THE ICO AND THE PRESS TODAY
1.1 The current Information Commissioner, Christopher Graham, took over from Mr Thomas in the summer of 2009. In the context of this Inquiry, it is of interest that his previous career was in journalism, broadcasting and regulation (he was a former Director General of the Advertising Standards Authority), rather than in law.
1.2 He told the Inquiry that the culture, practices and ethics of the press were not drawn to his attention on handover as an issue of top priority. He was, however, aware that commencement of the legislative changes to s55 was outstanding and he made a connection between legislative change and press conduct saying that there was:1
“a sword of Damocles hanging over the press. If there was any repetition of the behaviour that Operation Motorman had uncovered that would be accessed pretty quickly.”
1.3 In the event, he had what he described as a ‘wake up call’ a few weeks after taking up his appointment when the story by Nick Davies about phone hacking was published in the Guardian. His principal focus thereafter was not, however, operational but political: he had to prepare for his appearance on 2 September 2009 before the Culture Media and Sport Select Committee2 which was then taking evidence specifically as a result of the emergence of the Goodman/Mulcaire case and the coverage in the Guardian, but linking it also with the history of Operation Motorman. This was therefore an opportunity for Mr Graham to take stock of the history of Motorman, the role of the ICO, and the signs from the emerging hacking scandal that the story of press abuse of personal information was taking a new direction.
1.4 His evidence to the Select Committee was that:
- phone hacking was a matter for the police and the ICO had ‘no involvement whatsoever’;
- any operational steps the ICO could have taken in relation to Motorman (including criminal investigations into journalists) would have been too difficult practically and legally and were not a priority call on resources at the time;
- the priority of the ICO in relation to Motorman was to ‘sound the alarm, to warn the industry, to talk to the PCC, to urge the provision of a custodial penalty’ and the latter remained the priority;
- there was little more that could now be done in relation to the Motorman material without more, not least because it was old and not straightforward to interpret; and
- he had no intention at this point of proactively reviewing the Motorman evidence, because it would serve little purpose and the ICO had many other priorities.
1.5 The question of priorities was a matter of some concern to the Committee at the time. Mr Graham was pressed particularly hard on the position of the victims, some of whom were expressing anger at not having been notified by the ICO of their appearance in the Motorman material. Mr Graham indicated that he would treat approaches from individuals inquiring about their possible appearance in the Motorman material on a case by case basis. He was also pressed on whether the ICO had worked with the organisations, both public and private sector, whose information had been wrongly disclosed in the Motorman case; a certain amount of work had been done but various factors had limited the extent of the engagement. These included the increasing general insecurity of information of all sorts, the flourishing illegal trade in information procurement, and the risk that any investigation would itself present a risk of the further dissemination of the personal information in question
1.6 It is not necessary to consider Mr Graham’s evidence to the Select Committee in detail, because the same ground was explored in the course of his evidence to the Inquiry. His general update to the Committee on the work of the ICO work with the press at that time is, however, interesting. He said:3
“We started off by a general call to the industry which, indeed, was heeded to some extent in that the Editors’ Code Committee eventually amended clause 10 of the Code, made it much tougher, and we have done a lot of work with the PCC in training editors. We have done a couple of seminars, one in London and one in Scotland, to make sure that journalists understand that this is serious. I saw a copy of the Editors’ Code Handbook the other day and it makes it very clear that you mix with the Data Protection Act at your peril and you had better have a very solid public interest story very well documented, in order to do that. Chairman, the interesting question is why did not any of those titles that were listed in What Price Privacy Now? contact the Information Commissioner’s Office and say, “This is terrible, 45 of our journalists apparently have been doing this thing which we utterly condemn, tell us who they are”, and we then might have been able to talk turkey. Interestingly, of 305 journalists, and we listed the total in the document, we have not had a single inquiry from a journalist saying, “Am I on that list? Was I doing something wrong?”
1.7 The Inquiry has also had to consider the question of the lack of press interest in pursuing the Motorman evidence but it is also important to look at the position from the perspective of the ICO. Its own stocktake, at the end of 2009, was that it was aware that Mr Thomas’ political campaign had at best been only partially successful, and had also established a hostile response from the press. It knew that neither the ICO itself, nor evidently the press, had followed up the Motorman evidence operationally, either in relation to the particulars of the state and use of the information itself, the conduct of individual journalists, or its own practices. Finally, it was on notice of the emergence of the phone hacking scandal.
