Forcing media publishers to comply with subject access requests could curb investigative journalism, ICO warns

In a response (20-page / 385KB PDF) to recommendations made by Lord Justice Leveson, the UK's data protection watchdog warned that progressing with Leveson's suggestion to "narrow" the scope of section 32 of the Data Protection Act (DPA) may negatively impact on the ability of the press to engage in investigative journalism.

The ICO said EU laws allow individual EU member states to "provide for exemptions for the processing of personal data carried out solely for journalistic purposes in so far as they are necessary to reconcile the right to privacy with the rules governing freedom of expression". However, it said that changing the existing rules on the issue would "require careful consideration" by Parliament about how to balance privacy and freedom of expression interests.

"Whilst we can understand the arguments in favour of narrowing the scope of section 32 in terms of its engagement we believe that there is merit in having a broad exemption from the DPA once the threshold for engagement is reached," the ICO said in its response. "The area of subject access is particularly problematic in that there are legitimate concerns about the ‘chilling effect’ Lord Justice Leveson’s proposal might have on investigative journalism."

In November last year, following his review into the culture, ethics and practices of the press, Lord Justice Leveson outlined his recommendations for the future regulation of the industry.

As part of his report Leveson urged reforms to section 32 of the DPA. The section sets out a 'special purposes' exemption that publishers can rely on to justify the processing of personal data for journalistic reasons in circumstances where they do not satisfy any one of six general conditions on the lawful processing of that information, which includes obtaining individuals' consent.

Under section 32 of the DPA a publisher can currently process personal data without the consent of the individual concerned, or without having to conform to other rules that govern the legitimate processing of personal data, if it "reasonably believes that ... publication would be in the public interest", and providing it "reasonably believes" that complying with the need to obtain consent is "incompatible" with the purpose of journalism.

However, Leveson said that the rules should be reformed to require publishers to demonstrate that the processing of personal data is "necessary for publication, rather than simply being in fact undertaken with a view to publication" and that they reasonably believe that the publication would be or is in the public interest. He said there should be "no special weighting of the balance between the public interest in freedom of expression and in privacy", under the terms of the exemption.

In addition publishers seeking to rely on the exemption should have to show that, "objectively ... the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication".

Leveson said the journalistic purposes exemption rules should also be "narrowed" so that publishers seeking to rely on it are still, generally, bound by rules that require personal data to be processed fairly and lawfully and in line with the specific purposes for which the information was obtained.

Publishers seeking to rely on the exemption should also be forced to comply with other principles of data protection law, Leveson said, such as those that require the accuracy of personal data to be maintained and for the processing of such information to be conducted in accordance with the rights of the 'data subjects' under the terms of the DPA. Those rights require organisations to provide individuals with access to the personal data they hold about them upon request, subject to certain conditions.

The UK and other EU member states are currently negotiating changes proposed by the European Commission to EU data protection laws. In January last year the Commission proposed that a new General Data Protection Regulation be established to act as a singularly applicable framework across all 27 EU member states.

The ICO said, though, it could not "at this stage" guarantee that the changes Leveson has recommended to the DPA would "necessarily be compatible with the new Regulation".

"The Government will no doubt wish to consider how far it is sensible and practicable to introduce the legislative changes suggested by Lord Justice Leveson in advance of the changes to data protection law that will inevitably be required if the proposed European Regulation is adopted," the watchdog added in its response document.

The ICO said what Leveson had proposed would result in it becoming more of a "mainstream statutory regulator of the press". It said that it was not seeking such a role and warned that it would have a "significant impact" on its "strategy, operations and resources" if it was given more responsibilities to regulate the industry.

"In other words, if the ICO is to do more in relation to the press it is likely to be able to do less in areas of even greater public concern," the watchdog warned.