< Back

Share |

ICO publishes response to the Leveson Report

The Leveson report into the culture, practices and ethics of the press made a number of significant recommendations; not only as to the role of a future regulatory framework governing its activities but also for the UK's data protection regime and the role and functions of the Information Commissioner's Office (ICO).

February 2013

The Information Commissioner acknowledged at the time the report was published on 29 November 2012, that it offered much for his office to consider and reflect upon. The ICO has now published its views on the detail and practical affects of those recommendations affecting the legal framework of the data protection law, (which are seen as being directed at the Ministry of Justice) and those directed to the ICO.

Recommendations for the Ministry Of Justice (MOJ)

The media exemption at section 32 of the DPA

Looking at the recommendations to amend the exemption at section 32 of the Data Protection Act 1998 (DPA), the Information Commissioner explains that he can see 'the merit in certain changes'. He points favourably to the recommended narrowing of the exemption to data processing that is 'necessary' for publication, rather than merely being undertaken 'with a view to publication' and generally welcomes the aim of creating more of a balance between freedom of expression and the public interest in information privacy.

The ICO's view does not extend however to all of the proposals.  He is unconvinced of the merit in narrowing the scope of the exemption so that it no longer provides, by itself, for exemption from the requirements of the first, second, fourth, sixth and eighth principles of the DPA. The ICO still believes there should remain broad exemption from the DPA at the point an agreed threshold for engagement with the law has been reached.

The ICO is particularly cautious about the impact of removing the subject access exemption, pointing to legitimate concerns about the 'chilling effect'  this proposal could have on investigative journalism.

Taken as whole,  the Information Commissioner considers  the proposed changes here would 'move the ICO closer to becoming a mainstream regulator of the press'.  The Commissioner stresses that this is not a role he is actively seeking and he  'does not underestimate the challenges this would bring'.  His response is clear that whatever role the ICO should play in regulating the press, this is ultimately a public policy matter for the Government and Parliament to consider and that the ICO's comments on the recommendations relevant to the MOJ should therefore be considered in that light.

Welcome recommendations

tick boxCertain recommendations receive the clear backing of the ICO including:

  • strong support for the recommendation that the right to compensation for distress, provided for by section 13 of the DPA is not restricted to cases of financial loss, but should also include compensation for pure distress;
  • welcome for the recommendation to repeal procedures within the DPA that make it difficult for the ICO to take action in matters involving the press;
  • bringing into force the amendments made to section 55 of the DPA which would allow for terms of imprisonment for offences of unlawful obtaining or disclosure of personal data;

  • The ICO makes clear that such an action is now long overdue, despite the many previous occasions his office has explained why such an action is needed. The Commissioner's response points to a hope that there will now be no further delay in implementing this recommendation, whilst making clear that the scope of this sanction should not be limited to offences by the press, but should apply to the much wider trade in unlawful data.

    The ICO is however less enthusiastic about the separate recommendation that the prosecution powers of the ICO be extended to include any other offence which also constitutes a breach of the data protection principles. The response points out that this recommendation requires careful consideration: to implement such a change would significantly increase the powers of the ICO as an investigating and  prosecuting authority. It would also increase public expectations as to the range of issues on which the ICO could intervene which the ICO may not be able to live up to.

  • clearer sentencing guidelines from the sentencing council on data protection offences generally; and
  • a review of damages available to ensure proportionate compensation is available through the courts.
Other recommendations

Other recommendations do not, in themselves, present any difficulty to the ICO. However, the ICO questions whether they are necessary. For example:

  • the suggestion that a provision be included in the DPA that the ICO have 'special' regard to the obligation in law to balance the public interest in freedom of expression alongside that of upholding the data protection regime (despite the ICO already being bound to act in a way that is compatible with the Human Rights Convention);
  • the recommendation that the ICO must take account of other regulations or enforcement standards when exercising his powers in relation to the media or other publishers (which already reflects the ICO's policy and practice);
  • the recommendation that the ICO formally consult with the CPS (a practice that generally already takes place not withstanding the absence of a formal obligation in law to do so); and
  • the recommendation to consider amending the DPA to reconstitute the ICO into an Information Commission led by a Board of Commissioners

clear lines of accountabilityThe ICO agrees that the opportunity should be taken to consider if the current constitution of the ICO is still the right one and, if not to amend the law. The ICO stresses however that this requires careful consideration and points to the benefits to be had from keeping a single regulator model, including clear lines of accountability and a figurehead that can be more be more responsive to urgent issues. The ICO points out that any change, would require primary legislation and, given the European Commission's  proposals to change the data protection legislative framework, it would make sense for this recommendation to be considered as part of that wider process.

