The Leveson Report deals with data protection issues in considerable detail. We set out below the recommendations relating to data protection. The evidence and issues are more fully described in Part H, Chapter 5 of the Report.
The Press and Data Protection
Recommendations to the Ministry of Justice
48. The exemption in section 32 of the Data Protection Act 1998 should be amended so as to make it available only where:49 (a) the processing of data is necessary for publication, rather than simply being in fact undertaken with a view to publication; (b) the data controller reasonably believes that the relevant publication would be or is in the public interest, with no special weighting of the balance between the public interest in freedom of expression and in privacy; and (c) objectively, that the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication.
49. The exemption in section 32 of the Data Protection Act 1998 should be narrowed in scope, so that it no longer allows, by itself, for exemption from:50 (a) the requirement of the first data protection principle to process personal data fairly (except in relation to the provision of information to the data subject under paragraph 2(1)(a) of Part II Schedule 1 to the 1998 Act) and in accordance with statute law; (b) the second data protection principle (personal data to be obtained only for specific purposes and not processed incompatibly with those purposes); (c) the fourth data protection principle (personal data to be accurate and kept up to date); (d) the sixth data protection principle (personal data to be processed in accordance with the rights of individuals under the Act); (e) the eighth data protection principle (restrictions on exporting personal data); and (f) the right of subject access. The recommendation on the removal of the right of subject access from the scope of section 32 is subject to any necessary clarification that the law relating to the protection of journalists’ sources is not affected by the Act.
50. It should be made clear that the right to compensation for distress conferred by section 13 of the Data Protection Act 1998 is not restricted to cases of pecuniary loss, but should include compensation for pure distress.
51. The procedural provisions of the Data Protection Act 1998 with special application to journalism in: (a) section 32(4) and (5) (b) sections 44 to 46 inclusive should be repealed.52
51. In conjunction with the repeal of those procedural provisions, consideration should be given to the desirability of including in the Data Protection Act 1998 a provision to the effect that, in considering the exercise of any powers in relation to the media or other publishers, the Information Commissioner’s Office should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime.
53. Specific provision should be made to the effect that, in considering the exercise of any of its powers in relation to the media or other publishers, the Information Commissioner’s Office must have regard to the application to a data controller of any relevant system of regulation or standards enforcement which is contained in or recognised by statute.
54. The necessary steps should be taken to bring into force the amendments made to section 55 of the Data Protection Act 1998 by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism).
55. The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.
56. A new duty should be introduced (whether formal or informal) for the Information Commissioner’s Office to consult with the Crown Prosecution Service in relation to the exercise of its powers to undertake criminal proceedings.
57. The opportunity should be taken to consider amending the Data Protection Act 1998 formally to reconstitute the Information Commissioner’s Office as an Information Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public administration, law and business, and active consideration should be given in that context to the desirability of including on the Board a Commissioner from the media sector.
Recommendations to the Information Commissioner
58. The Information Commissioner’s Office should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime.
59. In discharge of its functions and duties to promote good practice in areas of public concern, the Information Commissioner’s Office should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. This should be prepared and implemented within six months from the date of this Report.
60. The Information Commissioner’s Office should take steps to prepare and issue guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights.
61. In particular, the Information Commissioner’s Office should take immediate steps to publish advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice.
62. The Information Commissioner’s Office, in the Annual Report to Parliament which it is required to make by virtue of section 52(1) of the Act, should include regular updates on the effectiveness of the foregoing measures, and on the culture, practices and ethics of the press in relation to the processing of personal data.
63. The Information Commissioner’s Office should immediately adopt the Guidelines for Prosecutors on assessing the public interest in cases affecting the media, issued by the Director of Public Prosecutions in September 2012.
64. The Information Commissioner’s Office should take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to ensuring that the Office is well placed to fulfil any necessary role in this respect in the future, and in particular in the aftermath of Operations Weeting, Tuleta and Elveden.
65. The Information Commissioner’s Office should take the opportunity to review the availability to it of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it.
66. The Information Commissioner’s Office should take the opportunity to review its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions (including the relationship between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other) can be satisfactorily considered and addressed in the round.
Regulation by Law
The Criminal Law
67. On the basis that the provisions of s77-78 of the Criminal Justice and Immigration Act 2008 are brought into effect, so that increased sentencing powers are available for breaches of s55 of the Data Protection Act 1998,68 the Secretary of State for Justice should use the power vested in him by s124(1)(a)(i) of the Coroners and Justice Act 2009 to invite the Sentencing Council of England and Wales to prepare guidelines in relation to data protection offences (including computer misuse).
