Appendix 5: Evidence relevant to the generic conclusions on the relationship

Appendix 5: Evidence relevant to the generic conclusions on the relationship

¶

• between politicians and the press: Part I, Chapter 8 — 1955

• Appendix 6: Bibliography — 1985

¶xi

997

PART H

¶The Press and Data Protection

999

¶Chapter 1 1. Background 1.1 As part of an inquiry into the culture, practices and ethics of the press, the Terms of Reference extend to a consideration of the extent to which the current policy and regulatory framework has failed, including in relation to data protection. It also requires a review of the extent to which there was a failure to act on previous warnings of media misconduct which undeniably includes the performance of the data protection regime. Data protection, with its origins in European and international law, is currently contained in the Data Protection Act 1998 (DPA) and is summarised elsewhere in the Report.1

¶1.2 The UK data protection regime suffers from an unenviable reputation, perhaps not wholly merited, but nevertheless important to understand at the outset. To say that it is little known or understood by the public, regarded as a regulatory inconvenience in the business world, and viewed as marginal and technical among legal practitioners (including by our higher courts), might be regarded as a little unfair by the more well-informed, but is perhaps not so far from the truth. And yet the subject-matter of the data protection regime, how personal information about individuals is acquired, used and traded for business purposes, could hardly be more fundamental to issues of personal integrity, particularly in a world of ever- accelerating information technology capability, nor, on the face of it, more central to the concerns of this Inquiry.

¶1.3 It has the following features:

¶(a) The law identifies broad principles requiring businesses acquiring and using personal information to do so lawfully, fairly, accurately, for specific purposes and to the limited extent necessary for those purposes; the information must be kept safely and individuals have legally enforceable rights to know what information is held about them, to see it, and to ensure that it is accurate. (b) There are a number of specific exceptions to those rights and principles, including exemptions designed to balance those rights with other individual rights, such as

¶H freedom of expression, and other public interests such as crime prevention. (c) The regime (along with the regime for freedom of information) is the responsibility of the Information Commissioner who has statutory power to investigate and rule on breaches, and enforce compliance (including by court action and prosecution). The Commissioner also has a wide-ranging function to promote awareness, compliance, and good practice over and above the basic legal requirements, including by education, guidance, publications and reporting to Parliament. 1.4 Successive Information Commissioners have worked hard and tirelessly to raise the profile of data protection within businesses, and to support public awareness, including by tackling 'myths' and unnecessarily risk-averse behaviour, and promoting straightforward and common- sense business practices.

¶1.5 The Information Commissioner operates through an office (the ICO) and it was in the execution of these responsibilities that the ICO became involved in Operation Motorman. The public

¶Appendix 4 facing narrative is described as part of the history2 in this Report but the way in which the ICO considered it appropriate to discharge its functions is far more complex than that narrative reveals. Having uncovered what appeared to be extensive unlawful or unethical practices of the press in the acquisition and subsequent use of private personal information from corrupt officials and private sector employees and through the medium of unscrupulous third-party 'blaggers', a regulatory response was essential. How these challenges were approached, the political campaign that has followed and the extent to which insights can be learnt for the future is at the heart of this Chapter.

1000

¶1.6 Also looking to the future, it is appropriate to move from a consideration of the specific to consider the way in which the ICO operates in relation to the press and, in particular, to review the relevant parts of the legal framework along with its powers and governance.

¶1.7 Different parts of this Report have dealt with single systems. In relation to the activities of the press, the focus has been on the operation of the criminal law and the approach of the Press Complaints Commission (PCC) to press conduct. The relationship between the press and the police has been examined through the operational decisions of the police and their interaction with the press. For politicians, the issue has been the different dynamics of the way in which they react with the press and the extent of any impact on public life. For the ICO, all these different elements are engaged. This part of the Report deals with the criminal law, the regulatory regime of the ICO and the way in which it sought to engage the PCC, other regulatory options open to the ICO, and the political sphere (in relation to the amendment to the DPA). It is thus somewhat more complex and, given the wide ranging recommendations about the operation of this statutory regulator with an extensive remit, has required a greater degree of analysis than other aspects of the Report: to that extent it is also different in approach.

¶1.8 Having been directed by the Terms of Reference to consider the press and the data protection regime together, I have been conscious that the Report would be addressing matters relatively little noticed or debated in the public discussion of the Inquiry.3 I am also conscious that this subject matter has had relatively little scrutiny more generally. In this respect, as with many independent public inquiries, the task is to shine a light on an unfamiliar landscape. It is worth emphasising because so much of the rest of the material considered in this Report has been extremely fully ventilated, including editorially, as the Inquiry has gone along. The extent to H which the relevance of data protection is and has been minimised is part of the background to this Part of the Report, as is the question of some of the reasons and motivations for it. I am also conscious that the discussion of this relatively unfamiliar territory throws aspects of it into relief in a way which may be a matter of surprise even to those more familiar with it. A fresh and independent perspective, by definition, is an opportunity for a different way of looking at things and perhaps of questioning some assumptions.

2. The ICO: structure, governance and approach 2.1 The Information Commissioner is a 'corporation sole' appointed by Her Majesty The Queen and independent of Government who (like the senior judiciary) can only be dismissed pursuant to an Address from both Houses of Parliament. He is funded by fees and grant-in- 2 Part E, Chapter 3 3 Although the evidence from the two Information Commissioners and two members of staff was heard over a comparatively short time (occupying one full day and less than three half days) the ripples flowing from Operation Motorman were felt throughout the Inquiry and were the subject both of evidence and legal argument. Detailed and comprehensive expert evidence was also called. The extent of this analysis has meant that particular care has been taken to address subsequent submissions by the two Commissioners which dealt with more wide ranging considerations

1001

¶Chapter 1 | Introduction aid voted by Parliament and supported through the Lord Chancellor and Ministry of Justice. Operationally independent, the full functions of the Office are exercised personally though the office holder who appoints staff who work by direct delegation from him. Between 2002 and 2009, the Commissioner was Richard Thomas, a solicitor by training. He was based in offices in Wilmslow and had two deputies and the office now has over 300 staff (including lawyers and investigators). The operational investigations department reported to him via one of the Deputies. Francis Aldhouse, also a solicitor, fulfilled this Deputy role from 1984 (in the precursor organisations) until his retirement in 2006.

¶2.2 Mr Thomas described his approach in this way:4

¶(a) As an overview, his role was "partly a regulator, partly an ombudsman, partly an educator and partly a policy adviser" the cornerstone being the duty to promote good practice including, but not limited to, compliance with the minimum legal obligations under the regime.5 (b) The ICO was "primarily not a prosecuting authority. That was almost on the side".6 The main formal power in the event of non-compliance was the 'enforcement notice', which could specify and require compliance action subject to the back-up sanctions of court enforcement, although this was not frequently used. (c) The principal power of investigation was the ability to serve an 'information notice' on an organisation to ascertain whether it was complying with the regime. This also was 'very, very rarely' used because, in most cases, asking a business to co-operate and supply information usually sufficed. (d) Prosecution powers were limited to s55 of the DPA and did not extend, for example, to other offences such as phone hacking (although this might also technically involve a s55 DPA breach). (e) Mr Thomas linked the application of the statutory 'public interest' defence provided by s55 to the core function of the ICO in freedom of information, in virtually every difficult case, in balancing public interest considerations for and against disclosure (on which it had published a great deal of guidance).7 2.3 Mr Thomas did not regard the ICO as "a regulator of the press as such" although the data protection regime applied to each media organisation which, therefore, was regulated and fee paying. He considered the exemption contained in s32 DPA (covering personal H information being used for the 'special purposes' of journalism, literature or art) as severely circumscribing and limiting the powers of the ICO in relation to the press, disapplying most of its enforcement powers where data is used for journalistic purposes while at the same time being 'incredibly complicated'. He had rarely had to engage with the issue (because it 'didn't arise') and did not consider it particularly relevant to the Inquiry.8 He considered that any journalist seeking to rely on the 'public interest' provision to disapply s55 would be expected 4 p5 onwards, Richard Thomas, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Transcript-of- Morning-Hearing-9-December-2011.pdf 5 p75, Richard Thomas, ibid to be very scrupulous about checking and recording the aspects of the public interest on which he or she was proposing to rely, in order to be able to take any available advantage of that provision.

1002

¶2.4 From this short summary, it appeared that the ICO relied, in the main, on an informal means of doing business. That is usual regulatory practice. The 'cornerstone' function of promoting good practice was largely discharged through co-operation with and encouragement of businesses; although little touched on in evidence, it appears that this was also the case with the ICO's complaint resolution or ombudsman function. It was not an organisation by its own account which regularly used its principal legal powers; prosecutions, in particular, were not its main business, but neither, it would appear, was direct regulatory enforcement. The main concern was prevention of poor practice and promotion of good practice. The Inquiry explored the extent to which the ICO was familiar with the press as an industry dealing in personal information, and with the specific aspects of the data protection regime applying to the press, and how it saw its role in relation to commercial journalism.

1003

¶Chapter 2 Operation Motorman 1. The investigation 1.1 The background and history of Operation Motorman is fully described above1 and does not need repetition. When Alex Owens2 attended the search in Operation Reproof, he was well aware that the data protection regime fastens on the acquisition, use and disclosure of personal data by public authorities under compulsive powers. As well as the application of the criminal law, the principles and rights of the regime are designed to ensure that individual civil liberties are respected and safeguarded when individuals' personal information is taken into the hands of public bodies, and that public bodies are strictly limited in terms of what can be done with that information and who can see it. Thus, although the focus of the police was the question of the corruption of public officials entrusted with people's confidential information, the primary interest of the Information Commissioner's Office (ICO) was the information itself, and the consequences of the unlawful access and disclosure for the people whose information it was and for the organisation whose responsibility it was to take care of it.

