The reason for our preoccupation with s.32 is that since the Defamation Act 2013 (DPA) raised the bar for defamation claims, claimants are increasingly turning to the DPA when seeking to claim damages against a publisher, or to prevent publication of articles to which they object, or to have them removed.
S.32 protects publishers because it enables newspapers to process personal data (which would otherwise breach the DPA) if the publisher reasonably believes that publication is in the public interest.
The purpose of the exemption for the ‘special purposes’ of journalism, literature and art, is to protect freedom of expression. However, there is no equivalent of s.32 in the GDPR, the pan-European regulation which will become law in the UK in May next year. This means that unless the government positively legislates to put s.32 into domestic legislation, this crucial right could be lost.
The government is calling for views on the derogations in the GDPR, and the DCMS would like stakeholders to submit their views on a number of derogations, including the journalism exemption (Theme 11 “Freedom of Expression in the Media).
Article 85 of the GDPR states that member states “shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression including processing for journalistic processes”. To do so, member states must provide for exemptions from GDPR data protection rights and principles in domestic law.
There have been concerns that following the phone hacking scandal and the Leveson report, the government may tighten s.32. The Leveson report recommended that the scope of the s.32 exemption should be reduced. For example, he concluded that the exemption should be available only where the processing of data is necessary for publication, rather than simply being undertaken with a view to publication. He also suggested that the likely interference with privacy resulting from the processing of the data should be objectively outweighed by the public interest, rather than subjectively assessed by the editor. These amendments would make it much more difficult for publishers to bring themselves within the scope of s.32.
In our last two Law Column articles, we have drawn attention to a couple of cases which highlighted the profound importance of s.32. Last week, we reported on a claim by a wealthy businessman James Stunt, who was asking the Court for an order for the publisher of an article about him in the Daily Mail Mail on Sunday and Mail Online to cease processing his personal data and to destroy it. This would effectively prevent the Mail reporting on him. The court agreed that the Mail ‘s use of s.32(4), which allows for data protection proceedings to be stayed where the data concerned is held for future journalistic purposes, was applicable in this instance. The court recognised that if it intervened on data protection grounds, this would inhibit the journalistic process and thus pose a threat to freedom of expression.
In an earlier case, the court upheld Bloomberg’s right to process personal data about criminal investigation into a businessman, even though the businessman was not convicted of any crime, and the information Bloomberg published was based on a leaked report. The court found that the exemption was justified and publication was in the public interest.
The purpose of the GDPR is to strengthen the rights of individuals and protect personal data in the digital age. Individuals’ rights will be improved across a number of areas such as consent, the right to be forgotten and the right to restrict processing of personal data.
Few would argue that individuals’ data protection rights should be better protected in the age of social media, apps, tracking and cookies. However, restricting publishers’ ability to process data in the public interest would skew the traditional balance of privacy and freedom of expression that the courts have upheld.
Publishers interested in submitting their response can access the online tool as follows:
The submission on the online tool should be brief, but further information to support views can be sent by email to: GDPRCallforViews@culture.gov.uk