On 22 February 2024, it became law that the press must comply with the Information Commissioner’s Office’s journalism code of practice or else face sanctions for its breach. This event has gone unnoticed, largely, but for those of us interested in securing access for justice against press malpractice it represents a major development. For, in principle at least, victims now have a cost-effective means of securing that justice through independent press regulation, just as Lord Justice Leveson envisaged.
Moreover, given that the long-awaited code is a statutory measure, required under the Data Protection Act 2018, there can be no accusations of regulation by stealth, of insidious political machinations, nor of Parliamentary unaccountability, as there was about the Royal Charter on Self-Regulation of the Press. Neither can it be said to compromise press freedom. It secures that right by means of a special journalistic exemption. The code is confined to press malpractice. Specifically, it requires anyone using personal information for journalistic purposes to comply with data protection law.
This development may catch the press out. They may either neglect its significance or else conclude it will have little impact on their practices due to (a misperception of) the journalistic exemption.
That journalists may underestimate its significance reflects, I think, the relative passivity of the industry to both the Bill itself, before it became law, and, then, most recently, its engagement with the ICO’s consultation process on the content of the code. For although the press contributed meaningfully to that process, it has not proclaimed the end of the world is nigh in quite the same way in which it greeted Lord Justice Leveson’s recommendations for independent self-regulation back in 2012.
This apparent indifference may reflect a profound misunderstanding about the requirements of either the Act or the code (or both). As I understand it, the ICO was led to believe that compliance by the industry would be unproblematic since the practice of having a data protection policy is widespread already. The message would seem to be that the introduction of the code changes nothing.
If there is such a widespread practice in place, though, then these policies are either well-hidden or else the industry is speaking at cross-purposes, for, so far as I can tell, the publicly available policies that publishers have relate only to the personal information of newspaper consumers and not those who receive unwanted press attention. As the code makes clear, it is the subject of press reporting, and of newsgathering techniques, to which the industry must now have policies in place.
As the code makes clear, these individuals have specific rights against journalists, including rights of access, to know if journalists have personal information about them that they intend to use, rights to restrict that use, rights to have that information corrected if used inaccurately, and rights to object about that use. They can complain to the ICO when these rights are not upheld.
It may be that the industry misunderstands, or otherwise neglects, the close parallels between data protection law and the misuse of private information tort (“MPI”). This is understandable. There is much in the code that relates to technical matters of data security, such as physical locations of data storage and the procedural measures of who shall act as a data controller.
Nevertheless, as with MPI, the obligation to use personal information fairly requires journalists to consider a person’s reasonable expectation of privacy in that information and to avoid unwarranted harm to that person when that reasonable expectation arises.
And, as with MPI, data protection law recognises the importance of public information journalism as a matter of press freedom. The right to privacy under Article 8 of the European Convention on Human Rights will give way to the right to freedom of expression under Article 10 when the circumstances demand it. The Data Protection Act 2018 reflects this in the journalistic exemption by which the general special public interest in freedom of expression and information is explicitly recognised.
Obviously, this does not mean that journalists can escape their obligations simply by virtue of being journalists or of exercising, or seeking to exercise, their right to freedom of expression. As a bare minimum, the story must be in the public interest.
Yet, even this proviso may be misunderstood as establishing an easily met threshold (given that, conceivably, most topics can be given the veneer of public interest respectability if they relate to a political matter or something of great moment). Certainly, IPSO has given the press an easy ride on this score. Complaints are invariably rejected whenever IPSO detects a plausible public interest dimension to the story, however minor or tangential.
The special exemption, though, does not work in quite the same way. It has four parts and each must be met. The first two are straightforward: the personal information must be used for a journalistic purpose with a view to publication. The third and fourth requires a reasonable belief that there is a public interest in publication and that compliance with data protection law would be ‘incompatible’ with the journalistic purpose in publishing.
