David Cameron was often derided as an “essay crisis” Prime Minister – the Oxford PPE undergraduate model of relying on good general knowledge and trusting your ability to pick up the details only as peril looms large.
With so many journalists still in the cabinet (Boris Johnson, Michael Gove, Chris Grayling, Esther McVey), and PPE graduate Matt Hancock as Secretary of State for Culture, Media and Sport, the instinct to work only to a deadline appears to remain strong, notwithstanding the change of Prime Minister.
Accordingly, the new Data Protection Act 2018 received Royal Assent at 3:06pm on Wednesday 23 May 2018, just less than 32 hours before the coming into force of the General Data Protection Regulation.
Like its predecessor, the Data Protection Directive, it doesn’t spell out the exemptions for journalism, but rather leaves that task for EU member states (which, for the moment at least, includes the UK).
Under the old regime, that exemption could be found in s.32 of the Data Protection Act 1998. I’m sure no slight against journalism is meant by relegating the exemption for freedom of expression (per Article 85(2) of the GDPR) to somewhere in the middle of the 354-page act. The detail is in Paragraph 26 of Part 5 of Schedule 2 of the new Act.
First, just like the old regime, GDPR does not offer a blanket exemption from data protection for journalists. Even where the journalistic exemption applies, it only exempts from specific provisions, and only insofar as those provisions are “incompatible” with journalism.
It still doesn’t offer any exemption in respect of the obligation under Article 5(f) of the GDPR, which is the principle that personal data must be processed with appropriate technical and organisational measures to ensure it is processed fairly and lawfully (see s.32(2)(a) DPA 1998 and Paragraph 26(9)(i) DPA 2018).
As some American attorneys would say: “Govern yourselves accordingly.”
Second, while there was a hubbub about whether the IPSO Code or Impress Code would be included in the list of relevant editorial guidelines under Paragraph 26(6), the more interesting change is who needs to consider the codes.
Section 32(3) of the DPA 1998 required the court to consider an editor’s compliance with the code (much like the court must have regard to the codes under s.12(4)(b) Human Rights Act 1998).
Paragraph 26(5) of the DPA 2018 requires the controller (i.e. the media publisher) to have regard to the relevant code in order to benefit from the journalistic exemption.
This sounds a slightly subtle change, and I’m not sure of the reason for it, but the ramifications could be significant.
An editor who never read the code, but managed to act within it was fine under s.32(3) DPA 1998. Now, there is an obligation on the publisher to have regard to the code in determining the public interest of publication. How many newsrooms could offer contemporaneous documentary evidence of that, even on the most contentious of stories?
Third, the power of the Secretary of State to add extra codes of practice under Paragraph 26(7) is far less interesting than the general power in s.16(1)(c) DPA 2018 to make further exemptions from GDPR for journalists. Start your lobbying engines, newspapers.
Fourth, the involvement of the Information Commissioner’s Office in monitoring journalism appears greatly expanded under DPA 2018. As well as Codes of Practice to be introduced under s.124, there will be reviews conducted under s.177-179 into the efforts of media organisations to provide non-litigation resolution of data protection concerns.
Fifth, the “stay” mechanism to prevent data protection being used to obtain a pre-publication injunction (in respect of material not published, or published for less than 24 hours) is retained in s.176. This rarely used provision, previously in s.32(4) DPA 1998, was relied upon by Mr Justice Warby in a case just the day before DPA 2018 was commenced: Sube v News Group Newspapers & anor [2018] EWHC 1234 (QB) at [88] onwards.
Sixth, a complete oddity – a Twitter user called David Acheson asked a month ago why there was a separate journalism exemption just for “sensitive personal data” under the Processing Sensitive Data Order 2000.
The provision was – I think – entirely otiose, because if a journalist satisfied s.32 DPA 1998, then the first data protection principle did not apply, and so no exemption from a Schedule 3 DPA 1998 condition was necessary.
But nonetheless, this belt-and-braces approach has made its way into the DPA 2018.
Even though the general Paragraph 26 exemption exempts journalists from Article 9 GDPR (Paragraph 26(9)(a)(v)), there is a separate exemption (with a higher test of “substantial public interest” and only where the journalism is related to “unlawful acts and dishonesty”) in Paragraph 13 of Part 2 to Schedule 1 DPA 2018 to processing of special category personal data under Article 9(2). I still cannot conceive of circumstances where it would be necessary to rely on this.
Finally, the media having done quite well out of the skirmishes over DPA 2018, the real fight to be had will be in respect of the EU Withdrawal Bill.
Article 85(2) GDPR requires a balancing of fundamental rights under the EU Charter of Fundamental Rights. Article 11 of of the charter is the freedom of expression, while articles 7 and 8 provide for rights to privacy and data protection.
The EU has left member states to strike their own balances between these rights in formulating journalism exemptions from GDPR, and I would expect the UK approach to be very different to even that in France and Germany, let alone Poland or Hungary.
It remains to be seen how tolerant the Court of Justice of the European Union will be of vastly different approaches to the balancing of EU charter rights under GDPR.
I suspect it will give rather less lip service to the “margin of appreciation” enjoyed by states than the Strasbourg Court has done under the European Convention on Human Rights.
The European Court of Justice is the apex court of a legal project intended to harmonise law.
If its instincts are to harmonise the approach to balancing rights in this particular area of law, that could have marked effects for member states who are outliers (as the UK is, in having traditionally privileged freedom of expression over privacy rights).
The EU Withdrawal Bill will determine the extent to which English courts will follow, or be bound to follow, the case law of the Court of Justice of the European Union in the post-Brexit era for retained legislation (like GDPR). In this area more than any other, that could have remarkable consequences.
Greg Callus is a barrister specialising in media and communications law at 5RB chambers. He acts for both claimants and defendants alike, with a particular focus on open justice and reporting restrictions. He tweets as @Greg_Callus.
This post originally appeared on the Press Gazette website and is reproduced with permission and thanks
While I would never usually question Mr Callus’ wisdom, in relation to his sixth point I had always understood the condition at para.3 of the Schedule to The Data Protection (Processing of Sensitive Personal Data) Order 2000 as being intended to enable third party data controllers, who may not be processing “only for the special purposes” as required under the DPA 1998, to disclose sensitive personal data to those who would process it for the special purposes. The provision is essentially replicated at Schedule 1 para.13 of the DPA 2018. Readers may also be interested in RPC’s take on the provisions relevant to publishers: https://www.rpc.co.uk/perspectives/data-and-privacy/gdpr-and-the-data-protection-act-2018/