Victims of ‘media abuse’ may turn to the Data Protection Act now that it is harder to bring libel actions

The new Defamation Act makes it harder for individuals to sue media organisations. But editors shouldn’t be complacent. I predict that aggrieved readers will start using the Data Protection Act instead.

The media are covered by the journalistic exemption under the DPA's s32. But the exemption isn’t a magic wand. People may be tempted to contest it.

They could serve a media organisation or a journalist with a notice under the DPA's s10, claiming a story contained their personal data, and that publication caused them unwarranted substantial damage or substantial distress.

The English courts, and potentially the European Court, would then have to balance the claimaint's rights to privacy with the journalistic exemption. The Information Commissioner’s new media guidelines anticipate this.

They also say that before publishing, the media must determine "how much personal data it is necessary to publish to properly report the story, balanced against the level of intrusion into the private life of the data subjects, and the potential harm this may cause. For instance, if a story would be highly intrusive or harmful then it is less likely to be fair to publish personal data. This is also the case with stories with very little obvious public interest, or where publication should have been delayed to verify facts."

Another problem arises from the fact that the journalistic exemption does not apply to the DPA’s sections 13 and 55.

Under s13, a reader could claim compensation for damage or distress if they believed a media organisation had failed in their legal duties as a data controller … for example, by failing to provide adequate security measures. Appeal judges awarded £20,000 damages in a recent case under this section.

Readers could also press for a prosecution under s55 if they believed a journalist had obtained their personal data by blagging or covert measures. This could affect investigative journalists and whistleblowers.

The EC's 'Right to be forgotten' ruling has created significant interest in data retention, and it would be naive to assume that the status quo under the DPA will not be tested.

Cleland Thom is author of Internet law for journalists