Leveson has published a report outlining his recommendations for the future regulation of the press after conducting a year-long inquiry into the culture, practices and ethics of the industry.
As part of his report (48-page / 522KB PDF) Leveson has urged reforms to section 32 of the Data Protection Act (DPA). The section sets out a 'special purposes' exemption that publishers can rely on to justify the processing of personal data for journalistic reasons in circumstances where they do not satisfy any one of six general conditions on the lawful processing of that information.
Leveson said that the rules should be reformed to require publishers to demonstrate that the processing of personal data is "necessary for publication, rather than simply being in fact undertaken with a view to publication" and that they reasonably believe that the publication would be or is in the public interest. He said there should be "no special weighting of the balance between the public interest in freedom of expression and in privacy", under the terms of the exemption.
In addition publishers seeking to rely on the exemption should have to show that, "objectively ... the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication".
Under section 32 of the DPA a publisher can currently process personal data without the consent of the individual concerned, or without having to conform to other rules that govern the legitimate processing of personal data, if it "reasonably believes that ... publication would be in the public interest", and providing it "reasonably believes" that complying with the need to obtain consent is "incompatible" with the purpose of journalism.
Leveson said the journalistic purposes exemption rules should also be "narrowed" so that publishers seeking to rely on it are still, generally, bound by rules that require personal data to be processed fairly and lawfully and in line with the specific purposes for which the information was obtained.
One of the "legitimising conditions" under the DPA that allows organisations to process personal data without individuals' consent is where the processing is "necessary for the purposes of the legitimate interests" they are pursuing, as long as that processing is not "unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject."
Publishers seeking to rely on the exemption should also be forced to comply with other principles of data protection law, Leveson said, such as those that require the accuracy of personal data to be maintained and for the processing of such information to be conducted in accordance with the rights of the 'data subjects' under the terms of the DPA.
The principle that personal data should not be transferred outside of the European Economic Area unless there is an "adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data" in place in the destination country, should also be adhered to by publishers seeking to rely on the journalistic purposes exemption, the judge added.
Individuals whose personal data is processed under the terms of the journalistic purposes exemption should have a right to access their data upon request to publishers, Leveson said. Currently individuals do not have this right. However, he said that there may need to be a "clarification" to "the law relating to the protection of journalists’ sources" to ensure their rights are not impinged on.
Among the other recommendations Leveson made was a proposal to alter the wording of section 13 of the DPA to make it "specifically" clear that individuals have a right to claim compensation for "pure distress” and not just "pecuniary loss".
Currently section 13 of the DPA outlines that a person is generally entitled to compensation if they suffer damage or damage and distress as a result of breaches of the DPA by organisations that determine how and why their personal data is being processed - 'data controllers'. Individuals are also generally entitled to compensation from those 'data controllers' if they suffer distress only, if that distress stems from processing for 'special purposes' which includes for journalistic purposes.
Leveson also suggested that "consideration" be given to changing the DPA to require the Information Commissioner's Office (ICO), the UK's data protection watchdog, to give “special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest" as part of its duties of "upholding the data protection regime”.
When reviewing publishers' compliance with data protection laws, the ICO should also have to consider whether the publisher has adhered to the “relevant system of regulation or standards enforcement which is contained in or recognised by statute” which he has recommended be put in place to regulate the press.
Leveson said that he wants to see the potential punishment of imprisonment be introduced against those that commit 'section 55' offences.
Under section 55 of the DPA a person is generally guilty of an offence if they "knowingly or recklessly ... obtain or disclose personal data or the information contained in personal data, or procure the disclosure to another person of the information contained in personal data" without consent from the 'data controller'. A person is not guilty of an offence if they can show that unlawfully obtaining, disclosing or procuring of the personal data was justified as being in the public interest.
Under the Criminal Justice and Immigration Act the Justice Secretary has the power to introduce new regulations that would allow a custodial sentence penalty to be available for blagging offences under section 55 of the DPA, but those powers have yet to be used. The current penalty for committing a section 55 offence is a maximum £5,000 fine if the case is heard in a Magistrates Court and an unlimited fine for cases tried in a Crown Court.
Leveson said the ICO should be given greater power to prosecute those who breach any of the data protection principles and that the ICO should put arrangements in place so as to consult with the Crown Prosecution Service over its use of its prosecution powers.
The ICO should, within six months, publish “good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data,” he added.
Leveson also said that consideration should be given to changing the DPA to "formally ... reconstitute" the ICO as "an Information Commission". The new Commission would be "led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public administration, law and business, and active consideration should be given in that context to the desirability of including on the Board a Commissioner from the media sector," he said.