Data protection: don’t you just love it?

Thought not, but it can’t be denied that in recent years, data protection law has grown in both relevance and importance for journalists and publishers.  Whilst it has been a legal consideration for years, these days, data protection is invariably one of the first areas of law a potential claimant thinks about when considering a claim against a publisher, usually alongside libel and breach of privacy.

As journalists and publishers know, the principle of the “journalism exemption” is well established.  The exemption was formerly contained in section 32 of the Data Protection Act 1998, but since the implementation of the General Data Protection Regulation (GDPR), it can now be found in paragraph 26 of Schedule 2 to the Data Protection Act 2018 (DPA 2018).

But remember, the journalism exemption does not give journalists a blanket exemption from the obligations of the GDPR and the DPA 2018.  For example, it does not exempt publishers from the obligation to have appropriate technical and organisational measures in place to ensure data is processed fairly and lawfully.  Rather, the journalism exemption only means that certain provisions of the DPA 2018 do not apply to journalists, and then only insofar as those provisions are incompatible with journalism itself.

So why the sudden interest in this issue?  Because a recent decision from the First-Tier Tribunal is one of the first to look at the journalism exemption in its reincarnated form under the DPA 2018.

(Warning: First-Tier Tribunal decisions do not create binding precedents, so this decision is purely an interesting case on the specific facts, though perhaps it is illustrative of the possible (likely?) approach other judges might take).

The case in question is called True Vision Productions v ICO.  It related to True Vision Production’s (TVP) filming of the ‘Child of Mine’ documentary in 2017.  It is an unusual case in that it considers the journalism exemption in the context of a publisher having been fined by the Information Commissioner’s Office for a data protection breach, rather than in the context of defending a legal claim for a data protection breach.

A crew from TVP was filming an observational documentary about the experience and aftermath of stillbirths.  The team recorded CCTV (both visual and audio) of expectant mothers having medical consultations when they were concerned about the health of their babies.  The Tribunal found that the purpose of the recording was to capture the moment when the mother was informed that her baby had died.

In his ruling, Judge Jacobs made clear that this was an example of sensitive and responsible film-making.  However, it was noted by the Tribunal that the project had not been designed with data protection in mind, and whilst privacy concerns were paramount regarding the treatment of personal data after it was gathered, it was the making of the recordings in the first place which was problematic for TVP.

TVP did not ask for the consent of the mothers prior to recording the consultations because to receive informed and effective consent, the mothers would have needed to be told that there was a prospect that their babies had died.  TVP decided that this information should be provided by medical professionals.  Instead, TVP explained what it was doing via letters and notices displayed in the consultation room, and gave mothers the option to use a different room where the CCTV was not being recorded.

The Tribunal said that the problem was that the mothers were unlikely to read the notices, or pay attention to the presence of a CCTV camera in this context whilst under emotional stress. The Judge found that even if they did see the CCTV cameras, they would be likely to associate them with security rather than the production of a documentary.

Apparently, TVP believed both that the recordings were carried out with a view to the publication of journalistic material and believed that publication would be in the public interest.

So the key question was whether compliance with the data protection principles was incompatible with the journalism.

The Tribunal concluded that whilst it was reasonable not to obtain explicit or effective consent to the recordings in the circumstances, TVP failed on the issue of transparency.  It said that hand-held cameras could have been used instead of CCTV, and this would have made the mothers aware that they were being recorded.  This, the judgment added, would have “prevented the collection and retention of data without the mother being aware it was taking place”.

TVP was issued with a Monetary Penalty Notice for £120,000 by the ICO, but this penalty was reduced to £20,000 by the Tribunal because:

• the breach was deemed to be non-deliberate;
• TVP had considered privacy rights prior to filming; and
• this breach did not warrant putting a company out of business.

So, how is this non-binding decision relevant to journalists’ daily working practices?

Well, first and foremost, most journalists these days have the ability to film whatever it is they are reporting on, so the idea that this is a problem for TV producers only, and “it couldn’t happen to me”, is not correct.  It isn’t, and it could!

In addition, you cannot just assume that data protection principles are incompatible with journalism.  To succeed with this kind of argument, there has to be a thorough examination of the particular facts of whatever you are filming.   It’s not straightforward or easy.

And because ignorance of data protection law is not a defence and will not be viewed sympathetically by the Tribunal, you must always have data protection at the forefront of your minds when gathering personal data, and ensure your journalism is compatible with the data protection principles.

Both data protection generally, and the journalism exemption in particular, are complex and difficult.  But it’s worth getting to grips with them because as this case shows, despite the significant reduction to the original penalty, getting it wrong is expensive.