Recent ruling a reminder that journalistic defence can defeat data protection breach claims, says expert

The judgment is a good reminder of how the so-called 'journalistic defence', under section 32 of the Data Protection Act (DPA), can successfully be invoked to defeat a DPA claim, where a media organisation can show that it reasonably believed that publication was in the public interest.

The ruling demonstrates the balancing exercise which the courts must conduct between rights to privacy and freedom of expression when assessing claims of misuse of private information.

ZXC v Bloomberg

The case before the High Court concerned a publication by Bloomberg in late 2016. According to the ruling, the news agency published an article which linked a man to a criminal investigation that was being carried out by an enforcement agency into allegations of fraud, bribery and corruption at a company.

The man, referred to as ZXC to maintain his anonymity, sued Bloomberg. He claimed that the article breached his privacy and the DPA and asked the High Court to order Bloomberg to remove the story from its website.

ZXC took particular issue in the publication of information contained in "highly confidential" files relating to the law enforcement agency's investigation. He said he had a "reasonable expectation of privacy" in relation to that investigation, and that there was no public interest in the publication of "highly confidential, leaked information about 'an ongoing criminal investigation into' him", the ruling said.

Bloomberg, however, refused to take down the article from its website. It said ZXC had no reasonable expectation of privacy in the parts of the article in which he was identified and further claimed that its reporting was protected by the journalistic exemption set out in section 32 of the DPA. Bloomberg also claimed that being forced to take down the article would infringe its rights to freedom of expression.

The journalistic exemption

Section 32 of the DPA sets out a 'special purposes' exemption that data controllers can rely on to justify the processing of personal data for journalistic reasons. This exempts those businesses from complying with certain provisions of the DPA provided the conditions in section 32 are met.

The journalistic purposes exemption can be relied upon where data controllers process personal data with a view to publishing a story and where they reasonably believe that the publication would be in the public interest and providing they reasonably believe that complying with the relevant provision of the DPA is "incompatible" with the purpose of journalism.

If organisations are processing personal data for reasons other than in pursuit of publishing public interest stories then they must conform to the general requirements governing lawful processing of that information. 

According to the High Court's ruling, Bloomberg wrote to ZXC's lawyers detailing why they believed their data processing was covered by the journalistic exemption.

Bloomberg said: "The information about [ZXC] was processed exclusively for journalism. It was published with the reasonable belief that the publication would be in the public interest and that non-disclosure of any person[al] data would be incompatible with Bloomberg News' journalistic purposes."

"Specifically the criminal investigation into [the company] has been of great interest to the public since it was announced by the [law enforcement agency] in 2013," it said. "The reporting contained in the article is strongly in the public interest and the fact that [ZXC] is being investigated should not come as a surprise to either [ZXC] or anyone else who has followed the extensive news coverage of the [law enforcement agency] investigation into [the company]."

The Data Protection Act claim

ZXC claimed that Bloomberg's refusal to take down the article constituted continued processing of his personal data without consent and was a breach of his right, under section 10 of the DPA, to prevent processing likely to cause damage or distress.

The section 32 journalistic exemption can defeat such claims. However, ZXC argued that Bloomberg could not rely on those provisions "because [Bloomberg] could have had no reasonable belief that publication of the article was in the public interest".

However, Bloomberg argued the opposite. Its defence was upheld by the judge in the case.

Mr Justice Garnham said: "[Bloomberg] rely on the witness statement of the author of the article. That statement … makes it clear that the decision to refer to [ZXC] in the article was taken after careful consideration of the relevant circumstances, including the public interest in the disclosure of [ZXC's] involvement. In my judgment, it is clear that [Bloomberg] as data controller believed, and believed on reasonable grounds, that publication would be in the public interest. In my judgment, [ZXC] cannot show that he is likely to succeed in overcoming that defence."

The General Data Protection Regulation (GDPR) is due to apply across the EU, including in the UK, from 25 May 2018. Practitioners will be keeping a close eye on whether the UK government will implement a similar journalism exemption under the GDPR to the current exemption under section 32 of the DPA.

The claims of misuse of private information

ZXC also sought a court order for the removal of the article from the news agency's website on the basis of misuse of private information.

Claims of misuse of private information must satisfy a two-stage test.

Firstly, individuals bringing such claims must demonstrate that they had a reasonable expectation of privacy in the information made, or intended to be made, public.

If they satisfy that part of the test, they must then show that their privacy rights outweigh freedom of expression rights when the two competing qualified rights, provided for under the European Convention on Human Rights and enshrined in the UK's Human Rights Act, are balanced against one another.

Mr Justice Garnham determined that ZXC did have a reasonable expectation of privacy over the information made public by Bloomberg. He said ZXC "would, entirely reasonably, have expected that the information contained in the formal law enforcement document would remain private to the law enforcement agency and the other party receiving it".

However, the judge said the right of Bloomberg to impart, and the rights of individuals to receive, such information – collectively referred to as the freedom of expression rights – "comfortably outweigh" the privacy rights enjoyed by ZXC.

Factors that weighed in Bloomberg's favour included the fact that its article "constituted a serious piece of journalism about a serious topic" and that the article "might encourage other witnesses to come forward to assist the investigation" by the law enforcement agency, the judge said. He also said it seemed the agency was not concerned that the reporting was damaging to its investigation.

Mr Justice Garnham also said that Bloomberg are "entitled to assert that the inclusion of [ZXC's] name in the piece is a legitimate journalistic decision". The addition of that information "not only adds colour and texture to the story but it is also directly relevant to the credibility of the analysis contained in the article", the judge said.

Imogen Allen-Back is a specialist in media law at Pinsent Masons, the law firm behind Out-Law.com.