In recent years there has been a new focus by media lawyers on the operation of the “statutory privacy” provisions of the Data Protection Act 1998 (“the DPA”). The Leveson Report and the resulting ICO publication “Data Protection and Journalism: a guide for the media” (“the ICO Guide”) has reminded us that the media must comply with the provisions of the act. Most importantly, the Court of Appeal’s “deletion” of section 13(2) (see our post here) has meant that general damages for distress are now available in DPA claims without proof of financial loss.
Over the seventeen years that the DPA has been in force it has not, generally, been thought to impose onerous obligations on the media. This is because they have relied the “journalism exemption” under section 32. However, the operation of this exemption is now coming under increasing scrutiny and there are powerful arguments that it is much more restricted in its scope than has previously been understood.
In a previous post I considered the “pre-publication“ provisions of section 32(4) and (5) and suggested that these should disapplied as being incompatible with EU law. In this post I will consider the operation of the “exemption” more generally. In the first post I will consider the law and in a second the possible practical implications.
The exemption: introduction
Section 32 of the DPA is headed “Journalism, Literature and Art”. It provides an exemption from most of the statutory provisions which apply to the processing of personal data if the data is being processed “only for the special purposes”, that is only for journalistic, artistic or literary purposes, and
“(a) the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,
(b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and
(c) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes (s.32(1))”.
This provision must be interpreted in the light of the Data Protection Directive (95/46/EC)(“the Directive”) which it seeks to transpose into domestic law. It is intended to give effect to Article 9 which is headed “Processing of personal data and freedom of expression” and provides as follows:
Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.
Concerns were expressed, by amongst others Lord Lester, at the time that the Data Protection Bill was being considered, that the provision which became section 32 did not properly import the test of “objective necessity” required by the Directive. The Government expressed the view that the mandatory requirements of section 32(1) were sufficient to impose a “necessity” test and the section must be construed in this light.
The section 32 exemption has four parts, four conditions which must be satisfied before the exemption is available:
(1) the data is processed only for journalism, art or literature,
(2) with a view to publication of some material,
(3) with a reasonable belief that publication is in the public interest, and
(4) with a reasonable belief that compliance is incompatible with journalism.
These will be considered in turn.
First condition: “only for the purposes of journalism”
In relation to the first condition it is a question of fact as to whether data is being processed only for one of these purposes. It is likely that a media organisation will be able to satisfy this requirement in any case where information is being collected, stored and edited for the purposes publishing articles. On the other hand, it may not be satisfied if the data is being used for purposes relating to advertising (see Sugar v BBC [2010] 1 WLR 2278 [55]).
“Journalism” is interpreted broadly. In the Satamedia case (Case C-73/07), the CJEU found that the reference to journalism in the Directive should be interpreted broadly and covered the disclosure to the public of information, opinions or ideas by any means.
Although there is some suggestion that “journalism” might be limited to news and current affairs however, as was pointed out by Lord Walker in the Sugar case, other media output would be covered by the wide terms “art or literature” and so would be within the exemption in any event ([2012] 1 WLR 439 [70]).
Second condition: “with a view to publication”
In relation to the second condition the data controller must show that the personal data was processed with a view to the publication of any journalistic, artistic and literary material. In other words, what has to be contemplated is not the publication of the data in question but the publication of some journalistic, artistic or literary material.
As the ICO says in its publication “Data Protection and Journalism: a guide for the media” (“the ICO Guide”):
“this means that the exemption can potentially cover any information collected, created or retained as part of a journalist’s day-today activities, both before and after publication. However, the exemption cannot apply to anything that is not an integral part of the newsgathering and editorial process. For example, information created in response to a complaint about a particular story after publication is unlikely to be processed with a view to publication” (p.30).
It is well established that the exemption applies both before and after publication (see Campbell v MGN [2003] QB 633).
Third condition: “reasonable belief in public interest”
In relation to the third condition the position is more complex: it has two “limbs”, public interest and reasonable belief.
On the first limb, the statute appears to provide two pieces of guidance as to the meaning of “public interest”. The first is more apparent than real. This is the reference in section 32(1)(b) to “the special importance of the public interest in freedom of expression”. These words cannot be read as “privileging” freedom of expression over the privacy rights of data subjects. It is plain and well established that neither Article 10 rights to freedom of expression nor Article 8 rights to privacy has, as such, precedence over the other (see Re S (a child) [2015] 1 AC 593 [17]). In other words, this provision must be read as a “reminder” that Article 10 rights must be put in the balance – but not as an instruction to give them special, much less predominant, weight.