¶1.2 Having identified Steve Whittamore as a self-employed private detective who had been requesting details from the DVLA in relation to a protected vehicle registration number, the ICO undertook the initiative to obtain a search warrant under its own powers. When it was executed, what was seized (over five-six hours) came to be referred to within the office as a 'treasure trove' or Aladdin's cave in the form of a substantial quantity of documentation together with four colour-coded notebooks ('the Motorman material'). These contained a very large amount of personal information, evidently acquired without the knowledge or consent of the people in question.

¶1.3 Mr Owens was concerned about a number of features. First was the sheer quantity of the information and how extensive and specific it was. Second, there was the fact that it appeared to have been obtained in the course of an investigative business spanning a period of years and earning considerable sums. Third, the evidence suggested that the material had been specifically requested and paid for by journalists writing for a significant range of newspapers and periodicals and related to a large number of well-known people (or those H close to them), including household names from the world of entertainment, sport, politics and other arenas of public life. Finally, Mr Owens was struck by the nature of the information, including personal details from restricted databases, clearly obtained in ways which were inconsistent with good data protection practice, with the legal rights and principles set down in the data protection regime, and even in some cases with the criminal law. During the course of the search Mr Whittamore was present and although not formally interviewed, Mr Owens reported (albeit speculatively) that:3

¶"Whittamore made it very [clear] to me that whilst he would admit to his own wrong doing, under no circumstances would he say anything which would incriminate any member of the press. I was undecided as to whether this was because he feared the press or whether he anticipated some financial recompense in return for his silence."

1004

¶1.4 Mr Owens reported back to the senior management, briefing both Mr Thomas and Mr Aldhouse. There are different recollections of discussions about the future handling of the material (which are discussed below). In the meantime, he began the laborious task of sifting the material and arranging for it to be placed on an electronic database. Although the lead came from a criminal investigation, the data protection aspects were apparent to the ICO with the 'treasure trove' they came upon taking them into a dimension of data misuse going far wider than specific issues of corruption which concerned the police. In fact, it appeared that the ICO had come upon an organised and systemic disregard for the data protection regime of a scale, duration and seriousness going beyond poor practice, beyond breach of the principles and rights of the regime, and into the realms of criminality in its own right.

¶1.5 There was thus no doubt that the ICO, through Mr Owens, was preparing the Motorman material to form the basis of a prosecution under s55 DPA: they planned to prepare some 25- 30 of the more egregious cases for detailed investigation and selective interviews in order to found specimen charges against a number of persons who could include (a) corrupt officials and employees who were providing the information to Mr Whittamore directly for money; (b) blaggers, who were obtaining the information for him by deceit; and (c) the press, who were commissioning (or 'procuring' in the language of s55) the information in the first place. In that regard, counsel subsequently advised:4

¶"Having regard to the sustained and serious nature of the journalistic involvement in the overall picture, there can be little doubt that many, perhaps all, of the journalists have committed offences.

¶The inference, overwhelming it seems to me, is that several editors must have been well aware of what their staff were up to and therefore party to it."

¶1.6 When it came to Operation Motorman, Mr Aldhouse had responsibilities which included providing direction to the head of investigations at the time (and so was formally answerable to Mr Thomas for the conduct of Operation Motorman). He said that it was not his role to direct investigations himself; rather, he had to supervise the person running the investigations department.5 His own focus was on policy work, not least on the significant European H dimension to data protection, which often took him to Brussels.

¶1.7 Asked specifically about the operational issues which the discovery of the Motorman material raised for the ICO, Mr Aldhouse had no recollection of when he first heard about the case, nor of any internal meetings to discuss it (including those meetings at which the investigator Alex Owens alleged that decisive policy positions on the operational conduct of Motorman were taken by senior management). Mr Aldhouse himself said he never looked at the original Motorman material, nor the legal advice obtained by the office about it. When asked by Counsel to the Inquiry whether there was anything in the office at the time which was as big or as important as Operation Motorman, Mr Aldhouse accepted that, from an operational investigations point of view, it probably was the largest investigation.6 However, he firmly maintained a position of non-involvement and, hence, non-accountability. That exchange included this:7

1005

¶Q: "I think all I'm gently suggesting, Mr Aldhouse, is this - and it's probably fairly obvious now: we have possibly the most important investigation involving your office, Operation Motorman. It has very serious ramifications. It was clearly being ramped up at this stage. Mr Thomas had it in mind to make a report to Parliament shortly afterwards and he did. Surely you were involved, even in informal discussions with Mr Thomas, as to the direction your office was taking, weren't you? A: "Well, I think they would only have been casual ones..."

¶1.8 These answers were consistent with his brief witness statement which suggested little in the way of senior oversight of operational matters at all. He said:8

¶"I am unable to comment on the detailed history of the Operation Motorman inquiry in the direction of which I was not involved. I believe that the investigators conducted the matter together with the Commissioner's lawyers....I regret that because of my limited role in the Operation I am unable to help the Inquiry further."

¶1.9 Mr Aldhouse was also asked about the senior structure in the ICO. He described a 'management team' comprising the Commissioner, two Deputies, a handful of Assistant Commissioners: 'perhaps ten or a dozen very senior people'9. But this team does not seem to have been engaged in any decision-making about the Motorman case, either operationally or strategically. Was it not surprising that neither the responsible Deputy personally, nor the organisation's senior management team, was consulted or engaged? Mr Aldhouse's response was:10

¶"Am I surprised? I'm disappointed. Not necessarily surprised. ... well, yes, I'm sure in retrospect it would have been - one could well say: wasn't this big enough for the whole of the management team to be involved? ... I certainly had views, anyway, yes."

¶1.10 As will be clear, despite being organisationally and functionally responsible for the investigations team, Mr Aldhouse placed himself at a considerable distance even from personal knowledge of the Motorman material. As Mr Thomas put it, with what appears to be a degree of understatement, "Francis was somewhat disengaged on these matters."11 Mr H Thomas himself, however, appeared to have grasped the implications, appreciated that it was very serious and congratulated Mr Owens and the team.12 He explained that, in what was the first year of his appointment:13

1006

¶"I was told about a "treasure trove" of evidence which the team had obtained under a search warrant as part of 'Operation Motorman' … There was a feeling that the material was of sufficient quality and quantity to make this a major case which would bring home the seriousness of the [s55] offence."

¶1.11 The assessment made by Mr Thomas of the Motorman material was that he saw it as "hard prima facie evidence ... of offences",14 on a scale that could hardly have been greater for the data protection regime. He said:15

¶"So my understanding, I think, remains the case that this was a far more serious matter than a breach of section 55."

¶1.12 Specifically, Mr Thomas apprehended that it was likely that that the journalists' involvement in the acquisition and use of this information took them within the sphere of conduct so seriously at fault as to be prima facie criminal. Criminal conduct by journalists was the ICO's 'very, very strong hypothesis'. This understanding was tested during his evidence,16 from which it appears that the following aspects of the Motorman material were particularly striking:

¶(a) Some of the material from the protected public databases could not have been obtained by lawful means at all, and appeared very likely to have breached specific statutory bars on disclosure. (b) It was known that Mr Whittamore did have corrupt sources in both the public and private sectors: these had been identified. (c) The pricing structure for the commissions was indicative of criminality because they were either too low to suggest that it had been obtained lawfully (because of the effort and time which would have been involved) or high enough positively to suggest a premium relating either to incentivising legal risk or corruption (with some cases, concerning very well known individuals) involving very large sums. (d) The circumstances suggested that it was highly likely that the journalists were knowing or reckless as to the unlawfulness of the means by which the commissioned material was acquired and that, on the face of it, it was unlikely that the s55 defence relating to the public interest would be available in the generality of cases. 1.13 It must, of course, be appreciated that criminal proceedings are complex to mount and H involve a high standard of proof but, quite apart from criminality, Mr Thomas understood that serious questions were raised by the Motorman material and there were causes for real concern. In his fifth witness statement, he outlined the way in which the ICO had classified the 13,343 transactions recorded as follows:17

¶"(a) 5,025 identified 'as transactions that were (of a type) actively investigated in the

¶Motorman enquiry and ....positively known to constitute a breach of the DPA 1998.'

¶(b) A further 6,330 representing 'transactions that are thought to have been information obtained from telephone service providers and are likely breaches of the

¶DPA. However, the nature of these is not fully understood and it is for this reason that they are considered to be probable illicit transactions'.

1007

¶(c) The balance of 1988 lacking sufficient identification and/or understanding of their nature to determine whether they represent illicit transactions or otherwise."

¶1.14 Mr Thomas then put the matter in this way:18

¶"The classification of the transactions related to the apparent commission of offences … But I suggest that there must be at the very least ethical questions where a journalist is the regular customer of an investigator who commits an offence to obtain the information, whether or not the journalist has also committed a procuring offence in relation to that transaction. Such ethical questions are even more pertinent where … the investigator could obtain the information "more quickly and reliably than they [the journalists] were able to", at least some of the information was of a confidential nature and Mr Whittamore was pressing to sell other pieces of information obtained for other clients."

¶1.15 Mr Thomas was in no doubt that a significant proportion of the Motorman material did indeed constitute evidence of criminality, particularly in contravening specific bars on the disclosure of material from databases under the control of public authorities. As for the possibility of a defence under s55 DPA, he said, for example, that "I haven't seen a whiff of public interest. It was tittle-tattle. It was fishing. There may be one or two examples, but they would be exceptional."19

¶1.16 He also made two further points. First, the theoretical availability of material by lawful and fair means did not by itself render innocuous the acquisition of material by other means which did, in fact, constitute breaches of the data protection regime. Secondly, at the very least, most of the material in question was not reasonably to be regarded as in the public domain, and therefore had a quality of confidentiality.

