HomepageCommercial LawPrivate LawPublic Law & Human RightsCriminal LawEU & International LawCareers


Have Irlen Syndrome, or need different contrast? Click the button below for options.

Background Colours


Enter you email address below to subscribe to free customisable article notifications.

Alternatively, click the button below for our various RSS Feeds (available journal wide, or per section).

The Leveson Inquiry: The Media & Data Protection

About The Author

Chris Bridges (Executive Editor)

Chris is an IT and Data Protection solicitor at a top 20 full service firm and the founder of Keep Calm Talk Law. He also contributes to Computers and Law and other sector specific publications.

[Read More]

The Leveson Inquiry, as you may well know, was announced by the current Prime Minister early in his term as a reaction to the phone hacking scandal. Whilst this was initially aimed at investigating the involvement of the police and press in phone hacking, it has considered a wide range of issues, some of which are likely to come into play in the not too distant future.

Part 1 of the inquiry was framed much wider than a review of phone hacking, examining the culture, practices and ethics of the press with a particular focus on the relationship of the press with the public, police and politicians. The report on Part 1 was published on 29th November 2012. Part 2 of the Inquiry is set to focus on the phone hacking scandal, but is yet to commence, and is unlikely to for some time as the inquiry must wait for criminal investigations and any subsequent prosecutions to conclude.

The postponement of the second part has however not affected action on Part 1 of the inquiry; a few important ripples from Part 1 may soon be hitting media organisations.

The inquiry suggested some extensive changes to the rules in relation to journalism and the Data Protection Act 1998, which in its current form provides journalists a fair bit of leeway in complying with the principles contained within the act where doing so would be detrimental to their story of public interest.

The focus of this article is however on one key element: the availability of personal data to data subjects.

Information Commissioners Office (ICO) Guidance

The Leveson inquiry asked the ICO to publish detailed guidance on the relationship between media organisations and the Data Protection Act 1998. Draft guidelines have now been published, and consultation is open on proposals until 22nd April 2014.

This guidance has not been entirely detrimental to the press as you may have presumed.

Generally, Section 7 DPA gives the data subject (the person on whom data is held) a right to receive a full copy of personal data held about himself or herself by a data controller (a company or other organisation that holds personal information). The data subject cannot be charged an administrative fee of more than £10 for this service.

However, there are a number of exceptions to this rule, most notably in this context the journalism exemption under Section 32 DPA. The essence of this exemption is that if a story is being run that can be deemed to be ‘in the public interest’, then many of the general principles of the DPA do not need to be complied with (bar a few key elements, such as the requirement to register, security, the section 55 offence of unlawfully collecting information, and so on). If not in the public interest, it is however business as usual.

This is nothing new. The document does however provide some clear guidance on what can and cannot be done under this exemption, and how the requirements of this exemption can be satisfied.

However, the controversial element of this guidance paper is found on page 40, reading:

You may be able to rely on the exemption to refuse the request if you hold the information in connection with the publication of a story in the public interest, and you believe responding to the SAR would stop you doing your job. However, you are not automatically exempt. If you can provide the information (or some of it) without undermining your activities, you should do so.

In practice, this means that when you receive a SAR you will need to give proper thought to whether you could respond, and how much information you can provide. If you decide not to comply with the request and the individual complains about your decision, we may ask you to show that you considered the request, and to explain why you thought providing the information would be harmful. As with other areas where the exemption might apply, you will need to be able to show you have a proper process for considering requests, and some clear reasons for the decision you made.

Despite this, the guidance is clear that should a media organisation be able to disclose some information without jeopardising the story, they should do so.

Whilst this is not a u-turn in ICO policy, and simply a clear statement of what exactly their policy is, it states in clear terms that media organisations are able to refuse these requests, and may well give these organisations the peace of mind to do so. It also highlights a controversial difference in opinion between the Leveson Inquiry and the ICO, the governing body on these matters.

The Inquiry’s Views on Subject Access Requests

For now, this guidance may be a green light for the press. However, the inquiry actually suggested that the exemption should no longer apply to many more principles of the DPA, including the right of subject access:

The exemption in section 32 of the Data Protection Act 1998 should be narrowed in scope, so that it no longer allows, by itself, for exemption from:

(f) the right of subject access.

The recommendation on the removal of the right of subject access from the scope of section 32 is subject to any necessary clarification that the law relating to the protection of journalists’ sources is not affected by the Act.

It is not yet clear whether such an amendment will be actioned by the legislature. The ICO itself has issued a response to this recommendation, warning that such an amendment could have a serious negative effect on investigative journalism and may not be compatible with an EU Regulation that is currently in the pipeline to establish a single framework for data protection across member states.


Reading the inquiry’s summary of recommendations in relation to the exemption, it is hard not to think of it as a full frontal attack on the media, and this may well be purely reactionary given that the phone hacking scandal has thrown some hefty logs on the mistrust of the media fire.

