ICO consultation on data protection guidance for the media

The Information Commissioner’s Office (ICO) has begun a public consultation on draft guidance on data protection and the media, developed in response to a recommendation by Lord Justice Leveson.

We draw attention to a number of points in the Draft Guidance:

• It points out that Data Protection does apply to the media, although the exemption in section 32 of the Data Protection Act 1998 (“the DPA”) for journalism, art and literature is one of the broadest, in the Act is not absolute but is intended to strike a fair balance between privacy and expression.
• This exemption allows journalists to mount a public interest defence to most apparent breaches of the DPA but it will be easier to rely on the exemption robust policies and procedures are in place.
• The exemption extends to “citizen bloggers”.
• As long as the aim is to publish a story (or for someone else to publish it), all the background information collected, used or created as part of investigation can also be exempt,
• To rely on the exemption the data controller must have a reasonable belief that the publication would be in the public interest.  The guidance suggests that the ICO is  – likely to accept there was a reasonable belief that publication was in the public interest if:

  •  there was editorial involvement from an early stage;

  •  there was a public interest check; and
  • there is compliance with industry codes.
  • suitable procedures and audit trails must be in place.
• In relation to the obtaining of information it is said that
  • In general, people should know if information is being collected about them.
  • Covert methods should only be used if there is no other way to get the story, and you are confident that this is justified in the public interest.
  • Information about someone’s health, sex life or criminal behaviour should only be collected if the journalist is very confident the public interest overrides their right to privacy.
• The Section 32 exemption applies to subject access requests (under section 7 of the DPA).  However, the media should
  • Ensure that a process is in place for subject access requests.
  • The media should always consider whether the information (or some of it) could be provided without undermining public interest journalism.
  • If there is a decision not to comply with a request, the reasons should be recorded.
  • Information about the identity of  sources can be redacted as long as it is reasonable to do so.

The final version of the guidance will help those working in the media to understand and comply with data protection law and good practice. The deadline for responses to the consultation on the draft guidance is 22 April 2014 and further details can be found on the consultations section of the ICO website.

Announcing the start of the consultation the Information Commissioner, Christopher Graham said:

“After speaking with journalists from a broad range of media outlets we are now inviting people from all areas of society to read our draft guidance on how the Data Protection Act applies to the media and provide us with their views.

“The guidance follows Lord Justice Leveson’s recommendations and aims to help journalists comply with the Act. This includes providing clear advice explaining how the existing exemption for journalism applies when working on stories that carry a clear public interest.”

The draft document follows a workshop held in September 2013 where journalists and editors from a broad cross-section of the media were invited to provide insight into journalistic processes and discuss how they interact with the Data Protection Act. The consultation will be supported by two further workshops with key stakeholder groups from within and outside the media industry in February 2014.