Apply the journalism exemption

The journalism exemption can remove the usual requirements to comply with the following parts of the UK GDPR listed in Schedule 2 Part 5 paragraph 26(9) of the DPA 2018:

• Article 5(1)(a) to (e) – the UK GDPR’s principles, apart from the security and accountability principles.
• Article 6 – requirement to satisfy a lawful basis for processing
• Article 7 – conditions for consent.
• Article 8(1) and (2) – conditions for children’s consent.
• Article 9 – rules relating to special category data.
• Article 10 – rules relating to criminal offence data.
• Article 11(2) – specific rules regarding informing people when their personal data has been anonymised.
• Article 13(1) to (3) – requirement to provide privacy information to people when you have collected data directly from the data subject.
• Article 14(1) to (4) – requirement to provide privacy information to people when you have not collected data directly from the data subject.
• Article 15(1) to (3) – right of access.
• Article 16 – right to have inaccurate or incomplete data rectified.
• Article 17(1) and (2) – right to erasure (the right to be forgotten).
• Article 18(1)(a), (b) and (d) – right to restrict processing.
• Article 19 – requirement to inform third parties to whom data has been disclosed of a rectification, erasure or restriction.
• Article 20(1) and (2) – right to data portability.
• Article 21(1) – right to object to processing (except for direct marketing).
• Article 34(1) and (4) – requirement to inform data subjects of a data security breach.
• Article 36 – requirement to consult the ICO prior to any high-risk processing.
• Article 44 – general principles for international transfers.

Although the journalism exemption is broad, you must always comply with some fundamental parts of data protection law, as follows:

• The principle to be able to demonstrate that you comply.
• The security principle.
• The right to opt-out of direct marketing.
• Rights about automated processing.
• The right to compensation for material or non-material damage.
• Registering with the ICO.

Specific industry codes listed in the DPA 2018 are as follows:

• Editors’ Code of Practice;
• BBC Editorial Guidelines; and
• Ofcom Broadcasting Code.

Although not listed in the DPA 2018, the IMPRESS standards code applies to its members.

If you are not sure whether you are using personal information for a journalistic purpose, you may find it helpful to consider:

• the purpose of the publication, including any reasons for publishing the information (eg informing the public);
• how closely the activity aligns with the media’s traditional functions (eg holding the powerful to account);
• whether you have made some attempt to align with typical journalistic standards or values (eg checking accuracy);
• the content of the information, including any public interest in publication; and
• the extent to which you have, or will, promote the information to the public.

The above factors are not exhaustive and it varies from case to case whether they are relevant, and the extent to which they are relevant.

For third party content or online “user-generated content”, you may find it helpful to consider whether you have applied any editorial judgement to the third party content. For example, to decide whether to include a reader’s response. The more editorial control you exerted, the more likely it is that you are using personal information for the purposes of journalism.

To make a decision that is objectively reasonable, factors you may find it helpful to consider include:

• whether you have enough relevant and reliable information to make a reasonable decision; and
• what weight to give to the information you decide to take into account to help you to make a balanced, proportionate decision.

In considering whether your belief is reasonable, it is not our role or a judge’s to disregard your decision lightly or substitute their own belief in place of yours. They will only consider the reasonableness of your belief on an objective basis.

You do not have to prove that publication is in the public interest or that complying with a specific part of data protection law would be incompatible with journalism. Nor do you need to arrive at the same conclusion as us or a judge. Different views may both be reasonable.

See case examples 19 and 20 below.

There are different ways to demonstrate a reasonable belief. You may also find it helpful to:

• have a clear policy or process explaining who can make the decision and how;
• be ready to demonstrate that you followed your policy or process, as well as any relevant industry codes or guidelines; and
• keep a record of your decision. The level of risk involved will help you consider what may be appropriate and proportionate. You might do this at a later stage, if more appropriate.

What is relevant is your belief as the person with legal responsibility for personal information. However, you might decide to delegate responsibility for decisions to individual journalists, taking into account the level of risk. A policy may help you to be clear about who has the authority to make decisions.

General examples include, but are not limited to:

• upholding standards of integrity;
• ensuring justice and fair treatment for all;
• promoting transparency and accountability;
• encouraging public understanding and involvement in the democratic process; and
• securing the best use of public resources.

There may be a public interest in the general subject matter of the information. Examples include, but are not limited to:

• protecting public health and safety;
• preventing people from being misled;
• exposing or detecting crime or anti-social behaviour; or
• exposing corruption, injustice, incompetence, wrongdoing, negligence or unethical behaviour.

