The right to privacy on which the GDPR is founded is enshrined into UK law under the Human Rights Act 1988 which itself gives effect to the European Convention on Human Rights. Article 8 of the Convention provides for the right to respect for private and family life, the home and correspondence. This right is often in conflict with the Article 10 right to freedom of expression. We look at this in more detail here, but for data protection purposes, the (UK) GDPR attempts to deal with the tension in Article 85.
Article 85 – processing and freedom of expression and information
Under Article 85(1) UK GDPR, the right to protection of personal data must be reconciled with the right to freedom of expression and information, including for journalistic purposes and for academic, artistic or literary expression. These are known as the "special purposes".
The way in which to do this is left to the discretion of the Secretary of State who may provide for a range of exceptions or derogations where data processing is carried out for the special purposes. In the EU GDPR, it is, similarly, up to Member States to decide which exemptions and derogations they apply.
The range of potential exemptions is wide covering virtually the entire (UK) GDPR:
- Chapter II – principles
- Chapter III – data subject rights
- Chapter IV – controller and processor
- Chapter V – data transfers
- Chapter VI – Independent supervisory authority
- Chapter VII – cooperation and consistency (not relevant in the UK)
- Chapter IX – specific data processing situations where necessary to reconcile the right to the protection of personal data with the freedom of expression or information.
Clearly the way in which the exemptions and derogations are selected is down to individual countries, but they must keep the Convention (and in the EU, the Charter on Fundamental Rights) as well as relevant case law in mind.
UK exemptions and derogations for journalistic purposes – Part 5, Schedule II, DPA 18
The scope of the UK's exemptions for journalistic purposes are set out in Part 5, Schedule II of the UK's Data Protection Act 2018.
Which UK GDPR provisions may be subject to exemptions?
- the Article 5 principles of processing except for the principle that data must be processed using appropriate security
- the need for a lawful basis
- consent requirements
- provisions relating to special category data and data on criminal convictions and offences
- Article 11 which deals with processing which does not require identification
- the majority of data subject rights (subject to some very limited exceptions)
- the requirement to communicate certain data breaches to individuals
- the requirement to consult the ICO before beginning high risk processing
- Article 44 requirements around data transfers outside the UK.
When can exemptions be applied?
The excepted provisions of the UK GDPR will not apply to the processing of personal data for the special purposes including journalism to the extent that the controller reasonably believes their application would be incompatible with the special purposes and where:
- the processing is being carried out with a view to the publication of special purpose material
- the controller reasonably believes that publication would be in the public interest.
What constitutes public interest?
The controller must reasonably believe (not prove) that it is in the public interest to publish material in order to apply the journalistic exemption. The DPA 18 requires the controller to take into account the special importance of public interest in the freedom of expression and information but to have regard to relevant Codes of Practice or guidelines. These include:
- BBC Editorial Guidelines
- Ofcom Broadcasting Code
- IPSO Editors' Code of Practice.
The ICO is also required to produce a statutory Code of Practice on journalism under s124 DPA 18.
Draft ICO Code of Practice on Journalism
The consultation on the ICO's new Code of Practice on Journalism closed on 24 January, and you can read more about proposals and how they differ from the current Code here. The Code will have statutory force which means it will be admissible as evidence in court.
Section 1 of the Code deals with how to balance journalism and privacy and the application of the journalistic exemption. However, it clarifies that the special purposes exemption is wider than the journalism exemption under the Data Protection Act 1998 as journalism is only one of the possible special purposes. Campaigning is repeatedly singled out as an example.
The ICO also comments that the emphasis is on the independent judgment of the controller as to what is in the public interest, although being able to demonstrate this will be important.
With a view to the publication of journalistic material
Where applied, the journalistic exemption can cover any personal data processed with the intention of making it available to the public. Whether or not it is eventually published is not relevant and background information collected as part of journalistic day-to-day material is also covered, both before and after publication.
Data processed as a result of a complaint with a view to printing a correction or retraction will be covered, but not if there is no possibility of the complaint affecting the publication.
Reasonable belief
Controllers can rely on the exemption if there is a reasonable belief publication is in the public interest. This involves both a subjective and an objective assessment. The subjective element requires the controller to consider whether publication is in the public interest and form a view, preferably keeping a record of it. The objective element is that the belief must be objectively reasonable ie one that a reasonable person could hold in the circumstances. It does not need to be the only nor the most reasonable view. The ICO points to defamation law as for further guidance on what constitutes reasonable belief in the context of public interest.
It is the belief of the controller rather than the individual journalist which is important although responsibility for decisions may be delegated to the relevant individuals. Having said that, the more high-profile or intrusive the story, the more likely formal consideration and editorial involvement are likely to be required.
Public interest
Assessing whether publication is in the public interest involves:
- considering the circumstances
- balancing relevant factors for and against publication
- deciding whether the public interest is best served by publication.
There is a general public interest in freedom of expression and information itself which must be objectively balanced against other factors. Relevant Codes of Practice should be considered. The ICO says that members of IMPRESS should consider the IMPRESS Standards Code in addition to the Codes which must be consulted under the DPA 18. Complaint outcomes by IPSO may also provide helpful background.
General public interest can cover a wide range of values and principles relating to the public good or best interests of society and there may be a public interest in certain types of subject matter, such as protecting public health and safety, or exposing corruption. In general, the public interest will be stronger where an individual is a public figure or has a role in public life.
Specific circumstances must also be considered. These include:
- the likelihood and severity of any harm to individuals or other public interests
- the nature of the information and the contribution it would be likely to make to the public interest
- whether the information is already in the public domain – this does not mean that the public interest requirement is automatically satisfied if the information is already in the public domain. There will be a stronger public interest in publication where the publication adds to understanding or corrects misinformation, and a weaker one where publication would not greatly add to understanding.
Incompatible with journalism
To rely on the journalistic exemption, it must be necessary not to comply with data protection law in order to achieve the journalistic purpose. There must be an assessment of what is proportionate in order to achieve the journalistic purpose.
Demonstrating the decision
Controllers must be able to demonstrate compliance with data protection law. This includes where a decision is taken to rely on an exemption from that law. It will be easier to demonstrate compliance with appropriate policies and procedures in place, as well as with evidence of how decisions are reached. The ICO says this is not an onerous requirement as most journalistic organisations already have suitable policies and procedures in place in accordance with industry codes which can be adapted to include data protection considerations.
Again, the greater the likely impact of the publication, the more detailed record keeping should be and the higher the degree of scrutiny.
A question of judgment?
Whether or not the journalistic exemption applies often involves nuanced decision making. Journalists, editors and publishers should have processes and policies in place to help them apply ICO and other relevant guidance.
