ICO publishes response to the Leveson Report

The Information Commissioner acknowledged at the time the report was published on 29 November 2012, that it offered much for his office to consider and reflect upon. The ICO has now published its views on the detail and practical affects of those recommendations affecting the legal framework of the data protection law, (which are seen as being directed at the Ministry of Justice) and those directed to the ICO.

Recommendations for the Ministry Of Justice (MOJ)

The media exemption at section 32 of the DPA

Looking at the recommendations to amend the exemption at section 32 of the Data Protection Act 1998 (DPA), the Information Commissioner explains that he can see 'the merit in certain changes'. He points favourably to the recommended narrowing of the exemption to data processing that is 'necessary' for publication, rather than merely being undertaken 'with a view to publication' and generally welcomes the aim of creating more of a balance between freedom of expression and the public interest in information privacy.

The ICO's view does not extend however to all of the proposals.  He is unconvinced of the merit in narrowing the scope of the exemption so that it no longer provides, by itself, for exemption from the requirements of the first, second, fourth, sixth and eighth principles of the DPA. The ICO still believes there should remain broad exemption from the DPA at the point an agreed threshold for engagement with the law has been reached.

The ICO is particularly cautious about the impact of removing the subject access exemption, pointing to legitimate concerns about the 'chilling effect'  this proposal could have on investigative journalism.

Taken as whole,  the Information Commissioner considers  the proposed changes here would 'move the ICO closer to becoming a mainstream regulator of the press'.  The Commissioner stresses that this is not a role he is actively seeking and he  'does not underestimate the challenges this would bring'.  His response is clear that whatever role the ICO should play in regulating the press, this is ultimately a public policy matter for the Government and Parliament to consider and that the ICO's comments on the recommendations relevant to the MOJ should therefore be considered in that light.

Welcome recommendations

Certain recommendations receive the clear backing of the ICO including:

• strong support for the recommendation that the right to compensation for distress, provided for by section 13 of the DPA is not restricted to cases of financial loss, but should also include compensation for pure distress;
• welcome for the recommendation to repeal procedures within the DPA that make it difficult for the ICO to take action in matters involving the press;
• bringing into force the amendments made to section 55 of the DPA which would allow for terms of imprisonment for offences of unlawful obtaining or disclosure of personal data;
  



The ICO makes clear that such an action is now long overdue, despite the many previous occasions his office has explained why such an action is needed. The Commissioner's response points to a hope that there will now be no further delay in implementing this recommendation, whilst making clear that the scope of this sanction should not be limited to offences by the press, but should apply to the much wider trade in unlawful data. The ICO is however less enthusiastic about the separate recommendation that the prosecution powers of the ICO be extended to include any other offence which also constitutes a breach of the data protection principles. The response points out that this recommendation requires careful consideration: to implement such a change would significantly increase the powers of the ICO as an investigating and  prosecuting authority. It would also increase public expectations as to the range of issues on which the ICO could intervene which the ICO may not be able to live up to.



• clearer sentencing guidelines from the sentencing council on data protection offences generally; and
• a review of damages available to ensure proportionate compensation is available through the courts.

Other recommendations

Other recommendations do not, in themselves, present any difficulty to the ICO. However, the ICO questions whether they are necessary. For example:

• the suggestion that a provision be included in the DPA that the ICO have 'special' regard to the obligation in law to balance the public interest in freedom of expression alongside that of upholding the data protection regime (despite the ICO already being bound to act in a way that is compatible with the Human Rights Convention);
• the recommendation that the ICO must take account of other regulations or enforcement standards when exercising his powers in relation to the media or other publishers (which already reflects the ICO's policy and practice);
• the recommendation that the ICO formally consult with the CPS (a practice that generally already takes place not withstanding the absence of a formal obligation in law to do so); and
• the recommendation to consider amending the DPA to reconstitute the ICO into an Information Commission led by a Board of Commissioners

The ICO agrees that the opportunity should be taken to consider if the current constitution of the ICO is still the right one and, if not to amend the law. The ICO stresses however that this requires careful consideration and points to the benefits to be had from keeping a single regulator model, including clear lines of accountability and a figurehead that can be more be more responsive to urgent issues. The ICO points out that any change, would require primary legislation and, given the European Commission's  proposals to change the data protection legislative framework, it would make sense for this recommendation to be considered as part of that wider process.

Recommendations for the ICO

In responding to the specific recommendations in the Leveson report that are directed at the ICO, there is a sense from reading between the lines, that the ICO considers some of the criticism that the report levels at his office to be unjustified (although the response of the ICO does not come out directly and say this).

The ICO is at pains to point out that it was, after all, the ICO who had taken the lead in presenting his concerns about the involvement of the press in the unlawful trade of personal data. This followed his predecessor's investigations almost 10 years previously and which were subsequently brought before the Parliament in two separate reports. He also points out that the bulk of the materials analysed by the Leveson inquiry date from between 2003 and 2007. Many changes had taken place at the ICO since then, meaning the ICO was a 'very different organisation'  from the one that was in place at that time (a point the Leveson report appears to overlook).

Despite these grumbles, the ICO has addressed each of the ten recommendations directed by the Leveson report for his office, providing an explanation of the actions his office will take, where appropriate, and the timetable for action.  A table summarising the recommendations and the ICO's response is provided below.

Conclusions

Ultimately, it is those recommendations directed at the Ministry of Justice that could have the most significant impact on the power and constitution of the ICO and his relationship with the press. The ICO has held back from a detailed critique of these proposals, deferring instead to Government whose appetite for significant reform in this area is questionable.

Notwithstanding the above, any decisions the Government does take will also need to be consistent with the proposed changes to the EU data protection framework. It is unlikely we will have visibility as to the final form of any such framework before the end of the year.

If you have any questions on this article please contact us.

Regulatory

Privacy & Cookie Policy

Terms of Use

© 2021 Taylor Wessing LLP