUJ codes. Covert recording of private conversations, especially those in private premises, carries a higher risk of liability than recording in public places. Always take advice before using covert recording methods.

What is the DPA 2018 journalism exemption?

Section 174 of the Data Protection Act 2018 provides a journalism exemption that allows journalists to process personal data without complying with certain UK GDPR principles and rights, where: (a) the processing is for journalistic, artistic, literary, or academic purposes; (b) it is in the public interest; and (c) compliance with the GDPR provision would be incompatible with those purposes. It is not a blanket exemption — it must be applied to specific data, specific purposes, and specific GDPR obligations. The ICO's Data Protection and Journalism Code is the key guidance.

Can I publish information about a suspect before they are charged?

Bloomberg v ZXC [2022] UKSC 5 established that individuals under criminal investigation have a reasonable expectation of privacy in the fact of that investigation, especially before charge. The Supreme Court held that Article 10 freedom of expression did not automatically override Article 8 privacy in such cases — a balancing exercise is required. Publication of the fact of a pre-charge investigation can found a claim for misuse of private information. This is separate from the s.1992 Act anonymity for sexual offence complainants.