ISSUES ABOUT THE LEGAL FRAMEWORK
1. The current views of the ICo
“The Information Commissioner’s role in regulating the use of personal data has evolved over the years. The role was originally intended primarily as an educator, ensuring data protection compliance by promoting good practice. Significant enforcement powers of the Commissioner, such as civil monetary penalties, have been introduced by amendment over the last few years, partly in response to high profile data losses. Section 51 [of the Data Protection Act 1998] sets out the general functions of the Information Commissioner. These are generally about promoting good practice rather than punishing poor practice. This educator function is still central to how I approach my role as Information Commissioner.”
“beginning to have a very salutary effect, both on public authorities and on commercial companies. They realise that the Information Commissioner has teeth.”
1.3 He also explained his view that the way in which the Data Protection Act (DPA) bore on the press was complex; it was not easy to explain in clear and simple terms to individuals what their rights were, what the role of the ICO was in enforcing those rights, and what its relationship was to other organisations with functions in the area of law enforcement and good practice. This, in his view, meant that individuals sometimes expected more of the DPA than it was capable of doing in this area.3 That might be thought likely to suggest two consequences in particular. These are an increased emphasis on the explanatory and educational role of the ICO which Mr Graham had previously emphasised, and an increased burden on the ICO itself to give a clear lead in relation to compliance and good practice by the press, since individuals were evidently relatively less well placed to proactively enforce their own rights.
1.4 The conclusion reached by Mr Graham was different. He put it that, had Parliament intended to give the Information Commissioner a significant role in overseeing the use of personal information for journalistic purposes, “it would have provided him with a very different and much simpler legal framework within which to do so”.4 He was clear that the ICO was never intended to play a major role in the regulation of the press and that while the data protection regime was designed to protect information privacy it was not intended to impinge on the use of personal information for the purposes of journalism. The enforcement role of the ICO in this context was intended to be very limited; there was to be no challenge available on data protection grounds to the use of personal information for journalism, and certainly none prior to publication. The principal effect of the DPA on journalism therefore was in the application of the criminal offence created by s55.5
1.5 However, Mr Graham’s more detailed consideration of the scheme of the DPA in relation to the press necessarily qualifies that very general proposition.6 In this, he set out the significant restrictions placed by the exemption provisions of s32 on the enforcement powers of the ICO in relation to journalists’ use of private information, concluding that therefore the Act largely leaves it to individuals to pursue court action after publication if they want to assert their rights: this is, of course, a problem if the legislation makes it hard for them to understand what those rights are.
1.6 He also drew attention to the fact that the exemption is made to turn on the reasonable belief of the journalist that publication would be in the public interest. In considering whether a journalist’s belief about the public interest is reasonable, the DPA provides that regard may be had to his or her compliance with any relevant Code which has been designated for that purpose by the Secretary of State: the Codes so far designated are the PCC Editors’ Code, the Ofcom Broadcasting Code and the BBC Producers’ Guidelines.
“it is not the Information Commissioner’s judgment about where the public interest lies or whether the provisions of the Act are compatible with journalism that counts and he has limited power to investigate or challenge the [journalist] data controller’s opinion.”
1.8 He did accept, however, that the Information Commissioner has powers, albeit ‘specific and limited’, to challenge whether the press exemption is being properly relied on. They are specific and limited because the DPA inserts a lot of procedural hurdles to their use, including the restriction that action cannot generally be taken unless the ICO is invited to do so by an individual or a court (irrespective of the fact that individuals may not be well-placed to issue such an invitation). But the powers do confer a function on the ICO of, in effect, policing the boundary between proper and improper claims on the journalism exemption:8
“In essence the investigative and enforcement powers at the Information Commissioner’s disposal exist to enable me to ascertain whether personal data are being processed for purposes other than journalism and to act in relation to those other purposes, rather than enabling me to regulate the actual processing of personal data for journalistic purposes.”
1.9 To the extent, therefore, that there is any issue that journalists were, for example, seeking and using personal information for a range of unethical purposes other than with a view to publication, a regulatory question does arise. An example might be to threaten publication for collateral purposes or otherwise to put pressure on individuals to act or refrain from acting in certain ways. That, he recognised, would be expected directly to engage the functions of the ICO.
1.10 Mr Graham also acknowledged that ss32 and 55 did not exhaust the application of the DPA to the press. Quite apart from specific provisions (for example, the express provision that individuals have enhanced rights to damages for breaches of the legal requirements of the regime by the press),9 the general duty of the ICO to promote compliance and good practice applies in relation to the press. About that general duty, Mr Graham observed:10
“I also have a duty under section 51 of the Act to issue guidance and promote good practice. This duty is not specific to the press, journalism or other special purposes. I am aware that during my predecessor’s time in office significant efforts were made to provide advice to the PCC in relation to guidance we were encouraging the PCC to produce for journalists, focusing on the section 55 offence. So far as I am aware, the PCC did not go any further than producing general, high level guidance on journalism and the Act at the time and we have not received any further approaches to discuss such guidance during my time in office.”Of course, the general duty to promote compliance and good practice, and the power to issue guidance, is free-standing and not dependent on the receipt of an approach.
1.11 Mr Graham’s perspective on the role of the ICO in relation to the press also included an important acknowledgement that the correct approach to its more specific regulatory functions had to be on a case by case basis and not on the basis of generalised assumptions about the exclusion of journalism from the purview of the regime. What Mr Graham said in this respect is set out in full here because I am content to adopt it for the purposes of this Report as an accurate and succinct summary of the legal and practical position, and one on the basis of which the outstanding questions about the detail of the regime in its application to the press should be considered:11
“The fact that there is a public interest in a free press being able to go about its business is reflected in the treatment of the “special purposes” under the Act. However, it cannot be the case that any and every activity carried out in the name of journalism should be regarded as exempt from the provisions of the Act. Indeed, I do not believe that that extreme position is seriously advanced by any significant strand of opinion within the journalistic profession. There will, in certain circumstances, always need to be a judgment around the public interest in particular stories. This point is explicitly provided for in the various journalistic codes, for example the PCC Editors’ Code, Ofcom Code, BBC Producers’ Guidelines, and so on. This is also the position reflected in the recitals to the Directive itself. The balance to be struck between Article 8 and Article 10 of the Human Rights Act 1998 has to be considered on a case by case basis. The inevitable tension between “the right to privacy”and “freedom of expression” demands that the issues at stake in each situation are properly evaluated. I observe in passing that making judgments on where the balance of the public interest lies on the facts of each case is something that the information Commissioner is called upon to do under both the Act and the FOIA.”
1.12 The last point is particularly significant. Although it is the journalist’s honest belief that he or she is working towards a publication in the public interest that counts, a challenge as to whether that belief is a reasonable one in all the circumstances is a matter for the Information Commissioner to consider on a case by case basis, and a matter on which the ICO has a general measure of experience and expertise.
1.13 In my judgment, on the face of it, a combination of this kind of case by case approach to the ICO’s law enforcement function in relation to the press, and the application to the press of the ICO’s general duties to promote compliance and good practice, do add up to a significant potential role in guaranteeing public confidence in the culture, practices and ethics of the press in relation to personal information. However, the Inquiry saw little evidence of the realisation of that potential, or, in practice, of that role having been fulfilled. It was particularly hard to reconcile this potential with Mr Graham’s resistance to the suggestion that the ICO should be actively making a connection between its role and functions and the activities of the press in relation to personal information privacy.
1.14 In looking for any possible explanation for that within the legal framework itself, the question which has to be considered is whether there are features of the current data protection regime in relation to the press (including perhaps the needless complexity cited by the Information Commissioner himself) which were themselves inhibiting that role and which are capable of improvement.
2. A different perspective on the legal framework
2.1 The Inquiry was greatly assisted by the evidence of Philip Coppel QC who reflected on the history and substance of the provisions of the DPA with a particular bearing on journalism.12 By way of introduction, Mr Coppel pointed out that the predecessor legislation to the DPA, that is to say the Data Protection Act 1984 (which was not the product of a European Directive), had no exemption provisions for the press equivalent to those in the modern legislation. It was the EU Data Protection Directive of 199513 which required Member States to introduce measures into domestic law to
“provide for exemptions or derogations … for processing personal data carried out solely for journalistic purposes only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression”
2.2 As Mr Coppel explained, in this way the Directive itself represents the balance that has been struck in relation to personal information privacy, between the individual right to privacy and the individual right to freedom of expression found, respectively, in Article 8 and Article 10 of the European Convention on Human Rights (now incorporated into UK law by the Human Rights Act 1998).
- “Through the s32 exemption. This relieves a data controller from all obligations under the DPA to an individual (and correspondingly removes protection conferred by the DPA on an individual –§§ 37-45 above) where the data controller is processing that individual’s data only for purposes of journalism, for artistic purposes or for literary purposes, and then only provided that three conditions are satisfied.” “The three conditions that must be satisfied in order for personal information processed for the special purposes to enjoy the s 32 exemption are:
- the processing is being undertaken with a view to the publication by any person of journalistic, literary or artistic material;
- the data controller reasonably believes that, having regard to the special importance of the public interest in freedom of expression, publication would be in the public interest; and
- the data controller reasonably believes that, in all the circumstances, compliance with the data subject’s rights is incompatible with the special purposes.”
- “By the procedural relief conferred by s 32(4)-(5). Proceedings against a data controller must be stayed where the data controller claims that the data are being processed only for the special purposes and with a view to publishing by any person of journalistic etc material. The stay remains in place until the Commissioner has made a determination under s 45 that the data is not being so processed.
- “By creating a special enforcement regime (see §§54-55 above), which largely displaces the ordinary enforcement regime.”
Civil law enforcement: the exemptions in s32 of the Data Protection Act Legal analysis and suggestions for reform
2.4 The first thing to note about s32, as Mr Coppel explained, is the extent to which it disapplies the protection for individuals which is effected by the Act itself.15 Mr Coppel’s analysis of s32 began by highlighting the notable features of the exemption:16
- “It exempts the data controller from compliance with the great majority of obligations under the DPA owed to a data subject …, rather than just the limited group of obligations termed “the subject information provisions” or “the non- disclosure provisions”. This includes compliance with the data protection principles.
- “The processing by the data controller must be both:
– “only for the special purposes”; and
– with a view to the publication by any person (i.e. not just the data controller) of any journalistic, literary or artistic material (i.e. it need not be the data being processed nor need it be related to the data being processed).
- #8220;The second and third limbs needed to engage the exemption turn on the reasonable belief of the data controller, rather than on fact. The only matter identified by the section as inform that belief when assessing its reasonableness are various press codes of conduct, prepared by the press.”