Second, section 32(3) refers to any code of practice designated for the purposes of the section. The Secretary of State has “designated” a number of Codes – in particular, the Ofcom Broadcasting Code, the BBC Producers Guidelines and the PCC Code (although this, strictly speaking, no longer exists). Common to these codes is relatively strict view of public interest. For example, the Ofcom Broadcasting Code
“Examples of public interest would include revealing or detecting crime, protecting public health or safety, exposing misleading claims made by individuals or organisations or disclosing incompetence that affects the public” (p.42).
This strict view of “public interest” would be consistent with the approach to balancing privacy and expression rights in Strasbourg and under the tort of misuse of private information and is consistent with Article 9 of the Directive.
Further guidance is given in the ICO Guide (pp.32.-34) – although this falls into the error of treating “freedom of expression” itself as providing a public interest justification for publication. As already mentioned, this is illegitimate: neither freedom of expression nor privacy has “presumptive priority”.
In short, the provision contemplates “public interest” justification for processing of a similar type to that required to justify the publication of private or confidential information: a belief that the public will be interested in the story or that publication of stories of that type is necessary for the economic viability of the publisher will not be enough.
The second “limb” of this condition is the “reasonable belief” of the data controller that publication is in the public interest. The belief is not that of the journalist (or the editor) but of the person responsible for deciding the purposes for which an organisation’s data is processed.
This exemption can only apply insofar as it is “necessary” to reconcile privacy and freedom of expression. Contrary to the view expressed in the ICO Guide, section 32(1)(b) it cannot be taken to give “leeway” to the media (p.35). Such an approach would, again, wrongly, prioritise freedom of expression over privacy.
The test must be a strict one: the facts as they are reasonably believed to be at the time of processing must be such that a reasonable data controller would believe that publication would be in the public interest. Any lower hurdle would not meet the necessity test.
Anyone who seeks to rely on the journalism exemption must be in a position to show that specific consideration was given to the processing in question and to the public interest. “After the event” justification will not be enough as the mandatory conditions for the exemption will not have been satisfied at the time the data was processed.
Fourth Condition: “Compliance would be ‘incompatible’ with journalism”
In relation to the fourth condition the position is also complex. The data controller must reasonably believe that, in relation to each of the relevant provisions of the DPA, compliance with that provision is “incompatible with the special purposes”.
The ICO’s Guide suggests that this means that the data controller must reasonably believe that it is “impossible both to comply with a particular provision” and fulfil the journalistic purpose (p.37).
This is a high hurdle. The ICO correctly points out that when considering “incompatibility”, the data controller cannot rely on a blanket policy but must give specific consideration to the factual position in each case.
In some cases the incompatibility will be obvious: for example, allowing the subjects of ongoing public interest journalistic research to make subject access requests would make that kind of journalism impossible. It is, however, less clear that other provisions of the DPA should not apply in such cases: if the publication is in the public interest then it is likely that the condition in Schedule 2, para 6 can be satisfied – namely that the processing is necessary for the purposes of legitimate interests pursued by the data controller and the processing is not “unwarranted”.
In the case of other kinds of journalism it is difficult to see why compliance the provisions of the DPA makes journalism impossible. There seems to be no incompatibility between subject access requests and “entertainment” or sports journalism. Furthermore, the data of celebrities or sportspeople can be processed fairly and lawfully without making journalism “impossible”.
The ICO’s Guide suggests (p.37) that the incompatibility condition may be satisfied where compliance is not practical but this is not a qualification to be found in the DPA. In general, the DPA does qualify duties owed to data subject considerations of “practicality” and there is no reason why this requirement should be read into section 32(1)(c). The criterion – based on Article 9 of the Directive – must be “necessity” not practicality. In other words, is the exemption from the provisions of the DPA necessary to allow the journalist to fulfil the purposes of journalism? If it is not necessary then the provisions should be complied with.
Once again, anyone who seeks to rely on the journalism exemption must be in a position to show that specific consideration was given to question as to whether compliance was incompatible with journalism in relation to the processing in question. Again, “after the event” justification will not be enough.
Conclusion
In summary, the above analysis suggests that the journalism exemption is much narrower than has often been thought. The mandatory conditions of section 32 must be shown to have been fulfilled at the time at which the data was processed in relation to each item of data being processed. The burden is on the data controller to establish that the exemption applies. The default should be DPA compliance, not exemption. In Part 2 of this post I will consider the practical consequences of this analysis.
Hugh Tomlinson QC is a member of Matrix Chambers and an editor of Inforrm
Reblogged this on World4Justice : NOW! Lobby Forum..