Individuals often only learn the true value of their reputation when it is attacked; for businesses, reputation has never left the agenda. It shores up a customer base, is a prerequisite for growth, and feeds into the bottom line as goodwill. But many businesses, and individuals, are struggling to navigate the protean landscape of threats to reputation in the digital age.
The good news is that ways of coping with these new risks are constantly developing. The recent Supreme Court case of ZXC v Bloomberg, for instance, confirmed what practitioners had long-known – that reputations can be protected via a variety of means and heads of claim. This article explores some key trends in online reputational risk which we have encountered, sheds light on protections which every business should be aware of, and scopes out potential threats around the corner.
Data breach and cyber attack
All responsible businesses have processes in place to manage their data processing (data controllers of course must do so), and no in-house lawyer needs a lecture in UK GDPR compliance. However, breaches continue to occur, as do full-scale cyber attacks, often causing terrible harm to companies’ operations and reputations. Cases like British Airways, or more recently JD Sports, show how expensive it can be for a company to address a major breach, especially as more and more businesses process data as a core element of their business.
When crisis strikes, unprepared companies may find their potential liabilities are wider than they previously thought. Of course, on the regulatory front there is the ICO, and the fines it issues can be very substantial (a phishing cyber attack cost a construction company £4.4m in fines last year). But a successful data hack can also give rise to claims under the UK GDPR and Data Protection Act 2018, or even under contract. As Carter-Ruck partner Rebecca Toman explains: ‘If data processing is in any way material to your business, having a proper crisis action plan in place is crucial. We recommend clients think through not just their regulatory reporting obligations, but also have strategies in place to get on top of potential claims under contract or data protection law quickly – especially when data protection claims like those against Morrisons and British Airways cases can easily snowball into complex group litigation.’
Due diligence reports and databases
Due diligence platforms such as Refinitiv, WorldCompliance and Dow Jones, which assist with KYC processes by providing database reports generally based on public sources, in addition to the providers of bespoke ‘business intelligence’ and risk management services, have opened up further avenues of risk for businesses and individuals. The negative impact of an inaccurate or outdated due diligence report is a clear example of reputational damage hitting a business’ bottom line or an individual’s financial interests.
We are therefore unsurprisingly seeing a major uptick in clients asking for assistance when inaccurate information leaks into these platforms. Some clients are finding their commercial transactions are falling through, or banking facilities are declined, and we have even seen instances of both businesses and individuals being the subject of commercial sabotage – such is the power of a poor diligence profile. Carter-Ruck senior associate Dominic Garner has significant experience in helping clients unblock their commercial activity by correcting their online and due diligence profiles: ‘These due diligence reports are often acting like an unofficial sanction on clients’ commercial activity, but there is a legal framework for individuals to find out what information – and allegations – these due diligence organisations might hold about them, and we can help clients correct the record to ensure that their interests are not unfairly damaged.’
Online reputation: value and danger
It isn’t only platforms specifically aimed at evaluating reputations, like online KYC providers, which businesses and their owners need to worry about. Our firm has seen ever more need to correct false or misleading search engine records, and even to protect our clients’ very presence on social media platforms such as Instagram. As always, the huge potential of search engine functionality and social media connectivity to boost a business, indeed in some cases to become the key value-creator for that business, has corresponding risks for users when things go wrong.
More and more, we find we are no longer simply concerned to obtain a correction or apology from a traditional media outlet which has inaccurately reported about our clients: such successes will be hollow if search engine results continue to throw up outdated and uncorrected reports. The de-listing process, which is meant to give effect to the Right to Erasure under the UK GDPR, is not always easy, as the responses from search engine correction teams can vary hugely in quality. Carter-Ruck partner Claire Gill explains: ‘The search engine de-listing process is still finding its feet, but with perseverance we can often achieve a major positive result for our clients without serious costs.’ Developing case law, such as the recent CJEU judgment of TU and RE v Google, has continued to set helpful guidance for the assessment of requests to de-list search results. For instance, the instigation of defamation proceedings against a publisher will generally require a search engine operator to add a legal notice to a contested search result, and evidenced submissions to search engine operators can definitively be used to require results to be de-listed where a manifest inaccuracy has been demonstrated.
On a simple level, the more value one puts into online profiles, for example on social media, the greater the prize for hackers or others who would steal or misuse them. We have advised many business owners whose Instagram accounts have been hacked, putting their livelihoods at risk. Carter-Ruck partner Persephone Bridgman Baker says: ‘I’ve dealt with a spate of Instagram hacks, and it’s particularly troubling when a big part of a client’s livelihood derives from social media advertising and sales. We find that social media accounts are often hugely valuable for both corporate and individual clients, and keeping those accounts secure isn’t always easy – though thankfully we’ve been successful thus far.’ Clients with a valuable or well-known profile also bear the risk of impersonation, and as online, impersonal communications have come to dominate, we have helped clients through the complexity and stress of seeking to restore and secure their online identity.
