A High Court case last month beautifully demonstrated the value of the Section 32 exemption to the Data Protection Act 1998 (the DPA), known as the ‘journalism exemption’. This exemption does not appear in the DPA’s replacement, the GDPR, which is due to become law next May.

Section 32 may not be a weapon that editors and publishers often reach for when defending publication of articles in the public interest. But because the DPA is increasingly being used by claimants alongside claims for defamation and breach of privacy, it is a valuable tool in the armoury.

The case involved a businessman, known as ZXC, who sought an interim injunction ordering that information about him be taken down, pending trial. The information, published in a 2016 Bloomberg article about a police investigation into alleged fraud at a company he was involved in, was based on a leaked police report.

ZXC argued that there was no public interest in publishing highly confidential, leaked information about an ongoing criminal investigation. He claimed that the publication was a misuse of private information and a breach of his data protection rights. These two privacy causes of action often go hand in hand these days, since the Defamation Act 2013 raised the libel bar by introducing the ‘serious harm’ threshold.

Privacy

The judge dealt swiftly with the misuse of private information claim. Firstly he agreed that ZXC did have a reasonable expectation of privacy in regard to the information contained in the confidential report. However, Article 8 privacy and Article 10 freedom of expression rights are evenly weighted, until the facts tip the balance on one side of the scales or the other.

The information had already been published in an earlier article to which he did not object. It was already in the public domain and although ZXC did suffer stress and anxiety as a result of the publication, this anxiety was no more than that caused by the investigation itself. Bloomberg had not suggested he was guilty of any offence, only that he was being investigated.

Crucially, the Bloomberg article was a serious piece of journalism in the public interest. Naming ZXC was a legitimate journalistic decision because it “not only adds colour and texture to the story, but it is also directly relevant to the credibility of the analysis contained in the article.” Bloomberg’s right to freedom of expression comfortably outweighed ZXC’s privacy rights.

The Data Protection Act

ZXC also argued that sections of the report about the criminal investigation into him, being his personal data, should be deleted from the article, because he had not given consent. His barrister argued that Bloomberg could not rely on the section 32 exemption to the DPA because the article consisted of unproven allegations, he had not been charged with any offence, the underlying document was highly confidential, and the leak was a breach of confidence.

The steps necessary to rely on the section 32 – processing personal data contrary to the individual’s data protection rights – can be expressed as a series of three questions:

Is the data processed with a view to the publication of journalistic material?

Does the data controller reasonably believe that, having regard to the special importance of public interest in the freedom of expression, publication would be in the public interest?

Does the data controller reasonably believe that in the circumstances compliance with that provision (i.e. the relevant section of the DPA which is protecting the individuals’ personal data rights) is incompatible with the special purposes?

Answer yes to those questions, and publishers can rely on the journalism exemption. Bloomberg did, and the judge agreed they had an absolute defence to publishing ZXC’s personal information.

This case highlights two issues:

Firstly, Bloomberg could show that the decision to publish was taken after careful consideration of the relevant circumstances, and concluded that it was justified in publishing on public interest grounds. If publishers are to rely on section 32, it is important to be able to demonstrate that the decision to publish was taken at a high level, and to keep a note showing that the individual’s data protection rights had been considered, but that the data controller, the publisher, believed at the time of publication that it was in the public interest.

The second issue concerns the future of this exemption, after the adoption of the new European data protection regulation, the GDPR, in May next year. The GDPR is the successor to the DPA, updated for the digital age, and is very much focused on enhancing and improving individual personal data rights. The government has confirmed that it will be adopted in the UK.

There is no “section 32” in the GDPR. Article 85 of the GDPR states: “member states shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression, including for journalistic purposes…” The government has not announced what it intends for section 32 following the GDPR.

However, it has indicated that it intends that some of the existing DPA, which is not superseded by the GDPR, will remain on the statute books.

Therefore given the volume of legislation that must be put in place for Brexit, it seems likely that rather than draft some new legislation or statutory instrument for the journalism exemption, it will simply stay as it is in the DPA, at least for the present.