1.8 Notwithstanding this assessment, the ICO had concluded that there was no imperative for it to engage further with the culture, practices and ethics of the press. In particular, Mr Graham expressed the view to the Select Committee in relation to the PCC that “We do not have any formal relationship with them, but I just accept that they do press standards and we do data protection and, where those two things cross over, then we probably need to talk.”
1.9 The two things clearly do cross over. In concluding this Part of the Report, assessing the current state of the role and functions of the ICO, and making recommendations for the future, the focus returns to the key themes of the Motorman case, but viewed now from the contemporary perspective. Those themes are:
- the extent to which there are problematic issues today which fall within the purview of the Information Commissioner and concern the culture, practices and ethics of the press in relation to personal information;
- the powers available to the ICO to tackle any such problematic issues, and whether they are sufficient to the task; and
- the governance, capability and priorities of the ICO and whether they too are sufficient and appropriate to the task.
2. Personal information privacy and press practices
2.1 Mr Graham’s evidence to the Inquiry was that he did not believe that the press was significantly involved in breaches of the Data Protection Act since the publication of the What Price Privacy? reports, and that therefore, by implication, they had learned the lessons of those reports. This evidence is at the heart of the Inquiry’s terms of reference, and, given the way in which the phone hacking scandal developed, is not entirely obvious. It thus requires close analysis.
“I can only speak of what’s in my own knowledge, and I can only speak of those aspects of press conduct that fall within the responsibilities of my office, and that’s primarily Section 55. I know that the Inquiry was triggered by concerns about hacking of phones and hacking of emails, these are criminal offences that don’t come under the Information Commissioner’s office, but Section 55 certainly does. I can’t prove a negative. All I can say is I’ve seen no further evidence beyond what we published in 2006, and that of course was about behaviour before when Mr Whittamore’s office was raided, and much of it related to activity between 1999 and 2003. I simply offer a view that this is an issue of such high salience, many investigative journalists working in the area, great rivalry between newspaper groups, lots of campaigners, that if there was evidence of further breaches of Section 55 by the press, it would have been drawn to my attention, and it hasn’t been.”
“…there’s been so much feverish activity over the past two years in relation to this with the various newspaper groups, with the journalists, with the books written on the subject, with the campaigning groups. If the best that critics can do is to turn up further evidence of what was going on between 1999 and 2003, it doesn’t amount to much.”
2.4 The questions raised by this evidence were many, and included:
- why s55 (the criminal offence of unlawfully obtaining information) was being used as the benchmark for contravention of the regime rather than the wider scheme of principles and rights created by the regime;
- why Mr Graham would have expected investigative journalists or other campaigners to have been likely to excavate issues about the press and personal information which the ICO, charged with legal responsibilities in that respect, was not itself minded to pursue;
- why the ICO did not appear to consider that the phone hacking scandal itself and the wider issues of the culture, practices and ethics of the press before the Inquiry were a cause of acute concern within its own sphere;
- why the ICO was able to conclude that the Motorman evidence was of no continuing interest or relevance in relation to the data protection regime; and
- if the ICO was unaware of any problems in relation to the press, to what extent that was a reasonable conclusion based on due diligence.
“Q. What I am trying to do is ascertain responsibility in the system for getting this right. … Are you convinced that these practices have now ended in newsrooms up and down the country?”
A. “I am not in a position to know.”
Q. “What I am trying to understand is that the decision you took, which, by the way, I think was the right decision, to blow this open, bring it into the public domain and try and effect massive change in the way journalists run about their work, I can understand why in a resource-sensitive area that is what you did, but what I cannot understand is why you have not gone back to see whether that has been successful or not or what gauge of success there is.”
A. “How can we measure it? Do we go to editors and say, ‘Have you come across any examples of journalists that have stepped over the line?’”
Q. “Is there anyone in this country who would know whether these practices are still going on other than editors and journalists in the newsrooms?”
A. “Well, editors and journalists must know; it is a self-regulatory system.”
Q. “So, when they tell us that they think that they have thoroughly investigated the matter and they have put it right, do you think they could possibly have done that if they do not know the list of journalists that you have got on your files?”
A. “I think there might be information which would identify some of those journalists because some of the invoices quite clearly indicate that there have been blags in relation to particular stories and invoice numbers. Surely, their records should be able to cross-reference that to a particular journalist, and sometimes the invoices cross-reference the stories, so editors could examine their business and perhaps identify which journalists were or were not.” “Q: “I think you could perhaps be a little proactive just to ensure that they have certainly done that or that they certainly have the information about the people who were at it?”
