Out-Law News 2 min. read
23 Jul 2014, 11:25 am
Media companies expressed concern about the impact that proposed changes to EU data protection laws will have on the way they handle personal information at a recent industry debate hosted by ITN and the Media Society.
However, Information Commissioner Christopher Graham said that a current exemption to the application of some data protection rules that apply in the UK was "safe", despite it not being explicitly provided for under the proposed EU General Data Protection Regulation, according to a report by Hold the Front Page.
A spokesperson for the Information Commissioner's Office (ICO) told Out-Law.com what Graham meant by his comment.
The spokesperson said that the draft Regulation, which is still subject to change by EU law makers, "provides a guarantee for freedom of expression". Whilst the Regulation does not need to be "transposed into different laws in different member states" but would apply directly as law in each member state, the current draft "leaves it open to member states to determine how to underpin this idea of freedom of expression", he said.
The spokesperson said that the ICO "believes that the level of protection afforded to journalists under the Regulation" would be effectively the same as is currently provided for under the UK's Data Protection Act (DPA)
Section 32 of the DPA sets out a 'special purposes' exemption that media organisations can rely on to justify the processing of personal data for journalistic reasons. The exemption means those businesses are not obliged to ensure their processing is compatible with one of the six general conditions set out under the Act that govern lawful processing of personal data, which include where organisations have individuals' consent to conduct that processing.
The journalistic purposes exemption can be relied upon where media organisations process personal data with a view to publishing a story and where they reasonably believe that the publication would be in the public interest and providing they reasonably believe that complying with the need to obtain consent, or satisfy one of the other conditions to justify the processing, is "incompatible" with the purpose of journalism.
If organisations are processing personal data for reasons other than in pursuit of publishing public interest stories then they must conform to the general requirements governing lawful processing of that information. In addition that data must also generally be disclosed to individuals who make a subject access request (SAR).
In January the ICO issued draft guidelines for media organisations on how the Section 32 exemption should be interpreted. Finalised guidelines have not yet been issued. The watchdog was urged to provide data protection guidance to media outlets by Lord Justice Leveson in his report following his inquiry into the culture, ethics and practices of the press.
In his report, Lord Justice Leveson recommended that a number changes be made to section 32 of the DPA. Among the recommendations, Leveson said that individuals whose personal data is processed under the terms of the journalistic purposes exemption should have a right to access that data upon request. The government has still to decide whether to propose changes to the DPA in light of Leveson's suggestions.