The above are only illustrative examples of general public interest factors. This is not an exhaustive list. It does not mean there is not a public interest in other journalism, including for example lifestyle, entertainment or showbusiness news.

The right to freedom of expression and information is protected by Article 10 of the ECHR. This is incorporated into UK law by the Human Rights Act 1998 (HRA). All public authorities, including the courts, have a duty to act compatibly with people’s rights under the ECHR. Article 10 says:

“1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impact information and ideas without interference by public authority and regardless of frontiers. This right shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.

2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democracy society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary”.

Equal status of human rights

None of the rights protected by the HRA take precedence over others as a matter of principle. This is consistent with Resolution 1165 (1998) of the Parliamentary Assembly of the Council of Europe, para 10 which says:

“The Assembly reaffirms the importance of everyone’s right to privacy, and of the right to freedom of expression, as fundamental to a democratic society. These rights are neither absolute nor in any hierarchical order, since they are of equal value”.

The right to privacy

The right to respect for private and family life is protected by Article 8 of the ECHR. This is incorporated into UK law by the HRA. All public authorities, including the courts, have a duty to act compatibly with people’s rights under the ECHR. Article 8 says:

“1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”.

Protection for personal data derives specifically from the EU Charter of Fundamental Rights. Although the UK is no longer a member of the EU, data protection is incorporated into UK law through the UK GDPR and DPA 2018.

Freedom of Information Act 2000 (FOIA) - definition of journalism (paragraph 13.9 of the code)

UK Supreme Court

Sugar (Deceased) v BBC and another [2012] UKSC 4

The court considered the meaning of journalism to decide whether the BBC was required to respond to a request under FOIA. The wording for the derogation derives from data protection law.

The judge considered that journalism, art and literature is likely to include all types of “output” by the BBC to inform, educate or entertain the public. He added that because of the overlap between journalism, art and literature, there was unlikely to be value in a debate about whether journalism encompassed more than news and current affairs. (38)

The judge generally endorsed earlier analysis by a tribunal that journalism encompassed a range of activities including “…the collecting, writing and verifying of material for publication…the editing of the material, including its selection and arrangement, the provision of context for it and the determination of when and how it should be broadcast…the maintenance and enhancement of standards of the output by reviews of its quality, in terms in particular of accuracy, balance and completeness, and the supervision and training and journalists” (39).

However, the judge cautioned against tangential links when defining information held for the purposes of journalism: “…I would not be sympathetic to the notion that information about, for instance, advertising revenue, property ownership or outgoings, financial debt, and the like would normally be ‘held for purposes…of journalism’”(84).

Another judge agreed that there should be a “sufficiently direct link” to journalism. (106)

DPA 1998 - definition of journalism (paragraph 13.9 of the code)

High Court

NT1 & NT2 v Google LLC and ICO [2018] EWHC 799 (QB)

The judge in this case considered the meaning of journalism under the previous version of data protection law, which used similar wording.

He found that the operation of Google’s search engine was for purposes other than journalism. He said:

“The concept [of journalism] extends beyond the activities of media undertakings and encompasses other activities, the object of which is the disclosure to the public of information, opinions and ideas…”

However, he also explained that “the concept is not so elastic that it can be stretched to embrace every activity that has to do with conveying information or opinions. To label all such activity as ‘journalism’ would be to elide the concept of journalism with that of communication. The two are plainly not the same…”(98).

Data Protection Directive 95/46 - definition of journalism (paragraph 13.9 of the code)

ECJ

Satamedia (Case C-73/07)

The ECJ said the following about journalism:

“In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary, first, to interpret notions relating to that freedom, such as journalism, broadly” (56).

The court described journalism as an activity involving “the disclosure to the public of information, opinions or ideas” (61).

It added that, “…account must be taken of the evolution and proliferation of methods of communication and dissemination of information” (60).

Data Protection Directive 95/46/EC - definition of journalism (paragraph 13.9 of the code)

ECJ

Buivids (C-345/17)

Mr Buivids published a video taken in a police station on You Tube. He said that he wanted to draw attention to unlawful conduct.

The ECJ said that:

• Mr Buivids could not rely on the exemption in data protection law for personal and household use because he had published a video on You Tube without any restrictions;
• Mr Buivids could still be engaged in journalism, even though he is not a professional;
• although journalism is a broad concept, it did not extend to all information published on the internet; and
• in determining whether Mr Buivids is using personal data for journalism, Mr Buivids’ reasons for publication could be taken into account. However, it is not necessary to prove that there had been any unlawful conduct.

