One of the main findings of Lord Justice Leveson’s Inquiry into the Culture, Practices and Ethics of the Press was that that the Information Commissioner’s Office (ICO) did not have sufficient procedural powers to ensure that journalists did not seriously abuse personal data.

His solution was radical – remove all the supervisory restrictions (p. 39) which limited the ICO in relation to journalism, literature and arts (the special purposes).

The procedural reforms in the Data Protection Bill as initially put forward by the Government in September 2017 were dramatically more limited.  The scheme set out was as follows.  In the first place, clause 164(3) provided that the Commissioner could make a determination that one of the following applied:

  • the personal data is not being processed only for the special purposes;
  • the personal data is not being processed with a view to the publication by a person of journalistic, academic, artistic or literary material which has not previously been published by the controller;
  • carrying out the processing in compliance with a provision of the data protection legislation specified in the determination, is not incompatible with the special purposes.

However, such a determination could only be made after the controller had been given a full opportunity to lodge a judicial appeal and, where it had done so, that that appeal had been judicially determined.  Making such a determination would, in principle, then allow the ICO to proceed to issue an enforcement notice (see clauses 140-141) and / or a monetary penalty notice (see clauses 148-149). However, any subsequent enforcement notice could only be issued after the Commissioner had gone to court and shown that it had reason to expect a failure which was of “substantial public importance” (clause 145(1)).

Moreover, in a change from current law (see page 50) which benefited the media, the same requirements to go to court would from now on apply to any issuing of a monetary penalty notice as well (see clause 149(1)).  Finally, making such a determination would allow any stayed private civil courts actions in this area to proceed (see clause 166).

In the second place, under clause 138(1), the Government proposed enabling the Information Commissioner to obtain information from a data controller processing personal data for journalistic / the special purposes through the issuing of an information notice so long as:

  • a determination under section [clause] 164 [special purposes] with respect to the data or the processing has taken effect, or
  • the Commissioner—
  • has reasonable grounds for suspecting that such a determination could be made, and
  • the information is required for the purposes of making such a determination.

The Dilemma

A dilemma and consequently controversy was spotted in the schema outlined above.  This related not to situations where the ICO wished to pursue action regarding processing outside the special purposes (dealt with through clause 164(3)(a)) or where it determined that the special purposes material at issue has already been published (dealt with through clause 164(3)(b)).  (These situations had in any case been covered in the existing Data Protection Act 1998 (see sections 44 and 45)).  Rather, it concerned situations where journalistic (or indeed other special purposes) activity may well be being carried on in violation of minimum data protection rights and standards but that this was taking place either prior to the publication of personal data or did not relate directly to a such publication at all.  In other words, the dilemma and controversy related to clause 164(c) including in its interface with the other provisions.

It must at this point be emphasised that it was precisely clause 164(3)(c)-type situations that were at the very heart of Leveson.  In that case, very serious wrongdoing in the form of the illegal obtaining of data and consequent phone hacking was far too belatedly uncovered.  A dilemma does nevertheless arise especially as regards the interaction between the suggested power to issue section 164(3)(c) determinations and the gathering of evidence in relation to this.  On the one hand, without an ability to gather any such evidence and thereby respond to potentially serious illegality, the ICO’s powers to respond to Leveson-like situations in the future would be unreasonably neutered, thereby putting individual’s data protection and privacy rights at severe risk.  On the other hand, granting the ICO an unconstrained ability to gather such evidence raises legitimate concerns over the potential for unreasonable interference as regards the exercise of journalistic and similar forms of expression, perhaps even prior to intended publication.

Solutions?

The Government’s initial solution was to prohibit the ICO exercising its new default power to issue an assessment notice in this context (see clause 141(4)) but to grant it an ability to issue a lesser information notice in this context, subject to it satisfying itself as regards (i) having reasonable grounds for believing that a change to the manner of data processing was required and (ii) that it needed to obtain the information in order to test this further (see clause 138(1)).  The Press, however, reacted with extreme disquiet at this idea, with even Roy Greenslade writing in The Guardian stating that

“there is a particular concern at the BBC, whose lawyers argue that important investigations may have been halted in their tracks by the ICO’s extended powers”.

The Government’s knee-jerk reaction to Press lobbying has been to propose removing the ability of the ICO to issue section 164(3)(c) determinations entirely (see the speech of Lord Keen of Elie in the House of Lords on 13 December 2017).   The Information Commissioner Elizabeth Denham has rightly expressed concern at this development, stating that if this went ahead

“it would be possible for privacy rights to be overridden even where there was no need to do this to protect freedom of expression including the special purposes”

and moreover that individual would be

“prejudiced when trying to take their own legal action to enforce their rights, as any proceedings would be stayed by a court until the Commissioner was able to make such a determination”.

She also noted that the clause as initially proposed did “not create a power for the Commissioner to prevent publication”.  (In fact, as will be seen below, this clause continues to restrain even court-based injunctions under data protection here, something which Lord Leveson and many others consider – with justice – unreasonable given the irreparable harms which can arise as a result of unlawful publication especially in today’s digital environment).   In sum, Denham argued the Government’s new proposal would result in a “‘Catch 22’ situation with no redress for individuals”.

A Compromise

These are very strong words, especially coming from a body which is “not actively seeking a wider role in relation to the Press and does not underestimate the challenges it would bring” (p. 9).  Moreover, that such an absence of effective privacy and data protection rights might indeed be solidified in new data protection legislation despite all the problems which Leveson uncovered should worry us all.   At the same time, the Press’s initial concerns as regards the potential for illegitimate prior interference in their publication activities are not without any merit.  All this suggests that there may be room for a compromise amendment that would genuinely represent a reconciliation between these two considerations.

Such a reconciliation could comprise of two elements.  To begin with, the wording of clause 164(3)(c) could be rethought.  Unhelpfully, it appears to establish a new test in relation to journalism / the special purposes, namely, that the Commissioner on objective grounds believes that a certain requirement is “not incompatible with the special purposes”.  This language does not replicate that found anywhere else in the legislation.  Therefore, the relevant determination should be amended to mirror the substantive test otherwise laid down in data protection law.

In other words, the Commissioner should be able to determine that the controller cannot reasonably believe that following the stipulation laid down in any determination is “incompatible with the special purposes” or, unless it follows this stipulation, cannot reasonably believe that intended publication of material “would be in the public interest” (see Sch. 2, Pt 2  para. 24).  Secondly, given that the use of information notices in relation to the making of section 164(3)(c) determinations raises unique prior interference issues, clause 138(1)(b) could be amended to prohibit the issuing of such a notice in these special circumstances unless the Commissioner first goes to court and demonstrates to the satisfaction of a judge that the reasonable grounds and necessity tests which it sets out are met.

These amendments would protect the Press whilst still enabling the Commissioner to respond in a reasonable fashion to the types of situations uncovered by Leveson.  Moreover, a journalistic / special purposes publisher would still have a full ability to appeal to court before any section 138(1) determination itself was made.  Court-based injunctions, let alone injunctions issued by the Commissioner herself, in the area of journalism / the special purposes would still be restrained.

In sum, this very modest extension of remedy would appear to be the absolute minimum necessary to make some reasonable response to Leveson’s findings here.  In contrast, anything less would risk not doing justice to the basic rights of the individual data subject in this very delicate area of the law.

David Erdos is Deputy Director of the Centre for Intellectual Property and Information Law and Senior Lecturer in Law and the Open Society, University of Cambridge.