A. “I understand what the Committee is saying, but you are not dealing with a regulator who is not proactive; we are proactive on a very wide front. … There are lots of ways we could spend our time.”
2.6 The due diligence point itself resolved itself into a number of sub-issues relating to the question of specific follow-up to Motorman; the strategic follow-up to Mr Thomas’s political campaign, the response to the phone hacking scandal, and the position of the ICO in relation to the press today. These will be discussed in turn.
3. Following up Operation Motorman
3.1 As is frequently repeated, Operation Motorman was the single biggest case of deliberate and systemic interference with personal information with which the ICO had had to deal since its inception. The ICO had taken no operational measures in respect of the case since handing over the Whittamore prosecution to the CPS. There had been modest progress in issuing general guidance to the industry after years of discussion with the PCC. A custodial penalty for s55 offences had been provisionally introduced but not activated. This fell short of the steps Mr Thomas had wanted to see in order to put a stop to Motorman-type practices in the press for the future. The ICO remained very concerned about the evidence it continued to encounter of an extensive illegal market in personal information beyond the activities of the press. It had no reason to believe that private investigators similar to Mr Whittamore were not operating in the market. It is therefore necessary to consider whether there was (or should have been) a question mark in the mind of the ICO as to whether or not the objective of putting a stop to the engagement by the press in the illegal market in personal information had in fact been achieved.
3.2 That general question might resolve itself into a number of specific questions. Firstly, what had happened to the information which the press had acquired prima facie in breach of the data protection regime from Mr Whittamore? Secondly, what effect had the What Price Privacy? reports and the guidance had on the industry? Finally, what steps had the newspaper titles involved taken (particularly in relation to the journalists who had been identified as customers of Mr Whittamore) to eliminate this sort of conduct from their culture, practices and ethics?
3.3 On the follow-up to the question of press conduct in relation to blagging and related activities, Mr Graham confirmed to the Inquiry the position he had taken in front of the Select Committee. The ICO had made no active investigations of any nature in relation to the Motorman material itself. No material had been brought to its attention suggesting that there was any problem. In the absence of that, it was not its role to pursue enquiries. It had other current priorities.7
3.4 There was also, in his view, no case for a proactive approach to the victims. But he did say that “so far as the individuals are concerned, I’m still very ready for subject access requests by those who may be concerned.”8
4. Following up the political campaign
Q. “But the evidence you have in front of you shows that there was law-breaking on an industrial scale from the newsrooms of some of the major newspapers in the United Kingdom.
A. “I am afraid I am going to become repetitive. You simply cannot run regulatory bodies on the basis that you go chasing after every detail that a particular investigative journalist decides should be the agenda for the day when you have got other very big and important questions. I am not pleading poverty here, I am just saying that you can only do what you can do. We thought, possibly naively, that, by telling Parliament about this back in 2006 and calling for the custodial sentence, we could close the thing down. I think they still can, but it is taking too long.”
4.2 As noted above, the ICO has continued to press for the activation of the custodial penalties for s55 offences, but no longer apparently with any direct focus on making an impact on the press. Although not directly a matter for the Inquiry, no account has been offered of how the case for the activation of those penalties has been affected by the more recent availability of civil penalties. In any event, however, the case for the activation of the s55 penalties in so far as it has a bearing on the matters before the Inquiry is considered on its own merits below.
4.3 If the ICO has yet to realise the benefits of the s55 campaign (and there remains no evidence of any active planning within the office for doing so – the effect still appears to be considered to be self-activating), it seems to be continuing to reap the dividend of general press hostility. That too requires consideration.
5. Phone hacking and the ICO
“the circumstances appear to have parallels with the Section 55 offence and to reinforce the evidence gathered during Operation Motorman”.In terms of pure personal information, the parallels between phone hacking and the Motorman activities are very clear. Shorn of the labels provided by the criminal law, both come down to the press employing unscrupulous external agents to obtain confidential personal information about other people. Further, that information is provided without their knowledge or consent and obtained by unlawful means whether by deceit, corruption, or the exploitation of technology. In respect of any individual piece of information, the journalists may or may not have had good reasons or formal defences for doing so. But prima facie these were the sort of invasive practices from which the data protection regime (along with its principles and rights) was designed to protect people.
