The Information Commissioner’s Office (“ICO”) has published its response to the recommendations that Lord Justice Leveson made to the ICO and the Ministry of Justice (“MoJ”) in his Inquiry Report on the Culture, Practices and Ethics of the Press. See here for the full response.
The ICO begins its response by reminding us of the leading role that the ICO played in revealing the press involvement in the unlawful trade in personal data in 2003 (Operation Motorman) which ultimately led to the Leveson Inquiry.
The ICO also emphasises that the Leveson Inquiry focused on events that took place between 2003 and 2007 and so Leveson’s Report does not take into account the significant strides that the ICO has made in recent years, in particular in its Regulatory Action Division and Enforcement Department and through its power to impose civil monetary penalties.
Nonetheless, the ICO is broadly welcoming of the vast majority of Leveson’s recommendations. See Rachel Kamm’s post of 29 November 2012 for details of those recommendations.
In response to Leveson, the ICO will be:
- Revising its Data Protection Regulatory Action Policy so that it specifically addresses how the ICO will use its regulatory powers to ensure that the press complies with the legal requirements of the data protection regime (by March 2013);
- Developing a new Code of Practice on appropriate principles and standards to be observed by the press in the processing of personal data (hopefully within 6 months) – watch out for consultation on this;
- Developing guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights (by May 2013) – watch out for a new dedicated media data rights advice on the ICO’s website;
- Providing regular reports to Parliament (through its statutory Annual Report) on the effectiveness of the new measures and on the culture, practices and ethics of the press in relation to the processing of personal data;
- Continuing to work with other prosecuting authorities in relation to alleged media crime (the ICO has already adopted the CPS Guidelines for Prosecutors);
- Allocating specific responsibility for managing relations with the press and key stakeholders to the Government and Society team in its Strategic Liaison Dept and looking to establishing a media reference panel along similar lines to its existing Technology Reference Panel to ensure that a ready source of expertise is available to the ICO on key media issues;
- Establishing an Intelligence Hub to make sure that the ICO identifies existing and emerging large-scale issues more quickly, as well as refining its process for handling high profile cases with significant policy or political implications;
- Ensuring that its Management Board comprises people with suitable expertise from a range of backgrounds, including the media.
As to Leveson’s suggestions for amendments to the Data Protection Act 1998 (“DPA”) (see Rachel Kamm’s previous post), the ICO says that he can “see the merit in certain changes but not all of them” and emphasises that it is a matter for Parliament to determine whether the ICO should have a wider role in press regulation – the ICO is not actively seeking such a role. Thus, while apparently
- broadly in favour of ‘tightening up’ the current exemption from the provisions of the DPA for data processed for journalistic purposes,
- strongly in favour of allowing individuals to claim damages for any breach of the DPA, even if it does not result in pecuniary loss, and
- strongly in favour of bringing in ss 77 and 78 of the Criminal Justice and Immigration Act 2008 (increased sentences for criminal breaches of the DPA and enhanced defence for public interest journalism),
the ICO nevertheless sounds some notes of caution:
- The ICO observes that Leveson’s proposed amendments to s 32 of the DPA would move the ICO much closer to being a general regulator of the press. Section 32 currently provides an exemption from most of the requirements of the DPA for data processing undertaken ‘with a view to the publication’ of journalistic material, provided that the data controller reasonably believes would be in the public interest, ‘having regard … to the special importance of the public interest in freedom of expression’ and the data controller reasonably believes that compliance with the relevant part of the DPA would be ‘incompatible’ with the journalistic purpose. Leveson proposes amending the exemption so that the processing must be ‘necessary’ for publication, so that no special weight is given to freedom of expression and so that the decision on whether the exemption applies is to be taken objectively rather than on the basis of the data controller’s reasonable belief. The latter proposed change is most significant in terms of the role of the ICO.
- The ICO points out that the new draft European Data Protection Regulation will require a number of changes to UK data protection law and therefore suggests that the Government may wish to consider how far it is sensible and practicable to introduce legislative changes ahead of the adoption of the new European Regulation.
- The ICO says that Leveson’s recommendation that the press should never be exempt from the subject access rights in the DPA raises legitimate concerns about the ‘chilling effect’ that this might have on investigative journalism and says this area will need very careful consideration.
- The ICO questions whether it is necessary to include specific provisions in the DPA requiring the IC to have special regard to the legal obligation to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime, pointing out that he is already subject to that duty by virtue of s 6 of the Human Rights Act 1998.
- Similarly, the ICO suggests that there is no need to enshrine in statute a duty to consult with the CPS and other enforcement agencies, but that is already something done as a matter of course. The ICO became a signatory to the Prosecutor’s Convention in July 2012 (an agreement between all the main government related prosecuting bodies to collaborate on cases that overlap jurisdictional areas).
- The ICO points out that Leveson’s proposal to widen the ICO’s powers of prosecution to include any crimes that are likely to involve breaches of data protection principles, e.g. phone hacking, computer hacking, etc would substantially increase the ICO’s role as an investigatory and prosecuting authority which would bring with it significant resource implications.
- While agreeing that the opportunity should be taken to consider the structure of the ICO and whether it would be better to have an Information Commission (i.e. a Board of Commissioners leading the organisation) rather than a single Information Commissioner, the ICO indicates that such a change would risk losing certain virtues of the current arrangements, which include the ability for the organisation to take decisions quickly where necessary and the higher degree of accountability that comes from having a single figurehead.