DPA 1998 - meaning of “acting with a view to publication” (paragraph 13.13 of the code)

Court of Appeal

Campbell v MGN Limited [2002] EWCA Civ 1373

In this case, the court considered the meaning of “with a view to publication” in the older version of data protection law.

The court said:

“…it would seem totally illogical to exempt the data controller from the obligation, prior to publication, to comply with provisions which he reasonably believes are incompatible with journalism, but to leave him exposed to a claim for compensation…the moment that the data have been published.

For these reasons we have reached the conclusion that, giving the provisions of the sub-sections their natural meaning…they apply both before and after publication”. (120-121)

DPA 1998 - meaning of “reasonable belief” (paragraph 13.15 of the code)

High Court

NT1 & NT2 v Google LLC and ICO [2018] EWHC 799 (QB)

The judge considered the meaning of “reasonable belief” under an older version of data protection law.

The judge said:

“Each of s.32(1)(b) and (c) has a subjective and an objective element: the data controller must establish that it held a belief that publication would be in the public interest, and that this belief was objectively reasonable; it must establish a subjective belief that compliance with the provision from which it seeks exemption would be incompatible with the special purpose in question, and that this was an objectively reasonable belief. That is the ordinary and natural meaning of the words used (and of the somewhat similar provisions of s.4 of the Defamation Act 2013…” (102)

DPA 1998, Misuse of Private information - editorial discretion (paragraph 13.16 of the code)

House of Lords

Campbell v MGN [2004] UKHL 22

In this case, the judge made the following comments about the scope of editorial discretion:

“There is no doubt that the presentation of material that it was legitimate to convey to the public in this case without breaching the duty of confidence was a matter for the journalists. The choice of language used to convey information and ideas, and decisions as to whether or not to accompany the printed word by the use of photographs, are pre-eminently editorial matters with which the court will not interfere. The respondents are also entitled to claim that they should be accorded a reasonable margin of appreciation in taking decisions as to what details needed to be included in the article to give it credibility. This is an essential part of the journalistic exercise.

But decisions about the publication of material that is private to the individual raise issues that are not simply about presentation and editing. Any interference with the public interest in disclosure has to be balanced against the interference with the right of the individual to respect for their private life. The decisions that are then taken are open to review by the court”. (112-113)

Misuse of private information – editorial discretion and evidence to demonstrate decision-making (paragraph 13.16 and 13.17 of the code)

High Court

Sicri v Associated Newspapers Ltd [2020] EWHC 3541 (QB)

The court referred to the concept of editorial discretion in this case. It said, “Properly understood, the authorities on the topic of editorial latitude are concerned with factors [such as] the importance of the free speech rights at stake, and – in particular – the appropriate way to give practical effect to those rights. That is why the Strasbourg authorities refer to ‘tone’ and to the ‘methods of objective and balanced reporting’, the ‘techniques of reporting’ and the ‘form in which’ information and ideas are conveyed’…the Court stated that Article 10 leaves it for journalists ‘to determine what details it is necessary to reproduce to ensure credibility’”.

The court said that it would determine the outcome of the case objectively, whilst giving weight to editorial discretion as appropriate. It said “The degree of latitude or weight giving to editorial decision-making depends on the circumstances”, including:

• the subject-matter;
• the nature of the information at stake;
• the context in which the defendant wishes to use it, and
• the extent to which the individual defendant can be seen to have relevant knowledge and expertise.

Commenting on a lack of evidence to demonstrate editorial decision-making on the public interest in line with the Editor’s Code (the requirements of which the ICO code echoes), the judge said:

“…the evidence falls well short of what the Code requires. It does not demonstrate that those responsible held a reasonable belief that identifying the claimant would serve and be proportionate to the public interest, or how such a belief was arrived at…There is no documentary evidence to support such a conclusion…There is no reliable evidence, either, that there was even a conversation on the matter”.

The judge said that he accepted that such decisions do not need to be made formally or recorded but said, “…if there is no record, and nobody can recall when or how it happened, a defendant may find it hard to ‘demonstrate’ any of the things which the Code requires to be demonstrated”. (131)

DPA 1998. Misuse of private information - public interest and proportionality (paragraph 13.18 of the code)

House of Lords

Campbell v MGN Ltd [2004] UKHL 22

In this case, there was a public interest in setting the record straight by publishing the fact that Miss Campbell had used drugs because she had repeatedly denied doing so in the media.