It is the third part that is, or ought to be, harder to satisfy if the ICO’s interpretation of it is followed strictly. For, according to clause 13.18 of the code, in determining if something is in the public interest, the journalist must ‘consider the circumstances; balance relevant factors for and against publication; and judge how the public interest is best served proportionately’ (emphasis added).
It is the additional requirement of proportionality that has the greatest potential to distinguish the ICO’s regulatory approach from that which journalists are used to under the Editors’ Code of Practice. For, under that regime, the fact of a public interest is sufficient to render the journalist’s actions immune to criticism from IPSO.
Thus, whereas, under the Editors’ Code of Practice, the seriousness of harm to the complainant is irrelevant if there is a public interest at stake, it remains a material factor that ought to be taken into account according to the ICO. Therefore, disproportionate harm to the complainant will be strong grounds to find against the journalist under the Code despite the presence of a conceivable public interest in the expression.
This is good news for victims of press malpractice, especially those who have had their complaint to IPSO dismissed under, say, clause 4 (Intrusion into grief or shock) because ‘deaths are a matter of public record… and newspapers have a right to publish.’ Thus, when the Mail Online published video images and stills under the macabre headline: Seconds from death: Horrific moment man, 70, is mowed down and killed by police car while carrying presents home from the pub on Christmas Day, IPSO dismissed the complaint.
Despite explicitly recognising that the story was ‘deeply distressing’ to the family, it did not breach the clause because these details ‘allowed readers to better understand the circumstances leading up to the accident.’ There is no elucidation of how or why some distant prospect of ‘better understanding’ should justify the cruel infliction of further pain to an already grieving family.
Moreover, the ICO has the distinct advantage of being truly independent from industry, adding to its advantages over IPSO as a proper press regulator. Admittedly, we should not get too carried away with the prospect. The ICO has been criticised for its track record as a regulator. Similarly, Lord Justice Leveson heard worrying testimony that suggested the ICO was too afraid to take on the press when alerted to allegations of serious phone hacking and other data protection breaches taking place.
Nevertheless, its relative performance far exceeds IPSO’s. For, whereas, the ICO has issued monetary penalties in 52 cases so far, IPSO has issued exactly zero. Furthermore, the Information Commissioner assures us, perhaps with that Leveson testimony in mind, ‘we are committed to taking regulatory action against media organisations, just as we would against organisations in other sectors.’
This commitment is both reassuring and timely. Whereas government is set to undo much of the groundwork established post-Leveson, by repealing the complex costs-shifting provisions in s40 Crime and Courts Act 2013 (which would have incentivised news publishers to join an approved independent press regulator such as Impress), the need for greater and tougher press regulation has been underscored by the important findings in Prince Harry’s successful claim back in December, in which we learnt that not even Lord Justice Leveson, let alone Parliament, or the general public, had received the true picture of unlawful newsgathering practices conducted by the press.
For whereas senior figures in the industry told us that such practices were limited to a few rogue reporters at one rogue title, it seems that the practice was prevalent at the Mirror Group, including up to, and during, the time of the Leveson inquiry itself. Had the public had this information then, the pressure to take decisive action against the press might have been strengthened.
Hence, the ICO’s new role as a de facto press regulator is something for which there should be cautious optimism. The press continues to do excellent work in convincing politicians and (at least some of) the general public that the only people who complain about press standards are either the crooked and corrupt (to borrow Paul Dacre’s phrase) or the pampered rich and famous. In fact, even a cursory glance at the adjudications published by IPSO demonstrates that this is utter fantasy. Those that complain are invariably unknown members of the public who have piqued the press’s curiosity for no other reason than that something truly horrific has happened to them and ‘grief sells newspapers.’ It is for them – for us – that proper regulation is needed. Perhaps now we might finally have it.
Paul Wragg, Professor of Media Law, University of Leeds, Director, Hacked Off;, Former Code Committee Member, Impress; Author of A Free and Regulated Press (Hart, 2020)
Leave a Reply