This week’s decision of the First-Tier Tribunal’s decision in True Vision Productions v IC (EA/2019/0170) is probably one of the last to deal with enforcement action under the old DPA 1998, but it is one of the first that deals with the journalism exemption (section 32 of the DPA 1998, reincarnated in substantially the same form in paragraph 26 of Schedule 2 to the DPA 2018). The exemption saved the controller – the production company, TVP – from part, but not all of its difficulties. TVP did enough, however, to persuade the Tribunal to slash the ICO’s £120k monetary penalty notice to £20k.
The Tribunal’s decision is here: True Vision Productions v ICO EA 2019 0170 Decision.
The penalty was imposed because TVP had breached the first data protection principle (these days found in Article 5(1)(a) of the GDPR – lawful, fair and transparent processing) by recording, via CCTV and audio, medical consultations with expectant mothers who were concerned about the health of their babies and went to a walk-in clinic to get input and help.
This was done for the purposes of an observational documentary called Child of Mine, filmed in 2017 and broadcast on Channel 4, following the experience and aftermath of stillbirths. As Judge Jacobs – normally of the Upper Tribunal, but sitting alone in the FTT for this case – observed, “the principal, if not the sole, purpose of the recording was to capture the moment of diagnosis when the mother learned that her baby had died”.
Lest that sound crass, it is important to note that Judge Jacobs considered this to be sensitive and responsible film-making. The producer did not design things with data protection in mind (though he “knew it existed” – para 13 of the judgment), but privacy concerns were fundamental, particularly as regards everything done with the data after it had been recorded. TVP’s problem, however, lay with the making of the recordings in the first place.
TVP did not ask mothers for their consent to their consultations being recorded. This was because, in order for consent to be informed and explicit (this was of course a health/medical context), TVP would have needed to tell the mothers about the prospect that their baby may have died. Understandably, TVP decided that this was best left to medical professionals who – equally understandably – did not want to be involved in data protection matters like this.
While TVP didn’t seek consent, it did explain what it was doing, so that mothers could, for example, opt to use a consultation room where recording would not happen. But one can readily see the difficulties with adequate transparency – and thus fairness (which is how the DPA 1998 packaged its transparency) – in this context. Judge Jacobs summed things up at paragraph 12:
“Anyone in this state would pay little attention to CCTV cameras. They are so ubiquitous nowadays that they are part of the background. The notices were obvious, but I find that mothers would mostly likely associate the cameras with safety and security. They would have little interest in reading the letters and notices, especially when they had finally been shown into a consulting room to see a midwife or doctor. And anyone who did read all the notices would probably have been more confused than enlightened. It would take more mental energy than most possessed to unravel the relationship between three different documents written at different times for different purposes. And staff and mothers alike would be unlikely to subject the documents to the kind of detailed linguistic construction undertaken at the hearing that would be more appropriate to a contract, deed or statute.”
So, transparency and thus fairness was the Achilles heel here. How did this cash out in terms of the journalistic exemption? Most elements of that exemption were uncontroversial here: the processing (recording) was carried out with a view to the publication of journalistic material and TVP reasonably believed that publication would be in the public interest. TVP in fact believed that compliance with the first data protection principle was incompatible with – would cut against – the journalistic purpose. It had formed the requisite belief even though it had not applied its mind specifically to the data protection framework – it did consider the substantive privacy considerations underpinning the first data protection principle.
The sticking point was whether that belief – that the first data protection principle should be disapplied here – was reasonable. Answer: as regards the decision not to obtain consent, yes, this was reasonable (as I say above, TVP getting up-front consent would have involved it telling mothers of the risk of stillbirth). But as regards transparency and thus fairness, the answer was no. It was unreasonable to believe that those requirements could not be met compatibly with TVP’s journalistic purposes. See paragraph 27:
“Although it was not possible to obtain effective consent, let alone explicit consent, the use of hand held cameras would at least have made every mother aware that they were being filmed and their voices recorded. This would be more demanding of staff time and so more expensive, but it would have prevented the collection and retention of data without a mother being aware that it was taking place….”
TVP had also gone wrong in focusing only on the recorded data it would end up broadcasting, and overlooking the recordings it made that were deleted without being used further. See paragraph 28:
“It is a mistake to concentrate on the data that would be used in Child of Mine without also taking into account the comparatively much larger amount of the data – the overwhelming majority it – that would never be used. This was where Mr Woods’ thinking went wrong, because he did not realise that he was processing data that would not be used. He saw that data as incidental. He was right that it was incidental to his project, but it was not incidental to the Data Protection Act.”
So the ICO was right to find that there was a serious contravention, and it was entitled to issue a MPN. But Judge Jacobs slashed the penalty from £120k to £20k. Note that, having considered TVP’s case before the Tribunal, the ICO itself supported a significant reduction along these lines.
If you want the checklist of considerations that got Judge Jacobs there, see paragraph 33. Those include: non-deliberate breach (though ignorance of data protection did not reflect well on TVP), a general approach that focused on privacy rights, and the fact that “the sort of breach involved in this case does not justify putting a company out of business”. Note as regards financial impact of the MPN: focus on the controller (TVP) not the individual owner who earned his living through it; “generally speaking the impact of a penalty should be judged on the company’s current financial position”.
Finally, given that this was novel stuff – journalistic exemption in a MPN context – the ICO invited Judge Jacobs to give some guidance. But Judge Jacobs famously hates this sort of thing. See paragraph 34:
“Mr Knight told me that ‘this appeal is an unusual one, and of course the Commissioner will welcome any guidance that the Tribunal gives as to the approach to section 32 in your decision.’ She will, I fear, be disappointed. I have said repeatedly in the Upper Tribunal that decisions of the First-tier Tribunal do not bind that tribunal or the Commissioner; the decisions are binding only on the parties to a particular case. I am not going to commit the error of disregarding my own decisions…”
One imagines the ICO – and Mr Knight – already understood that, and was asking Judge Jacobs for helpful soft guidance rather than to make radiate pronouncements out across the data protection landscape. But there you go.
And yes, that is the Mr Knight, Panopticon supremo.
Robin Hopkins