ICO to publish code of practice for the press on personal data processing

The Information Commissioner's Office (ICO) has launched a consultation in which it is seeking views from media organisations on whether the kind of issues it plans to address in its press code of practice (11-page / 152KB PDF) are the right ones. The ICO said that the code would relate solely to processing under section 32 of the Data Protection Act (DPA) and would offer guidance applicable to both print and broadcast journalists.

Under section 32 of the DPA a publisher can currently process personal data without the consent of the individual concerned, or without having to conform to other rules that govern the legitimate processing of personal data, if it "reasonably believes that ... publication would be in the public interest", and providing it "reasonably believes" that complying with the need to obtain consent is "incompatible" with the purpose of journalism.

The ICO has proposed that its new code contain answers to particular questions about that section of the DPA. The code should set out when the 'journalism exception' applies and what considerations journalists have to give to other aspects of data protection law when processing of personal data under that exemption takes place, it said.

In addition the ICO has outlined its intention to set out "minimum standards of good practice" for the handling of personal data, when publishers can consider that personal data has only been processed "for the special purposes of journalism" and the circumstances in which publishers can reasonably believe that " publication would be in the public interest".

The watchdog has also proposed to set out guidance on the cases where publishers can consider it "reasonable to believe that compliance with a relevant provision of the Data Protection Act would be incompatible with the special purpose of journalism".

"We intend to confine our consideration of data protection law to the processing of personal data in connection with commercial and public service journalism," the ICO said in its consultation document. "This will include the press and broadcast media. Although the code will therefore focus on journalism, it will be explicitly limited to data protection considerations. The purpose of the code will be to advise journalists and publishers how to comply with the Data Protection Act and about how to handle personal data in ways which are consistent with the principles of the Act."

"It is not the ICO’s intention to purport to set ethical standards for journalists, or to interfere with the standards which already apply under relevant industry guidance, such as the Editors’ Code of Practice, the Ofcom Broadcasting Code, and the BBC Producers’ Guidelines," the watchdog said. "Nevertheless, the existing industry guidance does not consider the requirements of data protection law in any detail, and the ICO’s code will complement existing industry standards by providing additional coverage of this issue."

"The ICO will assess the need for additional guidance on other aspects of the special purposes exemption when the code has been drafted and once it is known whether the relevant law is to be reformed," it added.

Lord Justice Leveson had recommended that the ICO establish guidance on data protection laws specific to the press in his report into the culture, practices and ethics in the industry last year. The judge also recommended that the DPA be amended so that the section 32 journalism exemption could only be taken to apply when stories are in the public interest and when personal data processing is "necessary for publication".

In addition Leveson also said publishers seeking to rely on the exemption should also be forced to comply with other principles of data protection law, such as those that require the accuracy of personal data to be maintained and for the processing of such information to be conducted in accordance with the rights of the 'data subjects' under the terms of the DPA. Those rights require organisations to provide individuals with access to the personal data they hold about them upon request, subject to certain conditions

Last month, in its official response to Leveson's recommendations, the ICO said that changing the DPA to restrict media publishers' ability to process personal data without individuals' consent could have a "chilling effect" on investigative journalism.