As the deadline approaches, LSE MPP Research Officer Sally Broughton Micova reminds those with an interest in British journalism to respond to the ICO’s draft guidelines for media on data protection and journalism and argues that more clarity is needed for the “citizen blogger”.
The deadline for responding to the UK’s Information Commissioner’s Office’s (ICO) draft document Data protection and journalism: a guide for the media is 22 April. The guide is a response to the Leveson Inquiry’s recommendation that the ICO “prepare and issue comprehensive good practice guidelines and advice” for the press on data protection and privacy. The main message of the draft reads loud and clear: there is no blanket exemption for journalism.
The draft that the ICO has produced goes a long way in explaining how the exception for journalism should be understood and implemented in practice. More importantly, it explains how the ICO interprets the journalism exemption and intends to make judgements in cases of suspected breaches of the Data Protection Act (DPA) or complaints against journalists. As Lorna Woods pointed out, when the ICO started the process of responding to Leveson’s recommendations, this matters because the DPA represents a form of statutory regulation that applies to the press and the ICO does have some enforcement powers.
The wrangling over the creation of a new press self-regulator may go on for quite some time yet and is proving to be a rather opaque process, but the ICO’s process is open for input. Anyone who considers him or herself a journalist should pay attention to it, especially those who are not part of a large or mainstream media company, because the current draft has some ambiguities for this group.
A broad definition of journalism
The ICO has chosen to go with a very broad definition of journalism. The exemption granted to journalism in the DPA also applies to art and literature, thus the draft guide states that the definition (for the purposes of the exemption) covers “the entire output of the print and broadcast media, with the exception of paid-for advertising”, or, as it adds for the sake of example, everything aired on the BBC.
In addition, the ICO has attempted to include in their definition of journalism those not necessarily paid by and working for mainstream media companies, or those it refers to as “citizen bloggers”. The document explains on page 24:
If amateur bloggers claim their purpose was journalism (or art or literature), the focus is therefore likely to be on the public interest part of the exemption… Of course, this doesn’t mean that every blog or comment posted online will be journalism. In many cases, people will simply intend to take part in normal social interaction or other recreational internet use. Individuals posting personal blogs or comments online, which were not intended as public interest journalism might instead be able to rely on the domestic purposes exemption in section 36.
This is an admirable attempt to include a vast array of online-only and one-man-show types of journalism without implying that the exemption applies to everything people might put on the net. However in this current draft the consideration of the “citizen blogger” does not play out in terms of how the ICO intends to judge journalistic practice.
Over-dependence on industry standards and editorial hierarchy
The draft guide uses very plain language and examples to explain in what circumstances the journalistic exemption can be claimed and when it might be a hard case to make. On page 29 it states:
The first key point here is that it is the belief of the data controller that counts, not the individual journalist. There must be a corporate decision that the story is in the public interest, which is likely to mean some editorial involvement (which might be a formal commissioning process, or might be a much more informal go-ahead, depending on the context and usual practice). But if a journalist investigates a story without discussing it with an editor first, it will be difficult to rely on the exemption, particularly in controversial cases.
The draft guide points to the Editor’s Code of Practice, the Ofcom Broadcasting Code, and the BBC’s Editorial Guidelines as highly relevant to being able to claim the journalistic exemption. It gives the BBC’s guidelines as an example, saying that existing industry guidance already helps in terms of thinking about when privacy should be subordinate to the public interest. Later the guide explains that relying on the journalistic exemption will be difficult if “industry codes” have not been considered and respected.
Where then is the “citizen blogger”?
Although the ICO has attempted to include journalists operating outside of legacy media companies in its definition of journalism, the rest of its guidance in this current draft fails this category of journalists. The general practice advice it gives relates to staff training, corporate governance and internal guidance on data protection – all of which are irrelevant to small scale online media or individual online journalists. The measures which it will use to judge whether the journalistic exemption can be claimed apply to media companies that have signed up to the Editor’s Code or are regulated by Ofcom and have internal structures in which editorial decisions are made within a hierarchy of responsibility or collectively.
The ICO needs input from some “citizen bloggers” who can testify to what constitutes good data protection practice for their category of journalists. It needs to hear how small media organisations or individuals practicing journalism can demonstrate that they have undertaken all the considerations and steps necessary to be able to claim the journalistic exemption.
This article gives the views of the author, and does not represent the position of the LSE Media Policy Project blog or the London School of Economics.
are you putting in a submission, beyond this? I would be interested to read it if so, especially something written from an academic blogger’s perspective – where does research-related blogging and media activity fit in?
Here is something I added in my submission to the consultation:
The guidance should include some advice as to what constitutes good data protection practice for journalists operating outside of the major or mid-sized industry players. It needs to consider how small media organisations or individuals practicing journalism can demonstrate that they have undertaken all the considerations and steps necessary to be able to claim the journalistic exemption. A section aimed at the “citizen blogger” category could include guidance on the following:
1. Ways to document decisions made about accessing or publishing data – how best to demonstrate due diligence
2. Ways to store and protect data for small operations or individuals
3. Clear advice as to individual liability and where else to turn for information or legal advice in cases of complaints or breaches.
While input from actual “citizen bloggers” is probably most valuable, it might be useful to look to University ethics codes for individual researchers for some commonly used advice for individuals on responsible handling of personal data.