2.5 Mr Coppel described the legislative and caselaw history of the s32 provision; this is important context and is therefore set out as follows in full:
“Parliamentary history of s.32 exemption
“The s 32 exemption originated as clause 31 in the Data Protection Bill. In giving the Bill its second reading speech in the House of Lords, Lord Williams of Mostyn recorded the paramountcy which the clause was intended to give to freedom of expression:“The Government believe that both privacy and freedom of expression are important rights and that the directive is not intended to alter the balance...”This view was endorsed by Lord Wakeham, chairman of the Press Complaints Commission, who commended the Bill for:“...steer[ing] a sensible path which avoids the perils of a privacy law and achieves the crucial balancing act - of privacy and freedom of expression - in a clever and constructive way....The Data Protection Bill does not introduce a back-door privacy regime. The Human Rights Bill does. The Data Protection Bill safeguards the position of effective self-regulation. The Human Rights Bill may end up undermining it.”The Solicitor-General (Lord Falconer of Thoroton) then endorsed Lord Wakeham’s view:“No one could have expressed the arguments in favour [of cl 31] more eloquently.”“Disquiet was expressed in the House by others:
– that, as a result of cl 31, the Bill failed to protect privacy,
– that cl 31 was too wide and significantly undermined the function of the legislation, and
– that the notion of the public interest was too wide and vague a basis upon which to disapply the protection conferred by the Bill.
Amendments were unsuccessfully introduced to address these misgivings. In supporting the amendments, Lord Lester of Herne Hill warned at length that, as drafted and because of cl 31, the DPA failed to implement the Directive and authorised interference by the press with the right to privacy in breach of Art 8 of the ECHR.
“Judicial pronouncements have acknowledged that the DPA is concerned with the protection of an individual’s ECHR rights to privacy.
“The principal judicial authority on the s 32 exemption is the Court of Appeal’s judgment in Campbell v MGN Ltd. The claimant had claimed against a newspaper for its having published articles which disclosed details of the therapy the claimant was receiving for her drug addiction. These included covertly taken photographs of her leaving a therapy group meeting. The claimant alleged that these amounted to a breach of confidence (based on her right to privacy under ECHR arts 8 and 10) and a breach of the data protection principles (entitling her to claim a breach of the s 4(4) DPA statutory duty).
“In the High Court, judgment was entered for the claimant on both claims. In relation to the DPA claim, the newspaper agreed that publishing the articles it had processed sensitive personal data relating to the claimant. The court held:
– that the published information (i.e. the nature and details of her therapy) constituted sensitive personal data relating to the claimant;
that that was not lawful since it constituted a breach of confidence;
that that processing was not fair as the information was acquired surreptitiously;
that that processing did not satisfy any of the conditions in Schedule 2;
that that processing did not satisfy any of the conditions in Schedule 3; and
that the exemption in s32 only applied to processing out “with a view to publication” and not to the processing involved in the publication itself.
The court assessed damages at £2,500 and aggravated damages at £1,000.
“The Court of Appeal allowed the newspaper’s appeal on both the confidentiality claim and the DPA claim. The Court of Appeal accepted that “processing” included publication in print. However, the Court, reversing the High Court, extended the duration of s 32 exemption to cover processing on and after publication. This division between processing before and after publication had limited s 32’s disapplication of the DPA’s protection up until, but not including, the most invasive activity - publication. In construing the section to give press freedom paramountcy throughout and with no opportunity to balance the individual’s interest in maintaining privacy, the judgment renders the DPA unlikely to be compliant with the Directive.
“The claimant appealed to the House of Lords. The claimant put the breach of confidence claim at the forefront of the appeal, with the parties agreeing that the DPA claim “stands or falls with the outcome of the main claim” and that it “add[ed] nothing to the claim for breach of confidence.” In this way, protection of privacy in personal information came to be secured through the adaptation of the action for breach of confidence. In so doing, the House of Lords absorbed into the action the competition between freedom of expression as protected by Art 10 and respect for an individual’s privacy as protected by Art 8 – the very balancing exercise which the Directive articulates and which the DPA is supposed to implement.
“On one analysis, the House of Lord’s judgment appears to leave untouched the Court of Appeal’s treatment of the DPA. This would be unfortunate. The misgivings which had been expressed in Parliament during the passage of the Bill (see above) materialised with the Court of Appeal’s judgment. The better analysis is that, given the parties’ agreement that the DPA claim stood or fell with the breach of confidence claim, the latter’s success means that the DPA claim enjoyed equal, if unspoken, success in the House of Lords.
“Personal privacy protection since Campbell v MGN “The practical effect of the Campbell litigation has been that breach of privacy claims are now principally brought under the HRA, rather than under the DPA. This is borne out by the treatment of privacy in the main media law practitioner text, which recognises that the DPA:“contains the most comprehensive privacy provisions now affecting the media”but goes on to comment that “misuse of private information” (i.e. the evolved breach of confidence action):“...will be of most relevance in the majority of privacy cases involving the media”and that:“..the other [action], much less significant in practice, is reliance on statutory rights such as those afforded by the Data Protection Act 1998.”The explanation offered for this is that:
“Data protection law is technical and unfamiliar to most judges. Claims under this legislation will rarely offer tangible advantages over a claim for breach of confidence or misuse of private information. Given the paucity of current authority on how the Data Protection Act 1998 is to be interpreted and applied, applications for summary judgment on such claims are ’for the moment at least, unlikely to find favour.”
“Given that the stated objective of the Directive was to protect personal privacy in information in a way which reconciled Arts 8 and 10 of the ECHR, this practical result suggests a shortfall in the implementation of the Directive.”
- “The DPA provides a code to protect the privacy of an individual’s personal information, in whatever form recorded other than in ad hoc manual records.
- The protection required by the Directive and provided by the DPA begins from the moment a person handling personal information acquires it and only ends once that person no longer holds it.
- The Directive – to which the DPA is intended to give effect – permits Member States to relieve the press of obligations otherwise applicable to the processing of personal information where that it required to reconcile the ECHR right of privacy with the ECHR right to freedom of expression.
- Freed of judge-made authority, the DPA provides an individual with a measure of protection against press invasions of personal information privacy, but, because the s 32 exemption does not provide for any balancing of the fundamental right to privacy against the fundamental right to freedom of expression, the measure of protection is less than that provided under Art 8 of the ECHR.
- The DPA, in articulating:
- degrees of sensitivity of personal information;
- the uses of that information against which protection is provided;
- the purposes for which those uses will be relieved of obligations securing the protection,
- and in adjusting the protection according the sensitivity of the information, offers a sophistication and predictability which is unmatched by the jurisprudence on ECHR-based privacy claims.
- In reported practice, press invasions of an individual’s personal information privacy have mostly been remedied through ECHR-based privacy claims.
- Judge-made law has substantially reduced the efficacy of the DPA as a means of remedying press invasions of an individual’s personal information privacy, possibly to the point that the DPA, so construed, no longer gives full effect to the Directive.”
“undoubtedly, once you’re in section 32 territory, then the protection which is given to an individual’s privacy almost entirely falls away. All you have to do is touch section 32 in some way, shape or form and the contest which the Act is supposed to embody between the right of expression, freedom of [expression], and an individual’s personal privacy has all been tilted one way.”
2.8 In other words, the journalist is made arbiter of the balance, and the balance in turn falls to be made on the basis of matters exclusively within the knowledge of the journalist, including matters inaccessible because of the extensive protection provided for journalists’ sources. He goes on to argue that s32:19
“does not recognise any right to privacy. It’s there, its sole objective is to cut away at the right of privacy, and at the end of it, certainly after the decisions of the court, there is nothing left of that right.”
2.9 In practical terms, the argument goes, the approach of the courts to the substantive law, coupled with the procedural inhibitions provided in other parts of the DPA (considered below) together with the very low level of damages which the courts have awarded have, between them, atrophied the principles and individual rights in their practical application to the press.
2.10 As a matter of law, there is more than one way to reflect on the tenor of Mr Coppel’s arguments. Put at its highest, his case would be that on the current state of the UK authorities, s32 fails to implement the Directive from which it derives, and is inconsistent with the relevant parts of the ECHR to which it is intended to give effect, because the relationship between privacy and expression rights has got out of balance. A proper balance is a fundamental obligation. The UK is therefore positively required to change the law to restore the balance. That is indeed Mr Coppel’s own contention: that UK data protection law currently fails to implement our obligations, and that Lord Lester’s concerns had proved to be prescient.20
2.11 Without going so far as that, even if the current balance were within the spectrum permitted by our international obligations, the argument could be expressed in terms that it is at an extreme end of that spectrum, and the UK can as a matter of law, and should as a matter of policy, restore a more even-handed approach, not least given the asymmetry of risks and harms as between the individual and the press.
2.12 Put at its very lowest, the point could be made that the effect of the development of the case law has been to push personal privacy law in media cases out of the data protection regime and into the more open seas of the Human Rights Act. This has happened for no better reason than the slowness of the legal profession to assimilate data protection law and, in the case of the judiciary, its greater familiarity with (and, he suggests, perhaps a preference for) the latitude afforded by the human rights regime over the specificity of data protection.21 But this, the argument goes, is undesirable because the data protection regime is much more predictable, detailed and sophisticated in the way it protects and balances rights, and significantly reduces the risks, uncertainties and expense of litigation concomitant on more open-textured law dependent on a court’s discretion.22 Where the law has provided specific answers, the fine-nibbed pen should be grasped and not the broad brush. The balancing of competing rights in a free democracy is a highly sophisticated exercise; appropriate tools have been provided for the job and should be used.
2.13 Mr Coppel suggested that the opportunity should be taken to redraft s32 in order better to reflect the balance between freedom of expression and the protection of privacy envisaged both in the Directive and in the ECHR. He suggested two changes in particular. The first is to modify the test for reliance on s32 so that it will be available only where:
- “the acquisition or use of the information is necessary for publication rather than simply being in fact undertaken with a view to publication;
- “there is a reasonable belief that publication would be in the public interest, with no special weighting of the balance between the public interest in freedom of information and in privacy; and
- “objectively, that the likely interference with privacy is outweighed by the public interest in freedom of information.”
2.14 The second change is to amend s32 so that it gives exemption from fewer rights and principles, and in particular no longer allows for exemption from:
- “the requirement to obtain and use information in accordance with statute law;
- “the requirement to obtain the information only for specific purposes and not to use it in any way incompatible with those purposes;
- “the requirement for information to be accurate and up to date;
- “the rights of individuals under the Act; and
- “restrictions on exporting the information.”
