Whilst media coverage of press regulation continues to focus on the on-going political debate over a new regulator, Lorna Woods, Professor and Associate Dean of Research at City Law School, City University London, explains that another form of press regulation has so far eluded the headlines; this time – in the data protection context.

One aspect of the Leveson recommendations that seems to have escaped the headlines is that relating to data protection. In fact, the implementation of his recommendations could give those adversely affected by media treatment of their personal data some stronger tools.  The Information Commissioner’s Office (ICO) has recently been consulting on the framework it plans to adopt based on s. 51 Data Protection Act (DPA)[1] for the introduction of a data protection code relating to journalism based on the recommendations in the Leveson Report. The new code would include but not be limited to the press, as the ICO proposed in its response to the Leveson Report.

The main aim of the DPA is to ensure that the processing of personal data is done fairly and lawfully – essentially in accordance with eight data protection principles.[2] For example, data should be processed only with the consent of the data subject or for a legitimate purpose; and data should also be retained only as long as necessary.[3]  The DPA also gives data subjects the right to request a data controller to give notice of any processing of their data and to provide them with access to that data.[4] Stricter rules apply to ‘sensitive personal data’.

Given the implications for  legitimate newsgathering activity (and news dissemination), s. 32 DPA provides an exemption to data processing rules in relation to certain ‘special purposes’, including journalism.[5]  This exemption is conditional on the press-related data controller believing that the special importance of the public interest in freedom of expression is served by the processing of personal data, and that the processing is undertaken with a view to publication.  Section 32(3) provides that when considering whether the processing was reasonable, “regard may be had to [a data controller’s] compliance with any code of practice.” The existing PCC and broadcasting codes were designated under this provision, but were not really designed for the purpose of data protection.

The test for the s. 32 DPA exemption has two parts.  The first concerns the public interest and what that means.  Leveson suggested that this be tied to the public interest in the content, rather than the public interest in the existence of an unbridled press with its capacity for spreading rumour and gossip.  Secondly, the processing must be undertaken with a view to publication. However, Leveson recommended that the journalistic exemption be narrowed to cover only data processing that is “necessary for publication, rather than simply being in fact undertaken with a view to publication” (Part H, Chapter 5, para 2.23, 2.59, 2.60). Mr Jay highlighted this point at the Leveson Inquiry:  when the press obtains an ex-directory number (for hacking purposes), is it likely that the press would publish that ex-directory number? The answer is “no”, so presumably processing such material cannot benefit from the exemption.

Although the Leveson Report suggested that changes be made to the DPA, statutory reform is likely to take a while, if it happens at all.  An alternative is to include these points in the code, though the ICO does not seem in favour of all Leveson’s recommendations on the DPA.   Crucially, if the proposed code is designated under s. 32(3), it will affect the scope of the exemption and that is particularly important since the DPA permits the ICO to apply monetary penalties. More generally, the ICO has committed itself – again in response to Leveson – to “provid[ing] regular updates to Parliament on the effectiveness of the measures we are adopting in response to Lord Justice Leveson’s recommendations and more generally on our assessment of the culture, practices and ethics of the press in relation to the processing of personal data”. This boils down to evidence about whether any new system of press regulation is working and which, significantly, comes from a body outside that system.

It remains to be seen whether or to what extent the ICO follows Leveson’s suggestions, and then whether the code is designated under s. 32. In the meantime, these developments illustrate that a form of statutory regulation of the press already exists in the data protection context, and that the potential strengthening of this regulation has so far escaped media attention during the on-going debate over press reform.