By Professor Lorna Woods

One aspect of the Leveson recommendations that seems to have escaped the headlines is that relating to data protection, though implementation of his recommendations could give those adversely affected by media treatment of their personal data some tools.

Section 32 Data Protection Act provides an exception to data processing rules in relation to a number of ‘special purposes’, which includes media purposes. The scope of the exemption is pretty broad: it provides an exemption to non-compliance with any of the Data Protection Principles except the Seventh Principle (security), the right of access and objection (Ss32(2)(a) Data Protection Act).

This exemption is available provided the press-related data controller believes that the special importance of the public interest in freedom of expression is served by the processing of personal data, and that the processing of such data is with a view to publication.

The terms of the Act in this regard are thus vague and potentially subjective; they do not really give any clear steer on when processing of data might be protected. Section 32(3) specifically provides, however, that when considering whether such belief was reasonable, “regard may be had to [a data controller’s] compliance with any code of practice” and provides that such codes may be designated by statutory instrument.

While there are existing codes for journalists (which are not limited to the PCC Code (SI 2000/1864), but include those put together by other media organisations, e.g. the BBC), they are not sufficiently detailed guidance on data protection obligations either. Section 51 Data Protection Act empowers the drawing up of codes of good practice, or encouraging trade associations so to do. On this basis the ICO consulted (close date 15^th March) on the intention to produce a code of conduct aimed at media organisations, including but not limited to the press, as it proposed in its response to the Leveson Report.

So given that there are existing codes under the system, what is the big deal about a new code? Well, if it is designated under s.32(3), then this brings into play the (statutory) enforcement procedures under the Data Protection Act. Given the monetary penalties that the ICO can now apply, this might get some attention.

More generally, the ICO has committed itself –again in response to Leveson – to “provid[ing] regular updates to Parliament on the effectiveness of the measures we are adopting in response to Lord Justice Leveson’s recommendations and more generally on our assessment of the culture, practices and ethics of the press in relation to the processing of personal data”. This may give evidence about whether any new system of regulation is working which, crucially, comes from outside the system.

This then re-emphasises the importance of the scope of the journalistic exception and the meaning of ‘public interest in freedom of expression’, which is presumably tied in to the fourth estate capacity of the media, rather than its capacity for spreading rumour and gossip.

Further, how closely connected must the processing of the data be to the publication of a story to benefit from the exception? Mr Jay made this point at the Leveson Inquiry: when the press obtains an ex-directory number (for hacking purposes), is it likely that the press would publish the ex-directory number? The answer is “no”, so presumably processing such material cannot benefit from Article 32.

Leveson recommended (Part H, Chapter 5, para 2.59) that both points be clarified, so that the processing of data is necessary for publication, rather than simply being in fact undertaken with a view to publication; and there is no special weighting towards freedom of the press, so that publication becomes about public interest in the information as balanced against privacy.

Statutory reform is likely to take a while, if it happens at all. An alternative is to include these points in the code, though the ICO does not seem in favour of all Leveson’s recommendations on the DPA. It remains to be seen whether or to what extent the ICO follows Leveson’s suggestions, and then whether the Secretary of State designates the code. More lobbying, no doubt..!