The ability of media organisations to hold personal data on individuals with a view to publication is under the spotlight in a high-profile case now being referred to the European Court of Justice (CJEU).
A data controller such as a newspaper facing proceedings under certain parts of the 'old' Data Protection Act 1998 can seek a stay of those proceedings where it claims that the personal data it holds is unpublished material being processed for journalistic purposes with a view to publication. Under ss.32(4) and (5) of the Act, the court must stay the proceedings until either the claim is withdrawn, or the Information Commissioner (IC, the data protection regulator) determines that the data are not being processed for the claimed purpose. The data subject cannot compel the IC to make a determination, which means that a stay will often become lengthy or permanent. In practice, the provision has acted as a considerable bar to bringing DPA proceedings against the press.
The issue has arisen in the context of a broader dispute between James Stunt and Associated Newspapers over articles published in the Daily Mail and Mail on Sunday. The proceedings that relate to the DPA have been stayed, but Mr Stunt argues that the stay mechanism itself is incompatible with EU law, namely Article 9 of Directive 95/46/EC (rights to freedom of expression) and Article 22 (rights to an effective remedy). The question is particularly relevant given that the mechanism has effectively been preserved within the 'new' Data Protection Act 2018.
The latest judgment by the Court of Appeal (Stunt v Associated Newspapers Ltd) has taken us not much further forward, as the Court split on the issue of compatibility. The majority view was that the UK, like all EU member states, had a wide margin of appreciation in implementing the Directive and was entitled – having consulted widely with the media – to guard against the "chilling effect" of pre-publication restrictions. The minority view was that compliance with the Directive was "far from clear": a stay can be imposed without judicial scrutiny, and depends wholly and exclusively on the self-interested claim of the data controller. Ultimately, the Court referred the issue to the CJEU for a preliminary ruling.
The Court of Appeal did however give a unanimous interpretation of the scope of s.32(4). It favoured a narrow, purposive reading, which restricts the stay to journalistic material containing unpublished personal data at the pre-publication or disclosure stage, over a wider, literal interpretation, which would allow for a stay irrespective of whether the data had already been published or relied upon for publication. This interpretation was, the Court held, in line with the equivalent provisions under s.176 of the new DPA.
For now, the judgment provides some clarity, short of the CJEU's forthcoming, definitive answer to the question of compatibility. That ruling may prompt a new approach to the special purposes stay, and there is of course a broader uncertainty as to the extent to which the UK will be bound by CJEU decisions post-Brexit. Watch this space.