2.15 Mr Coppel provided the Inquiry with an illustrative revised version of s32 to indicate the sort of changes which would need to be made.23 I should make it clear at once that I do not express any view on the drafting suggestions that Mr Coppel makes, nor is it appropriate for this Report to frame recommendations in the form of draft legislation. For that reason, the Report’s consideration is strictly limited to the policy objectives underlying Mr Coppel’s suggestions which are not simply to be inferred from the drafting but as explained by Mr Coppel in his evidence; it would of course be a matter for Parliamentary Counsel in due course to reflect on how any policy recommendations of this nature would best be captured in drafting terms.
2.16 Considered purely in terms of what it might be desirable to achieve in terms of outcomes by any changes in the law, the underlying rationale of Mr Coppel’s analysis and conclusions can be stated relatively simply. Firstly, it is to express more clearly the even-handed approach required by human rights law to the balance between individual civil liberties on the one hand, and the public interest in the liberties of the press on the other. Secondly, it is to improve the prospects of law enforcement and the restoration of that balance where the press goes too far in transgressing individual civil liberties.
2.17 The suggested reforms would seek to achieve these objectives by focusing the mind of the journalist much more explicitly on the balanced judgment he or she has to make in the first place, with a reminder that the journalist is not above the law, and cannot be the sole arbiter in the end of whether the public has been well-served by his or her actions. In other words, the changes are designed to promote conscious awareness in journalism and accountability to the public. Furthermore, they are intended to do so without imposing any burdens on honest and reasonably conscientious journalism24 beyond what is practicable and workable as a matter of day to day practice. The question is whether these intentions, from which it is hard to dissent, were indeed likely to be achievable along the lines Mr Coppel was proposing.
News International’s objections to Mr Coppel’s proposals
(a) The ‘fundamental objection’
2.19 In the first place, NI raised what it described as a ‘fundamental objection’.26 This relates to the proposed narrowing of the exemption in s32 on the basis of its divergence from the broad interpretation given to s32 by the Court of Appeal in Campbell v MGN Ltd.27 It was further argued that the effect of Campbell is that the existing provisions of s32, provided they are widely interpreted, strike the appropriate balance between Article 8 and Article 10.
2.20 As a matter of law, I do not see that this concern constitutes a ‘fundamental objection’ to the policy. Mr Coppel’s submission is precisely that Campbell, in its interpretation of s32, unduly widened an already excessively wide s32 as enacted in the DPA 1998. His argument is that the current s32 is framed in a way that effectively means journalism nearly always trumps privacy and therefore fails properly to implement the Directive. On that basis, the narrowing of the s32 exemption is better understood as returning s32 to its intended remit. It is of course open to Parliament to amend the wording of the exemption in s32 irrespective of the terms of the judgment of the Court of Appeal in Campbell, provided that any amended s32 does not conflict with the underlying Directive to which it is intended to give effect, nor is incompatible with Article 10 or other provisions of EU law. The issue is not whether the policy of the proposed amendments conflict with Campbell, but whether they are necessarily incompatible with Article 10.
2.21 It is not apparent to me that there is a necessary incompatibility, or that s32 as currently drafted is the least generous formulation from journalism’s point of view which is conceivably consistent with the ECHR if, indeed, it is consistent at all. Article 10 is a qualified right, inherently requiring a balance with other rights (including the right to privacy). I do not consider that Campbell can be read in the way that NI appears to contend, namely that a wide interpretation of s32 is necessarily required to give effect to Article 10 and that any narrowing of the scope of s32(1) is necessarily incompatible with Article 10. It must be remembered that the wide construction in Campbell concerned the temporal element of the exemption, i.e. whether it was confined to pre-publication activity or included publication itself. Campbell itself is entirely silent on the need to strike a balance between privacy and Article 10.
(b) The objection to a necessity test
2.22 It is argued by NI that the proposed replacement of the test of processing “undertaken with a view to publication”, with a test of processing “necessary for the publication” would be inconsistent with authority and unworkable in practice. NI makes the point that it is self- evident that for the s32 exemption to work it must cover, as it does at present, the processing of information which a journalist or editor ultimately decides to leave out of a published article.28 This point was, in fact, squarely addressed by Mr Coppel in oral evidence to the Inquiry.29 The exchange between Counsel to the Inquiry and Mr Coppel went like this:
Q. “Can we just look at a paradigm case of investigative journalism, that there’s a lot of preparatory work … before publication. If the journalist can show that all the work is necessary for the publication, then he or she is protected both in relation to the preparatory work and to the publication itself.”
Q. “Is that the correct analysis?”
A. “It recognises that particularly for investigative journalism, in which there may be a long trail leading up to the publication itself – and some of those sub-trails may turn out to be fruitless in themselves but are nevertheless necessary in order to explore all the avenues to produce the article itself. That will be captured by my proposed 32(1) paragraph (a).”
2.23 The policy intention here would be to tighten the nexus, or causal link, which the legislation requires between the acquisition and handling of the personal information and the ultimate publication but certainly not to the (obviously unworkable) extent that the exemption would apply only to material actually published. The idea would be to protect bona fide research or investigatory work without which publication could not happen, and that would have to apply from the point of view of the work at the time and not with hindsight. But it would not protect dealing in personal information unless it was properly necessary for research and publication. I do not see that that policy aim is either legally repugnant or necessarily unachievable in law and practice. As currently drafted, s32 of the Act requires the Court (or Commissioner) to consider whether the processing is undertaken with a view to publication, and that requires the Court (or the Commissioner) to consider the link between the processing and its ultimate purpose and the publication. Exactly the same conceptual process would be required under Mr Coppel’s proposals, but more would be being asked of the journalist to demonstrate the necessary link.
(c) Replacing the requirement in s32(1)(b) to have particular regard to the ‘special importance of the public interest in the freedom of expression’ with a more neutral balance, and an explicit balancing test
2.24 The NI submission30 suggests that this would be inconsistent both with Article 10 and s12(4) of the Human Rights Act. Dealing with the latter point first, I do not think that there is any arguable technical inconsistency with s12(4), which is essentially a procedural mechanism, directing a court when proceedings before it concern journalistic material to have particular regard to the importance of freedom of expression. In the event that a DPA claim engaging s12(4) were before the court, it would operate as a free standing provision and there is no need for the further incorporation of an equivalent provision in s32 in order to give effect to it. Where there are no proceedings before a court, for example where a journalist is considering whether s32 is met, s12(4) has no direct application.
2.25 It may be asked whether the recognition given in s12(4) to the importance of freedom of expression is not a reflection of the more fundamental point in the NI submission, namely that as a matter of ECHR law there is in fact special importance attached to freedom of expression, and beyond that to a lack of constraint on journalism, to which the removal of the formulation in s32 is repugnant. Undoubtedly, there is a very special public interest in freedom of expression, as formulated in Article 10. But it certainly puts the argument very high to say that the existing language of s32 is a minimum imperative required by the ECHR. Indeed, as is apparent, during the passage of the Data Protection Bill, some anxiety was expressed by expert opinion in Parliament to the effect that the pull it exerted on the scales balancing the public interest in freedom of expression as against other public interests (including privacy) was itself not compatible with the language of the Convention.
2.26 I do not consider, as the NI submission seems to suggest, that the current drafting of s32 can be held up as the only and immutable expression of the balance between personal information privacy and the value in a free society of journalistic (or artistic or literary) endeavour. An expression of that balance in UK data protection law, which occupies a more central zone of the margin of appreciation, and which is expressed in language more close to that of Articles 8 and 10 themselves and which encourages those exercising precious freedoms to be mindful in doing so of other people’s precious freedoms is something which it seems to me to be both possible and desirable to achieve. None of the provisions of s32 at present contains any explicit recognition of the wider context of public interest within which journalism must fairly operate. Mr Coppel’s suggestion of introducing an explicit balancing test seems to me to be both truer to the letter and spirit of the Convention, and an important and necessary encouragement to mindfulness where journalism handles, as it often must, private information.
(d) Taking individual subject access rights out of the automatic exemption provision
2.27 The NI submission describes this as “perhaps the most worrying of Mr Coppel’s proposals”.31 The right of individuals to know what information is held about them is of course at the heart of the data protection regime, and a very fundamental privacy entitlement in its own right. But its application in the modern world of journalism would be a change of some significance, and it is right that the idea should be considered with great care. The NI submission makes a number of points about the idea, some of which certainly need to be taken very seriously.
2.28 It is, for example, argued that it would seriously undermine the protection of sources. Journalists’ sources enjoy a considerable degree of legal protection, not least under Article 10 of the Convention.32 Any change to that protection would have to be considered most carefully, and in its own right rather than simply as the by-product of another policy. Sources (although not in a way specifically addressed to journalism) are, however, given considerable general protection by the data protection regime. That is because where access to one’s own data would necessarily involve the disclosure of information about a third party (including a source), the privacy entitlements of that third party have to be respected as well as one’s own. In conferring the right of access to one’s own information, s7 of the existing DPA, therefore, makes this further specific provision:
“(4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless—
(5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise. (6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to—
- the other individual has consented to the disclosure of the information to the person making the request, or
- it is reasonable in all the circumstances to comply with the request without the consent of the other individual.
- any duty of confidentiality owed to the other individual,
- any steps taken by the data controller with a view to seeking the consent of the other individual,
- whether the other individual is capable of giving consent, and
- any express refusal of consent by the other individual.”
2.29 It is an important, if technical, point to note that the subject access right is a compound right, including not just a right of access to the information, but a right to know whether information is held at all about one. So if even to confirm whether information is held would disclose a source, s7 makes provision for an answer which will neither confirm nor deny it.
2.30 I do not express a concluded view as to whether the existing provisions of the DPA are a complete answer to the challenge that introducing at least the possibility of a right of subject access has to be reconciled with the need to protect journalists’ sources. I simply observe that it is not apparent to me that the importance of protecting journalists’ sources cannot be captured in suitable amendment to these provisions, should any be needed. The more fundamental point is that there does not seem to me to be an argument from first principles that the protection of journalists’ sources necessitates a complete and blanket dis-application of the subject access right in all circumstances. And if it is not necessary to disapply a fundamental privacy right in all circumstances, it is necessary not to.
2.31 It is further argued by NI that there are other reasons why it would be necessary to take a blanket approach to this right in the world of journalism. These are:
- “the need for legitimate investigative journalism to be able to operate covertly, and over a period of time, without the object of the investigations being able to find out that the press are interested in them;
- “the burden on newspapers’ resources, particularly given the motivation of individuals to find out what is being held about them at regular intervals;
- “‘it would spell the end of the exclusive’ if individuals could get hold of a possible story and provide it on their own terms to another newspaper – or indeed take to the internet with their own pre-emptive version; and
- “that it fails to respect the balance required between Article 10 and 8 more generally.”
