The House of Lords has now finished its Committee stage review of the Data Protection Bill (“DPB”). The DPB will, once enacted, repeal the Data Protection Act 1998 (“DPA”) and generally overhaul the UK’s data protection regime. It is intended to be supplementary to the GDPR from May 2018, and the provisions of the GDPR which will be retained in domestic law by virtue of the European Union (Withdrawal) bill from March 2019.
By and large, the GDPR leaves the formulation of the relevant exemptions to Member States’ national law, so the DPB has huge practical implications for data controllers, who don’t yet know exactly how the exemptions they may have been relying on will apply in the future regime.
Of particular note is the way in which the Lords have approached exemptions for the special purposes of journalistic, artistic, academic or literary expression – such exemptions as will be required by Article 85 GDPR to balance a data subject’s right to privacy with freedom of expression.
So what protections might the DPB afford – and how might these take practical effect, coming as senior industry figures are calling on supporters to champion the continued freedom of the press?
Journalists and publishers will be aware of the oft cited section 32 carve-out which can exempt most provisions of the DPA (including subject access and the right to rectification) when three criteria are met. Namely – the processing must be undertaken with “a view to” publication (s32(1)(a)); where the data controller has a reasonable belief that publication would be in the public interest (s32(1(b)); and where the data controller reasonably believes that in all the circumstances compliance is incompatible with the special purpose (s32(1)(c)).
Whilst the current draft bill would appear to broadly reflect the provisions of s32 DPA (now at schedule 2 section 24 DPB), four specific amendments moved by Baroness Hollins and Earl Attlee could significantly alter the landscape. Amongst the many other areas discussed by the Lords, the proposed amendments give rise to two key considerations:
(1) Amendments 87A/87C
In draft form the DPB mirrors the three subjective tests set out in section 32 DPA (as above), now at Schedule 2 s24(2)(a)-(c), in particular retaining reference to processing that is undertaken “with a view” to publication. It is well established that this “view” can exist both before and after publication (Campbell v MGN [2003] QB 633).
However, amendment 87A introduces a new objective test – as recommended by Leveson – exempting only such processing as is “necessary” for (not “with a view” to) publication. This will significantly narrow the ambit of the exemption, but is it compatible with how journalists actually work? Clearly a journalist will not always know what is necessary until the relevant data has been gathered, reviewed and assessed. Under the DPA, “with a view” to publication encompasses the publication of any journalistic material – does it follow that the processing of data, if it is to be objectively necessary, can only be as regards a particular (rather than any) publication?
Amendment 87C introduces a second objective test – that the likely interference with privacy resulting from the processing is outweighed by the public interest in publication. How might this objective test reconcile with a controller’s subjective belief in the public interest, as per s24(2)(b)? It would appear that the intended reference to taking account of the “special importance of the public interest in freedom of expression” at draft DPB s24(3) – which was been criticised as conferring presumptive priority on Article 10 – is unlikely to be transposed from the DPA if amendment 87C is accepted.
(2) Amendments 89B/91A
The draft DPB also sets out the specific provisions of the GDPR from which processing may be exempted at schedule 2 s24(8). However, by amendments 89B/91A, a publisher that is not a member of an approved regulator (as defined by s42 CCA 2013) will have access to an alternate list of exemptible provisions. In short, such data controllers might only be exempted from e.g. subject access obligations where to comply would otherwise identify a confidential journalistic source (Article 15(1)(g) GDPR).
This makes the exemption far narrower in scope than under the present regime; it also affords the data subject far stronger rights in respect of rectification (Article 16) and erasure (Article 17) where a controller is not regulated by an approved body. Conversely, a controller that is a member of an approved regulator could, if the relevant objective/subjective tests were met, rely on blanket exemptions to subject access, rectification, and/or erasure.
Although the mere fact of somebody’s name appearing in a document does not mean that the document contains the individual’s “personal” data (as per Ittihadieh and Deer [2017] EWCA Civ 121), controllers are likely to treat the proposed amendments with concern particularly given the commercial pressures associated with responding to voluminous subject access and related requests. As the Lords recognised, the proposed amendments provide a strong “incentive” for publications to join an approved regulator.
The Lords’ Report stage is now scheduled for 11 December 2017 – journalists and publishers alike should pay close attention to further developments.
James Theaker is an Associate in the Media: Content and Disputes Team at Simons Muirhead & Burton.
Reblogged this on World4Justice : NOW! Lobby Forum..