¶1.17 I have no doubt that this analysis is both important and valid. It was for that reason that I took the view that it was both appropriate and correct that Mr Owens should produce the Motorman material to the Inquiry but that (given the privacy of those whose records had been mined), it should be seen by the core participants under strict confidentiality and should remain in redacted form.20 Having said that, I summarised the effect of the evidence in this way:21

¶"It's abundantly clear, looking at the electronic records, which you've checked against

¶H the actual documents, that Mr Whittamore had collected together a vast amount of personal data. The documents identify the names of titles and specific journalists at the titles apparently or inferentially making the request. It identifies the names of people from a wide range of public life and in the public eye, and provides addresses, telephone numbers, mobile telephone numbers and charging details for that information. It's not necessary to go into the identity of the individuals, … it's not necessary otherwise to identify titles or names and certainly not necessary to identify the persons who were the targets of enquiry. In relation to some of them, it is absolutely right that there may well be a public interest justification in the enquiry. In relation to others, however, it is difficult, if not impossible, to see what public interest justification there could be." 1.18 A further point that Mr Thomas made was to recognise the possibility that the Motorman material was representative in nature. He said:22

1008

¶"I have always recognised that the material seized in Operation Motorman came only from one group of investigators and may have been entirely isolated. Equally, many other private investigators were known to be active and it is difficult to believe the investigators raided by the ICO were the only ones with press clients. This view is strengthened by the quite separate Goodman / Mulcaire prosecutions which came to light after the first ICO report and which had parallels with the section 55 offences and reinforced the evidence gathered during Operation Motorman."

¶1.19 This identifies the general awareness of, and concern about, the security of confidential databases in both the public and private sectors, the sensitivity of the concentration in those databases of very large amounts of personal data, and the risks of that getting into the wrong hands.23 Albeit retrospectively, Mr Thomas also made the connection between the Motorman material and the subsequent evidence of phone hacking undertaken within the press24 as did Mr Owens.25 In any event, however, there was a clear apprehension of a general problem concerning unlawful and unethical trading in personal information, including, but not limited to, the press.26

¶1.20 In sum, therefore, Mr Thomas, and the ICO more generally, was aware that the Motorman evidence was an indication, in relation to the culture, practices and ethics of the press and beyond, of conduct that was likely to be criminal, probably constituted systematic breaches of confidentiality, privacy and the principles and rights of the data protection regime, was certainly unethical, and was "quite outrageous in policy terms".27 As summarised in the ICO's report to Parliament, it amounted to evidence of "a flourishing and unlawful trade in confidential personal information by unscrupulous tracing agents and corrupt employees with access to personal information".28 The Culture, Media and Sport Select Committee in 2003 described it as a "depressing catalogue of deplorable practices".29 The modus operandi, and the harm done, was well understood.30 How it was addressed by the ICO now falls to be considered.

¶H 2. The ICO response: leadership 2.1 As the office holder, Mr Thomas was in a unique position to influence the culture and priorities of the office and to determine the nature and degree of his own personal priorities. In that regard, it is noteworthy that he was at pains in his evidence to the Inquiry to distance himself from the operational decisions made about Motorman; effectively, he disclaimed significant contemporaneous knowledge of the operational management of the case. It is also striking that, as Mr Thomas was aware, his Deputy, Mr Aldhouse, also distanced himself from the operational management of the case.

1009

¶2.2 Although aware that a wealth of material had been recovered, Mr Thomas had little recollection of the briefing or of discussing the detail. He emphasised that the question of investigating the role of journalists and newspapers in the events "was not a matter with which in any way I was engaged";31 at the time "I can't really say that I was giving very active consideration to these matters";32 and "I personally did not give any serious consideration to that matter, and I cannot recall any conversation or discussion when that particular issue was being discussed".33 He said, for example, that it was only as a result of being asked to assist the Inquiry that he had latterly become aware that the MPS had investigated journalists as part of Operation Glade, of the note made by his office of their meeting with Counsel on 3 October 2003 advising that there were grounds in the Motorman evidence for proceeding against journalists,34 or that the judge hearing the Motorman prosecutions at Blackfriars had questioned the lack of proceedings against any journalist.35

¶2.3 I must admit to being surprised about the extent to which Mr Thomas distanced himself from the practical details of the operation that was later to take up so much of his attention politically. By his own account he did not direct the operational strategy, involve himself in key decisions or, it would seem, keep himself especially closely briefed. One of the earliest notes of his reaction was a handwritten entry in a personal notebook36 written between 3 and 10 March 200337 recording: "Francis – Newspapers/s55". Unable to recall any conversation with Mr Aldhouse, Mr Thomas was pressed as to whether this did not suggest a personal interest in the press dimension to Operation Motorman. But he remained firm: he personally did not give any serious consideration to the operational dimension. He 'assumed' that an operational decision would be taken at the level of Mr Owens and the in-house legal team, about whether and to what extent to pursue action against the press. Put to him that he must at least have been aware that no journalist was being prosecuted, that he must at least have been alert to the criminal process, he replied that that was only in very general terms. There were, he pointed out, 'many, many other matters going on at that time'.38

¶2.4 The 'Newspapers/s55' note might, at least, be thought to suggest that Mr Thomas was H concerned with the criminal process. It is to that issue that most if not all references to his assumptions about the operational management of Motorman are made in his evidence.39 He stated, for example, that:40

1010

¶"It was my understanding that the case would be pursued in line with established Office practice – prosecutions led by the in-house legal team, advising and acting upon the evidence obtained by the Investigations Unit. I was subsequently kept broadly abreast of developments, notably that the CPS were taking over the prosecutions [this is, of the private investigators] and then that trial had resulted in major disappointment. The

¶ICO lawyer with lead responsibility was Phil Taylor."

¶2.5 The Motorman material had emerged in the course of a criminal investigation, but its implications for the data protection regime were much broader than that. There is no indication, however, that aspects other than prosecution were actively being considered within the ICO. It is difficult on the face of it to understand why not: that question is considered in some detail below.

¶2.6 Both in law and in terms of the reputation of the ICO, operational decisions, especially any involving the press, would have been complex and significant, and Mr Thomas was ultimately accountable for them. Motorman was not a simple operational issue: it was an indication of data protection breaches and poor practice on an unprecedentedly large scale and driven by the newspaper industry. It obviously engaged the ICO functionally and could have reputational consequences. In addition to criminal proceedings, there was a spectrum of powers and functions which, at any rate potentially, could be engaged, in different combinations. These are considered in more detail below. Given the inherent risks in criminal proceedings, contingency planning was also in question. In other words, there were strategic decisions to be taken in considering the operational response to Motorman which could only be taken effectively at the level of strategic overview. However those in a position to take that strategic overview of operations emphasised to the Inquiry that they were not doing so.

¶2.7 In addition to operational responses there were political possibilities and it is these that Mr Thomas focused on. His strategy was to take a twin-track approach, consisting of initiating a dialogue with the Press Complaints Commission and undertaking a campaign to persuade the government to change the law to introduce custodial sentence maxima for s55 of the Act. In some ways, Mr Thomas characterised this as in itself an operational response:41

¶"I think we were using our powers to promote good practice. That was a far more general power, and you know, that was the justification, the rationale – the statutory H foundation for much of what we did was promoting good practice. I would describe pretty well everything we did in this area as promoting good practice."

¶2.8 There were, however, risks in the extent to which the most senior staff were at a distance from the specifics of the operational response to Motorman. The first was that the strategic approach adopted would be insufficiently informed by detailed operational knowledge and understanding of the problem revealed. The Motorman material was a very rich resource of empirical evidence of the nature and scale of the presenting problem, and any strategic solution was likely to have been importantly enriched by expert analysis of that information in the context of the industry in question. The second risk was that the political and operational responses would be insufficiently well co-ordinated for the maximisation of the effectiveness of each. Decisions made in one context might well be capable of affecting the other at least at a handling level. Mutual knowledge and understanding would be important resources for both. Finally, the third risk was that if the top of the office did not sufficiently communicate with or engage the operational part of the office about the political strategy, operational decisions might be taken on the basis of weak knowledge or assumptions about the operational implications of the political strategy.

1011

¶2.9 As for the distance that Mr Thomas kept from operational decision-making in Motorman, he put his own frame of mind in embarking on his twin-track political strategy in this way:42

¶"My speculation is when I was told some time in October or November [of 2003] that it was going to be too expensive or too difficult to pursue the journalists, that's when I went off to the Press Complaints Commission. But throughout that period from March to October, as far as I was concerned, it was being handled in what I can broadly call the normal way by those who were charged with enforcing Section 55."

¶2.10 This speculation does not seem to be strictly accurate. At the time, with the assistance of Counsel, the investigations officers evidently continued actively to consider the possibility of criminal proceedings in relation to the press. The availability of civil investigation and enforcement powers also fell to be considered in the alternative in any event. In other words, Motorman, remained a live operational issue for the ICO at the time Mr Thomas embarked on his political strategy; there were therefore risks both to it and to his own plans.

3. The approach to the PCC 3.1 Mr Thomas was clear that it was his personal decision to approach the PCC;43 this was reinforced by his Deputy, Mr Aldhouse. In oral evidence to the Inquiry, Mr Aldhouse said:44

¶"I do recall that Richard Thomas decided that he wanted to pursue the route of going to the Press Complaints Commission and writing to Sir Christopher Meyer, but I have to say I think that was Richard Thomas's decision rather than the result of some discussion."

¶3.2 Pressed as to whether he would not have expected, as Deputy, to have been involved, he said he would, but he was 'otherwise engaged', including in Brussels. Although Mr Aldhouse saw his own role as somewhat dissociated, given the policy ramifications that the Motorman case might throw up and the potential cost implications for the ICO, when asked whether it was strange that he was not at least involved quite closely in discussions with Mr Thomas, his response was:45 H "What can I say? It's for the Commissioner to decide how he runs the office. If - and it is worth bearing in mind, of course, that it is - that the Commissioner is a one-man band and if the Commissioner decides to take a route, so be it."