2.32 Care must be taken in this context to avoid rhetorical elision between matters of commercial convenience or profit, on the one hand, and a challenge to the current business model of the newspapers so fundamental as to amount to an abridgement of free speech, on the other. With the first of the four points noted above, it is possible to readily to agree. With the second and third, there are issues of degree. With the third in particular in relation to the question of exclusive stories, the business model may well be under rather more acute threat from the internet generally and the highly ephemeral nature of exclusivity once any publication takes place, than from any legislative change relating to the entitlement of individuals to know whether information is held about them. Similarly, the issue is to a degree less concerned with the exercise of freedom of expression than with the abridgement of the rights of others to receive and impart information. In reality, the key question, therefore, is the fourth, of which the first is an aspect. Does a fair balance between Articles 10 and 8 prohibit any possibility of subject access to journalistic material in all circumstances?
2.33 I am not persuaded that it does. It is evident that a fair balance would require an entitlement for a subject access request to be refused to any degree where to comply with it would compromise the protections envisaged by Article 10. But I am inclined to think that this could properly be done on a case by case basis rather than by wholesale ouster of the right. This point needs to be borne in mind: a significant aspect of the importance of the subject access right lies in the ability it gives individuals to test for themselves whether their information is being dealt with lawfully and in accordance with the data protection regime (including, of course, whether the information is accurate). That includes being able to test whether any exemptions are being properly claimed (although not to the extent that properly claimed exemptions are themselves thereby compromised). The complete exclusion of subject access from all journalistic activity removes a principal check on its lawfulness. Who then is to perform that function? The obvious answer would be the Information Commissioner, but that answer in itself takes us to a second area which Mr Coppel has identified as problematic.
Civil law enforcement: journalism, access to justice and the powers of the Information Commissioner
2.34 As well as the substantive exemptions provided by s32, the DPA creates a number of special procedural provisions which apply whenever it is claimed that personal information is being acquired or used for journalism. Their effects are both very significant for the purposes of the Inquiry and also very complicated. Their very complexity adds to their impact. It is necessary to engage with and unravel the detail of these provisions in order properly to understand and address their effect.
“Once a data controller claims that the personal data are being processed for a “special purpose” (i.e. journalism, artistic or literary purposes) or with a view to the publication by any person of any journalistic, literary or artistic material:
Where the proceedings are so stayed or the Commissioner has received a s 42 request for assessment, he may serve a “special information notice” (s 44). The object of the notice is to enable the Commissioner to carry out the s 45 determination. A data controller has a right of appeal against a special information notice (s 48).
- the Commissioner cannot ordinarily serve an enforcement notice or an information notice (s 46); and
- where a person has brought a claim under the DPA seeking a remedy for breach of any of the data subject’s rights (see §§37-45 above), the Court must stay the proceedings until there has been a determination under s 45 of the data controller’s claim (s 32(4)).
“Under s 45(1), where it appears to the Commissioner that the personal data are not being processed only for a special purpose or are not being processed with a view to the publication by any person of any journalistic, literary or artistic material, the Commissioner may make a determination to that effect. A data controller has a right of appeal against the determination. Once the determination takes effect, the Commissioner may serve an information notice. And, if a court gives leave, the Commissioner may serve an enforcement notice. If the Commissioner decides otherwise, proceedings for breach of the DPA may be stayed indefinitely…”
2.36 Broadly speaking then, the Information Commissioner cannot exercise his regulatory powers in relation to the press (and a court cannot decide an action brought by an individual for breach by the press of the rights contained within the data protection regime) unless the Information Commissioner has first made a formal determination that the newspaper is not, in relation to given personal information, using it wholly for the purposes of journalism. The only power he can use to help him make that determination is the power to issue a ‘special information notice’ for the purpose. And he cannot issue one of those unless either litigation is already on foot or he receives a specific request from a complainant. Where he does issue a special information notice, the newspaper can appeal it. And if he does finally make a ‘determination’ the newspaper can appeal that too. Any enforcement steps he is then able to take, whether investigative or compliance, each brings its own appeal rights.
“It results in a disapplication of the power to serve an enforcement notice – that’s the first important thing that it does – and then secondly, where an individual has brought a claim, a section 4(4) claim for breach of statutory duty through the DPA, then the court must stay those proceedings until there has been a determination under section 45, and section 45 is a special procedure relating to the so-called special purposes, ie journalism, literature and art, to see whether in fact that is the case. “In practice, what happens is that it becomes so convoluted– the individual disgruntled has commenced proceedings under section 4(4). If they – if the point is taken that these are special purposes, then a satellite set of proceedings is effectively launched, namely the section 45 one. That, if one ever gets to the end of it, reaches its end, it might come up with a conclusion. If the conclusion is in favour of the individual, then they resume their claim, by which time, of course, matters have marched on significantly and it may be of cold comfort, any such relief – [they may quite possibly have lost interest in living by then] and particularly if one realises that at the end of it all one is going to get like, for example, Catherine Zeta Jones, £50, one can well understand why interest might be a little bit diminished.”
2.38 During the course of the Inquiry, it has frequently been asserted that most or all of the evident problems with the culture, practices and ethics of the press would be solved if the existing law were to be properly enforced. Where press compliance with the legal requirements of the data protection regime is concerned, enforcing the civil law is a two-stage process. It must first ensure that the boundary between exempt and non-exempt activity in relation to dealings in personal information is properly observed by the press, and this is a point which applies wherever that boundary is drawn by the substantive law. Secondly, it must also ensure proper compliance with the regime where exemptions do not apply.
2.39 Law enforcement in these respects takes place in two different ways. First, it is by individuals bringing cases in the courts, and, secondly, by the exercise of his powers by the Information Commissioner. Both as regards litigation procedure on the one hand and as regards the assertion of the powers of public authorities on the other, there are already significant inhibitions in the general law which impact on the possibility of proper law enforcement in respect of the press because of the balance which must be struck between the public interest in law enforcement and the public interest in the protection of journalists’ sources. The additional procedural thicket which the DPA erects in the way of anyone attempting to find out whether the press is complying with the law, that is to say whether their activities are genuinely covered by exemptions and if not whether they are complying with what is legally required of them, is for practical purposes near-insuperable. The press, so this analysis goes, is effectively beyond the reach of law enforcement. In that regard, the legal regime can be and is disregarded for any practical purposes. Whether what the press are doing with people’s information is or is not specifically exempted from the regime hardly matters in practice since the question is effectively prevented from arising.
2.40 Mr Coppel suggested that this aspect of the problem should be addressed in two ways, that is to say by removing the elaborate tangle of red tape which stops the Information Commissioner doing his job in relation to the press, and by providing more straightforward access to justice for individuals.
Powers of the Information Commissioner
2.41 Here, Mr Coppel’s proposal is very straightforward: the DPA should be amended to repeal the entirety of the complex special regime limiting the Information Commissioner’s powers in relation to the press. Specifically, he recommends:35
“removing the provisions for special information notices (s 44), special purpose determinations (s 45) and special purposes restrictions (s 46), thereby aligning the DPA’s enforcement procedures as they apply to the press with those that apply to others, i.e. the ordinary provisions for enforcement (s 40), assessment (s 42) and information notices (s 43)”.
2.42 These provisions of the DPA are highly redolent of a policy context in which the self-interest of the press was a powerful advocate, rather than one in which law enforcement was an active concern. Given the specificity and elaborate nature of the provision made for testing the compliance of the press with the law, however, this much can be said: it cannot have been the intention of the legislation that the compliance of the press with the law should, in reality, be incapable of being tested in practice. No doubt concerns were vocally expressed that legitimate journalism should be able to go about its business without interference or ‘chill’ from overzealous regulators or nuisance litigation. But there is no policy intention on the face of the legislation that it should be impossible, in the usual ways, to establish whether the journalism was in fact legitimate in the first place. Such an intention would have been very simple to express legislatively although it would, of course, have been incompatible with the spirit and letter of the Directive. However wide the boundaries of an exemption are set, those boundaries have to be given some real meaning. Making those boundaries inaccessible, and the question on which side of them any activity falls effectively incapable of being answered, strips those boundaries of meaning.
2.43 The risks of applying the ordinary regime of information and enforcement notices to the press are capable of being overstated. An information notice could not be issued unless the Commissioner reasonably required any information for the purposes of determining whether the press were complying with the law. Similarly, an enforcement notice could not be issued unless the Commissioner was satisfied that the press had contravened or was contravening the law. In each case, the Commissioner would have to bear in mind any genuine risk to freedom of expression. Each measure, if deployed, has an appeal mechanism through which its compatibility with freedom of expression could readily be tested, case by case. It is not my view that the mere existence of the possibility of law enforcement measures of this sort would itself be an improper inhibition to journalistic activity, nor that the press would be slow to understand and make use of the sort of procedural safeguards which the standard data protection regime provides.
2.44 None of this is of course intended to give any encouragement to the idea of over-zealous reliance by the ICO on formal powers. As successive Information Commissioners have repeatedly emphasised, in general, the first recourse of a regulator with concerns about compliance should always be to seek to resolve matters informally and cooperatively. But it has not been my perspective that over-zealous recourse to formal powers has been a major concern about the way in which the ICO has engaged with the press and there are, in any event, plenty of inhibitions in law and practice to any such tendency. On the contrary, it appears that the most pressing concern is the need to address the extent to which the ICO is shy about performing its proper role in relation to the press as a member of its field of regulation, not least by addressing the evident cultural inhibitions to doing so created by the DPA’s complicated procedural regime. If the ICO has entertained a view that it is somehow unable to apply the law to the press, that it is not really supposed to do so, the process provisions are likely to have been a significant encouragement to that view, however overstated that view may be.
2.45 From the point of view of legitimate journalism, it is right that the ICO should not interfere or over-regulate. It is also right that journalism should be judged primarily by what it prints rather than be held to account at the newsgathering stage. A theme of this part of the Report, however, is that this does not mean that blanket exclusion from regular law enforcement measures is the only, or a very sensible, response. It is my conclusion that it is a part of the culture, practices and ethics of some sections of the press that there is a sense of comparative impunity and, in the main, of being beyond the reach of the law. This has not been in the public interest, and needs to be rebalanced by a greater sense of awareness of the law and what is the continuum between the constraints of the law and aspiration towards good practice. The existing procedural provisions of the DPA in relation to the press appear to be an unnecessary and unwelcome inhibition to making progress towards that goal.
