ICO moves to clarify journalism exemption to UK data protection law

UK data protection law contains a journalism exemption from some of the legal requirements that otherwise apply to the processing of personal data, such as obligations to comply with rights data subjects enjoy under data protection law, like data subject access rights. The exemption is designed to protect freedom of expression and information in journalism.

The ICO is seeking to develop a new journalism code of practice that clarifies when that exemption applies, and when it does not. An initial consultation on a new code closed earlier this year, but the ICO has now published an updated version (60-page / 547KB PDF) that it said is shorter, less complex, and more user-friendly. The new guidance differentiates ‘musts’, ‘shoulds’, and ‘coulds’ for individuals and organisations seeking to interpret whether they can benefit from the journalism exemption, and the ICO has also published a summary document with the key information (5-page / 353KB PDF) to aid understanding.

According to the draft code, the journalism exemption applies where you use personal data for journalism, you act with the intention or hope of publishing journalistic material, you reasonably believe publication is in the public interest, and you reasonably believe that complying with a specific part of data protection law is incompatible with journalism.

The ICO has said that the term ‘journalism’ should be interpreted broadly. It said the term should include everything published in a newspaper or magazine, content published by non-professional journalists including members of the public, and material that is journalistic but is being used for other purposes, such as campaigning. It said that when considering whether personal data is being used for journalism, factors to consider include the purposes of the publication, how closely the activity aligns with the media’s traditional functions, and the content of the information – including any public interest in publication.

The draft code also includes guidance on what is meant by other terms pivotal to the application of the journalism exemption, such as ‘reasonable belief’.

According to that guidance, there is no need to prove that publication is in the public interest, and need not arrive at the same conclusion as the ICO or a judge.  However, organisations seeking to rely on the journalism exemption must be able to demonstrate the reasonableness of their decision. They should make an objectively reasonable decision – this being one that the ICO said organisations “are able to justify to another person in a reasonable way”.

The ICO said organisations can demonstrate the reasonableness of their decision by having a clear policy or process explaining who can make the decision and how, by being ready to demonstrate that they followed the policy or process, as well as any relevant industry codes or guidelines, and keeping a record of their decision.

The ICO’s draft code also clarifies what is meant by ‘in the public interest’. Media law expert Lottie Peach of Pinsent Masons said that the public interest test proposed for the journalism exemption promotes both general and specific public interest arguments.

Peach said: “According to the draft code, the meaning of ‘in the public interest’ for the journalism exemption to data protection law can take many forms, but examples of public interest arguments the ICO cites include: ensuring justice and fair treatment for all, upholding standards of integrity, promoting transparency and accountability, encouraging public understanding and involvement in the democratic process. There also may be subject matter considerations such as exposing corruption, detecting crime or anti-social behaviour, protecting public health and safety.”

“According to the ICO, there may be stronger public interest arguments where the person is a public figure or has a role in public life more broadly,” she said. “Overall, there must be a consideration of the particular circumstances, balancing factors for and against publication and making an objective decision about how the public interest is best served.”

Data protection law expert Rosie Nance of Pinsent Masons said: “The guidance promotes a risk-based approach, in line with the ICO’s wider approach to guidance and the approach that is set to have more of a statutory footing under the government’s proposed Data Protection and Digital Information Bill.”

The ICO is seeking responses to the latest version of the draft code by 16 November 2022. It has encouraged anyone involved in the media industry or who uses personal data for journalism to provide feedback.