Lord Justice Leveson has today published his eagerly awaited report into the culture, practices and ethics of the press. The key proposal which will shape the future of press regulation is the recommendation to create an independent self-regulatory body, governed by an independent board. Of particular interest to information lawyers is the discussion of the extent to which the current legal, policy and regulatory framework has failed in relation to data protection. In this respect, the Report considers the lessons that can be learned from the practices of the press in relation to data handling and processing, makes bold recommendations in relation to legislative reform and further considers a bolstering of the Information Commissioner’s role and function. The principal parts of the report dealing with the Data Protection Act 1998 (“DPA”) and ICO are Volume III, Part H and Volume IV, Appendix 4, Part 4.
Data protection: a key element of privacy rights
A key part of the Leveson Inquiry has been to consider the extent to which the press has unjustifiably interfered with the privacy of individuals in a manner which cannot be justified in the public interest. In this context, invasion of privacy does not mean simply through the publication of articles which intrude into the details of individuals’ private lives, but rights of individuals to keep personal information private, and rights restricting how personal information is processed by journalists. The Inquiry’s Terms of Reference expressly required Lord Justice Leveson to consider the extent to which the current policy and regulatory framework has failed in relation to data protection. The Inquiry provided a fresh and independent perspective for considering the DPA and the role of the ICO.
Historic difficulties in investigating and regulating data protection breaches by the press
Operation Motorman was an investigation by the ICO into the conduct of a private investigator, Steve Whittamore, which revealed that a significant amount of personal data was being sought by journalists working for most of the major newspaper groups. The data was being obtained by Mr Whittamore in breach of s.55 DPA (for example, through payments to public officials for details from a DVLA database, or through the blagging of friends and family telephone numbers from BT) and subsequently supplied to journalists. Mr Whittamore was prosecuted, but no journalist was interviewed by the ICO or subjected to enforcement action or prosecution. The Report highlights that the investigation produced a ‘treasure trove’ of evidence of serious and systemic illegality and poor practice in the acquisition and use of personal information which could have spread across the press as a whole. It also questions why the ICO failed to interview journalists or prosecute journalists for breach of the DPA, and notes that two reports laid before Parliament by the ICO had set out the evidence of a flourishing and unlawful trade in confidential personal information.
The Report highlights that one of the difficulties encountered by the ICO in pursuing breaches of data protection legislation against the press arose from deficiencies in the legal framework, which “puts unnecessary and inappropriate barriers in the way of regulatory law enforcement and the protection of victims’ rights”. Perhaps for this reason, amendments to the legal framework form a key part of the recommendations on data protection reform.
Recommendations to amend data protection legislation
Section 32 of the DPA restricts the circumstances in which the ICO can exercise most of its powers in relation to the press. Section 32 operates by disapplying a number of investigative and enforcement powers in circumstances where the data processing falls within section 32, namely where (i) the processing is undertaken with a view to the publication by any person of any journalistic material; (ii) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest; and (iii) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.
The Report recommends that section 32 should be amended so as to make it available only where: (a) the processing of data is necessary for publication, rather than simply being in fact undertaken with a view to publication; (b) the data controller reasonably believes that the relevant publication would be or is in the public interest, with no special weighting of the balance between the public interest in freedom of expression and in privacy; and (c) objectively, that the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication. These amendments would render it more difficult for those organisations processing data for the purposes of publication to bring themselves within the scope of s.32. The proposed amendments seek to re-set the balance between the public interest in freedom of expression and the public interest in personal information privacy.
Further, the report recommends that the extent to which s.32 disapplies provisions of the DPA should be reduced and that the processing of data by the press should be subject to the following obligations (which previously attracted exemption):
- the requirement of the first data protection principle to process personal data fairly (except in relation to the provision of information to the data subject under paragraph 2(1)(a) of Part II Schedule 1 to the DPA) and in accordance with statute law;
- the second data protection principle (personal data to be obtained only for specific purposes and not processed incompatibly with those purposes);
- the fourth data protection principle (personal data to be accurate and kept up to date);
- the sixth data protection principle (personal data to be processed in accordance with the rights of individuals under the Act);
- the eighth data protection principle (restrictions on exporting personal data); and
- the right of subject access (subject to further investigation and clarification of protection of journalists’ sources).