Access to justice
2.46 In general, the DPA provides36 for individuals who suffer damage as a result of breach of the legal requirements of the regime to be entitled to financial compensation from the person or organisation responsible. It is a defence in such proceedings for the latter to show they had taken reasonable care to try to act in a way that is compliant with the law. If any individual has suffered damage, compensation is also payable for distress. Where, however, the contravention relates to acquiring or using personal for the purposes of journalism, literature or art, compensation is payable for distress alone, without the need to prove physical damage. This is in recognition of the fact that the unlawful widespread public dissemination of someone’s personal information is capable of having a distressing impact in its own right; this is the impact about which very many of the witnesses before the Inquiry have eloquently spoken.
2.47 In practice, however, the way that the courts have interpreted this entitlement to compensation has been very limiting indeed. As a result, claims are rarely successful, and even when successful have resulted in very small awards.37 At its root the problem is that the courts have been reluctant to award compensation for anything other than measurable financial loss caused by the breach of the regime. Nothing, in other words, is awarded for the distress in its own right, but only if it has occasioned economic loss. But by its nature, the subject matter of the regime, that is to say privacy, is unlikely to produce circumstances in which breach straightforwardly causes pecuniary loss. The harm done is the invasion of privacy itself.38
2.48 In other areas of the civil law, the courts have solved this problem by evolving a tariff of compensation to be paid for non-pecuniary loss. The best example is in relation to compensation for pain, suffering and loss of amenity in personal injury case. A more recent (and perhaps more relevant) illustration is the award of damages for breach of contract where holidaymakers have been let down by travel companies or holiday operators. The whole point of the contract was the pleasure of a holiday with the result that compensation will be payable for the disappointment.
2.49 On the face of it, the inability of victims of data protection breaches to obtain compensation for distress in its own right is an anomaly for a regime whose principal purpose is to safeguard individuals from unlawful intrusion into their private lives. The practical problem facing any attempt to address that lacuna, however, would be how to put a price on privacy in the way that the courts have evolved tariffs of compensation in other areas of ‘immeasurable’ psychological or emotional harm.
2.50 It must immediately be acknowledged that this is an issue which is relevant to activities in relation to private information which go beyond journalism, and beyond public dissemination of information in breach of the data protection principles. Damages for non-pecuniary loss in privacy cases is a potentially large subject in its own right, and one which has an extremely large and detailed context in the law of damages more generally.39 On the other hand, as indicated above, the DPA makes special provision for compensation for distress unlawfully caused by the press although this is a provision to which the courts have not in practice given substantive effect.
2.51 Mr Coppel tested the issue with the example of the medical records of an individual being published in a newspaper in breach of the DPA, that is to say, unfairly and without legitimate public interest justification.40 To that example might be added the example of the dissemination of intimate sexual details or nude photographs, again, for the purposes of the argument, unfairly and without legitimate public interest justification. Mr Coppel suggested: “That, it seems to me, is a fundamental breach of what the Act is there to protect”. Should the measure of recompense be simply how much money the individual may lose as a result – and if none, should the individual be left to endure any amount of distress and personal devastation uncompensated?
2.52 The DPA has been amended in recent years to make provision for the Information Commissioner to be able to impose monetary penalties, including in cases of this sort.41 But monetary penalties of course, while they may have a deterrent or punitive effect, still leave the victim uncompensated.
2.53 Mr Coppel’s own suggested solution has two elements. First, the Information Commissioner should be empowered to set a tariff of financial solace for breaches of the data protection principles, referable to the duration, extent, gravity and profitability of their contravention, such amounts to be in addition to amounts for damage and distress resulting from the contravention and to be followed by the Commissioner and the Courts. Secondly, a wronged individual should be provided with the choice of an alternative system to claim the tariff only, with no provision for damages, legal costs or fees, such a system to be administered by the Information Commissioner.42
2.54 Within Mr Coppel’s analysis and conclusions, there are proposals that are specifically directed to the law relating to data protection; others have far wider ramifications into the law of damages. As for the proposed way forward in relation to the DPA, I accept that, at their heart, they reflect a recognition that changes need to be made in order to provide a response to the demand repeatedly expressed for the law to be properly enforced in relation to press misconduct and for individuals to have proper access to ways in which they can enforce their rights.
2.55 More specifically, in relation to the ‘special enforcement regime’ provided in the 1998 Act in relation to the press, there are good grounds to conclude that it has had an unintended and damaging effect on the ability of the ICO to perform its functions. Exceptionally complex and largely unworkable in practice, it appears to have had a chilling effect on reasonable law enforcement and, equally, to have a high risk of impacting unfairly on individuals. In my judgment, Mr Coppel’s view is correct: its removal would promote the overall public interest and a balanced improvement in the culture, practices and ethics of the press in its approach to personal information.
2.56 In reaching that conclusion, I am very conscious of the need to ensure that legitimate journalism is not unduly impeded by attempts at pre-publication law enforcement on the one hand, albeit at the same time that individual liberties are not unduly stripped of their content by being rendered wholly unenforceable before publication (and then to be defeated by the act of publication) on the other. It is my provisional view that this difficult, but essential balance, is one which can and must be performed on a case by case basis by the ICO in considering the exercise of its powers, and that it is not one for which it is necessary or appropriate to attempt to make further provision by law. If, however, it were thought desirable to do so, it would perhaps be possible to preserve expressly in the Act the principle that, in considering the exercise of any powers in relation to the press or other publishers, the ICO should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime.
2.57 Built into this balancing exercise should be a requirement on the ICO, when considering the exercise of any of its powers, to have regard to the fact of membership of an accredited press regulator by the relevant title: this should be capable of establishing the proposition that the title subscribes to recognised and approved standards of conduct which are, themselves, enforceable.
2.58 The proposals for adjusting the boundaries and operation of the press exemption in s32 is a more difficult exercise. Although I am minded to the view that there is, indeed, an issue about compatibility, I do not consider that it is necessary for me to resolve whether there is any incompatibility between the provision as interpreted by UK courts and the UK’s European and international obligations. What I am, however, clear about is that there is room within the latitude afforded by those obligations for a fairer, more even-handed balance, and that improvement in that respect is, both as a matter of both law and policy, desirable.
2.59 I therefore recommend that the policy represented by the suggested revisions to section 32 of the DPA should be given effect to by suitable amendment to the Act. In doing so, I consider that particular attention should be addressed to one area where further refinement of that policy seems to me to be desirable.
2.60 The removal of the blanket exemption from the fundamental right of subject access currently provided by s32 seems to me to be right for the reasons considered above. But there are special considerations relating to the exercise of a right of this nature in relation to the press to which careful attention needs to be paid. It remains necessary for the right to be balanced against the special protections afforded by the law to journalists’ sources. That protection is not absolute as the law stands, but it is extensive. On the face of it, the existing general limitations on the subject access right which are designed to safeguard third party information do appear generally apt to follow the existing (important) protection for journalists’ sources. If it were thought that there was any doubt about the matter, however, that doubt should be resolved by a provision to the effect that the right of subject access is not intended to displace the general law on the inaccessibility of journalists’ sources.
2.61 Turning to the question of damages, I do not consider that it is appropriate for the Information Commissioner to be setting a tariff of financial solace for breaches of data protection or why this should be different from damages for distress (which might themselves be linked to damages for breach of other privacy rights). The proper place for the assessment of damages (or non pecuniary compensation) is allied to the consideration of damages across this area of the law. I return to this topic when dealing with the civil law.43
2.62 In making these recommendations, I accept that the current state of the legal framework in relation to the ICO’s civil law enforcement powers goes some way to explain the indications of reluctance by the ICO to take an active, or any significant, interest in the formal exercise of their regulatory functions in relation to the press. I do not, however, accept that as a complete explanation. In reality, there is a lack of evidence that the ICO has, over the years:
- regarded the symptoms of deficiencies in the culture, practices and ethics of the press in relation to personal information as a serious operational priority;
- shown a will to test in practice the powers and procedures conferred by law specifically for the purposes of ensuring compliance with the legal obligations of the regime by the press – however attenuated those obligations and however difficult those procedures; or
- drawn attention politically to any perceived shortcomings in the legal framework in this respect. This raises questions about a possibly deeper reluctance to accept an active role in relation to the press. Neither do I accept that other operational priorities must be accepted without more as an explanation for ICO inactivity in an area which the very existence of this Inquiry demonstrates to be a matter of acute public concern.
2.63 While recommending changes to the law, I do not intend to encourage the idea that the ICO should continue to take no steps to address the culture, practices and ethics of the press in the meantime. I therefore additionally recommend that the ICO should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime. I explain elsewhere, it is also my recommendation that in future such a policy should expressly provide that membership of an effective and independent self-organised system of standards regulation should be able to be taken into account by the ICO in contemplating the exercise of those functions.
2.64 I further recommend that the ICO take immediate steps to publish advice aimed at individuals concerned that they are or may have been victims of unlawful use of their personal information by the press. That might, for example, take the form suggested above, of enabling individuals, on application to the ICO, to obtain confirmation in so far as the office is able to offer it of whether they can be identified among the Motorman victims, and if so in relation to which title or titles, and to obtain assistance if necessary in making a suitable request to those titles. It might also take the form of engaging with victims’ representative organisations to those ends.
Promoting good practice: journalism and ss51-52 DPA
2.65 In considering the role of the ICO in relation to the conduct of the press in connection with the handling of personal information, it is sensible to start with ss51-52 of the DPA.44 These are among the simpler and more straightforward aspects of the application of the data protection regime to the press and it has not been suggested that the provisions should not be taken at other than face value. In short, they provide that:
- the ICO has a positive duty to promote the following of good practice in relation to the handling of personal information by the press, no less than in the case of any other business;
- the ICO also has a positive duty to promote the observance of the legal requirements of the DPA by the press, in so far as they apply;
- the powers of the ICO in relation to the dissemination of public information and industry guidance apply in the context of the press industry;
- the powers of the ICO to encourage sections of industry to develop and apply codes of good practice in the handling of personal information apply to the press sector;
- the duty of the ICO to make an annual report to Parliament on the exercise of its functions includes a power to cover press aspects in that report; and
- the power of the ICO to make special reports to Parliament includes the ability to make special reports about the intersection between the data protection regime in practice, and the culture, practices and ethics of the press in relation to personal information (which provision provided the basis for the laying of the What Price Privacy? Reports).
2.66 As a matter of ordinary public law, the exercise of any of these powers has to be kept under review, considered within the overall framework and purposes of the data protection regime as a whole, and both reasonable and proportionate in all the circumstances. On the face of it, relevant considerations in that context would include matters such as the extent of objective evidence of poor practice along with the nature and seriousness of that poor practice and levels of public concern. Evidence of widespread ignorance of the requirements of law and good practice (whether on the part of industry or individual) would be particularly relevant, especially if that ignorance were related to the genuine complexity of those requirements. As an expert regulator, the ICO would then be in a unique position to address the problem with explanation, education and support.