¶3.3 In the event, on 4 November 2003, Mr Thomas wrote personally to the Chairman of the PCC, then Sir Christopher Meyer.46 He explained that his idea had been to 'go collectively' rather than individually to the press.47 This gives rise to a number of issues. First, what his understanding of the role and functions of the PCC was (and how that developed); second, to what extent he understood the PCC to be a representative of the press collectively and to what extent a regulator of the press (two very different propositions); and third, how he judged the ICO and PCC would relate to each other functionally and how he managed that relationship. The resolution of these leads to the overarching question about the objectives in approaching the PCC, whether they were appropriate and how effectively were they achieved.

1012

¶3.4 In relation to his approach and objectives, Mr Thomas was looking at these at a high level and generic nature which was some distance from the immediate operational issues faced by the ICO. He did not have it in mind to ask the PCC to investigate the specifics of the Motorman material or the conduct of the press (although he does not appear to have resolved how an investigation would be handled if at all within the ICO). He wanted a general, forward- looking exercise, conducted across the industry as a whole, with a view to putting a halt to the practice of commissioning unscrupulous private investigators to obtain confidential personal information without regard to whether means such as blagging and corruption were used. He considered that this would principally be achieved by issuing a prominent and general condemnation of the practice and securing appropriate changes to the Editors' Code.48 There is, however, no clear indication of how Mr Thomas thought condemnation by the PCC and changes to the Code would definitively terminate the practice, nor of what, if any, complementary action would be necessary or desirable on the ICO's part to achieve that result.

¶3.5 Mr Thomas was also concerned about the tone of his approach. He wanted to make a 'constructive and friendly'49 overture to the senior leadership of the PCC. He evidently had in mind that a 'good relationship'50 would be important. There was to be an element of outreach and informality, so lunch meetings were contemplated, Mr Thomas would attend on the PCC so far as location was concerned (a concession inevitably constrained by the location of his premises in Cheshire), and formal or agreed notes were not expected. In other words, Mr Thomas intended to conduct the relationship himself, at a personal level and in a personal manner.

¶3.6 The letter51 drew attention to a recommendation of the Parliamentary Culture, Media and Sport Select Committee that the Editors' Code should be amended to include explicit bans on H payments to the police for information and on the use and payment of intermediaries such as private detectives. The letter outlined the Motorman findings and the Metropolitan Police investigations. It stressed the considerable volume of material uncovered; the indication that journalists from most newspapers and many periodicals were customers of Mr Whittamore; and that numerous journalists routinely obtained confidential information that 'they should have no access to'. It suggested that this material was being obtained in the service of celebrity gossip, not to expose wrong-doing, and that the sums involved and the nature of the documentation made it 'difficult to believe that senior managers were not aware of what was going on, and were therefore at least tacitly condoning it'.

1013

¶3.7 The letter also indicated that the ICO was considering whether to take action under the DPA against individual journalists and/or newspapers. It was put to Mr Thomas by the Inquiry that this was an empty threat; he resisted the idea that it was a threat of any sort, on the basis that he intended the letter to be a 'constructive and friendly opening in my engagement with the Press Complaints Commission' but he did accept that 'it may have been somewhat overstating the case'.52 It suggested however that the ICO had provisionally concluded that it would be appropriate first to give the PCC and its Code Committee the prior opportunity to 'deal with' the issue in a way which would put a stop to the 'deplorable' practices across the media as a whole. It envisaged that the ICO would provide some of the Motorman material to the PCC and that the PCC would respond with a suitable change to the Code; this could provide a more satisfactory outcome than 'legal proceedings' and would also, it was suggested, be consistent with Sir Christopher Meyer's wish expressed to the Select Committee to demonstrate the effectiveness of the PCC. 3.8 In the light of all that has been said about the PCC, it is significant that the letter addresses the relationship between the ICO and the PCC as Mr Thomas saw it. Intending to discuss the relationship, he said:53 "I believe it would be to our mutual advantage to meet at an early opportunity to discuss the matters raised in this letter and, more generally, our respective roles and the relationship between our organisations." He also indicated that: "though I do not wish to usurp your role as the regulator of the press - newspapers, and their employees, are subject to the Data Protection Act 1998."54 3.9 Mr Thomas was surely correct to suggest that the respective roles and responsibilities of the two organisations, namely the statutory data protection regulator and the industry's voluntary body, would be an important issue. The obvious asymmetry made it so. The ICO had legal functions and duties to be discharged in relation to the matter of how businesses acquired and used individuals' information; the PCC did not. It is inevitable therefore that Mr Thomas's approach would have had to have been at the level of seeking to elicit the voluntary cooperation of the PCC rather than making a claim on any complementary or overlapping formal legal jurisdiction. 3.10 Mr Thomas's letter suggested a meeting within days at the offices of the PCC; he approached H that meeting in a structured way, preparing a speaking note55 setting out his evident hope that the PCC would respond with a 'general condemnation' and changes to the Editors' Code. The meeting took place on 27 November 2003, Sir Christopher was accompanied by Guy Black (then the Director of the PCC, now Lord Black of Brentwood). 3.11 Mr Thomas said that, initially, the PCC had at first not really known why the ICO had approached them, but that the atmosphere changed as he set the matter out and he convinced them a serious matter was in issue and that the two organisations would work together to deal with the problem.56 His subsequent written notes stated:57

1014

¶"The PCC would like time to consider their response. They were clearly surprised by the scale and nature of the material we have collected and see this as a 'watershed' in terms of this sort of activity.

¶"Although this was not suggested by us, they would be resistant to 'taking over' individual cases and taking action in each case instead of us. Their starting point was that statutory bodies should enforce the law, not them. But they seemed to be increasingly ready as the meeting progressed to work with us as 'fellow regulators' with a strategic response. This might lead to some sort of general condemnation and

¶– though there are some difficulties – an amendment to the Code.

¶"It is for them to identify precisely what they might do, and they recognise this. They want a second meeting before Christmas."

¶3.12 It is somewhat surprising that Mr Thomas appears to have seen a measure of equivalence between the roles of the ICO and the PCC, if not actually of deference to the latter. In oral evidence he explained that "I think we were both very proud of independence, I'm sure",58 and he noted to himself after that first meeting that it had been "constructive – 'fellow regulators'". In the circumstances, I felt driven to ask:59

¶"What are you relying on as concluding that the Press Complaints Commission was a regulator? You're a regulator, but you've concluded here that they're a regulator, or asserted that they're a regulator. I'm just interested to investigate your understanding of that."

¶3.13 The response from Mr Thomas was that the PCC called themselves a 'self-regulatory body' and confirmed that at that point he certainly saw them as such; and therefore as likely to be 'intelligence-driven, proactive, mainly focused on either prevention or punishment'. He had drawn parallels with the Advertising Standards Authority and the banking and insurance ombudsman schemes with which he was familiar from his previous career, and saw the PCC as, like the ASA, able to intervene and take action to prevent unacceptable behaviour. It was with that expectation that he had approached Sir Christopher. The PCC was 'supposed to be in charge of the press, they ought to know what's going on'60 and, indeed, to stop it.

¶3.14 Mr Thomas accepts now that this was a misconception. In oral evidence to the Inquiry he H confirmed that:61

¶"I did see them and they held themselves out as a regulator and I think experience showed that they were not a regulator in the conventional sense."

¶He went so far as to suggest that the inadequacy of the PCC to the task he had envisaged for it formed a part of the dialogue:62

¶"I can recall saying, you know, 'Why can't you transform and change the Press

¶Complaints Commission to make it look more like the effective self-regulation models

¶I've encountered elsewhere?'"

1015

¶3.15 His current understanding was that the PCC was essentially a complaints handler, with functions focused on the investigation of complaints from the public. That leads to the question of the steps he might have taken to ascertain the position at the outset, or as his understanding of the PCC developed over time, not least bearing in mind his express placing the question of the relationship between the two bodies on the agenda at that original meeting. This is important because the assumption of equivalence (or deference) with which he mistakenly embarked on the initiative with the PCC could have had direct implications for decisions the ICO might otherwise have made about the exercise of its own powers and functions. That, as well as Mr Thomas' personal distance from the operational issues raised for his office by the Motorman data, put him in an unsatisfactory position in embarking on this enterprise.

¶3.16 Furthermore, although the initial letter expressly put the question of respective roles and relationships on the agenda for discussion with the PCC, it is evident that the opportunity was not in fact taken to clarify that fundamental question. Mr Thomas was specifically asked whether the role of the PCC was described and his perception discussed and corrected.63 His response was that over the course of his interactions with Sir Christopher 'we've probably touched on some of these matters'. Given the significance that Mr Thomas attached to this approach that cannot, in the circumstances, be considered a satisfactory basis on which the ICO, as a statutory regulator, ought to have made any decisions about respective roles and responsibilities. The likely explanation for (and consequences of) this is considered below.

¶3.17 Sir Christopher's own account of that first meeting was more highly coloured. He was evidently interested in what he heard about Motorman: he characterised the ICO as describing a 'fairly apocalyptic situation',64 leading them to expect court action in relation to the press (which did not materialise), but principally in getting to the data underlying the issue:65

¶"I wanted beef. I wanted red meat, Mr Jay, and he didn't give it to me."

¶This, on his account, would have enabled the PCC to 'have gone into some kind of action with the newspapers in question' and to sharpen and hone their guidance to the press. In the light of the way in which Sir Christopher dealt with Operation Caryatid, it is not obvious what might have been done but, although his letter had held out the prospect of some limited disclosure of material, Mr Thomas was clear in his own mind that his purpose was not to ask the PCC to investigate individual cases. In any event, the PCC was equally clear that they could not look at cases from unidentified victims: this could have been a clue as to the PCC's H quintessentially complaint-handling function.

