By Professor Lorna Woods
One aspect of the Leveson recommendations that seems to have escaped the headlines is that relating to data protection, though implementation of his recommendations could give those adversely affected by media treatment of their personal data some tools.
Section 32 Data Protection Act provides an exception to data processing rules in relation to a number of ‘special purposes’, which includes media purposes. The scope of the exemption is pretty broad: it provides an exemption to non-compliance with any of the Data Protection Principles except the Seventh Principle (security), the right of access and objection (Ss32(2)(a) Data Protection Act).
This exemption is available provided the press-related data controller believes that the special importance of the public interest in freedom of expression is served by the processing of personal data, and that the processing of such data is with a view to publication.
The terms of the Act in this regard are thus vague and potentially subjective; they do not really give any clear steer on when processing of data might be protected. Section 32(3) specifically provides, however, that when considering whether such belief was reasonable, “regard may be had to [a data controller’s] compliance with any code of practice” and provides that such codes may be designated by statutory instrument.
While there are existing codes for journalists (which are not limited to the PCC Code (SI 2000/1864), but include those put together by other media organisations, e.g. the BBC), they are not sufficiently detailed guidance on data protection obligations either. Section 51 Data Protection Act empowers the drawing up of codes of good practice, or encouraging trade associations so to do. On this basis the ICO consulted (close date 15th March) on the intention to produce a code of conduct aimed at media organisations, including but not limited to the press, as it proposed in its response to the Leveson Report.
So given that there are existing codes under the system, what is the big deal about a new code? Well, if it is designated under s.32(3), then this brings into play the (statutory) enforcement procedures under the Data Protection Act. Given the monetary penalties that the ICO can now apply, this might get some attention.
More generally, the ICO has committed itself –again in response to Leveson – to “provid[ing] regular updates to Parliament on the effectiveness of the measures we are adopting in response to Lord Justice Leveson’s recommendations and more generally on our assessment of the culture, practices and ethics of the press in relation to the processing of personal data”. This may give evidence about whether any new system of regulation is working which, crucially, comes from outside the system.
This then re-emphasises the importance of the scope of the journalistic exception and the meaning of ‘public interest in freedom of expression’, which is presumably tied in to the fourth estate capacity of the media, rather than its capacity for spreading rumour and gossip.
Further, how closely connected must the processing of the data be to the publication of a story to benefit from the exception? Mr Jay made this point at the Leveson Inquiry: when the press obtains an ex-directory number (for hacking purposes), is it likely that the press would publish the ex-directory number? The answer is “no”, so presumably processing such material cannot benefit from Article 32.

freedom of expression, lorna woods, pirate bay, sweden
Comment: ECtHR decision in Pirate Bay case - Neij and Sunde Kolisoppi v. Sweden
In Comment, Law on March 15, 2025 at 12:39 pmBy Professor Lorna Woods
The European Court of Human Rights declared the Pirate Bay claim for freedom of expression inadmissible as being manifestly ill-founded [summary, PDF]. It follows the case earlier this year of Ashby Donald (Appl. nr. 36769/08 judgment 10th January 2013) and while it follows much of the reasoning in Ashby Donald, the court’s decision here carries some unusual points worth noting.
Ashby Donald and the Pirate Bay case both take place in a digital context in that they both relate to use of the Internet. Ashby Donald was noteworthy as it seems to accept that speech infringing copyright can in principle claim protection.
This might seem good news for Pirate Bay, but the terms of Ashby Donald recognised the need to protect copyright, meaning freedom of expression by no means automatically trumps copyright protection. It certainly does not appear to be a pirate’s charter, as is re-affirmed by the admissibility decision in Pirate Bay: Neij and Sunde Kolisoppi v. Sweden (Appl. nr. 40397/12, decision 13th March 2013).
The applicants were both involved in the running of the website “The Pirate Bay”, one of the world’s largest file sharing services on the Internet. They were charged with complicity to commit crimes in violation of the Copyright Act. Subsequently, several entertainment companies brought private claims within the proceedings.
In April 2009, the Stockholm District Court sentenced them to one year’s imprisonment and held them, together with the other defendants, jointly liable for damages. The applicants complained that the finding of complicity had violated their freedom of expression; they should not be held liable for others’ use of their service. Their claim was very broad. The Court summarised it thus:
While the Court eventually rejected the claim as manifestly ill-founded, its reasoning might suggest that to some extent accepts this broad-reaching right exists. It started by recognising the importance of Internet, but linked to public sphere (e.g. news) raising the question of the extent to which the Internet is special in this regard.
The Court reaffirmed that “Article 10 applies not only to the content of the information but also to the means of transmission or reception since any restriction imposed on the means necessarily interferes with the right to receive and impart information” – but without considering who it restricted and whose right to expression is affected.
The Court then further blurs this point: “the applicants put in place the means for others to impart and receive information within the meaning of Article 10 of the Convention. The Court considers that the actions taken by the applicants are afforded protection under Article 10 § 1 of the Convention and, consequently, the applicants’ convictions interfered with their right to freedom of expression”.
Read the rest of this entry »