Section 32 of the Data Protection Act 1998 (“the DPA”) contains a curious provision apparently designed to prevent “pre-publication” claims where unpublished journalistic, literary or artistic material is involved. There is no basis for this provision in the Data Protection Directive (“the Directive”) and it appears to be inconsistent with the EU Charter of Fundamental Rights and a clear candidate for disapplication.
The Statutory Provision
Section 32 is headed “journalism, literature and art”. It provides that, subject to certain conditions, processing of personal data undertaking with a view to publication for the purposes of “journalism, literature or art” is exempt of most of the operative provisions of the DPA.
This section is intended to give effect to Article 9 of the the Directive which provides that Member States shall provide for “exemptions and derogations” from a most of the Directive
“for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression“.
There are a number of issues as to whether the substantive provisions of section 32 properly give effect to Article 9. These are matters for a later post. At present I want to consider the provisions of sub-sections 32(4) and (5) as follows:
“(4) Where at any time (“the relevant time”) in any proceedings against a data controller under section 7(9), 10(4), 12(8) or 14 or by virtue of section 13 the data controller claims, or it appears to the court, that any personal data to which the proceedings relate are being processed—
(a) only for the special purposes, and
(b) with a view to the publication by any person of any journalistic, literary or artistic material which, at the time twenty-four hours immediately before the relevant time, had not previously been published by the data controller,
the court shall stay the proceedings until either of the conditions in subsection (5) is met.
(5) Those conditions are—
(a) that a determination of the Commissioner under section 45 with respect to the data in question takes effect, or
(b) in a case where the proceedings were stayed on the making of a claim, that the claim is withdrawn.
A “determination by Commissioner” (that is, the ICO) under section 45 is a “determination in writing” that any personal data
(a) are not being processed only for the special purposes, or
(b) are not being processed with a view to the publication by any person of any journalistic, literary or artistic material which has not previously been published by the data controller,
In other words, the effect of section 32(4) and (5) is that if it appears that someone is processing unpublished personal data for the purposes of journalism (or for “artistic or literary purposes”) with a view to publication the Court must stay any proceedings unless and until the ICO decides that the data is not being processed for the purposes of journalism etc with a view to publication.
The Problem with Section 32(4)
The ICO says of section 32(4) in the guide on Data protection and journalism [pdf], “In effect, this means that someone cannot use the DPA to prevent publication.” (p.52). Indeed it does, but it goes further. Its effect is that no claim can be brought against any kind of publisher (not just media organisations but also “citizen journalists”) in respect of the unlawful processing of any unpublished personal data which the publisher intends to publish in the future.
It is important to note that the “stay” does not depend on the other conditions in section 32 being fulfilled – as long the publisher is processing the personal data with a view to publication there is no need for the publisher to demonstrate reasonable belief that publication would be in the public interest (section 32(1)(b)) or that compliance with the provisions of the DPA would be incompatible with the special purposes (section 32(1)(c)).
This means that, for example, if a publisher is known to be processing unlawfully obtained personal data relating to an individual in circumstances in which there was no conceivable public interest in publication no DPA claim can be brought if the publisher asserts that it intends to publish the data at some future date. This is an extraordinary position which plainly does not involve a proper balancing of privacy and expression rights.
It is unsurprising that Lord Justice Leveson recommended that these provisions be repealed (Report, Part L, Chap 1, para 51). This recommendation has been ignored by the Government and the question arises as to whether repeal is, in fact, needed.
Compatibility with the Directive
Is section 32(4) compatible with the Directive? In other words, is this provision “necessary to reconcile the right to privacy with the rules governing freedom of expression”? It is very difficult to see how this is the case.
The Directive aims to protect the data protection and privacy rights of individuals. Those rights must, of course, be balanced against the right of freedom of expression. There is clearly an issue as to whether this result is properly achieved by section 32. As was pointed out in the Parliamentary debates on the Data Protection Bill (particuarly by Lord Lester, Hansard, HL, 24 Mar 1998), the test of “necessity” in Article 9 is ignored by section 32.
The arguments in relation to section 32(1) to (3) are complex, Those in relation to section 32(4) are not. This provision does not provide any balancing mechanism at all: it fixes the scales in favour of freedom of expression every time. However strong the privacy and data protection rights of the individual, however weak the freedom of expression rights, freedom of expression always wins. This breaks a fundamental and well established rule: that neither Article 8 nor Article 10 has “presumptive priority”. As Lord Wakeham noted during the debates on the Bill in 1998, section 32 “enshrines the pre-eminence of freedom of expression” (Hansard, HL, 2 Feb 1998). In fact, there is no such “pre-eminence” to enshrine.
What is to be done? There is a clear way to deal with this problem. Applying the reasoning used by the Court of Appeal in Vidal-Hall v Google ([2016] QB 1003) there is a strong argument that section 32(4) should be disapplied pursuant to article 47 of the Charter of Fundamental Rights of the European Union on the grounds that it conflicts with the rights guaranteed by the Charter, namely the right to respect for private and family life under Article 7 and the right to protection of personal data under Article 8.
The new focus, in recent years, on the privacy protections provided by the DPA highlights the anomalous position of the “section 32 exemption” in general and, in particular, the misconceived idea of the “pre-eminence” of Article 10, enshrined in section 32(4). An order for the disapplication of this anomalous provision will be a small step towards the rebalancing of the DPA.
Hugh Tomlinson QC is a specialist in media and information law and an editor of Inforrm
Reblogged this on World4Justice : NOW! Lobby Forum..