¶3.18 Sir Christopher's appetite for beef, therefore, was evidently related at least in part to seeing the proof of the message he was being given. Pressed as to whether the PCC could not simply have taken on trust the ICO's indication of the extent of the problem without the underlying data, Sir Christopher's answer was that while of course it could be assumed Mr Thomas would not have made the allegations without some substance, they never saw the substance or the expected litigation.

1016

¶3.19 Sir Christopher also describes telling Mr Thomas that he was the Information Commissioner and should "get on with it. Prosecute these guys", noting that "And prosecutions came around none, ever, in my time, anyway."66 This reaction is echoed in Mr Thomas's own note where he records the PCC as emphasising 'not our role to enforce law, not arm of ICO'.67

¶3.20 The refusal of the PCC to take any action while criminal proceedings were pending or possible was also made plain;68 this was a position which Mr Thomas on his part made very clear he did not accept, but from which the PCC refused to move. The message from Sir Christopher, in other words, was that the Motorman evidence was ICO business rather than for the PCC; they were prepared to help as far as they could, but needed more to go on.69

¶3.21 The reaction (that the PCC wanted details of the underlying data and decisive action from the ICO before it could act) continued to set the tone and might be viewed as an early warning of the extent to which the PCC was either unwilling or unable to deliver what Mr Thomas hoped to achieve. It might (but did not) cause a reconsideration of his investment in the twin-track strategy of approaching the PCC and the government, but without at the same time attending closely to the operational response itself.

¶3.22 A year passed with little progress. Mr Thomas described the joint effort to produce a guidance note as seeming to "sort of grind to a halt in April of 2004".70 He wrote to the PCC on 8 December of that year expressing concern that the work had 'run into the sand',71 and that there was consequently a real risk that the problematic practices would continue unabated. This comment is particularly significant because if the ICO apprehended that there was a real risk of continuing unlawful conduct after the Motorman seizure there was again no indication that this was the subject of any reassessment, either of the PCC strategy itself or of the operational response and options within the ICO. A whole year had elapsed since the first approach to the PCC, two years since the seizure of the Motorman material. These were potentially very serious matters, and the PCC strategy had yet to bear any fruit. Mr Thomas explained that he did not 'lose all faith'.72 In the circumstances, the basis of that faith and his continued reliance on it are increasingly hard to understand.

¶3.23 Both sides appear to have thought that the matter had become bogged down in legal details, including over the matter of the effect of the public interest exemption in s55 of the DPA in relation to actual or potential criminal liability of journalists. Mr Thomas put it to the PCC H in his letter that he was strongly of the view that inaction on their part would show the 'principles of self-regulation in a poor light'.73 If his intention was to suggest either that the PCC risked its own credibility politically, or that the industry risked direct regulatory action from the ICO, there is no evidence that Mr Thomas had any particular basis for making such a suggestion.

1017

¶3.24 On 15 December 2004, Sir Christopher replied74 indicating that he was going to "resurrect" the project with a view to approving a note the following February. He made it clear, however, that the key objective of the note from the point of view of the PCC was to assist journalists in understanding how to comply with the DPA: that would be 'most welcome'. A very brief was issued ('probably in the spring of 2005')75 but evidently with little impact; it contained no reference to Operation Motorman and no warning to journalists.76

¶3.25 In evidence, Tim Toulmin (then the Director of the PCC) agreed that "there was no attempt by the PCC in 2005, through its guidance, specifically to warn the press of what they should do in the future by reference to what they might have done in the past."77 His view was that, given that the PCC was 'a complaints body looking at breaches of the code of practice rather than the Data Protection Act', there was some question about whether it should even have issued the note it did, but 'it did want to be helpful'. The PCC had regarded it as 'pretty much outside its remit' and required a specific decision from its board to proceed with the matter at all. Mr Toulmin also agreed with the proposition that the PCC's view was: "Well, there isn't a specific complaint here, therefore our powers aren't engaged and we're only going to take second place to the Information Commissioner, who is the real regulator in this area".78

¶3.26 Mr Toulmin also said:79

¶"The question was, I think, where the different responsibilities lay. The PCC, as a platform for discussing the behaviour of journalists and so on in another context, which was about the application of the code of practice, was happy also to say, "By the way, Richard Thomas has this campaign about the Data Protection Act and he's right to do so", but beyond that, it was difficult really to know what the PCC could do."

¶His conclusion was that Mr Thomas should have engaged directly with the industry, the trade bodies or straight to the Code Committee (as being 'more representative of the industry') and not to the PCC at all: it did not have the right remit.80 Throughout this period, however, there was still no evidence that the ICO was either successfully managing the relationship with the PCC towards its stated objectives, or assessing the alternatives.

¶3.27 The next step was the publication by the ICO of What Price Privacy81on 10 May 2006; the ICO included the PCC in its distribution list. A response (described with conscious understatement by Mr Thomas as "disappointing") came on 31 May in a form acknowledged by Sir Christopher H as a bit "sneering". It was in these terms:82

¶"Thank you for sending me a copy of your report, What Price Privacy? It was an interesting read. I am sending you a copy of our annual report, which we have just published, along with the text of a speech I gave last week in which I refer to your remarks about the PCC.

1018

I think that, as a next step, it would be helpful if we organised a meeting so that we can explore what more it is that you think the PCC can do. You will appreciate that your call for us to act came rather out of the blue, and we have no material to work with other than what you put into the public domain in your report. Perhaps someone in your office could be in touch ... to arrange a suitable time."

¶3.28 The enclosed speech was largely a celebration of the achievements of the PCC, and immediately before closing with the claim that '15 years of the PCC has changed the culture of an entire industry', dealt with the ICO in two short paragraphs which strongly suggested that it had reached the limits of the action it was prepared to take:83

"There is one issue not touched on in the Report which merits an observation. Recently, the Information Commissioner, Richard Thomas, wrote to me, as he did to members of the newspaper and magazine industries, about the suborning of people by agencies paid by publications to obtain confidential information. This is something that I have intermittently discussed with Mr. Thomas over the last two years or so. It was as a result of our exchanges that the PCC published last year, in collaboration with the Information Commissioner's office, an advice note to journalists about the Data Protection Act and how it impinged on their profession. "Part of the purpose of the note was to remind journalists that offering money for confidential information, either directly or through third parties, was illegal. Mr. Thomas is clearly concerned that this is a practice which continues. He would like the PCC to do something more about it. I intend to tell him once again that we can and do urge on journalists respect for the law – bribery has no place in journalism. I will go on urging. And I look forward to discussions with Mr. Thomas about what more he thinks the PCC can do about this within the self-regulatory framework. But clearly it would not be viable simply to duplicate the criminal law in the Code of Practice."

¶3.29 This did not prompt a reassessment of the strategy, but, on 13 July, a further meeting between Mr Thomas and Sir Christopher took place. The ICO note of the meeting84 identified as key issues the PCC response to What Price Privacy?, support so far and next steps, along with 'the respective roles and responsibilities of the PCC and the code of practice committee of editors'. Sir Christopher was reported to have said that 'the PCC is not able to act as a H general regulator. He believes that what is needed is a strong stance from the ICO including prosecutions. He queried what more the PCC could do.' The ICO considered that the PCC's role was to come up with proposals on raising awareness to help prevent misconduct, and seemed to consider in turn that there was little more that the ICO could be expected to do. Sir Christopher encouraged the ICO "to engage directly with the industry" and Tim Toulmin stressed the need for the PCC to act 'with the consent from industry' in the matter of issuing guidance, and also recommended direct engagement with the industry.

¶3.30 A number of action points were recorded for the meeting. These were:

¶(a) the Code of Practice Committee of Editors was to be engaged by the ICO and the PCC to discuss the possibility of changes to the Code and production of guidance; (b) the PCC was to give thought to the production of question and answer style guidance separate of the Code; (c) the PCC was to continue to condemn the illegal obtaining of confidential personal information by journalists; and

1019

¶(d) the PCC was to provide the ICO with a formal response to the recommendations in the report. 3.31 The disappointment felt by Mr Thomas with the response of the PCC remains keenly felt in his oral testimony.85 He was exasperated with the PCC's line:86

¶"[…]Coming back all the time: "What do you want us to do? Tell us exactly what to do." My line was: "Well, you are the self-regulators. You're the ones supposed to be working out what is needed to stop the press getting into unacceptable territory. It's not my job to tell you what your job is."

¶3.32 Sir Christopher's account of this meeting also evinced a certain amount of exasperation also:87

¶"I was sort of repeating the same message like a parrot: where's the beef? For Pete's sake – you know, we can do general exhortation, we can do guidance, we can do this stuff, but if you really want me to home in on miscreants, I must have some evidence of who has been procuring enquiry agents – or hiring enquiry agents to procure information illegally, and he was unwilling to do that."

¶Asked what he might have meant by saying that the PCC was unable to act as a general regulator, Sir Christopher said this:88

¶"I think what I had in mind there was a notion that we should in some way take on the work of the Information Commissioner by virtue of being a Press Complaints Commission, and this is what I wanted to reject. The point I always made to Mr Thomas, apart from my insistent demands on beef, was to suggest that we had to work in a complementary way. He did his thing, but there were things that we could do to help him, and I've described them..."

