EDITORS' CODE OF PRACTICE COMMITTEE | GUIDANCE NOTES
Data Protection Act, Journalism and the PCC Code
Guidance Note: Issued by the PCC in co-operation with the Information Commissioner, 2005

This note has been put together with the help of the Information Commissioner to draw the attention of journalists and editors to those provisions of the Data Protection Act 1998 (DPA) that may impact on them as they carry out their professional duties. The DPA carries within it a journalistic exemption and implicit reference to media codes including the PCC Code of Practice. As such, the Commission is from time to time asked questions about how it is applied. Therefore, the Commission has drawn together some of the questions it is most frequently asked. This note is by way of straightforward general guidance only and should not be relied on as legal advice. If you are concerned about how the Act will impact on a specific case you should seek advice from a specialist lawyer.

What is the DPA designed to do? The DPA requires those who use information about individuals for a business purpose to observe rules of good practice when handling information to ensure that such information is used appropriately, and is accurate, relevant, and up to date. It also grants rights to the individual 'data subject' to ask for information from the 'data controller' about such 'personal data', where it came from (subject to some protection of individual sources), to whom it has been passed and, in some cases, to require that there be no further processing of relevant data.

There are various exemptions.

What do 'data processing', 'personal data' and 'data controller' mean?

Very broadly, 'personal data' is information relating to an identifiable, living human being (the 'data subject') which is held electronically and capable of being processed by computer, or held in equivalent non-computerised filing systems. Processing personal data includes obtaining, recording, holding the information or data, or carrying out operations on it such as consulting, adapting, organizing, retrieving, disclosing (which includes publishing), erasing and destroying it.

'Data controller' is a person who 'determines the purposes for which, and the manner in which, any personal data are to be processed'.

Full definitions are contained in the DPA which can be found here. Relevant case law is developing on their legal meaning as the courts consider cases brought under the Act.

Isn't there a journalistic exemption?
The government recognised that the imposition of these rules without exemptions for journalistic, literary and artistic purposes ('the special purposes') would be damaging to freedom of expression. It acknowledged that journalists and the media must be allowed to process data about individuals without having their activities, including newsgathering, investigations and publication, scotched by the Act's requirements. The DPA therefore contains an exemption for personal data that is processed for the special purposes. This exempts newspapers and magazines from compliance in relation to some aspects of the processing of personal data when it is undertaken with a view to publication where this would prejudice journalism.

There are also other safeguards for the media that allow the courts to stay legal action and protect against arbitrary use of investigation and enforcement powers.

Part of the journalistic exemption relates to the public interest. What counts as the public interest? The Act does not define what the public interest means in any context.

However, in the case of the journalistic exemption under section 32, it does say that in considering whether a data controller's belief was reasonable that publication was or would be in the public interest, regard may be had by the court to his compliance with any relevant Code of Practice, designated by order of the Secretary of State. The broadcasters' codes and the PCC Code have been designated. In the case of newspaper and magazine journalism, this therefore clearly means the PCC Code of Practice.

The Code of Practice makes clear that the public interest may be invoked to justify breaching 9 of the 16 clauses of the Code, principally relating to an individual's privacy. It says that the public interest includes detecting or exposing crime or serious misdemeanour, protecting public health and safety, and preventing the public from being misled by some statement or action of an individual or organisation. It also states that there is a public interest in freedom of expression itself, and that the Commission will have regard to the extent to which material has, or is about to, become available to the public. The Commission has made clear on a number of occasions - not least through its case law that has been built up since 1991 - that the examples of the public interest contained within the Code do not constitute an exhaustive list. The Commission's adjudications, which can be found at www.pcc.org.uk, amplify the Code and should be read in conjunction with it.

Are there any other rules on obtaining personal information?
The DPA also regulates the lawful disclosure of information. This note does not deal with how that might be relevant to disclosure to the media, or how journalists might use DPA information rights, or the DPA's inter-relation with the Freedom of Information Act 2000, for which the Information Commissioner also has responsibility.

However, it is important for journalists to understand that in addition to the Act's requirements about the way that personal data can be used, the rights of data subjects and the exemptions to them, it contains some other controls and prohibitions on the way that information can be obtained and disclosed.

There is a specific criminal offence of unlawful obtaining of personal data. A person must not knowingly or recklessly, without the consent of the data controller, obtain or disclose personal data or the information that it contains, or procure the disclosure to another person of the information contained in personal data.

Both individuals and companies can be prosecuted at the instigation of the Information Commissioner or the Director of Public Prosecutions. It is also an offence to sell or offer to sell information that has been obtained without consent. However, there are a number of exemptions - which are generally applicable and not just for journalists - from liability for the offences. Among other things, it may be a defence to argue that the obtaining, disclosing or procuring of the data or information:

  • was necessary for the purpose of preventing or detecting crime;
  • was justified as being in the public interest (see note on the public interest, above). A court would have to decide whether, in the circumstances, obtaining the information without the agreement of the organisation or individual concerned (the data controller) was of sufficient importance to override the protection afforded by the Act.
Moreover:
  • in rare cases, there may be an exemption where the personal data in question fall within the Act's national security exemption;
  • and also where the data fall within the 'manual data held by public authorities' exemption which is due to come into force on 30 November 2005.
However, it would be advisable to seek legal advice before assuming whether any of these defences will apply. There are other exemptions that may not be as likely to apply to journalists. More information can be found on the website below. How can I find out more about the Data Protection Act? A copy of the Act can be found here. For more information about how the Act has been implemented, you can visit the website of the Information Commissioner at www.informationcommissioner.gov.uk or telephone the office of the Commissioner on 01625 545 700. The website also gives information about the Freedom of Information Act 2000 and its implementation.


« Back