Can you publicly name and shame online someone who has been convicted of a crime?

[mumof2andstillsurviving]

We are a group of women who have survived the criminal justice system and have successfully seen the man who abused us as children convicted. We are trying to reach more of his victims. We are in the process of setting up a website. Can we include his police mugshot and his details? Are you legally allowed to name and shake someone publicly for this purpose. He has a very common name and therefore his photo needs to be out there too.

I would be very cautious about going down this road. You cannot use his police mugshot unless you have specific consent from the police as they own the copyright. If any of the information you post is inaccurate he may be able to sue you for libel or you may get a fine under GDPR. You could also be in trouble if you inadvertently reveal personal information about someone else or keep the information public after his convictions are spent.

I would take the view that it is up to the police to find victims, not you. They may well publish information themselves for this purpose.

They have published a press release. And a local paper have written something. Presumably I could put the links up to these? The website is predominantly going to be to support others going through the process; things we found useful, things we wish we had known

Not specifically victims of his, and not detailing anything to do with the crimes themselves

What do you want to achieve, he has been convicted.

There will be many more survivors out there. We hope that they can also get justice for them. He is a very dangerous man, still a danger to children (was still grooming ) but could be out in 8 years. We hope that if others come forward he will stay where he is

You as a private individual is not required to comply with GDPR.

Also if this information is publicly available and is true you can’t defame him.

If he is not currently subject to a court case then it’s not subjudice.

Bert is correct. All you are doing is publishing publicly available information. Forces themselves so,times publish photographs of either suspects or convicts

Reproducing and or linking to press articles would be the way forward.

You as a private individual is not required to comply with GDPR

Bert is wrong. Private individuals ARE required to comply with GDPR. The exemption only applies for personal or household activities. What the OP is proposing does not fall under the exemption.

You can use the police press release. Use the exact wording on the release. Do not use conjecture or accuse the person of any crime they have not been convicted of.

A police press release is covered by qualified privilege which gives you a defence for any defamation claim (you’d also have the defence of justification because what you’ve said is true)

A police press release is covered by qualified privilege

Not always, as Bedfordshire police discovered when they were sued for libel over a press release and had to pay a six figure sum in damages. And qualified privilege does not necessarily extend to republication. So even if the police are protected, the OP may not be protected if she republishes the police press release.

Note that police forces that publish information about convictions are required to remove the details from their website after one month and are only allowed to publish photos of the offender if there is a specific reason to do so. Under GDPR and human rights laws they must:

• take into account the impact of publishing on the offender's family

• consider whether publishing the information is proportionate

• consider whether publishing could have an "unjustifiably adverse effect" on the offender

Whilst the Human Rights Act does not apply to private individuals, GDPR very definitely does despite the assertion by Berthatydfil up thread. There is an exemption for personal or household activities. Publishing information on a website does not fall under this exemption.

I remain of the view that the safest course for the OP would be to leave it to the police to find any further victims.

I'm with prh, I'd leave this to the police. If you really can't do that, get proper legal advice before you publish anything at all.

That’s interesting prh. I hadn’t heard of the case you mention but I assume that because they were sued for libel, there was a negligent mistake in the press release itself? This does not negate the qualified privilege that media outlets have who used the press release in good faith which is why I presume none of them were sued? Obviously the claimant would have a right to reply as part of that qualified privilege, and any upstanding media outlet would remove the story anyway, if it was shown to be inaccurate.

While the police force may be subject to the confines of GDPR and the HRA, in this case journalists are not (provided the info is used for journalstic purposes) and can leave stories about court cases online for much longer than eight months (putting the ‘right to be forgotten’ aside for a moment)

If the info is in the public domain already then would the republication by the defendant be seen as a GDPR or HRA breach? (These are genuine questions, by the way. GDPR is not really my bag!)

The information the OP wishes to publish is clearly personal data. Publishing on a website is processing it in GDPR terms. To process personal data about criminal convictions you must have a lawful basis for the processing and either legal authority or official authority. It is not clear that the OP has a lawful basis, nor is it clear that she has official authority (which doesn't mean some official body giving permission - it means that she has authority under the provisions of the Data Protection Act 2018).

The police and official bodies are protected when publishing conviction information as there is an exemption for such bodies when there is a substantial public interest. There is also an exemption for journalism but it is not clear if that would cover what the OP is proposing to do. The courts may feel that it does not fall under the journalism exemption or, if it does, that the substantial public interest is time limited. The courts may see a difference between an article that remains on a news website forever but can only be found by those searching for it and a website that is devoted to a particular case. There is no case law that I am aware of in this area so I would be cautious and err on the side of safety.

So the short answer to your question is that republishing conviction information that is in the public domain may be a breach of GDPR unless the data subject (i.e. the offender) is the one who put the information in the public domain. It is not a breach of the HRA as that only applies to official bodies.

Thank prh. Yes I agree, it’s untested really so probably better to be cautious.

If it was as part of a personal blog? Would have be covered?

GDPR still applies. A personal blog is not what is meant by personal or household activities.