¶3.33 It is not the function of this part of the Report to analyse the response of the PCC on its own account;89 rightly or wrongly, however, the PCC had unmistakably demonstrated that it was unwilling or unable to take action of a sort which could or should have convinced the ICO that the problems with the culture, practices and ethics of the press evidenced in the Motorman material had been definitively addressed by the industry for the future. It had also demonstrated a challenge back to the ICO to address the situation through the discharge of its own powers and functions, and specifically by direct engagement with the industry. H 3.34 The result is that it was evident that the strategy adopted by Mr Thomas (dialogue with the PCC, and distance from both from the operational choices of his office and from direct engagement with the regulated members of the industry) was becoming increasingly unlikely to achieve its aims. Whether Mr Thomas considered himself to be dealing with an ineffective industry regulator, or with a recalcitrant representative body of the industry itself, the onus was clearly firmly on the ICO to reflect further on the direction that it wished to take with the Motorman evidence. No such reconsideration appears to have taken place. Nor is it clear that the ICO explained to the PCC either its position or its operational approach.

1020

¶3.35 Doubtless in the hope of making progress, in accordance with the action points from the meeting, Mr Thomas wrote to the Code Committee on 19 July 2006 and a meeting was fixed for 21 September. In the meantime, there was a 'formal response' from the PCC to the effect that the ICO should take up the question of Code amendment directly with the Code Committee and that the PCC would await the outcome of that process before turning its mind back to the issue of guidance90. Mr Thomas later described himself as having been "fobbed off" to the Code Committee by Sir Christopher.91

¶3.36 Notably, the question of a response by the PCC was now 'complicated' by the fact that the then Department for Constitutional Affairs, had issued a consultation paper (picking up from What Price Privacy?) relating to the introduction of custodial penalties for conviction under s55 of the DPA. In other words, at this point, if not earlier, the strategy around the approach to the PCC became inextricably entwined with the political campaign which was the second limb of the ICO response to the Motorman material. In relation to this campaign, the PCC unambiguously positioned itself not as a regulator of the industry but as a champion of the view opposing any legislative change: it did so by active political lobbying (not least through Guy Black). The twin tracks of Mr Thomas's approach effectively became one. It is to the political campaign that it is now appropriate to turn.

4. What Price Privacy? The political campaign 4.1 Any new statutory regime can take time to bed down in practice and a regulator created by statute will be in the best position to report on its practical operation. In relation to the DPA, the ICO had two channels for doing so. The first was to do so informally to the sponsoring government department with policy responsibility,92 the second was to do so formally by reporting directly to Parliament either generally on the exercise of its functions under the Act or on specific aspects of those functions.93 It was this second channel which had been used in the case of the What Price Privacy? Reports.

¶4.2 Reporting on effectiveness of legislation is not the same as campaigning to change it. The duties of the ICO under the DPA focus on performance of statutory functions94 and do not themselves very obviously provide the platform from which to mount such a campaign. Clearly, the general desirability of a statutory regulator undertaking such a role is a matter of H judgment on which I do not express an opinion but a number of issues do fall to be considered.

¶4.3 The first is the risk that a political campaign might impact on the principal function of a regulator such as the ICO, that is to say, the discharge of regulatory obligations which must be undertaken independently, impartially, fairly and objectively, and many of them in a quasi- judicial fashion. As a matter of law, therefore, any campaign should raise no issue, whether as a matter of fact or of perception, which could cast any doubt on the proper conduct of those functions. In that regard, it is relevant that the ICO exercises regulatory functions in relation to the Government itself both as users of personal information and therefore subject to the ordinary data protection regime but also of course as the single largest collective subject of the freedom of information regime. The Information Commissioner would obviously have to be circumspect in relation to any campaign for change in data protection law and, when personally identifying himself with it, have regard to its effects on the reputation of the office and the enhancement of its role and functions.

1021

¶4.4 The second issue relates to the choice of the topic on which to campaign. S55 creates a criminal offence with statutory defences and a maximum sentence on conviction of a fine.95 Yet Mr Thomas had said that the ICO was not principally a prosecuting authority. In most regulatory regimes, criminal provisions usually constitute a measure of last resort, dealing with situations either of egregious breach for which no other response is appropriate, or for persistent and escalating breach where other, stepped, interventions have been tried without success. Criminal prosecution is complex and expensive. The deterrent effect of differential maximum sentences is not straightforward (and, as discussed below, of potential relevance at all only if there is a realistic prospect of apprehension and conviction).

¶4.5 The importance of s55 to the data protection regime did not therefore lie in its centrality to the operation of the regime, any functional dependence on it of other powers, the regularity with which it was likely to be deployed or its operational visibility to the senior leadership of the office. Nor, of course, is s55 a provision of inherent particular relevance to the press: it is a provision of complete generality, the offence able to be committed by 'any person', whether or not they are formally subject themselves to regulation by any of the other provisions of the data protection regime.

¶4.6 In his first witness statement, Mr Thomas suggested that s55 was likely to be the most relevant provision of the Act to the Inquiry's terms of reference.96 Doubtless, he did so because of the prominence that he had given the issue in his strategic response to the Motorman evidence and the role of the press. It was on 15 April 2005, with the conviction and conditional discharge of Mr Whittamore for s55 offences arising out of Motorman, that Mr Thomas records, "When I heard this, I can recall personally and strongly sharing my team's feelings of frustration."97 He understood Counsel to have advised as a result that further prosecutions would not be in the public interest. "It was then my personal decision to commission a report to be presented to Parliament…"

¶4.7 It will be necessary to consider the sentencing remarks of the judge and the reasons for the sentencing decision but they are, obviously, fact-specific, not least in relation to the personal circumstances of Mr Whittamore and his inability to meet the obligations of a financial penalty. The disappointment in the office at the Whittamore result is understandable, but H consideration must also be given to the extent to which the disappointment was, in any event, the direct result of the choices that had been made within the ICO about the extent of its own engagement with the criminal process, and about pursuing alternative or additional operational options more generally.

¶4.8 The outcome of the prosecution may have been a blow to the ICO principally because, in the first place, it had represented the majority of its investment in an operational response to the Motorman material. It is beyond question, however, that there was an entirely justifiable and genuine sense that it would have been a travesty for matters to have been left there, given the sheer extent of the evidence uncovered. It is not entirely clear why the approach adopted was seen as the principal way forward.

1022

¶4.9 What Price Privacy? The unlawful trade in confidential information98 was the report to Parliament on the Motorman affair and its implications by the ICO issued pursuant to its powers under s52(2) of the Act.99 The foreword provided by Mr Thomas introduced the report as being essentially about the evidence of a "pervasive and widespread 'industry' devoted to the illegal buying and selling" of information contrary to s55, and about the need for change to the law. He put it this way:100

¶"The crime at present carries no custodial sentence. When cases involving the unlawful procurement or sale of confidential personal information come before the courts, convictions often bring no more than a derisory fine or a conditional discharge.

¶Low penalties devalue the data protection offence in the public mind and mask the true seriousness of the crime, even within the judicial system. They likewise do little to deter those who seek to buy or supply confidential information that should rightly remain private. The remedy I am proposing is to introduce a custodial sentence of up to two years for persons convicted on indictment, and up to six months for summary convictions. The aim is not to send more people to prison but to discourage all who might be tempted to engage in this unlawful trade."

¶Operation Motorman is cited as one of the major cases providing evidence for this trade, but a range of other cases are cited also.

¶4.10 What is striking about this analysis, and indeed about What Price Privacy? more generally, is the absence of any context within which s55 sits in the wider data protection regime. Even ignoring the unexamined assumption that different sentence maxima would have a definitive impact on the problem, no attention is given to the obvious question of what other operational means were available to the ICO to address the problem it had diagnosed. On the contrary, the entire thrust of the report is directed to legislative change on criminal penalties. As the foreword concludes:101

¶"These concerns, and the need for increased penalties, have been raised with the

¶Department for Constitutional Affairs. The positive response that I have received so far is encouraging. These are early and welcome indications of progress on the possibility of Government action."

¶H What Price Privacy? set out the problem. Government action (and of course action by the PCC) was expressed to be the answer to the problem. To focus continued attention on the issue, the ICO was to publish a follow up report after six months to monitor progress on the answer.

¶4.11 Putting to one side the important argument that breach of the criminal law should not simply be seen as a cost of doing business, the most important deterrent the criminal justice system can provide is the likelihood of being caught. In the analysis of the perspective provided by the criminal law,102 the first problem in relation to data protection is that those whose personal information is being illegally traded are unlikely to know about it with the result that no complaint will ever be made. Thus, the critical aspect of Operation Motorman was the unexpected discovery of the 'treasure trove' (as was equally the case in relation to Operation

1023

¶Caryatid).103 This is particularly so in relation to cases involving the press because of the complications that will flow from the legal protection afforded to journalistic materials and to sources. In truth, without victim complaints, the only systemic way of identifying criminality of this sort is by the exercise of regulatory investigative powers. If there is a measure of confidence that crime will not be detected, the possibility of a custodial sentence may not be sufficient to discourage the behaviour: it was not sufficient, for example, to prevent the phone hacking exposed by Operation Caryatid.

¶4.12 Mr Thomas explained the objective behind his focus on increasing the maximum available sentence for s55 in this way:104

¶"I think I had quite a long list of objectives by the end of the day, by the time we got to publishing this report. The first objective was to tell the world what was going on. The primary stated objective was to get the recommendations taken seriously, particularly to get the government to increase the penalty, because we felt the penalty was the main problem. But I also felt – and I'm not sure this was articulated, but in my own mind – the more noise we could make about this, even if not successful in getting the law changed, the more that was likely to have a beneficial result. I wanted to get people on the back foot."

¶Although the significance of a maximum which was financial (so that any penalty would have to be linked to means to pay) is important, it is difficult to see it as the 'main problem' facing a regulator armed with other means of enforcing the law and driving up standards. It had, however, attained a more symbolic quality.