However, the published information revealed significant additional information. This included that Miss Campbell was receiving treatment at Narcotics Anonymous, the details of her treatment, and a photograph of her leaving a meeting with others. The court said anyone who knew the locality would know where it was.

The House of Lords found that there was not a sufficient public interest to justify publishing this additional information, particularly bearing in mind that it was sensitive health data which could put Miss Campbell’s recovery at risk.

ECHR -Importance of the right to freedom of expression and information, and the role of the press (paragraph 13.20 of the code)

Sunday Times v UK (No.2) 26 November 1991

The ECtHR court said:

“Freedom of expression constitutes one of the essential foundations of a democratic society…it is applicable not only to ‘information’ or ‘ideas’ that are favourably received or regarded as inoffensive as a matter of indifference, but also to those that offend, shock or disturb. Freedom of expression, as enshrined in Article 10, is subject to a number of exceptions which, however, must be narrowly interpreted and the necessity for any restrictions convincingly established.

These principles are of particular importance as far as the press is concerned. Whilst it must not overstep the bounds set…it is nevertheless incumbent on it to impart information and ideas on matters of public interest. Not only does the press have the task of imparting such information and ideas: the public has a right to receive them. Where it otherwise, the press would be unable to play its vital role of public watchdog”.(50)

DPA 1998 and Misuse of Private information - Importance of right to privacy (paragraph 13.22 of the code)

House of Lords

Campbell v MGN [2004] UKHL 22

The court said:

“The case involves the familiar competition between freedom of expression and respect for an individual’s privacy. Both are vitally important rights. Neither has precedence over the other. The importance of freedom of expression has been stressed often and eloquently, the importance of privacy less so. But it too, lies at the heart of liberty in a modern state. A proper degree of privacy is essentially for the well-being and development of an individual. And restraints imposed on government to pry into the lives of the citizen go to the essence of a democratic state…”

ECHR and HRA 1998 – balancing Article 8 and Article 10 rights (paragraph 13.22 of the code)

House of Lords

In re S (A Child) [2004] UKHL 47

At paragraph 17, Lord Steyn said the following about Article 8 and Article 10 of ECHR:

“First, neither article has as such precedence over the other. Secondly, where the values under the two articles are in conflict, an intense focus on the comparative importance of the specific rights being claimed in the individual case is necessary. Thirdly, the justifications for interfering with or restricting each right must be taken into account. Finally, the proportionality test must be applied to each. For convenience, I will call this the ultimate balancing test”.

DPA 1998 - meaning of “incompatible with a journalistic purpose”(paragraph 13.26 of the code)

First-Tier Tribunal

True Vision Productions (TVP) v ICO (EA 2019 0170)

This case concerned whether we were correct to impose a monetary penalty. Although not a binding precedent, this case shows how the judge considered whether compliance with data protection was incompatible with a journalistic purpose in this case.

The case was about filming in a maternity ward for the purpose of making a documentary about still births using CCTV. The fact that filming was taking place was not adequately brought to the mothers’ attention. The intention was to capture a woman’s reaction on being told the news.

The judge decided that there was a reasonable way that TVP could have collected the data it required in accordance with the principle of fairness. This meant that TVP had not correctly relied on the journalism exemption because compliance with the data protection principle was not incompatible with the journalistic purpose.

The judge considered editorial judgement and “whether there was any possibility of different but reasonable views.” He said, “…the use of hand held cameras would at least have made every mother aware that they were being filmed and their voices recorded” and “this was a modest, practical and reasonable alternative method…”

UK GDPR article 85 – duty to reconcile data protection with the right to freedom of expression, including processing for journalistic purposes

DPA 2018 schedule 2, part 5, paragraph 26 – special purposes exemption for journalistic, academic, artistic or literary purposes

DPA 2018 schedule 2, part 5, paragraph 26(5) – requirement for controller to take into account specific industry codes

DPA 2018 schedule 2 Part 5 paragraph 26(9) – provisions of the UK GDPR that can be disapplied by the special purposes exemption.

UK GDPR guidance and resources: Children’s information

Industry codes contain guidance about the public interest including:

Independent Press Standards Organisation (IPSO) Editors’ Code of Practice;

BBC Editorial Guidelines;

Ofcom Broadcasting Code; and

IMPRESS Standards Code.

The Equality and Human Rights Commission website has further information about human rights generally.

The EctHR has also published detailed guidance on Article 10 and Article 8 of the ECHR