Recommendations for the ICO

In responding to the specific recommendations in the Leveson report that are directed at the ICO, there is a sense from reading between the lines, that the ICO considers some of the criticism that the report levels at his office to be unjustified (although the response of the ICO does not come out directly and say this).

The ICO is at pains to point out that it was, after all, the ICO who had taken the lead in presenting his concerns about the involvement of the press in the unlawful trade of personal data. This followed his predecessor's investigations almost 10 years previously and which were subsequently brought before the Parliament in two separate reports. He also points out that the bulk of the materials analysed by the Leveson inquiry date from between 2003 and 2007. Many changes had taken place at the ICO since then, meaning the ICO was a 'very different organisation'  from the one that was in place at that time (a point the Leveson report appears to overlook).

Despite these grumbles, the ICO has addressed each of the ten recommendations directed by the Leveson report for his office, providing an explanation of the actions his office will take, where appropriate, and the timetable for action.  A table summarising the recommendations and the ICO's response is provided below.

  Leveson recommendation for the ICO ICO response Completion Date
1 The ICO should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the data protection regime. The Regulatory Action Policy is in the process of being revised. End of March 2013.
2 The ICO should take immediate steps in consultation with the industry to prepare and issue within six months,  comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. The initial proposal is to develop a Code of Practice on the DPA and the media in consultation with the press and broadcasting industry. End of May 2013.
3 The ICO should take immediate steps to prepare and issue guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data and how to exercise these rights. Guidance to the public in line with the Code of Practice (at point 2 above) will be prepared and issued. End of May 2013.
4 The ICO should take steps to prepare and issue guidance to the public on their individuals rights in relation to the obtaining and use by the press of their personal data and how to exercise their rights. A section will be added to the ICO's website to give advice to individuals on their rights in relation to the media. End of January 2013.
5 The ICO to take immediate steps to publish advice aimed at individuals concerned that their data may have been processed by the press unlawfully. See ICO response in relation to point 4 above. End of January 2013.
6 The ICO's Annual Report to Parliament should include regular updates on the effectiveness of the measures taken and on the culture, practice and ethics of the press in relation to the processing of personal data. First update to be included in the Annual Report to Parliament. End of June 2013.
7 The ICO should immediately adopt the Guidelines for Prosecutors on assessing the public interest in cases affecting the media issued by the Director of Public Prosecutions in September 2012. The ICO had, already adopted the Guidelines for Prosecutors and also adheres to the CPS Code of Practice for Criminal Cases. Already in place.
8 The ICO should take immediate steps to engage with the Metropolitan police on preparing a long-term strategy in relation to alleged media crime. This process is already underway. Already underway.
9 The ICO should review the availability to it of specialist legal and practical knowledge on the application of the data protection regime to the press and to any extent necessary address it. This review has been undertaken and a key stakeholder engagement plan is being produced. End February 2013.
10 The ICO should review its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions can be satisfactorily considered and addressed in the round. The current management structures and controls at the ICO are now very different from those at the time of the events considered by the Leveson inquiry. Nevertheless consideration will be given to whether to establish a cross-office Enforcement Board to oversee the application of ICO prosecution and civil enforcement powers. End August 2013.


Ultimately, it is those recommendations directed at the Ministry of Justice that could have the most significant impact on the power and constitution of the ICO and his relationship with the press. The ICO has held back from a detailed critique of these proposals, deferring instead to Government whose appetite for significant reform in this area is questionable.

make the right decision

Notwithstanding the above, any decisions the Government does take will also need to be consistent with the proposed changes to the EU data protection framework. It is unlikely we will have visibility as to the final form of any such framework before the end of the year.

If you have any questions on this article please contact us.

ICO publishes response to Leveson Report
Sally Annereau

Sally Annereau looks at the Information Commissioner's recently published views on Lord Justice Leveson's recommendations for the UK's data protection regime.

"In responding to the specific recommendations in the Leveson report that are directed at the ICO, there is a sense from reading between the lines, that the ICO considers some of the criticism that the report levels at his office to be unjustified (although the response of the ICO does not come out directly and say this)."