¶4.13 It is possible to sympathise with the description of the problem in the introduction to What Price Privacy? that low penalties devalued the data protection offence in the public mind and masked the true seriousness of the crime, but it is possible to argue about the degree to which the sentence maxima stood proxy for the regime as a whole. In the perennial struggle to get data protection (and, thus, the ICO) taken seriously, whether by regulated business, by the public, by the courts, by politicians, or by the press, the ICO quite understandably needed to make a public example of the Motorman find. The outcome of the Whittamore prosecution could be thought to reveal that the wider objective had been set back and that failure was in turn symptomatic of the lack of seriousness with which the courts seemed to consider data protection. The sentence maxima contributed to that lack of seriousness, and were in turn a H sign of a lack of legislative seriousness: a failure at the political level to take data protection seriously. The s55 campaign was to that extent a test of political commitment, and as such existential for the ICO. The Motorman evidence, and the other evidence referred to in What Price Privacy?, gave the ICO an impressive platform from which to make its case for data protection.

¶4.14 Mr Thomas put it this way:105

¶"The ICO put heavy effort into promoting the two reports. The main aim was to secure implementation of our recommendations – especially custodial sentences which were primarily seen in terms of deterrence – but also to raise awareness about the nature and scale of the illegal trade and get it taken much more seriously. The technique of announcing the intention to produce a second (progress) report was deliberately part of this strategy.

1024

¶I was personally involved in this promotional activity to a very considerable extent. The

¶Commissioner - as the personification and leader of the ICO - is obviously expected to be a visible part of all major activity. In this case, I attached particular priority to the issue and also viewed promoting the reports as a tangible way of fulfilling a wider ambition to get data protection taken more seriously."

¶4.15 Operation Motorman triggered the political campaign on s55 although that campaign was neither a specific response to the evidence uncovered by Motorman, nor was it addressed specifically to the culture, practices and ethics of the press. At its heart, although it was much more general and, in the mind of Mr Thomas, symbolic of the struggle to get data protection taken seriously by a wider political audience, it very quickly acquired totemic resonances of a very different kind in the political arena into which What Price Privacy? had ventured.

¶4.16 It is important to appreciate that the ICO campaign on s55 was not targeted specifically at journalists although the campaign against it was championed by the press.106 The publication of What Price Privacy? marked the emergence into the public arena of what had until then been low-key policy discussions with the Department for Constitutional Affairs about law reform. It also coincided with a point in the protracted and frustrating dialogue between Mr Thomas and the PCC at which the latter had formed a view that there was little it was able or willing to contribute to the nominally jointly-espoused aim of effecting culture change in the press, without direct regulatory engagement by the ICO with the industry.

¶4.17 The arrival of What Price Privacy? proclaimed the introduction of custodial penalties as 'the solution' to the problem the ICO had been describing to the PCC. This could reasonably have been expected to have been interpreted by the industry as 'the solution' directed to the culture, practices and ethics of the press in relation to the acquisition and use of personal information. It was a solution the press entirely rejected for itself. Two results predictably followed. The first was the mobilisation of a political lobbying effort by the press against the campaign, directed to the heart of government. The second was a hardening of the attitude of the press (now unmistakably represented by the PCC) towards the ICO. H 4.18 As Mr Thomas described, his political campaign was both elaborate and extensive; on any basis, it was a major undertaking and a substantial investment of his personal time and attention. In the end it involved him engaging at the highest levels in Government and extensively in Parliament, including by giving evidence to no fewer than four Select Committees.107 By December 2006 (the time of the promised follow-up report What Price Privacy Now? The first six months progress in halting the unlawful trade in confidential personal information),108 the campaign had, at least in its own terms, achieved a measure of success. On 24 July 2006, the DCA had published its public consultation paper on increasing the sentencing maxima for s55 to include custodial penalties.109 There had been a degree of public attention and media coverage (What Price Privacy Now? had included four pages of headline press cuttings) and the report claimed an encouraging response from the investigations industry, and raised awareness among (at any rate intermediary) media organisations.

1025

¶4.19 The follow-up report expressed disappointment with the opposition from within the press (both by editors and proprietors) to the s55 campaign and considered it misconceived in underestimating the existing protections in the law and the commitment of the ICO itself to freedom of expression. Its conclusion was that:110

¶"There is still further work to be done to reduce the demand for illegally obtained confidential information. This work will be ongoing. We will continue to track down and prosecute offenders. We will continue to press the Government to introduce the option of a prison sentence and see this progress report as supporting that goal. We will continue to raise awareness and we will encourage and work with any organisation that wants to raise standards or produce clear guidance on data protection obligations.

¶In particular we will be working closely with the media on the development of relevant guidance and standards for journalists."

5. What Price Privacy? The reaction of the PCC and the editors 5.1 At this point it is appropriate to return to the dialogue between Mr Thomas and the PCC whose 'formal response' had been to direct the ICO to the Editors' Code Committee while noting that the issue had become 'complicated' by the publication of the DCA consultation on s55.

¶5.2 On 21 September 2006, Mr Thomas met Ian Beales, Secretary of the Editors' Code of Practice Committee. Mr Thomas described the meeting in his internal note as 'interesting and intelligent'.¹¹¹¹¹¹ HL Hansard, 09 October 1990, Volume 522, Column 169, http://hansard.millbanksystems.com/lords/1990/oct/09/ broadcasting-bill p83, lines 17-21, Carla Buzasi, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Transcript-of- Morning-Hearing-8-February-2012.pdf p587, lines 14-23, Baroness Buscombe, ibid pp45-46, lines 24-23, ibid p2, para 14, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Witness-statement-of-Anna-van- Heeswijk.pdf http://www.atkinsthomson.com/07.06.2011%20-%20Sienna%20Miller%20Statement%20in%20Open%20Court.pdf in order to protect the privacy of the Bowles family to such extent as is possible, and notwithstanding the fact that the information is, at least to a large extent, in the public domain and available, this Report will not publish references to their names, the precise articles or photographs or other family details p70-71, Piers Morgan http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Transcript-of-Afternoon- Hearing-20-December-2011.pdf; p19, para 40, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Chief- Constable-Matthew-Baggott.pdf p8, para 42, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Sean-ONeill. pdf p1, para 1, Richard Thomas, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/RJT-Exhibit-18.pdf pp1-6, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Exhibit-GB6-to-Witness-Statement-of- Gordon-Brown-MP-Black.pdf p3, lines 17-23, Rupert Murdoch, ibid p65, lines 11-15, Sir John Major, ibid p8, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Exhibit-KRM-18.pdf ibid p9, paras 54-55, ibid K p34, lines 16-21, Lord Black, ibid p38, para 119, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Lord-Hunt-of- K Wirral.pdf This includes organisations such as the Chinese Federation of Labour, the China Youth League or the All-China Women's Federation [2004] 2 AC 457Show full note In addition to the established themes of louder condemnation of unacceptable practices and suitable amendments to the Code, Mr Thomas was explicitly now also looking for 'better awareness of s55' from the industry. S55 was evidently the dominant theme in the event, Mr Thomas with a degree of understatement indicating that "support for the prison sentence would be welcome, but I did not expect that" and Mr Beales dismissive of the DCA paper and stressing the 'chilling effect' of the proposal. Mr Thomas had proffered some proposed Code changes of his own but came away from the meeting largely empty handed. H 5.3 On Mr Thomas's account, Mr Beales's position was simple: "his main difficulty is that there is not much incentive to improve the Code unless the threat of increased penalties disappears at the same time". If accurately represented, this is a somewhat remarkable position to adopt: the offence contained within s55 was the law and contained within it a defence for journalists acting in the public interest. A Code of Conduct should surely provide the very best guidance it can and it is difficult to see why there needs to be an incentive to improve it.

¶5.4 In any event, the press had fully subsumed the dialogue between the ICO and the PCC into its own political campaign in opposition to reform of s55 and it may be legitimate to infer the extent to which Mr Thomas had accepted that reconstitution of the agenda: his note suggests that the talk of producing joint guidance was now explicitly in terms of 'better section 55 guidance' rather than anything more generally addressed to the culture, practices and ethics of the press in the handling of personal information.

1026

¶5.5 On 27 October 2006, there was a follow-up meeting (at NI's Wapping premises): the Committee Chairman Les Hinton, and Stephen Abell from the PCC also attended. The note of that meeting suggests that Mr Hinton made plain from the outset that the Code Committee had no mandate to take a position at that point but was considering its response to What Price Privacy?.112 The conversation appears to have amounted to a further turn around the familiar course but with Mr Thomas now leading on s55. Dealing with the 'illegal trade' needed tougher sentences, but these were not targeted at journalists (who in any event had the protection of special exemptions), he was seeking co-operation with guidance and code revisions as a means of addressing journalism's contribution to the demand side of that illegal trade. Mr Thomas had evidently responded to the industry's elision of the PCC dialogue and the s55 campaign, not by attempting to return the dialogue to its original broader purpose but by accepting the redrawn terms of reference and trying to argue his side of that debate.

¶5.6 Mr Hinton's response, however, is illuminative of the distance this dialogue had shifted from the original sceptical but pragmatic tone of the PCC in the opening stages of the encounter. Not only did he deploy the familiar challenge back to the ICO on the question of regulatory inaction, and the clear statement of objection to the s55 campaign, cast in the language of the chilling effect on journalism, but he moved the counter-attack on to the territory of the principles of press self-regulation. Mr Thomas records the Committee representatives as having:113

¶"expressed the view that a prison sentence would undermine the effective operation of the PCC as legal advice is likely to result in journalists not cooperating with PCC investigations in case they incriminate themselves. In addition explicit inclusion of offences in the code would need to be investigated by the prosecuting authority not the PCC effectively taking that provision outside of and therefore undermining the self regulatory model."

¶This ignores the fact that the criminal offence existed and was hardly the constructive dialogue of fellow regulators; this was taking the political battle on to definitive territory with an open challenge to the ICO to retreat from PCC (that is to say industry) territory.

