Paper could have to justify any disclosure of personal data contained in Lockerbie report, expert says

A data protection law expert has warned, though, that Glasgow’s Sunday Herald will have to be sure that it can demonstrate the public interest in relation to each identified person and that the redactions it has made prevent the identification of others if it is to avoid legal action. Individuals can claim compensation from organisations that breach the DPA under certain circumstances.

"In the case of Megrahi it appears that he has consented to the disclosure of his personal data," said data protection law specialist Kathryn Wynn of Pinsent Masons, the law firm behind Out-Law.com. "In any case there is a strong public interest argument that justifies disclosure in the event that he has not."

"However, it is less clear cut in the cases of third party individuals who are identifiable in the report," she said." Clearly the Sunday Herald has taken steps to anonymise information about individuals it does not believe is in the public interest to disclose. However, redacting the names of those third parties may not be enough to achieve anonymisation. That is because those individuals may still be identifiable from other information contained in the report or that is already in the public domain."

"Further, although the report is principally about Megrahi, if those third parties are expressing professional opinions or making professional judgements or decisions, that information would constitute that third party's personal data. In that case the Sunday Herald would need to be in a position to show that it has applied the public interest test in relation to that personal data also and had concluded that it is in the public interest to disclose it," Wynn said.

"Both the clearly-identified individuals and those who feel they can be identified in spite of the redactions would have a right to claim compensation. It would then be up to the paper to show that it had taken reasonable steps to comply with the DPA. In practice that would mean it would need documented evidence that it had analysed whether the public interest test was satisfied in respect of disclosure of those individuals' personal data, and a court would need to be satisfied that that analysis was legitimate," she said.

At the weekend the Sunday Herald published an 802-page report (802-page / 11.06MB PDF) by the Scottish Criminal Cases Review Commission (SCCRC) into the application by Abdelbaset Ali Mohmed Al Megrahi for a review of his conviction as the man responsible for the 1988 Lockerbie bombing. The June 2007 report, which states that Megrahi's conviction "may" have been a "miscarriage of justice", had previously never been published in its entirety.

The SCCRC had previously only published a summary of its report and said it would have been a criminal offence for it to publish the entire document under the terms of the Criminal Procedure (Scotland) Act, according to the Sunday Herald. The Scottish Government had said that it could not publish the report because of data protection restrictions.

However, the UK's data protection watchdog said that data protection restrictions had not been to blame for the report not being published in its entirety until now.

"The ICO (Information Commissioner's Office) has always been clear that it was the restrictive nature of the legislation governing the operation of Scottish Criminal Case Review Commission (SCCRC) and not the Data Protection Act that resulted in the release of this information, relating to Abdelbaset al-Megrahi, being blocked," an ICO spokesperson told Out-Law.com. "We have consistently advised the Scottish Parliament and Government that the DPA would not stand in the way of openness, providing the other legal requirements for disclosure could be satisfied."

Under the DPA personal data must be processed fairly and lawfully. Organisations are required to satisfy one of six lawful processing conditions - obtaining an individual's consent meets that requirement.

However, under section 32 of the DPA, a media organisation is exempt from the fair and lawful processing requirement, and therefore does not need to obtain consent in order to publish personal data, if it "reasonably believes that ... publication would be in the public interest", and providing it "reasonably believes" that complying with the need to obtain consent is "incompatible" with the purpose of journalism.

Under section 13 of the DPA a person is generally entitled to compensation if they suffer damage or damage and distress as a result of breaches of the DPA by organisations that determine how and why their personal data is being processed - 'data controllers'. Individuals are also generally entitled to compensation from those 'data controllers' if they suffer distress only, if that distress stems from processing for 'special purposes' which includes for journalistic purposes.

However, a media organisation does have a defence to this right to compensation if it can "prove that [it] had taken such care as in all the circumstances was reasonably required to comply with the requirement [that it is alleged to have breached]."

The SCCRC report contains personal data belonging to Megrahi and to a number of other individuals. The Sunday Herald said Megrahi had consented to his personal data being published "providing all other parties consented" but that not all those individuals had given their permission.

A leading QC said it was “questionable whether [the SCCRC] report is the ‘personal data’ of anyone other than Megrahi," according to the Sunday Herald's report.

The paper said it had made "very few redactions to protect the names of confidential sources and private information". It said publication of the rest of the report was justified under UK data protection laws.

"We choose to publish it because we have the permission of Abdelbaset Ali Mohmed al Megrahi, the Libyan convicted of the bombing, and because we believe it is in the public interest to disseminate the whole document," the Sunday Herald's report said.