2.67 Of course, the exercise of any of these powers in relation to the press would also have to take into account the wider legal context, including respecting in full the balance to be struck both in law and in policy between the liberties of the individual and the vital requirements of a free press. That wider context would certainly affect the manner in which the powers were exercised, and the content of any guidance, codes, reports and so on. But it does not on the face of it appear to constitute a limitation on the existence or potential value of these powers in relation to the press.
2.68 For my part, I do not see any defect in these provisions which could limit their ability to contribute to the promotion of good standards of behaviour in the press in the handling of private information: none has been overtly suggested. There has been no suggestion, for example, that throughout the period in which Mr Thomas was trying to encourage the PCC to promote good practice in the industry, including by means of its own Codes and guidance, he was in any way inhibited as a matter of law by the legislation governing the ICO from acting in those areas or fulfilling those requirements himself.
2.69 If there were any real doubt in the matter, legislation could put its application to the press beyond doubt. Indeed, it would also be possible to introduce new positive duties in relation to the press, for example to insert positive duties into the legislation as follows:
- into s1(3) for the ICO, in consultation with the industry and the public, to exercise the power to issue comprehensive guidance to the press on good practice in the handling of personal information;
- into s51(2) to exercise the power to issue comprehensive guidance to the public on their individual rights in relation to the obtaining and use by the press of their information, and how to exercise them; and
- into s52 to include in the ICO’s annual report to Parliament an account of its perspective on press compliance with law and good practice in the handling of personal information and to draw special attention to any concerns.
2.70 I do not accept that there is any reason in law to explain the failure of the ICO to use these powers by taking active steps to address the need for improvement in the standards of the practices of the press in relation to the handling of personal information. Successive Commissioners have emphasised that this drive for good practice function is the cornerstone of the entire regulatory regime. Unfortunately, evidence to justify serious concern about the standards of the press in this respect has been available and well publicised: an informed, well-targeted, proactive and engaged approach to the problem might have made a real difference. It is a matter of regret to record that the failure by the ICO to address this issue must be regarded as a regulatory opportunity missed.
2.71 In those circumstances, I recommend that, in discharge of its functions and duties to promote good practice in areas of public concern, the ICO should take immediate steps, in consultation with the press, to prepare and issue comprehensive good practice guidelines and advice. This should include the articulation of principles and standards dealing with the acquisition and use of personal information. I hope and anticipate that the press will actively cooperate in the preparation and implementation of such guidelines and advice, not least so as to ensure that its Article 10 rights are fully recognised and reflected in the work. In those circumstances I would expect the guidelines and advice to be prepared and implemented no later than six months from the date of this Report.
2.72 I also recommend that the ICO take steps to prepare and issue comprehensive guidance to the public on their individual rights in relation to the obtaining and use by the press of their information, and how to exercise them. To demonstrate the effect of this guidance, the ICO should include regular updates on the practices of the press in relation to handling of personal information in its annual reports to Parliament.
Criminal Law: the sentence for breach of s55 DPA
2.73 The history of the campaign started by Mr Thomas to amend s55 DPA to introduce the possibility of custodial penalties on conviction (by providing a statutory maximum of two years imprisonment) has been set out. The position is that the Criminal Justice and Immigration Act 2008 introduced that amendment, but the changes had not been brought into force. A statutory instrument, to be laid before Parliament by the Government, is required.
2.74 As a matter of principle, the existence of uncommenced legislation on the statute books is potentially problematic. The power of the Secretary of State to commence legislation must, by law, be kept under review, so it always remains a live issue. As described elsewhere,45 the legislative process by which the maximum penalty was increased and the defence to the substantive offence available to journalists broadened, with both changes left uncommenced, was strongly indicative of a political compromise, designed as much as anything to quieten two opposing campaigning voices rather than as a response to a thought through policy analysis for which there was genuine empirical evidence. It is not surprising to find that the delicate balance of the compromise has not proved something which succeeding Secretaries of State for Justice have been in a hurry to revisit.
Recent history of the ICO’s s55 campaign
2.75 In October 2009, the Government published a consultation paper in seeking views on the commencement of both parts of the changes.46 Responses were sought by January 2010, with a view to assessing the possibility of activating the changes in the April of that year, at the same time as it was proposed to confer on the ICO enhanced powers in relation to civil penalties. It does not appear that the responses to that consultation exercise have been published by the Ministry of Justice. However, the press has consistently opposed the commencement of the provisions and the then Government did not bring the new provisions into force in what were the final weeks before the General Election. Neither has the current Administration advanced the position: a decision is now said to await this Report.
“The main reform, in my view, should be an immediate ministerial Order to activate the prison sentence for s55 offences. The public controversy of the last two months, and public outrage at press misconduct, make the case for that reform more pressing than ever. Even if there has been improvement in press conduct since 2006 there is still no guarantee that this will remain indefinitely and I understand that illegal activity remains rife in other sectors. A strong deterrent is needed and it is vital that a clear signal should be sent that s55 offences are not trivial or “technical”.”
His exasperation was evident in his oral evidence to the Inquiry:48
“I cannot for the life of me understand why the Government has now not activated that provision. … I am very disappointed as an individual now that still, despite all the material that has surfaced in recent months, the order has not been activated. It would be a very simple matter to bring that into force now, and my broad understanding back in 2008 was that it would only be a delay of six months or so, but that has not yet materialised.”
2.77 The ICO campaign on s55 has continued under Mr Graham, but with a perceptible change of emphasis. The ICO submitted evidence to the consultation on activation of the new provisions at the end of 200949 but, by this time, Motorman was presented as somewhat distant history. The ICO submission focused instead on examples, including half a dozen case studies, of the blagging of personal information by deceit in the routine criminal contexts of unscrupulous debt-collection, commercial espionage and profiteering, and personal grudge and intimidation. Judicial sentencing remarks in cases prosecuted are cited to the effect that the sentence maxima on s55 conviction did not allow a sentence to be passed commensurate with the criminality of the behaviour. An example is given of ICO investigators executing a search warrant: “They were greeted at the premises, by an individual who had a previous conviction for a section 55 offence, with the following comments. ‘What’s the maximum fine for this, £5000? I will write the cheque out now.’” At the other end of spectrum, Mr Graham explained in evidence that he wanted to:50
“…deal with the problem of the courts being limited to fines and then dealing with people who are of limited means and can only be fined about £100, and the court doesn’t have the option of doing anything about a community sentence or tagging or curfew or whatever else might be involved. It’s just the going rate is £100. It happened again the week before last. It’s nothing.”
2.78 Other general points are made in the ICO submission to the consultation exercise about the consequences of s55 not being capable of attracting a custodial penalty. Two points in particular should be noted: “At present the offence of unlawful obtaining etc is not a recordable offence. It is not therefore recorded on the Police National Computer. Fingerprint impressions, DNA samples and descriptive details are not currently taken from those individuals who are prosecuted by the ICO for the section 55 offence (a descriptive form contains personal information relative to the accused person, for example, ethnic appearance, build, shoe size, glasses, hair, facial hair, marks, scars and abnormalities etc). If the penalties for this offence are increased to imprisonment the offence will become a recordable offence. This will not only underline the serious nature of the offence but will ensure that those convicted carry a meaningful criminal record.” The criminal record is both a matter of deterrence in its own right and also of assisting detection. The second point made is that, with a custodial penalty available, s55 crime could fit within the framework of the European arrest warrants; data crime is an easy cross-border activity, and the availability of simple extradition procedures would overcome jurisdictional inhibitions to criminal enforcement.
2.79 Subsequently, including in an update report to the Ministry of Justice in August 201151 and in the evidence that Mr Graham provided to the Inquiry, the ICO has sought to turn the spotlight in relation to s55 definitively away from the press altogether. As discussed above, that is articulated by way of an assertion that the practices of the press are no longer an issue in relation to information blagging. From the perspective of the ICO, however, given the history of the s55 campaign, there is no doubt a degree to which the press are simply seen as the principal inhibition to the commencement of these provisions. The policy is now to seek to neutralise the hostility of the press and emphasising that the policy aim to be achieved now has little to do with their activities no doubt has that in mind. Mr Graham illustrated this in his evidence when he said:52
“In fact, I went to the Society of Editors conference in 2009 and said: ‘it’s so not about you. It’s about NHS workers, it’s about private investigators, it’s about bank clerks, and it’s frustrating not to be able to deal with that real challenge, which the Information Commissioner’s office is concerned to deal with, because we’re constantly met by the press saying, “This is terrible, the sky is falling, the sky is falling”. It really isn’t.’”
2.80 That the tension between the ICO and the press on the s55 issue is still very much a current source of heat was vividly illustrated by exchanges between Mr Graham and Mr Rhodri Davies QC, asking questions on behalf of News International. This exchange is set out at some length here because it illustrated in microcosm, and in many ways can be regarded as the summation of, the long years of debate and lobbying on this subject, in Parliament, in successive Governments, and in other public fora. Mr Davies put it to Mr Graham that, if the behaviour of the press was not itself the current operational focus of the campaign, nevertheless:53
“The political problem, if I can call it that, that you have in getting the existing legislation into force is what we might call the perceived effect on the press. It’s not the bank clerks who are campaigning against this; it’s the perceived effect on the press which is your problem?
“A. My problem is the press. It’s not the perceived effect on the press, it’s the behaviour of the press, worrying away at a penalty designed to deal with a problem which they say doesn’t apply to them, and I say, “If it doesn’t apply to you, get out of the way.”
“Q. Isn’t the way through this, which might perhaps satisfy both parties, simply to exempt from the threat of a prison sentence anyone who is acting for the special purposes of journalism, artistic or literary matters, using the phraseology in Section 32?
“A. How much of a good deal do you guys want? Excuse me, sir, for being heated about this, but you fought everyone to a standstill back in 2006/7. You did it again in 2009/10. You’ve got so many privileges and exemptions. It’s perfectly possible for a journalist to do a decent job legally. There is Section 78 [of the Criminal Justice and Immigration Act 2008] on the statute book, applying the reasonable belief of the journalist that what they were doing for publication was in the public interest. It’s going to be very difficult for anyone to strike that down, but there are some people who believe that that’s more generous to the press than really should have been the case, but that was the deal. Now, if I understand it, you’re sort of coming back for more - on behalf of your clients.
“Q. What I’m trying to do, Mr Graham, is to point out a route through the problem, or one that bypasses the Gordian Knot, and I’m not quite understanding why this solution is not acceptable to you.
