Production company True Visions Production (TVP) have received a £120,000 monetary penalty notice from the Information Commissioner's Office (ICO), after setting up fixed cameras to record footage, over a six month period, of at a clinic at Addenbrooke’s Hospital Cambridge, for a Channel 4 documentary on stillbirths.
The penalty was imposed under the now-repealed Data Protection Act 1998 (DPA98), as it related to incidents prior to the General Data Protection Regulation (GDPR) coming into effect.
The ICO noted that, although TVP had put up signs drawing attention to the filming and left "generalised" letters in waiting areas, consent was not sought from patients in advance, and the signs and letter were inadequate, or actually misleading (the signs stated "no mums or visitors will be filmed without permission", when this was not accurate).
The ICO found that the filming was in contravention of TVP's obligation to process personal data (and this was – notably – particularly sensitive personal data) "fairly", in accordance with the first data protection principle of DPA98. And, although TVP sought in representations to the ICO to rely on the data protection exemptions for processing for journalistic purposes, this argument foundered because the ICO found that although TVP had a subjective belief that compliance with the first data protection principle was not compatible with its journalistic activities, this was not (following the dicta of Mr Justice Warby in NT1 & NT2 v Google LLC,  EWHC 799 (QB)) an objectively reasonable belief. In arriving at this position, the ICO also had regard also to Ofcom's Broadcasting Code.
Additionally (with reference to the DPA98 first data protection principle), the ICO found that the processing had not been "lawful", because it constituted "a gross invasion of privacy which was an unjustified and disproportionate interference with the [ECHR] Article 8 rights of the patients filmed".
Furthermore, the fact that – after they had initially been challenged about, and ceased, the filming – TVP then resumed, but with handheld cameras and appropriate consents from data subjects, and ultimately produced a programme which gathered much acclaim, showed that there had always been an alternative, unobjectionable, means of gathering the footage.
It is interesting to see the ICO probing the limits of the DPA98 "journalistic exemption". The equivalent exemption for journalistic purposes in the Data Protection Act 2018 is drafted in similar terms (although, crucially, a court must now grant leave for a notice to be served), and controllers relying on it would therefore be strongly recommended to read this TVP monetary penalty notice carefully.