Elle Todd, a partner at Reed Smith, explains the new draft journalism code of practice from the Information Commissioner’s Office and the questions it leaves unanswered.
Following a long wait, the UK’s data protection regulator has published its new draft journalism code of practice.
It is aimed at data controllers in the field of journalism, a broad area covering not only traditional press, broadcast media and professional journalists but also, significantly, citizen journalists. It covers the disclosure of information, opinions, or ideas, by any means, to the public.
Although the focus of the Code is on journalistic activity, it will have broader value throughout the media sector. In the absence of other media-specific guidance from the ICO, this document will serve as a primary resource and reference point for expectations more broadly in relation to media content.
The purpose of the Code
The document is one of a handful of statutory codes the ICO is required to publish under the Data Protection Act 2018. It will replace the existing media code once finalised (which must be done with the approval of Parliament).
It covers how personal data about individuals can be processed in the context of journalistic activities and in compliance with data protection legislation. It does not deal with media regulation or other “privacy” claims that individuals may be able to assert from a legal perspective.
As one of a handful of statutory codes of practice under UK data protection law, the ICO, courts and tribunals are required to take it into account when considering issues arising in relation to data protection compliance and proceedings. Generally, the courts will give weight to statutory codes of practice, taking the approach that they should be considered carefully unless there is a good reason not to.
The Code is not there just to act as a stick but primarily serves as a guide to assist individuals and organisations in their understanding of the laws and legal obligations under UK data protection laws.
What are the key areas it covers?
The Code covers many aspects of data protection law so much of it is familiar and serves as a reminder of what organisations engaged in journalism will already know.
Where the Code is perhaps of most interest is where it seeks to give practical guidance around key issues that are notoriously difficult to navigate in this field. In particular, a big part of the new data protection regime post the implementation of GDPR is the focus on accountability, which can generally involve quite a heavy paperwork compliance burden.
The draft Code confirms that the ICO considers accountability obligations as key but also notes that “accountability is a flexible concept”, not least in a fast-paced newsroom. This is one part of the code where the ICO has already been receiving a lot of feedback. For example, how would a citizen journalist even know what a data-sharing agreement or data protection assessment is?
The scope of the exemption in the Data Protection Act for “journalistic and artistic purposes” is an additional significant area of the Code that many industry experts are looking at closely. Many journalists are aware of this exemption but still struggle with it from a practical implementation point of view.
A key reason is that the exemption can’t be applied retrospectively or in a blanket fashion but only to specific requirements of data protection law that are identified as incompatible with the journalistic purpose – for example individually to a requirement for informing individuals about data processing, or failure to get consent if otherwise required. Many journalists simply don’t have the time or knowledge to apply this type of a test systematically when working on stories and guidance on how to do so has been scarce to date.
One area that the Code races through rather too hastily is where the lawful bases that may be relevant for the processing of information are outlined. Although the Code makes clear that consent can be problematic, journalists may still be unclear as to when it should be obtained and how.
Greater nuanced advice is also needed around another potential lawful basis of special category data which has been “manifestly made public”. For instance, the Code glosses over key issues such as whether the term applies to personal data which is being made public through say an interview with a journalist, rather than being taken from sources such as social media where an individual has chosen to disclose such information. It is likely that consultation responses will be significant here.
Similarly, whilst the Code helpfully confirms that offenders may be deemed to have manifestly made information about their offence public, it does not clearly clarify the restrictions that this is subject to.
What’s next?
In general, this is an important Code but remains a work in progress to make it truly practical for the huge range of journalism it covers. The ICO is actively engaged in obtaining feedback to help on this front. Therefore, where readers have comments and recommendations to make, they should ensure these are submitted by the deadline so that the Code is as practical and informative for all in the industry when in its final form.
Those wanting to provide their views can do so by completing the online survey online by emailing journalismcode@ico.org.uk by 10 January.
Email pged@pressgazette.co.uk to point out mistakes, provide story tips or send in a letter for publication on our "Letters Page" blog