“A. Well, this isn’t a negotiation about these things, but it sounds to me as if the representatives of the press want to be somehow above the law. Surely a free press operates within a framework of law, and a vibrant and healthy press, challenging those in authority and doing the job that it should be doing and the job that I joined the profession to do, operates within the law. Yes, okay, you sometimes have to apply the dark arts to get the story, and then you’re accountable for it. And if you’re really in trouble, that’s the mitigation that you put to the court. But we can’t keep having more and more carve-outs and reductions and special cases, surely.
“Q. The point is, Mr Graham, that prison sentences do have a more chilling effect than the lesser sanctions available to the court -
“LORD JUSTICE LEVESON: Is that right, Mr Rhodri Davies? I’d be very interested to see evidence about that, because one thing is for rock solid certain: interception of communications did have a custodial sentence attached to it, and it didn’t seem to have stopped a great deal of activity.
“MR DAVIES: Well, that certainly was true-up to 2006/7, I entirely understand that.
“LORD JUSTICE LEVESON: I’m not, I think, trying to make a cheap point. I’m not doing that at all. But I am concerned about the evidence base for the assertion. I’m not stopping you, I understand the point, and of course you can pursue it.
“MR DAVIES: Well, I think - really, what I’m putting to you, Mr Graham, is your own assumption, which is that if the sentences available for breach of Section 55 are increased and the range of sanctions available to the court is widened, then you think that that will have a beneficially chilling effect on people who would otherwise contemplate a breach of Section 55?
“A. It would have a beneficially chilling effect on DVLC workers handing out car numbers and addresses based on those car numbers in exchange for money. It will have a beneficial chilling effect on health workers who apparently think it’s perfectly okay to access someone’s medical records in order to find the telephone numbers of their in-laws, who they’re having a fight with, or the bank clerk in Haywards Heath who thinks it’s fine to look at someone’s bank records in order to provide the case in her husband’s defence in a sex attack trial. That’s what we’re dealing with. What’s that got to do with the press? If you’re not doing this stuff, get out of the way.
“Q. Yes. I entirely understand those problems.”
2.81 Mr Davies took Mr Graham through some practical examples of where the public interest defence might be relied on by a journalist in a s55 case. These drew on the sort of material which emerged in Motorman. The exchange continued:54
“MR DAVIES: So that is a situation, Mr Graham, where, as I understand it, you think that the journalist might very well have a public interest defence?
“A. I say it’s arguable, anyway.
“Q. It’s arguable. That’s the difficulty, isn’t it? Because once we’re into the territory of it’s arguable, and it’s a prison sentence if you’re wrong, do we not have a chilling effect?
“A. But all you have to advance is the reasonable belief that the story you’re pursuing was in the public interest. Really, if you can’t make that case, you shouldn’t be in journalism. It’s a very, very good increased defence for journalists.
“Q. I’m just wondering how far that goes. So you say if there’s a reasonable belief that the story you’re pursuing is in the public interest, then that would be a public interest defence to obtaining an ex-directory telephone number?
“LORD JUSTICE LEVESON: I’m not going to allow you, Mr Davies, to use the opportunity to try and tie the Information Commissioner down. Let me say what I presently believe, and then people can make submissions in due course. I presently believe that the new potential provision contains both subjective and objective elements, so not only must the journalist believe that it’s in the public interest to do so, but there must be reasonable grounds for that belief. Thereafter, if I follow up your earlier question, the Information Commissioner would have to decide whether there was evidence to rebut that defence before he thought of bringing a prosecution. If he thought of bringing a prosecution because he thought he could rebut the defence, it would be open to the journalist to advance the defence in court. If the court decided against the journalist, then it would have to decide on a scale how grave the particular offence was, and in my experience of sentencing criminal cases, which extends over 27 years, I don’t think you’ll find that there would be any question of a mandatory sentence in those circumstances at all.”
2.82 No further formal submissions were in fact received by the Inquiry on this subject and it now falls therefore to reflect on the extent to which this Report should seek to resolve the matter on way or the other. I do not, for the reasons set out above, accept that I should avoid doing so on the grounds that I can be confident that the culture, practices and ethics of the press are such that it is simply no longer a live issue within the Terms of Reference of the Inquiry. Bearing in mind those Terms of Reference, however, it is important to make clear two points.
2.83 The first point is that the thread of argument in Mr Thomas’s original campaign (that increasing the sentencing maxima for s55 was a necessary element in increasing the profile of the data protection regime generally, and the seriousness with which it is regarded, whether politically of forensically), is not the concern of this Inquiry and not something on which this Report can or should express a view. Secondly, since the operational considerations currently being advanced in favour of commencing the increased maxima are explicitly said to be directed elsewhere than in the direction of the press, these are not considerations within the purview of this Inquiry and not matters on which it would be appropriate for this Report to have a determinative effect
2.84 S55, in other words, is not a provision of exclusive application to the press, and it is necessary that I should be suitably circumspect about any effect of considering the matter otherwise than in relation to the press. S55 is, however, a provision which, as amended, has a specific and modified application to the press, and to that extent the uncommenced amendments must be considered to be part of the special approach to journalism that is evident throughout the data protection regime. It is also a provision the history of which, up to and including the present day, has been dominated by the press’s policy interests. It is impossible therefore to avoid reflecting on the history of the s55 issue in the context of this Report at any rate in relation to the press dimension to the policy.
2.85 This is not in any event, as indicated above, simply a policy issue at large. Parliament has considered this matter in extensive detail and legislated on it. The very strong presumption must be that Parliament does not legislate in idleness. Deferred implementation of legislation, in the rare instances in which that is deliberate policy, is usually a matter of making provision for preliminary practical issues or, as in this case, to allow for contingent events. The s55 contingency might be described as a policy of waiting to see whether the mere uncommenced existence of the possibility of a prison sentence would itself prove to be a deterrent to criminal activity. There appears to be ample evidence that criminal activity comprising the knowing or reckless misuse of personal information continues to be a real problem, and that specifically the absence of a potential custodial sentence (which would therefore permit sentences short of custody such as a community penalty) has emerged as a contributory factor. This is not least because, as Mr Graham made clear, a financial penalty must be related to means to pay and those of limited means will therefore face potential sanctions which have little correlation with the gravity of the offence and the potential for harm.
2.86 The only reason which has been cited to the Inquiry for failure to commence the provisions for increasing the maximum potential sentence is the potentially damaging effect that it would have on journalism. These are not considerations which, in my view, can reasonably argued to be persuasive, let alone determinative.
2.87 In the first place, the argument that the prospect of custody would have a differential ‘chilling’ effect on lawful and ethical journalism from the prospect of a financial penalty is one which it is barely respectable for national press organisations to advance at all. Its necessary implication is that the prospect of a criminal conviction can, of itself, be regarded as a tolerable business risk, and a criminal fine a tolerable overhead, in journalism. This says little more than that ‘unchilled’ journalism is an activity which takes calculated risks with deliberate and indefensible criminality. This is an argument for criminal impunity including (as it was put before the Inquiry) by way of a plea for indemnity from the otherwise universal application of criminal penalties; it amounts to special pleading to be placed above the law. I put the matter starkly, because no-one reading this Report should be in any doubt as to the true nature of the argument being advanced on behalf of the press in its most unqualified form.
2.88 There is a more respectable version of the argument that there is a chilling effect in this provision. That version is not a contention that the press should be indulged in committing calculated criminality. It is an argument that the boundaries in this territory between what is criminal and what is not are not clear enough to make it safe for journalists to operate confidently. It is not an argument therefore about the consequences of criminality but about the risks of crossing criminal boundaries unwittingly. Where the boundaries are unclear, the possibility of a custodial penalty raises the stakes to the extent that decent journalists will have to take a risk-averse approach and give them a wide berth. The result, so the argument goes, is that some areas of investigative journalism on the right side of the law will be lost and that this would be contrary to the public interest.
2.89 This remains an argument which envisages journalism tracking the boundaries of crime in a way which is not, and has not been over the years in which the s55 issue has been debated, empirically evidenced as a genuine operational problem to any degree; neither does it deal with the ethical (and indeed legal) questions which are raised by behaviour which is only just on the right side of crime. But the important point is that it is essentially an argument about whether the provision made in the new defence to cater for journalistic operations where they do sail close to the wind is adequate. If the defence deals satisfactorily with the boundaries between criminal and lawful journalism, then the question of the ultimate penalty must be a genuine second-order issue.
2.90 It is hard to see how the new defence could go any further. If a journalist engages in a course of conduct which prima facie crosses the criminal boundary marking the unlawful acquisition of personal information, but can show that he or she was acting with a view to publication and in the reasonable belief that it was in the public interest, there can be no conviction. Note that it is not even necessary to show that the conduct was in fact, in the end, in the public interest. There is no alternative to asking the journalist to establish that the belief was genuine, because its basis will be uniquely within his or her own knowledge. And if the belief was neither genuine nor rational it is hard to see the case for a defence to crime. The provision made by the new defence to give honest journalists trying to respect the boundaries of the criminal law confidence in doing so, appears to be straightforward to understand, and more than adequate in giving honesty the benefit of the doubt.
2.91 I am, therefore, entirely unpersuaded that the argument that there is a possible chilling effect on legitimate journalism is a reasonable one, and should be regarded as a proper reason in itself for continuing to resist giving effect to the legislation. Much more the point: Parliament has already settled the matter from a policy point of view. To the extent that the press effectively wishes to reopen not the question of penal policy but the matter of the substantive law itself, it is both too late and devoid of merit. Without suggesting that no other formulation of the new defence is imaginable, Parliament has given very close attention to the alternatives, and settled on something which, on any fair analysis, is fully capable of being made to work for the press.
2.92 I am conscious that in recommending the activation of the amendments to the Data Protection Act created by the Criminal Justice and Immigration Act 2008, this Report is dealing with an issue with considerable history, and not just as a matter of addressing the culture, practices and ethics of the press in relation the acquisition and use of private personal information. It is also addressing the operations of the press as powerful lobbyists on self-interested questions of media law and policy. On both of these grounds, I conclude that the public interest, taken in the round, favours there being no further delay in the implementation of this measure.
2.93 As indicated in the Government consultation paper,55 therefore, I recommend that the necessary steps are taken (by statutory instrument) to increase the sentence maxima on conviction for an offence under s55, to include, in addition to the current fines, custodial penalties up to the statutory maximum on summary conviction, and, on conviction on indictment, up to two years’ imprisonment.
2.94 It is important to underline that I also recommend that the enhanced defence for public interest journalism be activated at the same time.
