This briefing note is only intended as a general statement of the law and no action should be taken in reliance on it without specific legal advice.

No blanket exemption from data protection compliance for media – ICO Guide published
08 September 2014

No blanket exemption from data protection compliance for media – ICO Guide published

At the end of last week, the Information Commissioner published his widely awaited guide for the media on data protection and journalism.

The Guide does not create new law, but clarifies how the Data Protection Act should be interpreted. It explains how the rights of individuals in relation to their personal data and its use by organisations is balanced with the those of journalists who often seek to rely on the right of freedom of expression to publish personal data.

Clearly, the right to privacy and the right to free expression will sometimes clash, and section 32 of the Data Protection Act (often referred to as the 'section 32 exemption'), sets out a formula which seeks to balance those two competing interests.

The background to the Guide lies in the Leveson Inquiry, which recommended that the ICO "should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data."

One key issue that has arisen between individuals and organisations holding their data has been around the scope and application of the section 32 exception.  Broadly, it provides that if personal data is being held only for the special purpose of journalism, the data controller may refuse to supply the information to the individual concerned.

The Guide advises the media on how section 32 works. Section 32 is set out in four parts, each of which must be met by the organisation involved:

  1. the data must be processed only for journalism;
  2. with a view to publication of some material;
  3. with a reasonable belief that publication is in the public interest; and
  4. with a reasonable belief that compliance with the obligations imposed by some of the provisions of the Data Protection Act is incompatible with journalism.

The Guide highlights that "the [section 32] exemption protects freedom of expression in journalism. The ICO must interpret it broadly to give proper protection to freedom of expression but we will also expect organisations to be able to justify why the exemption is required on the merits of each case. The law does not provide journalists with an automatic exemption."

It may come as a surprise to some that section 32 does not provide a blanket exemption to those who engage in journalism.  As the Guide states: "You should be able to show it was impossible to both comply with a particular provision and to fulfil your journalistic purpose" and "[organisations] cannot rely on a blanket policy that the media don’t have to comply with certain requirements; there must be specific consideration given to each case, at an appropriate level."

This firm advises a number of individuals who have been unable to acquire details of their personal data from organisations that claim total exemptions from providing it under section 32 of the Data Protection Act, and as such we have been awaiting the publication of the Guide with interest.