The Government yesterday published the Data Protection Bill [pdf] which is intended to replace the Data Protection Act 1998 and to deal with various matters reserved to EU Member states by the General Data Protection Regulation [pdf] (“GDPR”). The GDPR itself will form part of English law under the provisions of the European Union (Withdrawal) Bill [pdf].
The Bill repeals the Data Protection Act 1998 (see clause 190 and Schedule 18 para 2).
Media lawyers will be particularly interested in the way in which the Bill deals with the obligations placed on Member States by Article 85 of the GDPR. This provides that
“1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information”.
Schedule 2 is entitled “Exemptions from the GDPR”. Part 5 deals with “Exemptions etc based on Article 85(2) for reasons of freedom of expression and information”.
The “reconciling” is done by paragraph 24 of Schedule 2 which closely follows the provisions of the present “Journalistic Exemption” in section 32 of the DPA.
Paragraph 24 provides as follows:
“(1) In this paragraph, “the special purposes” means one or more of the following—
(a) the purposes of journalism;
(b) academic purposes;
(c) artistic purposes;
(d) literary purposes.
(2) The listed GDPR provisions do not apply to personal data that is being processed only for the special purposes to the extent that—
(a) the personal data is being processed with a view to the publication by a person of journalistic, academic, artistic or literary material,
(b) the controller reasonably believes that
(c) the controller reasonably believes that the application of any one or more of the listed GDPR provisions would be incompatible with the special purposes.
(3) In determining whether publication would be in the public interest the controller must take into account the special importance of the public interest in the freedom of expression and information.
(4) In determining whether it is reasonable to believe that publication would be
in the public interest, the controller must have regard to any of the codes of practice or guidelines listed in sub-paragraph (5) that is relevant to the publication in question.
(5) The codes of practice and guidelines are—
(a) BBC Editorial Guidelines;
(b) Ofcom Broadcasting Code;
(c) IPSO Editors’ Code of Practice”.
The Explanatory Notes [pdf] state (at paragraph 818) that this balances the right to privacy and the right to freedom of expression. Many commentators will disagree.
Section 32 was criticised as by amongst others Lord Lester, at the time that the Data Protection Bill was being considered, for not properly importing the test of “objective necessity” required by the Directive (see also our posts here and here). The same criticisms can be applied to paragraph 24.
We also draw attention to clause 159 of the Bill which is entitled “Compensation for contravention of the GDPR”. Clause 59(1) provides that
“In Article 82 of the GDPR (right to compensation) “damage” includes financial
loss, distress and other adverse effects”.
This confirms and arguably extends the present position under the Data Protection Act 1998 following the “striking down” of section 13(2) by the Court of Appeal in the Vidal Hall case.