The issue of exemptions from data protection legislation has recently been raised again by a judgment in the Court of Justice of the European Union. Case C-212/13 František Ryneš v Ú?ad pro ochranu osobních údaj? looked at the duties imposed on individuals installing private CCTV cameras. The CJEU held that individuals doing so would not be able to claim ‘domestic purposes’ exemption under Czech data protection laws; s 36 of the Data Protection Act 1998 provides a similar if broader exemption. Commentators have suggested that the finding could in effect lead to a situation where anyone in this country who has ever taken a picture or shot a video in public and then posted it online is required to register with the Information Commissioner’s Office as a data controller.
This is a worrying prospect. If people have to register with the ICO, how many will be dissuaded from publishing anything online? And what about all those websites devoted to local interests, hobbies, games and activities? Will these have to also register and in that case how many will even bother to continue publishing given the additional requirements they will have to shoulder as data controllers? Even if they don’t publish images, will the prospect of having to register put them off? Does the DPA provide any other exemptions that might help?
This article looks at the exemptions under s 32 of the DPA and discusses which individuals might, arguably, be able to qualify.
This is not purely an intellectual exercise. There are serious concerns attached. Recent years have seen an explosion in the number of blogs and websites published by individuals tackling an enormous range of topics.[1]
Not only have these individual sites gained in scope but the mainstream media has also encouraged, and paid handsomely for, contributions from non-journalists, especially in regard to pictures and video.[2] Are these citizens actually data controllers? Or is there the possibility that they and others can become journalists?
Defining a journalist
Section 32 states:
(1) Personal data which are processed only for the special purposes are exempt from any provision to which this subsection relates if –
(a) the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,
(b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and
(c) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.
There is no legal definition of a journalist in English law, due in part to the opposition by journalists to any attempt to regulate the profession by introducing mandatory qualifications, licensing, or standard identity cards. Other jurisdictions have attempted to do so with mixed results. It is worth, briefly, looking at the USA where the issue has had particular relevance in recent years due to the ongoing debate on a federal shield law.
In some cases the courts have expressed a particular concern about making the definition too broad so as to include “the stereotypical blogger sitting in his pajamas at his personal computer posting to the World Wide Web.”[3] This has led to definitions which have included an employment consideration. For example, in Delaware a journalist is defined as any person who has earned their “principle livelihood by, or in each of the preceding 3 weeks or 4 of the preceding 8 weeks [having] spent at least 20 hours engaged in the practice of , obtaining, or preparing information for dissemination … to the general public.” Likewise Indiana requires the individual to have “received income from legitimate gathering, writing, editing and interpretation of news.”
Far broader, and therefore far more likely to include a wide range of individuals, is the definition in Minnesota which applies to “any person who is or has directly engaged in the gathering, procuring, compiling, editing, or publishing of information for the purpose of transmission, dissemination or publication to the public.” This talks of information rather than news and makes no mention of income or specific employment, an individual simply has to be “directly engaged.”
Perhaps the best definition, and one it is hoped courts in this country might use as a precedent, is that contained in the US OPEN Government Act of 2007, which amended the definition of a representative of the news media in the Freedom of Information Act to read “any person or entity that gathers information of potential interest to a segment of the public, uses its editorial skills to turn the raw materials into a distinct work, and distributes that work to an audience.” It goes on to define news as “information that is about current events or that would be of current interest to the public.” More importantly it takes into account changes in how news is disseminated by adding that “as methods of news delivery evolve … such alternative media shall be considered to be news-media entities.”[4]
Beliefs and actions
In the UK, the courts to date appear less inclined to define journalism or journalistic but place the emphasis on the beliefs of the data controller, in other words on s 32(1)(b) and (c).
As far as the individual is concerned, it means that anyone posting information or ideas online for public consumption may be able to invoke the journalistic exemption even if he or she is not paid for the work.[5]
This was made clear in The Law Society v Kordowski [2011] EWHC 3185 (QB), Tugendhat J pointed out (at [99]) that “today anyone with access to the internet can engage in journalism at no cost.”
Made equally clear in that case was the nature of what is protected. “Journalism that is protected by s 32 involves communication of information or ideas to the public at large in the public interest.”
In “Data protection and journalism: a guide for the media”, the ICO takes this further by breaking down the exemption into four elements:
“(1) the data is processed only for journalism, art, or literature,
(2) with a view to publication of some material,
(3) with a reasonable belief that publication is in the public interest, and
(4) with a reasonable belief that compliance is incompatible with journalism.”
adding that the emphasis will be on (3) and (4).
This means that, when considering an application for an exemption under s 32, it is not the definition of journalism that will be paramount. Neither is it a question of the kind of material that is published. As the ICO points out in its guideline “the exemption can potentially cover almost all information collected or created as part of the day to day output of the press and broadcast media, and comparable online news or current affairs outlets.”
In fact it is potentially even wider as the ICO “accepts that non-media organizations may be able to invoke the exemption. If their purpose in processing the specific information is to publish information, opinions, or ideas for general consumption, this will count as a journalistic purpose…”
Neither is there any requirement for a certain number of readers or hits. The ICO defines publish as “make available to the public or any section of the public.” This provides a broad spectrum and also does not insist on publication in any particular form.