5.2 There were on the face of it two reasons why the ICO might have taken a keen interest in the Goodman/Mulcaire developments In the first place, there was the indication that even in the post-Motorman environment, sections of the press were still involved in the unlawful trade in personal information. This was a clear warning signal in its own right that all might not be well in the approach and practice of the press regarding personal information, and raised a question mark against the efficacy of the strategy of the ICO for responding to Motorman.
5.3 In the second place, there was the concern whether there could be any direct relationship between Motorman and Goodman/Mulcaire. This was the question which had occurred to Mr Owens:11 was it possible that the private phone numbers obtained by the press via Mr Whittamore (not just the ex-directory numbers of the ‘targets’ but the multiplicity of ‘friends and family’ numbers), had been used to hack their phones? Were these precisely the private lines most likely to have been used by the ‘targets’ for the purposes of confidential conversations, texts or voicemails? Mr Owens told the Inquiry that he took these questions and thoughts to Nick Davies of the Guardian. He also told the Inquiry that there seemed to be considerable overlap between the target names in the Motorman material and in the Mulcaire material.
5.4 If the connection was made in the mind of the ICO, whether at either the general or the specific levels, the Inquiry had no evidence of it beyond the reference in What Price Privacy Now? Mr Thomas told the Inquiry, somewhat obliquely, that notwithstanding the connection made in its own report, the ICO thought that “the Goodman-Mulcaire case appeared to be a completely separate group”.12 For his part, Mr Graham maintained in his evidence to the Inquiry the position he had taken in front of the Select Committee two years previously, namely that hacking and blagging were separate activities and that the ICO had no formal role in relation to the former because it had no prosecution or criminal investigation powers in relation to hacking, which was a police matter.13 He had put it bluntly to the Select Committee:14
“We were not involved, so far as I know and I cannot think of any reason why we would be, in the most recent PCC investigation which was into the Goodman case which, I will repeat, was about hacking and not about blagging, so I would have been surprised if they had come to us and, if they had, I would have had to say, ‘Can’t help you, chum’.”
5.5 Counsel to the Inquiry pressed Mr Graham on the broader question; the newspaper industry had claimed, and the ICO appear to have accepted that claim, that after the ICO’s 2006 reports, it had cleaned up its act. How could we know that was true, given that we did know it hadn’t cleaned up its act in relation to phone hacking? Mr Graham’s answer was that they were different things.
The ICO’s current stance
5.6 Mr Graham’s position that the ICO had no particular reason to take an interest in the press was challenged in the course of his oral evidence to the Inquiry. His response was that it was a matter for the politicians, the PCC or indeed for the Inquiry itself to find out whether there was a problem with the press’ approach to personal information.15 Furthermore, the ICO had many other current priorities.16
5.7 Mr Graham explained that he had no present intention of using his powers, or taking any other step formally or informally, to consider the culture, practices and ethics of the press in relation to personal information. Put to him that he had positive responsibilities to promote compliance and good practice, that he had appropriate investigatory powers to take proactive steps to consider the position of the press in this regard, and that it would not on the face of it involve any great exercise to do so, he remained clear that he had other competing demands on his time. He did conclude, however, that should the Inquiry recommend that he consider deploying his resources in this way, that view would be something the ICO would have to take very seriously.17 I return to this.
5.8 As an independent statutory regulator, the ICO has a prerogative to set its own priorities within the overall scheme of the powers and duties entrusted to it by Parliament. For the behaviour of the press to have no part in those priorities is not, on the face of it however, easy to understand. The ICO was created to have custody of the issue of the law and practice of information privacy as articulated in the data protection regime. This Inquiry was established to address arguably the greatest crisis in public confidence in information privacy since the creation of the data protection regime. A great deal of the evidence received by the Inquiry about press misconduct related to personal information privacy (including inaccuracy). The persistence of the ICO, even in the face of the commissioning of the Inquiry and the evidence received by it, in seeking to recuse itself from any proactive engagement in addressing the crisis in public confidence was troubling. Even allowing for the inevitably particular perspective that the Inquiry has, I do not find it easy to accept the proposition that the lack of priority which the ICO accorded to the press issue is obviously reconcilable with its overall public responsibilities.
5.9 Before reaching a final conclusion on that point, however, it is necessary to reflect on whether there were in fact other, possibly structural, explanations for its unwillingness to put itself forward as a significant part of the answer to the concerns before the Inquiry.