Online customer review platforms (such as Yelp, or industry-specific sites) have also posed an ever-increasing risk to businesses whose customers explore the market online. We help clients try to solve the issue of false and damaging reviews without litigation, but in extreme cases, it may be necessary to consider some form of legal action. The case of Brett Wilson v Persons Unknown indicates that the court can show leniency to the evidential and procedural difficulties for claimants in these cases, where often the author or publisher is unknown and the review may be entirely fake.
Traditional media trends
We are seeing no let-up in clients’ needs for robust action to protect themselves from inaccurate and damaging coverage in more ‘traditional’ media, too. The rolling news cycle continues to put huge pressure on corporate and individual clients. Deadlines for responses are regularly as little as 24 hours, even where requests for comment are full of wide-ranging and serious allegations. Nor does the threat of a failed or wasted print run now hang so heavy over journalists: the non-stop, largely online news cycle now favours publication now, with correction or removal at the click of a button later.
Nigel Tait, managing partner and head of media law at Carter-Ruck, has been fielding urgent pre-publication enquiries alongside clients for over 30 years and can trace the influence of the online revolution on journalistic practices, finding for instance that damaging online customer reviews can even translate into mainstream news stories: ‘Even if there isn’t time to neutralise a false customer review immediately, it’s encouraging that our experience in this field means we can often contain the damage to our client within the review site, and stop it spilling into the press.’ And, on the upside for those defamed online, regulations that came into force alongside the 2013 Defamation Act mean that websites republishing harmful material can’t raise a defence of passive republication where the claimant has put them on notice of their complaint.
From local to worldwide
The final trend to be aware of is the sheer speed that crises can now play out through online media, and worldwide. Particularly interesting is the way allegations against senior executives or individuals within a business can race through the media and back to harm their organisation. This might be allegations of fraud or other ‘corporate’ wrongdoing, or serious concerns around discrimination or abuse. In either case, as in-house lawyers know, preparation and processes are key, but as crises break faster and faster, an agile, coordinated, and above-all swift, media response is also crucial. ‘It’s not about killing a worthy story – our corporate clients are too sensible for that, and we certainly cannot – and would not want to – interfere with properly-researched, responsible and accurate investigative journalism. It’s about making sure an accurate story is told, and one which doesn’t cause unnecessary damage to the client’, said Adam Tudor, partner at the firm. ‘In such cases we almost always need to work closely with PR and other client advisers to ensure a connected response across the board. We have to be seamless to be effective.’
What’s around the corner
Looking now to the horizon, many have been struck by the recent story of Professor Jonathan Turley, the US lawyer and academic falsely accused of sexual assault by the AI tool ChatGPT. In response to a request that ChatGPT give details of recent accusations of sexual assault against law professors, the programme returned details of a claim of sexual harassment against Professor Turley, and, in an extraordinary twist, cited an entirely fictitious article by the Washington Post in support. No such article was ever written. Sure enough, in another far-off (and common law) land, the first defamation suit against an AI chatbot has been threatened by an Australian mayor falsely accused by the programme of having been convicted of bribery.
These stories have concerned defamed individuals, but as is already clear, there is little to distinguish a company’s reputation from the reputation of its people. In any event, as AI chatbots enter mainstream use (which seems inevitable), these troubling flaws in the accuracy of information produced by them could have serious ramifications for companies which use them and act on their mistaken reports, or which become the subject of false allegations spread to third parties. It seems certain that regulation of some shape will be forthcoming; in the meantime (and beyond) all those with valuable reputations need to be vigilant to these risks. ‘As specialist media practitioners, we can’t help but be fascinated by the potential for developing the law in response to such novel issues: but at the end of the day our focus is on protecting our clients and remaining alive to the practical solutions as they develop, be they in traditional media law causes of action, or new regulation’, says Antonia Foster, partner at Carter-Ruck.
Scrutiny of media law practices – from political and regulatory spheres, and from litigation opponents – is intense at the moment, and it is not easy to predict what if any tangible outcome that scrutiny will produce. What is already clear is that legitimate legal complaints and protective measures are these days vulnerable not only (as always) on their merits, but on many other fronts. But specialists are alive to these developing risks – as Nigel says: ‘There is certainly more focus now on responsibility and best-practice – but we were doing that already. Thankfully, there haven’t yet been any changes to prevent us protecting clients’ interests robustly, as usual.’
If you, your business’ or client’s reputation is at risk, or you would like to discuss issues of privacy, data protection or harassment, the media team at Carter-Ruck are always happy to have an exploratory call and offer assistance if need be.