APPENDICES
of numbers of enforcement notices served, Mr Thomas estimated this was probably only two or three in a year, and they were normally preceded by a draft of a notice which was served before the Commissioner entered the actual notice as a matter of good regulation.375 Mr Thomas agreed that in principle this power would apply to media organisations but this is subject to exemptions in s32.376
¶Enforcement powers in relation to the press 4.50 The enforcement powers set out in the Act are modified where the data processing is for the purposes of journalism.
¶4.51 The first step is for the Information Commissioner to establish whether processing is for the
purposes of journalism linked to the publication of journalistic material. Section 44 of the Act empowers the Information Commissioner to serve a "special information notice" to instigate an investigation of the data controller where; i) he receives a request for an assessment by an affected person, or ii) court proceedings have been stayed on the basis that a data controller claims or it appears to the court that the processing under consideration is for the purposes of journalism and the Information Commission has reasonable grounds for suspecting that the personal data are not being processed only for the purposes of journalism or with a view to publication of journalistic material. As a consequence of these provisions the Information Commissioner is not able to issue a special information notice to initiate an investigation if it appears to him that information was gathered for journalism purposes with a view to publication (even if the gathering of the data was unlawful), unless a complaint is made by an affected person.
¶4.52 The extent of an investigation under s44 is limited to resolving the question of whether
personal data are being processed for the purposes of journalism and to ascertain if they are processed with a view to future publication of material. There is no power to investigate under a special information notice whether the data controller has committed any other offence under the Act.
¶4.53 The second step is a determination. If it appears to the Commissioner (whether as a result
of the service of a special information notice or otherwise) that any personal data are not being processed only for the special purposes, or are not being processed with a view to the publication by any person of any journalistic material which has not previously been published by the data controller, he or she may make a determination in writing to that effect.377
¶4.54 Until a determination is made under s45, the Information Commissioner may not issue an
information notice requiring the data controller to provide him with other information, issue an enforcement notice or exercise their powers of entry and inspection provided under Schedule 9 of the Act where the data processing is for the purposes of journalism.378 Thus the Commissioner's investigatory powers are restricted in these circumstances.
¶4.55 Section 46 imposes a procedural restriction on use of enforcement powers in respect of
1915processing of data for journalistic purposes even if it appears to the Information Commissioner that enforcement action is justified. It prohibits the Commissioner from serving an enforcement notice on a data controller in respect of processing personal data for journalistic purposes
¶Appendix 4 | Legal Materials
unless a determination under s45(1) has been made and the court has granted leave for the notice to be served. It is noteworthy that as at September 2011, no enforcement notices have been issued by the Information Commissioner in any cases where s32 is relevant.379
¶4.56 The court may not grant leave to serve the notice unless it is satisfied that the Commissioner
has reason to suspect a contravention of the data protection principles which is of substantial public importance and, except where the case is one of urgency, that the data controller has been given notice of the application for leave in accordance with rules of court.
¶4.57 The Inquiry heard evidence that the investigative and enforcement powers at the
Commissioner's disposal exist to ascertain whether personal data are being processed for purposes other than journalism and to act in relation to those other purposes, rather than to enable it to regulate the actual processing of personal data for journalistic purposes.380
¶4.58 Since April 2010 the Information Commissioner has had the power to impose a civil monetary
penalty of up to £500,000 for serious breaches of data protection. Mr Graham observed that this power is beginning to have a very salutary effect, both on public authorities and on commercial companies who realise that the Information Commissioner has teeth.381 However, he noted in relation to the media that, given the limitations on the investigatory powers available to the Information Commissioner, in practice it would be difficult for the Commissioner to establish whether the processing was in breach of the data principles or whether the exemption at s32 of Act applied such that the processing was exempt from compliance with data protection principles.382
Section 55 offence Scope of s55(1)
¶4.59 Section 55(1) makes it a criminal offence to knowingly or recklessly, without the consent
of the data controller (a) obtain or disclose personal data or the information contained in personal data, or (b) procure the disclosure to another person of the information contained in personal data, subject to specified defences in section 55(2). An offence can therefore be committed by three different types of activity: obtaining information, disclosing information, and procuring the disclosure of information.
¶4.60 This section of the Act is significant because, whilst the DPA primarily regulates data
1916controllers, any person can commit an offence under s55. There may be effectively two victims when an s55 offence is committed: the data controller (i.e the organisation holding personal information) from whom the data is wrongfully obtained and the person to whom the data relates.383