You have probably skimmed section 32 of the Data Protection Act, and seen that the exemption negates the application of all the Principles (except the 7th) and most of the data subject rights, if personal data are processed for a journalism purpose and if the processing is necessary with a “view to publication” of the personal data.
You also probably have drawn the conclusion that there was not much data protection to be had, given the scope of this exemption for the Special Purposes (and given the Appeal Court judges in the Naomi Campbell case broadened its reach – see references).
However, following cross examination, Counsel for the Leveson Inquiry (Mr Jay), has argued that there is a strong case that the Information Commissioner could have (and by implication, should have) used his Enforcement Powers to put a stop to unlawful processing of ex-directory telephone numbers by the press, years ago.
So how did Mr Jay get round the section 32 exemption? The argument goes as follows:
1. Does the Section 32 exemption apply to any personal data processed by the press with “a view to publication”? Answer “yes”.
2. When the press obtains an ex-directory number, is it likely that the press would publish the ex-directory number? Answer, of course, “no”.
3. It follows that with regards to ex-directory numbers, there is no “view to publication” of personal data and so the Section 32 exemption does not apply.
Neat isn’t it? The Special Information Notice (Section 44) provisions also fall away, assuming the Information Commissioner is acting independently (i.e. not acting as a result of a data subject asking for an assessment). This is because the Special Information Notice, in such circumstances, is linked to the application of the Section 32 exemption. So if the Section 32 does not apply, then neither do the provisions that require a serving of a Special Information Notice.
This means, according to Mr Jay, that the Commissioner falls back on the normal Information Notice provisions in section 43. This requires either a request for an assessment from a data subject (not relevant here) or “If the Commissioner .... reasonably requires any information for the purpose of determining whether the data controller has complied or is complying with the data protection principles”.
Mr Jay’s intent is clear. He is implying that the Commissioner (given what he knew from Operation Motorman, his two reports entitled “What Price Privacy?” and subsequent press reports) could have “reasonably” served an Information Notice asking the press to explain how they got their ex-directory telephone numbers. Once this information is provided, other forms of enforcement can follow – and if the Commissioner had done this, the abuse by the press could have been nipped in the bud.
Mr Jay’s neat argument, however, is not as clear cut as he thinks. He has overlooked the impact of Section 46(3) which states that:
“The Commissioner may not serve an information notice on a data controller with respect to the processing of personal data for the special purposes unless a determination under section 45(1) with respect to those data has taken effect”.
So the Commissioner, before he gets to serving an Information Notice (by Mr Jay’s recipe), has to determine whether or not the processing of personal data (i.e. the ex-directory number”) is for the special purpose.
However, Section 45(1) then says that such a determination requires the Commissioner to state that the personal data (in this case the ex-directory number):
(a) “are not being processed only for the special purposes”, or
(b) “are not being processed with a view to the publication by any person of any journalistic, literary or artistic material which has not previously been published by the data controller”
Note that the test in paragraph(a) has now changed – it’s not whether the exemption for the special purpose applies (which is linked to “a view to publication” – Mr Jay’s argument), it’s whether the processing is not for the special purpose. Clearly, the newspaper is processing the ex-directory telephone number for the special purpose of journalism; so the Commissioner can’t serve an Information Notice and Mr Jay’s argument is derailed.
However, if the Commissioner chooses paragraph (b), he can link his “determination” back to the fact that the “ex-directory number” is “not being processed with a view to the publication”; Mr Jay’s argument is back on the tracks.
In addition, undermining paragraph(b) of section 45(1) is easy. Perhaps some anonymous individual, wholly unconnected with the press (of course), would be able to magically tweet any ex-directory number concerned, so these numbers could be re-Tweeted or reported by other members of the press. I can already see the headline: “Tweets reveal celeb’s secret phone” – it has happened before with a footballer!
We can now see the issue is not as clear cut as Mr Jay implies and no doubt the press would vehemently contest any interpretation of Data Protection law which just relied on paragraph(b). However, if the Commissioner were to win such a case, then Mr Jay is correct in that he could have enforced the Act, because the same test in section 45(1) is applied to his use of his Enforcement Notice powers.
Another outcome, also foreseeable, is that the tabloid press would appeal any negative judgment all the way up to the House of Lords and beyond, even to that dastardly European Human Rights Court:– yes the Court they always object to!
So the Commissioner’s answer to Mr Jay should have been this: “If I were to enforce the Data Protection Act in such a case, I would use up all my legal resources in a fight where there is a 50-50 chance of winning, where I would also know that if I were successful, the data controllers in the press would issue appeal after appeal”.
In addition, I would have added: “If Parliament wanted me to investigate the processing of personal data by the press, it would have given me unambiguous powers and sufficient resources to do so”.
Mr Graham’s cross examination: http://www.levesoninquiry.org.uk/hearing/2012-01-26am/
Naomi Campbell – extension of section 32 (See para 128 of the Court of Appeal decision: if you track to the Parliamentary discussions in the Lords re the Data Protection Act when it was a Bill, you will see that Parliament was told the exemption applied only prior to publication). http://www.bailii.org/ew/cases/EWCA/Civ/2002/1373.html
Our Update session on March 26th (London, £195+VAT; details on www.amberhawk.com has half a day devoted to the Regulation. As well as a guest speaker from the ICO on the Regulation, we have sessions on:
• What are changes in the definitions?
• What are changes in the Principles?
• What are changes in the Rights?
• What are changes in the Enforcement and other odds and ends?