Recommendations for procedural amendments
The Report recommends:
- The repeal of certain procedural provisions of the DPA with special application to journalism (namely section 32(4) and (5) and sections 44 to 46). The purpose of this is to give the ICO, and the Courts, greater powers to consider breaches of data protection without procedural hurdles in place, for example repealing section 32(4) would allow Courts to consdier preventing the Courts considering the complaint whilst the ICO determines whether the data controller has been processing the date for the purposes of journalism;
- In conjunction with the repeal of those procedural provisions, consideration should be given to the desirability of including in the DPA a provision to the effect that, in considering the exercise of any powers in relation to the media or other publishers, the ICO should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime;
- Specific provision should be made to the effect that, in considering the exercise of any of its powers in relation to the media or other publishers, the ICO must have regard to the application to a data controller of any relevant system of regulation or standards enforcement which is contained in or recognised by statute; and
- To further strengthen individuals’ rights, the right to compensation for distress conferred by section 13 of the DPA is not restricted to cases of pecuniary loss, but should include compensation for pure distress.
ICO’s powers of prosecution
In his evidence to the Inquiry, the former Information Commissioner Richard Thomas described the ICO as “primarily not a prosecuting authority. That was almost on the side”. The main formal power in the event of non-compliance was the ‘enforcement notice’, which could specify and require compliance action subject to the back-up sanctions of court enforcement, although this was not frequently used. Prosecution powers were limited to section 55 of the DPA and did not extend, for example, to other offences such as phone hacking (although this might also technically involve a section 55 DPA breach).
The Report recommends that:
- The necessary steps should be taken to bring into force the amendments made to section 55 of the DPA by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism);
- The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.
- A new duty should be introduced (whether formal or informal) for the ICO to consult with the Crown Prosecution Service in relation to the exercise of its powers to undertake criminal proceedings;
- The ICO should immediately adopt the Guidelines for Prosecutors on assessing the public interest in cases affecting the media, issued by the Director of Public Prosecutions in September 2012; and
- The ICO should take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to ensuring that it is well placed to fulfil any necessary role in this respect in the future, and in particular in the aftermath of Operations Weeting, Tuleta and Elveden.
Recommendation to issue guidance
The Report includes a number of recommendations directed at the ICO in relation to its provision of guidance and advice. In particular, it recommends that the ICO should issue good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. Further, it should issue guidance to the public on their individual rights in relation to the press and their personal data and also advice for data subjects who are concerned that their data may have been processed by the press unlawfully or otherwise than in accordance with good practice. In full:
- The ICO should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime.
- In discharge of its functions and duties to promote good practice in areas of public concern, the ICO should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. This should be prepared and implemented within six months from the date of this Report.
- The ICO should take steps to prepare and issue guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights.
- In particular, the ICO should take immediate steps to publish advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice.
- The ICO, in the Annual Report to Parliament which it is required to make by virtue of section 52(1) of the DPA, should include regular updates on the effectiveness of the foregoing measures, and on the culture, practices and ethics of the press in relation to the processing of personal data.
Strengthening the ICO
The Report recommends that the opportunity should be taken to consider amending the DPA formally to reconstitute the ICO as an Information Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public administration, law and business, and active consideration should be given in that context to the desirability of including on the Board a Commissioner from the media sector.
The Report recommended to the ICO that:
- It should take the opportunity to review the availability to it of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it; and
- It should take the opportunity to review its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions (including the relationship between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other) can be satisfactorily considered and addressed in the round.
The recommendations in the Report seek to significantly strengthen the ICO’s powers to investigate and enforce against poor press practices and, if enacted, would represent a marked change in the relationship between the ICO and the press.
(11KBW’s Heather Emmerson was instructed by the Treasury Solicitor as part of the team of Counsel to the Leveson Inquiry.)