APPENDICES

APPENDICES

blocking, erasure or destruction of the data on specified grounds. These provisions are not appropriate for the data processing which will normally be an incident of journalism. This is because the definition of processing is so wide that it embraces the relatively ephemeral operations that will normally be carried out by way of the day-to-day tasks, involving the use of electronic equipment, such as the lap-top and the modern printing press, in translating information into the printed newspaper. The speed with which these operations have to be carried out if a newspaper is to publish news renders it impractical to comply with many of the data processing principles and the conditions in Schedules 2 and 3, including the requirement that the data subject has given his consent to the processing. Furthermore, the requirements of the Act, in the absence of s.32, would impose restrictions on the media which would radically restrict the freedom of the press."

¶4.42 The Court of Appeal in Campbell held that "processing" under the DPA includes publication

in print, thus reversing the decision of the High Court and extending the duration of the s32 exemption to including processing for and after publication.365

¶4.43 Guardian News further submitted that the processing of personal data by journalists prior

to publication, including the obtaining and use of a telephone number for the purpose of contacting a subject or source for potential comment or corroboration, must fall within the ambit of s32 otherwise the exemption would cease usefully to serve the objective it was designed to protect.366

¶Effect of s32 exemption 4.44 Where the conditions in s32(1) are met, there is an exemption from all data protection principles

(save for the duty to keep data secure) and the obligation to comply with a number of rights of data subjects, including the right of subject access (s7), the right to prevent processing of personal data (s10), the right to prevent a decision being made on an automated basis (s12) and the rights relating to rectification, blocking, erasure and destruction of data (s14).

¶4.45 Further, s32(4) makes special provision for the conduct of proceedings that have been

commenced by a person seeking subject access, the prevention of processing, rectification, blocking or erasing of data, or compensation for breach of the Act where the data is subject to processing for the purposes of journalism. If the data controller claims or it appears to the court that the data in question are being processed only for special purposes and with a view to publication of journalistic material which had not been published by the data controller previously the court must stay the proceedings until either the data controller withdraws their claim or a s45 determination is issued. The evidence of the Information Commissioner is that in many cases the Information Commissioner will not be in a position to make a s45 determination, leaving the proceedings stayed indefinitely.367

¶Appendix 4 | Legal Materials

¶Powers of investigation and enforcement 4.46 The duty to enforce the provisions of the DPA lies with the Information Commissioner

(the Commissioner) whose powers and duties are set out in Part V of the Act and can be summarised as follows: (a) If the Commissioner is satisfied that a data controller has contravened or is contravening any of the data protection principles, the Commissioner may serve an enforcement notice requiring him to take such steps or refrain from taking such steps as may be specified and/or to refrain from processing personal data.368 In considering whether to issue an enforcement notice the Commissioner shall consider whether the contravention has caused or is likely to cause any person damage or distress. (b) The Commissioner may serve on a data controller an assessment notice for the purpose of enabling the Commissioner to determine whether the data controller has complied or is complying with the data protection principles.369 An assessment notice facilitates the exercise by the Commissioner of investigatory powers, including entry to premises, obtaining inspection or examination or documents, information or equipment, and requiring persons to be available for interview. Powers of entry and inspection are set out in detail in Schedule 9. (c) If any person who is, or believes themselves to be, directly affected by processing of personal data requests an assessment as to whether it is likely or unlikely that the processing has been or is being carried out in compliance with the provisions of this Act, the Commissioner shall make an assessment in such manner as appears to him to be appropriate.370 (d) The Commissioner may serve on a data controller an information notice requiring a data controller to furnish the Commissioner with specified information relating to the request or compliance with the principles.371

¶4.47 It is an offence to fail to comply with an enforcement notice, an information notice or a special

information notice.372 A person on whom an enforcement notice, an assessment notice, an information notice or a special information notice has been served may appeal against the notice to the Information Tribunal.373

¶4.48 Whilst the Commissioner has a broad suite of enforcement powers at his disposal, the balance

of evidence before the Inquiry suggests that there has to date been limited use of formal enforcement powers.

¶4.49 Mr Thomas described the power to serve enforcement notices contained in s40 as the main

formal power which the Commissioner had in its armoury for occasions when it felt that there had been non-compliance with the requirements of the legislation. He observed that the power was not used frequently, but there was a power to serve an enforcement notice on a data controller and that could be challenged, but if it was not challenged, then in due course it became a criminal matter not to obey the terms of an enforcement order.374 In terms

¶s40 369 s41A 370 s42 371 s43 372 s47 373 s48