Media can refuse subject access requests if complying could jeopardise stories, says ICO

The watchdog has issued new draft guidelines on how media organisations can comply with UK data protection laws (50-page / 538KB PDF). Its consultation on the proposals is open until 22 April. The Data Protection Act (DPA) contains a carve out that makes journalists' exempt from some of the rules contained under the framework in certain circumstances.

The ICO, following a request from Lord Justice Leveson in his report into the culture, practices and ethics of the press, has now issued guidance that explains in more detail how that carve out applies.

Generally, the DPA requires organisations to provide a copy of the personal data they hold about an individual to that person when that person requests access to it within 40 days of receiving that request. However, section 32 of the DPA specifically refers to those 'subject access' rules as not applying to data processed for journalistic purposes.

Section 32 of the DPA sets out a 'special purposes' exemption that media organisations can rely on to justify the processing of personal data for journalistic reasons. The exemption means those businesses are not obliged to ensure their processing is compatible with one of the six general conditions set out under the Act that govern lawful processing of personal data, which include where organisations have individuals' consent to conduct that processing.

The journalistic purposes exemption can be relied upon where media organisations process personal data with a view to publishing a story and where they reasonably believe that the publication would be in the public interest and providing they reasonably believe that complying with the need to obtain consent, or satisfy one of the other conditions to justify the processing, is "incompatible" with the purpose of journalism.

If organisations are processing personal data for reasons other than in pursuit of publishing public interest stories then they must conform to the general requirements governing lawful processing of that information. In addition that data must also generally be disclosed to individuals who make a subject access request (SAR).

However, the ICO's new guidance explains that data processed in accordance with the journalistic purposes exemption can be withheld from individuals whose data it is when those people request access to it.

"You may be able to rely on the exemption to refuse the request if you hold the information in connection with the publication of a story in the public interest, and you believe responding to the SAR would stop you doing your job," the ICO's new guidance to the media said. "However, you are not automatically exempt. If you can provide the information (or some of it) without undermining your activities, you should do so."

"In practice, this means that when you receive a SAR you will need to give proper thought to whether you could respond, and how much information you can provide. If you decide not to comply with the request and the individual complains about your decision, we may ask you to show that you considered the request, and to explain why you thought providing the information would be harmful," it added.

The ICO said that it will be hard, but not impossible, for media organisations to justify refusing a SAR for data processed in line with the section 32 exemption post-publication of the story for which the data was processed.

"The exemption can apply to SARs made before or after publication of a story," the watchdog said. "However, you might find it harder to justify rejecting a SAR made after publication, as you cannot argue that providing the information will undermine the story by tipping someone off to a forthcoming publication. We would therefore always expect you to take the timing of the SAR into account when considering whether you can respond, even if you have rejected a similar request in the past."

"You may still be able to use the exemption after publication, but only if you can explain why you think responding would undermine future investigations or publications, or journalism more generally. Even if you decide that you cannot provide copies of all the information, you should still consider whether you can partially comply by providing some of the information, or a description of the information, or even just confirming whether or not you hold some information," the draft guide said.

In his report, Lord Justice Leveson recommended that a number changes be made to section 32 of the DPA. Among the recommendations, Leveson said that individuals whose personal data is processed under the terms of the journalistic purposes exemption should have a right to access that data upon request.

The ICO had previously warned that forcing the media to comply with SARs made for data processed in line with the journalistic purposes exemption could curb investigative journalism.

The Government has still to decide whether to propose changes to the DPA in light of Leveson's suggestions.