Prosecution powers of the ICO
2.95 Before concluding this part of the Report, a number of further aspects of the criminal law functions of the ICO in relation to the press fall to be considered. One particularly important piece of context to the s55 debate is the fact that this is the only offence in respect of which the ICO has prosecution powers. There are other criminal offences which are also contraventions of the data protection regime when committed in relation to personal information (which, incidentally, already attract the possibility of custodial sentences). There may be considerable overlap between these other offences and s55. Examples include:
- phone hacking contrary to the Regulation of Investigatory Powers Act 2000;56
- computer hacking contrary to the Computer Misuse Act 1990;57
- offences of corruption, bribery and aiding and abetting misconduct in public office; and
- inchoate and accessory offences including attempt and conspiracy.
2.96 There is indeed an argument that, since the first data protection principle requires that all acquisition and use of personal information must be fair and lawful, all criminal offences in relation to personal information within the meaning of the data protection regime will also constitute a breach of that regime.58 In practice, in any case in which a breach of the data protection regime may also constitute a criminal offence other than under s55, the ICO will effectively hand the matter in its entirety, and defer wholly, to the police and the CPS. That is at least in part because all of the other offences comprehend, including by way of higher sentencing maxima, a much wider spectrum of seriousness. That is important context for the decision in Motorman itself which, effectively, was to stand back from the prosecution process while the police and CPS proceeded with corruption and conspiracy prosecutions. But it has two important practical consequences.
2.97 The first consequence is that it effectively relegates s55 to a wholly residuary position, in practice only of real use in cases where all other criminal possibilities have been eliminated. But the process of elimination itself may, including by reason of delay, weaken the prospect in the end of bringing s55 charges. Secondly, it also puts the ICO at a disadvantage in considering cases of breach of the data protection principles in the round, including giving full consideration to alternatives to prosecution. So in cases at the extreme end of breaches of the principles and rights of the regime, the expert regulator is in danger of being left out of the picture altogether.
“In some circumstances, such as an allegation of unlawful processing, I have to rely on the police and the CPS to indicate whether they consider that an offence under another relevant Act has been committed before I can properly assess whether there has also been an associated breach of the data protection principle on which I might act. On the other hand if my office comes into possession of evidence which suggests that an offence has been committed under other legislation, I would pass this directly to the police or suggest to a complainant that he or she does so….. “It is possible that, in some circumstances, personal data could be obtained in a way that suggests the commission of offences under both another Act and under section 55 of the Act. The investigation of offences which carry a custodial penalty takes precedence over the investigation of offences, such as those under the Act, which do not. Usually, the police will take the lead in investigating where penalties that carry a custodial penalty are suspected. They can consider the offence under section 55 of the Act as part of their investigation if they choose to do so. Whilst my office will pass relevant information on to the police to assist them in any investigation, it does not make good sense for us to run our own investigation in parallel.”
2.99 As considered at length above, this cannot stand as a full account of the operational inaction of the ICO in relation to the press and its involvement in Operation Motorman. But it does suggest a weakness in the scheme of the powers and functions of the ICO. It is a weakness which would be remedied in part by the activation of the higher sentence maxima for s55 because, at least, it would address the problem of its role as an offence of last resort by strengthening the ability of the ICO to prosecute s55 cases which also constitute other offences. But it would not address the position of the ICO as a prosecutor of last resort or the disabling effect of that on its consideration of the exercise of its other regulatory functions in relation to serious abuses of personal information.
2.100 This isa point of considerable importance for that strand of opinion in relation to phone hacking that urged that the primary response of this Inquiry should be to ensure that the existing law (and, in particular, the existing criminal law) is properly enforced. As fully set out above,60 the huge investment of the resources of the Metropolitan Police in their current Operations Weeting (phone hacking), Tuleta (computer hacking), and Elveden (corruption) is both unsustainable indefinitely and unrepeatable in the future. It is, however, noteworthy that all concern the possibility of the press committing crimes which involves the acquisition of personal information in breach of the data protection principles.
2.101 Information crime in contexts involving neither national security issues nor the furtherance of other criminal purposes (that is to say, crime constituted wholly by the extreme violation of personal information privacy), is a matter which cannot hold a place at the top of the police agenda in competition with the many other priorities that the police face. Nor, in any event, can the police be expected to invest in the deep expertise in personal information privacy which the data protection regime envisages in for its own regulatory authority. Furthermore, the handling by the police of these cases is effectively binary: charges are either brought or dropped, without consideration of law enforcement issues falling short of criminal liability. The present disposition of prosecution powers therefore presents a threat to the proper enforcement of privacy crime in the future, including in relation to the press.
2.102 One possible way to address that problem would be to enable the ICO to prosecute breaches of the data protection regime which constituted criminal offences whether or not they did so as a result of s55. This would, in particular, enable the ICO to deal with cases of data abuse going beyond the processes of first acquisition of the information. It would have a number of specific advantages. It would:
- relieve the police and CPS of the pressure of privacy crime on their priorities and resources;
- place prosecution in the hands of an expert regulator who would be well placed to investigate cases and if appropriate place their full criminality before the criminal courts;
- enable cases to be dealt with within the rounded context of a regulatory regime which has a range of other operational options falling short of prosecution. Three matters would, however, have to be addressed in taking forward thinking in this context.
2.103 The first is the necessity of acknowledging, again, that this is not an issue of sole application to the press, and that it is beyond the purview of this Inquiry to address its implications in areas which have nothing to do with its terms of reference. As against that, however, it is necessary to note the very close association of the issue of prosecution powers with the s55 issue as discussed extensively above. And whereas it is to a degree speculative to reflect on the Motorman case itself from this perspective, there are genuine questions, including those raised at the time and since by the ICO itself, as to whether in the circumstance an information regulator, alive to the magnitude and nature of the breach of the law and good practice of the data protection regime and armed with a full range of responses up to and including prosecution for serious offences, would not have afforded the best prospects of effective law enforcement and of making the case a turning point for the good in the culture, practices and ethics of the press in the handling of personal information.
2.104 The second matter that would need to be addressed would be the capability and governance of the ICO itself in handling any enhanced prosecution functions. In so far as those questions have wider implications they are addressed more generally below. But it would be highly desirable to ensure that in all of its prosecution functions there was excellent liaison between the ICO and the police and CPS. It might, for example, be desirable to make the exercise of any powers to prosecute s55 cases which also constitute or may constitute other criminal offences and criminal breaches of the data protection regime falling outside s55 formally the subject of a duty to consult with the CPS.
2.105 The third matter concerns the position of the press as the potential subjects of criminal investigation by the ICO. Under that heading two issues in particular present themselves. The first relates to the circumstances in which the ICO might bring a prosecution as opposed to relying on its civil regulatory powers. That is a question which would need to be addressed by reference to the public interest. At the invitation of the Inquiry and following consultation, the Director of Public Prosecutions has issued guidelines for prosecutors on assessing the public interest in cases affecting the media.61 The ICO would be expected to follow these guidelines in the exercise of any enhanced prosecution powers and indeed in relation to its current powers. Mr Graham has already indicated that he is:62
“happy to give an assurance that I will not seek to prosecute journalists who are genuinely pursuing enquiries in the public interest, even if those enquiries do not ultimately bear fruit.”
2.106 Subject to the point of generality noted above, my conclusion, therefore, is that proper and proportionate enforcement of the criminal law in relation to press abuse of personal information would be enhanced by extending the prosecution powers of the ICO to include offences which comprehend a breach of the data protection principles in addition to the offence created by s55 of the DPA, coupled with a duty (whether formal or informal) to consult the CPS on such prosecutions, and the formal adoption by the ICO of the CPS guidelines on media prosecutions.
2.107 I recommend also that the ICO take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to handling the issue in the aftermath of Operations Weeting, Tuleta and Elveden, on the basis that the priority currently being given by the police to addressing this form of alleged criminal behaviour is not sustainable indefinitely, and with a view to ensuring that the ICO is well placed to fulfil any necessary role in this respect in future.
2.108 The position of the ICO as prosecutor of last resort does not fully account for evident weaknesses in its handling of the question of criminal investigations in relation to the journalists involved in Operation Motorman. The ICO has prosecution powers at all because it is uniquely placed to view personal information privacy crime in the full context of its regulatory regime as a whole. This includes the perspective of the victim in such a context. That is a responsibility which it does not appear was fully engaged let alone discharged. I consider, however, that the enhancement of the prosecution powers of the ICO has a potential positively to support that position of overview and overall direction regarding information privacy breaches that are so serious as to enter the criminal spectrum. Further, it is reasonable to conclude that it could help to dissolve artificial boundaries, avoid confusion of accountabilities and support a better focus on the nature of the conduct and its impact on the individual.
2.109 A final issue to be considered within the framework of formal criminal law enforcement is the matter of sentencing. When dealing with the criminal law generally,63 I recommend that the Sentencing Council of England and Wales be asked to prepare guidelines in relation to information privacy and misuse offences (including computer misuse): for the sake of completeness, it is sufficient simply to repeat the recommendation and refer to the reasons for it.
Conclusions and recommendations on the legal framework
2.110 The recommendations set out above are not intended to do other than provide for more effective enforcement of the existing principles of law as they stand, and for a fairer, more even handed approach to the reconciliation of existing rights within those principles in cases in which they may conflict. They are also intended, importantly, substantially to simplify the law and make it more accessible to those, that is to say both press and the public, whom it is designed to serve. There are implications in these recommendations also for the legal system, the legal profession and the courts. Although the data protection regime is intended to sit lightly on businesses and not regularly to trouble the world of litigation, that is precisely because it is explicit in the provision it makes as a matter of law; in the rare cases where it does need to enter the legal system to resolve a disputed issue, the fundamental liberties with which it deals, and the sensitivity with which it deals with them need to be recognised for what they are.
2.111 As Mr Coppel has pointed out, the European Commission is currently considering replacing the existing Data Protection Directive with a directly applicable regulation. The present proposed Regulation would leave it to individual Member States to provide in detail for the exemptions or derogations it sets out. Those include provision relating to the processing of personal data for journalistic purposes. That means that it would be for Parliament in due course to come up with a suitable formulation, within the limits of what the regulation eventually requires. In other words, the expectation is that Parliament will have to revisit this topic in any event.
2.112 It would be unfortunate if that were regarded as reason for legislative inaction in the meantime. Any new regulation would itself, of course, have to make general provision within the overall requirement of the ECHR for a balance between Articles 8 and 10, and indeed would any UK domestic legislation. The risk posed by the prospect of a new regulation that any legislation prompted by this Report would have to be revisited seems to me in this respect to be of modest proportions, and to be outweighed by the need to make progress on amendment to the 1998 Act, both as a matter of law and of policy.