British papers sued over outing identity of teen suspect in TalkTalk hack

Some British papers have screwed up, it seems. In reporting on the arrest of a 15-year-old from Antrim County, Northern Ireland, some media outlets went too far. As one result, the teenager has been named and his photo disseminated online. As another result of the publicity, the teen had to move. Now lawyers for the teenager are suing.

I’ve been covering the TalkTalk hack over on DataBreaches.net, but the relevant details are that the youth was arrested, and media outlets showed somewhat altered pictures of  a head shot. But the alterations were nowheres near sufficient, it seems, and he was recognized after his location was provided in media reports. Then, too, it didn’t help his privacy that one newspaper showed a picture of him sitting next to his mother in their home. While his face was altered, hers was not, so how hard would it be for anyone to figure out who he was? Why the mother ever consented to an interview or picture (assuming, for now, that she did consent) is puzzling, but is it a legal defense to privacy invasion if the the mother did not take reasonable steps to protect her child’s privacy? I would love to hear from some UK privacy scholars or media lawyers on this point.

But worse, one paper – The Telegraph – actually reported his name. I expressed shock about that on Twitter at the time, and wasn’t surprised that within a few hours, that story was silently deleted. But by then, the word had spread on Twitter, where he was also named and his picture posted. And because The Telegraph’s url for the story embedded the youth’s name, a search for the now deleted url returns results showing what news aggregation sites or other sites had linked to it.  His name now also appears on ArrestTracker, an Australian site that tracks arrests in hacking-related incidents.

Three newspapers have been named in a lawsuit filed by the youth’s lawyers. The Belfast Telegraph, which is not one of those sued, reports that The Daily Telegraph, The Daily Mail and The Sun have been named as defendants. It’s not clear to me why The Mirror wasn’t also named as a defendant, as they, too, had published a somewhat blurred photo of the teen.

The lawsuit reportedly makes claims of negligence, misuse of private information, defamation, breach of confidence and data protection.

The lawyers are also attempting to get material posted online deleted, and to that end, sought injunctions against Google and Twitter, requiring them to remove references to his name, location, images of him, etc.  Those injunctions were granted, but as of this morning, I still find results in both Google and Twitter when I search on his name or other details. (UPDATE:  according to correspondence Twitter Legal sent to one individual, Twitter is withholding tweets that contain the youth’s name in the UK. They do not seem to be withholding them in the US).

According to the Belfast Telegraph:

The three newspapers defending the action, The Daily Telegraph, The Daily Mail and The Sun, all gave undertakings aimed to protecting his identity pending the outcome of the case.

Injunctions and undertakings may work in the U.K. or where businesses are under U.K. laws, but what’s going to happen to non-U.K. sites like this one (if I had chosen to publish his name or pic, which I had chosen not to do) or to non-commercial Australian sites and blogs that may have named him? I suppose the UK media could send DMCA takedown notices where their copyrighted images were reproduced, but how do you pull back someone’s name once it’s been revealed?

From my coverage of the case, it appeared to me that at the time The Telegraph ran their “EXCLUSIVE” revealing his name, no other UK media site was reporting it. So perhaps the court will find that much of the liability lies with them and less with other defendants that just followed suit once the teen had been outed. But we’ll have to wait to see.