This essentially means that anyone publishing online could fall under the journalistic exemption.
However, there are certain key issues that the individual or organization would have to address.
Firstly that the data should only be used for one of the purposes stated in the exemption, journalistic, art, or literature, so material that is to be used for any other purpose, for example advertising or political lobbying, would not be exempt. This is relatively straightforward.
Secondly the material would have to be in the public interest, to trump any individual rights, which is not defined in the DPA, and would necessarily have to be considered on a case by case basis to determine an adequate balance between individual’s rights under Article 8 and freedom of expression Article 10 rights in the European Convention on Human Rights. Particular care would need to be given to the publication of photographs which have come in for particular discussion in court.[6]
In making a decision as to whether material is in the public interest the ICO suggests that reference can be made to existing editorial codes of practice, such as the BBC guidelines, a point underlined in CG v Facebook & Anor [2015] NIQB 11 by Stephens J who reiterated that when considering whether a data controller’s belief was reasonable, “regard may be made to his compliance with any code of practice…”.[7]
The ICO also lays out four main criteria in accepting if it was a reasonable belief:
The organization has clear policies and procedures on public interest decisions,
Those procedures were followed,
It can provide a cogent argument about the public interest
It has complied with any relevant industry codes.
This means that for the individual they would presumably need to be able to demonstrate that they are aware of the issues, have put some sort of procedure in place to decide what to publish and have at least tried to follow a relevant industry code of practice. Obviously some will be in a better position to do this than others, and it is not clear how much leeway the ICO will allow, but the emphasis appears to be on at least making a serious effort.
Thirdly, on compliance, the DPA requires more than just an argument that complying would be inconvenient. Specific issues such as it would require a disproportionate use of resources, or would not be practical, would need to be advanced, with each case judged on its merit and a separate argument put forward for each act of non-compliance. Again it would seem the ICO is prepared to work on a case by case basis and not go with a one-size-fits-all solution.
The eight data protection principles also apply, and individuals and organizations would almost certainly have to demonstrate that they have tried to comply with these, except where an exemption allows.
Conclusion
Not every blogger or online publisher is likely to want to claim exemptions under s 32 of the DPA. Neither will every publisher be able to – some sites will fail even the most basic test. However, for those who want to continue with their activities without having to comply with all the requirements, either because they lack the time and resources to do so, or because they worry that doing so will ultimately force them to give up publishing, the journalistic exemption offers possibilities.
They do not have to prove they are journalists, neither that they are part of the news media. Income from the site is not an issue, neither is the nature of the content, or the size of readership. The ICO appears to be willing to allow broad definitions of who is covered and what is covered.
What is essential is their intent; that the data is for publication, that publication is in the public interest and that there exist good reasons for not complying.
It will require looking at and trying to follow codes of practice, such as the BBC’s guidelines. It will require demonstrating that at least some procedures are in place for discussing and evaluating material before it is published. It will require an ability to put forward a cogent argument for the way material was published. Finally it will require the ability to demonstrate that the DPA principles on gathering and handling data have been respected as far as possible. These are not particularly onerous requirements.
It remains to be seen how many individuals will seek to use the exemptions and ultimately how the ICO and the courts will deal with them, but it is important that at least some try if only to ensure that the volume and range of material published online does not get unduly curtailed. It would be a sad moment for freedom of expression if sites were forced to close because of administrative excess.
Justin Dear is Head of Online News Desk (Asia-Pacific) for Agence France-Presse and specializes in criminal and media law issues
[1] Daniel W. Drezner & Henry Farrell, The Power and Politics of Blogs, Presentation at the 2004 American Political Science Association Annual Meeting 4, 16 (July 2004) http://www.utsc.utoronto.ca/~farrell/blogpaperfinal.pdf
[2] Mary-Rose Papandrea. “Citizen Journalism and the Reporter’s Privilege.” Minnesota Law Review, (2007): 515-591
[3] In re Grand Jury Subpoena, Judith Miller, 397 F.3d 964, 976-80 (D.C. Cir. 2005) Sentelle J.; see also Lee v. Dep’t of Justice, 401 F. Supp. 2d 123, 139-40 (D.D.C. 2005).
[4] Section 552(a)(4)(A)(ii) of title 5, United States Code http://www.justice.gov/oip/blog/foia-update-freedom-information-act-5-usc-sect-552-amended-public-law-no-104-110-stat US Department of Justice accessed 11/03/2015
[5] “Data protection and journalism: a guide for the media”, (2)(p30). Information Commissioner’s Office
[6] See for example Von Hannover Germany (2005) 40 E.H.R.R. 1 [at 59]; Douglas v Hello! (No 6) [2006] Q.B. 125 [at 56]; Theakston v MGN Limited [2002] EWHC 137 (QB) [at 78]; Campbell v MGN Limited [2004] UKHL 22 [at 11]
[7] [at 86] see also DPA, s 32(3).