If the ICO is right in saying such an amendment would have a profound negative effect on investigative journalism, this over-reaction cannot be overlooked. Investigative journalism plays an extremely important part in our society and in many cases bringing the government to account. Many of you may have watched the recently aired Panorama, covering the BBC investigation into student visa fraud. This story has resulted in student visa tests run by the provider concerned being suspended by the Home Secretary.

The long-term investigation revealed that many ‘Visa Agents’ were working with examination centres around the country to provide examination results for a fee. Visa candidates would pay a large sum of money for someone else to sit their exam, while they waited in a secret room within the examination centre. The institutions that run such examinations are allegedly vetted by the Home Office, and only trusted organisations are able to host such tests.

Not only were examination centres at fault, some of the most highly rated colleges in the country were accepting foreign students with implied knowledge that they were here to work, not to study (which is a breach of student visa conditions).

The investigation exposed widespread fraud far beyond the knowledge of the Home Office and the British public, and will undoubtedly spark a thorough review of the current student visa system, that quite clearly has holes in it. This may never have seen the light of day if it was not for investigative journalism. Like it or not, journalists play an important role in exposing criminality, foul play and misfeasance in public office where the police and other organisations fail.

Whether this amendment would have affected this particular case cannot be confirmed, but this is just one example of how investigative journalism plays an important part in our society. Take this away by deterring journalists from taking on such stories, and the legislature threatens to remove a key tool in ensuring accountability.

Is this really the type of journalism that should be targeted? The phone hacking scandal, overall, has been concerned with tabloid style stories on the personal lives of public figures and celebrities. Stories such as these, you hope, could not be held to be ‘in the public interest’ so much so that a subject access request be refused. If such stories have previously been held to be in the public interest, then the way forward should be to tighten up what exactly is in the public interest, not an outright ban on the rejection of subject access requests.

The ICO guidance says the following about public interest:

There is no definitive public interest test. Whether and how something is in the public interest, and, if so, how strong that public interest is, will differ from case to case.

With such ‘fuzzy’ guidance, it is no wonder that media organisations may be overstepping the mark. Some credit can be given for stating:

In particular, you should not make a general assumption that the private life of a public figure is always the subject of legitimate public interest.

These factors will carry more weight in some cases than in others, depending on the context. For example, revealing corruption or incompetence in public office is likely to carry significantly more weight than discussing the misbehaviour of celebrities, even though both cases are nominally about exposing wrongdoing.

Nevertheless, this is not enough. By providing definitive guidelines of what is in the public interest, either through ICO guidance, further legislation, or judicial comment, this exemption can be tightened up enough without putting a chokehold on the journalists that provide a vital service to society.

It cannot be disputed that the work the Leveson Inquiry has done is important, and many of their recommendations should be carried forward, but this is not one that should.

Further Reading

Part 1 of the Leveson Inquiry

For the latest articles straight to your inbox, you can subscribe for free. Alternatively, follow @KeepCalmTalkLaw on Twitter or Like us on Facebook.

Tagged: Commercial Law, Media, Privacy Law

Comment / Show Comments (2)

You May Also Be Interested In...

Living in an Interconnected World – A Legal Conundrum

17th Sep 2015 by Matt Bogdan

Public Service Broadcasting Pt II: Cutting The Licence Fee

7th Aug 2015 by Chris Bridges

Public Service Broadcasting Pt I: How Do We Compare?

6th Aug 2015 by Chris Bridges

How Long Until Privacy Prevails?

13th Sep 2014 by Chris Bridges

A complicated relationship: The ECtHR, media, privacy & freedom of expression

9th Feb 2014 by Chris Bridges

Data Privacy: Due Diligence Due?

13th Nov 2013 by Chris Bridges

Section Pick May

Coronavirus and Contracts: Is Frustration in Play?

Editors' Pick Image

View More


Keep Calm Talk Law: Moving Forward

3rd Sep 2019

Changing of the Guard: Moving Keep Calm Talk Law Forward

12th Aug 2018

An Anniversary or Two: Four Years of Keep Calm Talk Law

11th Nov 2017

Rising from the Ashes: The Return of Keep Calm Talk Law

18th Nov 2016

Two Years On, Keep Calm Talk Law’s Legacy is Expanding

11th Nov 2015


Javascript must be enabled for the Twitter plugin to function. Click below to visit us on Twitter.

Free Email Subscription

Subscribe to Keep Calm Talk Law for email updates, and/or weekly roundups. You can tailor your subscription on activation. Both fields are required.

Your occupation / Career stage is used to tailor your subscription and for readership monitoring.

Uncheck this box if you do not want to receive our monthly newsletter.

By clicking the Subscribe button, you agree to our privacy policy and terms of service. Please ensure you read these in full.

Free Subscription