Turning a new page on data protection in 2015 – ICO confirms that the definition of ‘journalism’ should be interpreted broadly

The UK Information Commissioner’s Office (ICO) has been busy over the last month on data protection matters. This week, we heard news that the ICO has been carrying out some New Year reorganisation of its website, including an updating of its Guide to Data Protection. The Guide can now be found on a single page on the ICO’s website, which contains an index linked to the different sections in addition to a link to a PDF version of the full document. The ICO advises that these versions replace earlier versions of the Guide produced by the ICO.

The ICO has also issued an interesting decision about the special purposes exemption under section 32 of the Data Protection Act 1998 (DPA), which protects freedom of expression in journalism, art and literature. On a referral from the English High Court, the ICO found that a non-governmental, not-for-profit campaign group could rely on this exemption to withhold personal data in response to access requests from the subjects of the data in question (pursuant to the latter’s right of access to their personal data under section 7, DPA). These data subjects were four individuals associated with BSG Resources Ltd – an organisation that Global Witness is investigating in respect of allegations that it obtained rights to deposits from a large iron ore mine in Guinea, West Africa, by corrupt means. More information about the facts of the matter can be found here.

From a legal viewpoint, this decision is thought to be the first time that section 32 of the DPA has been extended to a non-media organisation. This is not, however, the first time that the scope of the journalism exemption under data protection rules has been considered. For example, in 2008 the Court of Justice of the EU (CJEU) looked at the equivalent journalistic exemption under Article 9 of the Data Protection Directive (95/46/EC) (see Satakunnan Markkinapörssi and Satamedia (Case C-73/07)). The CJEU concluded in its judgement that the definition of ‘journalism’ should be interpreted widely to encompass all activities whose object is the disclosure to the public of information, opinions or ideas (irrespective of who is carrying on such activities, the medium used to transmit the processed data or the nature of those activities). However, the CJEU added a caveat that such activity must not have the effect of encroaching unnecessarily on the protection of the fundamental right of privacy.

More recently, the ICO itself issued guidance for the media on data protection and journalism, with which its assessment in its current decision concurs in finding in Global Witness’ favour. For background, in November 2012, Lord Justice Leveson published the Leveson Report setting out the findings of his review into the regulation of the press within the UK following several high-profile press phone-hacking inquiries. Section 32 of the DPA is discussed in Part H of the Leveson Report, which includes suggestions for its amendment and also for the ICO to consult on and publish comprehensive good practice guidelines and advice for the press on data protection and journalism.

In January 2013, the ICO responded to the Leveson Report and subsequently published its guidance clarifying that anyone engaged in public interest reporting can rely on the journalism exemption under the DPA if four elements can be satisfied. These conditions are as follows:

• The personal data is being processed only for the purposes of journalism, art or literature;
• The processing of personal data is being undertaken with a view to publication of any journalistic, literary or artistic material;
• The data controller reasonably believes that publication is in the public interest and, in particular with regards to the importance to be placed upon freedom of expression, versus the impact upon the privacy rights of the affected data subjects under the facts of the case; and,
• The data controller reasonably believes that compliance is incompatible with journalism.

In its guidance, the ICO also provides useful advice for data controllers who want to ensure compliance with the DPA, in particular by meeting the ICO’s expectation that organisations should be able to justify why reliance upon the section 32 exemption is required on the merits of the case. These include suggestions to create good awareness of data protection internal handling and checking processes within an organisation, such as around clear policies and procedures, as well as audit trails demonstrating that an organisation has addressed particularly difficult issues appropriately – such as around the refusal of subject access requests – and records the reasons for its decisions. Other areas on which the ICO provides compliance tips to the media in its guidance include dispute-handling and confidential sources.

There are reports that the data subjects associated with BSG Resources Ltd intend to challenge the ICO’s decision, so it may be a case of watch this space for further news. Further guidance about exemptions and derogations under the DPA is likely to be welcome by data protection practitioners, who typically regard the interpretation of Part IV of the DPA (dealing with exemptions, including section 32) as particularly complicated.