¶5.7 In a contemporaneous handwritten note by Mr Thomas,114 the words 'last chance saloon' appear. At one stage earlier in the dialogue, Mr Thomas appears to have deployed an H intimation that the credibility of the PCC as a 'self-regulator' was at stake in response to the action he sought from them in the aftermath of Motorman. If he was seeking to deploy it again in the highly-charged context of the s55 debate that was undoubtedly a high-risk political strategy, and Mr Hinton's response would be to a degree less startling. Needless to say, Mr Thomas emerged from that meeting empty handed again. Mr Hinton's follow- up letter of 17 November was more positive in tone, but non-committal as regards further industry action.115

¶5.8 It was now fully three years since Mr Thomas had moved to open a dialogue with the PCC, during which period he had identified himself very personally with the conduct of that relationship. The return on that significant personal investment was not evident. But even now, at a point which might be described as open antagonism, there was no evidence that he sought to reappraise his approach. It is possible that one effect of the elision of the PCC and s55 strands of his strategy had been to reframe the former not as a practical end in itself but, by keeping open a channel of communication, as a means of furthering (or at least seeking to manage opposition to) the latter. At any rate, Mr Thomas persisted in it. 5.9 What Price Privacy Now? provided some public comment on the interaction between the ICO and the PCC, thereby to some extent setting the agenda for its future interaction. It also records an understanding that the PCC 'monitors and adjudicates on disputes about breaches of the Editors' Code of Practice, which sets out the conduct the press have agreed to follow as part of a self regulatory system'.116 The progress recorded was, however, relatively modest and is in these terms: (a) The PCC had confirmed publicly and in writing that journalists must act within the law. (b) It had agreed to keep repeating that message – and the ICO "hopes that this will be done as loudly and actively as possible". (c) There had been discussion about Code amendment relating to the acquisition of personal information – "unfortunately, however, no concrete proposals have so far been brought forward". (d) The Code Committee had rejected the ICO's own suggested amendments, but had agreed to keep the matter under review. (e) There was agreement in principle to the issue of "guidance for journalists" by the PCC with ICO assistance. 5.10 On 4 January 2007, there was a further meeting with Murdoch MacLennan (then Chief Executive Officer of Telegraph Media Group) and Guy Black, both by this stage leading actors in the s55 counter-campaign. On Mr Thomas' account,117 the agreed action points were that the ICO should prepare guidance on s55 and the public interest defence with a view to helping journalists to navigate it. It is notable, first, that the focus appears to have swung fully around from the industry representatives being asked to take action to change the culture, practices and ethics of the press, to the regulator being asked to clarify the law and his approach to regulation. Secondly, this appears, in itself, to have become part of what was, by now, a three- way negotiation on s55 between the press, the government and Mr Thomas. 5.11 The course of that negotiation is set out more fully in that part of the Report that deals with the relationship between the press and politicians.118 It culminated in a compromise arrangement whereby a custodial penalty for s55 was finally introduced by the Criminal Justice and Immigration Act 2008,119 together with an enhanced, more subjective defence for

1027

¶H journalists, but neither provision was commenced as operative law; commencement relies on the exercise of an Order-making power which has not to date been exercised. At the same time, further desultory exchanges were continuing between Mr Thomas and the PCC. By letter of 27 March 2007, the Code Committee eventually rejected the amendments to the Code that he had proposed, but suggested some alternatives.120 The ICO responded on 16 April, accepting the changes on the basis of a "hope that they will be introduced with maximum publicity and advice to the media. Otherwise, the 'burial' of the changes within the existing Code, and the absence of a section explicitly prohibiting the obtaining of any private information without consent or a public interest justification, may present the risk that unacceptable activity will continue."

1028

¶There is no indication that the ICO saw itself as playing a direct role in publicity and advice to the media. The letter reaffirmed the ICO's commitment to the s55 campaign and to producing guidance on s55 for journalists.121

¶5.12 On 25 April 2007, there was a further meeting with Guy Black and colleagues from press representative bodies to discuss 'stakeholder engagement' and the preparation of the guidance. It seems to have been inconclusive. The press representatives saw their role in relation to the guidance as 'supporting and commenting and they do not envisage a jointly badged product'; the ICO undertook to shorten and simplify the latest draft of the s.55 guidance.122 A new version was worked on over the late spring and summer of 2007. Work also began within the ICO on a draft statement of prosecution policy on s55, designed to provide a measure of reassurance to the press as the ICO continued its campaign for custodial penalties over the first half of 2008.

¶5.13 An insight into the extent to which Mr Thomas had become very personally engaged in the politics of the passage of the relevant provisions of the Criminal Justice and Immigration Bill can be gained from some of the contemporary documentation which he provided to the Inquiry. In February 2008, the ICO prepared a draft report to Parliament in response to its apprehension that the amendment would be withdrawn by the Government in the face of press-sponsored opposition123 as well as briefing for Ministers and recommendations for Parliamentary handling.124 It also shows Mr Thomas directly lobbying the Government against withdrawal of the amendment in terms which included:

¶(a) urging that 'withdrawal would damage the reinvigorated credibility and authority of data protection law and the Information Commissioner's Office'; (b) an intimation that withdrawal would 'sit strangely' with the Government's legislation on identity cards; (c) the anticipation of support in a number of outstanding Select Committee Reports; (d) ripostes to the press campaigning; (e) averring a determination on his own part to stop the pernicious, largely hidden and illegal market in personal data; and (f) a conclusion, 'with considerable reluctance' that he would respond to withdrawal by H laying a further specific report before Parliament.125

¶In due course, Mr Thomas met the Prime Minister, preparing for an agreed role in the continuing political negotiations between the Government and the press. He said that 'the PM started by saying that I had the most difficult job in the country'.126

¶5.14 It is noteworthy that Mr Thomas was placing no (other) operational action by the ICO into this political arena. There was no proffered action plan for the means by which the ICO would structure its priorities and operations so as to ensure that the legislative change would, indeed, stop the trafficking of confidential personal information. The assumption appeared to remain that the change in its own right, and the accompanying publicity for the role of the ICO in promoting that change, would be effective in themselves. An internal note of a meeting that Mr Thomas had with senior officials from the Ministry of Justice (the successor department to the DCA) is illustrative of the way he was thinking.127 As well as offering an assessment of the party politics of the Bill's provisions, he described his likely public reaction to a then-current possibility to change its provisions significantly in favour of the press. It would, he said, be "nuclear":

1029

¶"I said it would be very noisy and very messy. We will publicly denounce any such attempt. If we lost, we would publish a third report to Parliament, documenting how this state of affairs had come about."

¶5.15 Suggestions that the press might finally take steps of their own (such as amendment to the Code, training and guidance) to address the extent to which their own culture, practices and ethics were in issue were now dismissed as 'too little, too late'. Only a change in the law would do. To that end, Mr Thomas wrote to selected high profile opposition politicians (including the Conservative and Liberal Democrat leaders) as 'a warning shot across the bows of those who might be wavering and as an encouragement to potential supporters' and planned press releases and a public media initiative.

¶5.16 This was not a regulator simply enhancing public debate from an expert point of view. Mr Thomas himself described it as 'playing hard ball'128 or, in other words, full-blooded political campaigning. As noted above, the issue was settled for the time being by the compromise solution of legislation for custodial penalties (along with an improved defence) which was not then and has not since been commenced. At the same time, correspondence continued with industry representatives over the summer of 2008 about the publication of guidance and the promotion of awareness.

¶5.17 About the compromise solution on s55, Mr Thomas himself said this:129

¶"This was clearly the end of this particular road. I saw the compromise in "half a loaf" terms and – although very disappointed – recognised that it would still serve some deterrent and awareness-raising purpose, though less direct or powerful than originally envisaged."

¶5.18 Reflecting more generally on his interaction with the PCC, Mr Thomas referred many times to an overall sense of disappointment. This is important commentary and it is worth setting some of them out in full.

¶H (a) "I think over time I was somewhat disappointed. Although I don't decry everything they did, it fell short of what I'd hoped they might be doing."130 (b) "The evidence shows that I went back a number of times to the PCC throughout

¶2005, 2006 and 2007, and tried to keep – engage their interest with it. But it is true to say that I thought their response was less strident and I think I used the word "disappointing" more than once in this context. I thought they could and should have done more."131

1030

¶(c) "We thought and had some hopes that the PCC would be a better way of

addressing the problem than anything to do with [pur]suing the prosecutions, which we were, at that time, recognising was going to be very expensive and demanding for the office. Now, with hindsight, I think I would have been more aggressive and more assertive with the PCC and with the Code at the outset, and they did disappoint me, as I said, in terms of their response."132

¶(d) "Overall – with only the limited progress recorded on page 19 of What Price

Privacy Now? – I was disappointed by the response from the PCC and the Editors' Code of Practice Committee before and during 2006. I had hoped for much stronger and louder condemnation of wholly unacceptable misconduct, an explicit change to the Code, and more focussed guidance. Instead, there seemed to be a "Catch-22" view that the conduct was already illegal and that therefore not much – if anything – could be done by way of self-regulation. The exchanges did lead to guidance (with which the ICO assisted) on data protection law at large and some discussion about possible changes to the Code, but this increasingly seemed directed as much as heading off tougher sentences."133

¶5.19 Notwithstanding all of this, Mr Thomas made clear his view that his strategy (that is to say, the continuing dialogue with the PCC, publication of his two reports to Parliament, and getting the law changed, despite the non-commencement of the changes) had proved to be very effective, at any rate in relation to the press.134 His grounds for saying so come down to what he claimed was the lack of evidence of criminal conduct within the press postdating 2006:135

¶"I am not saying it's been eliminated altogether – this is under the surface, clearly – but I am saying – and my successor has said this to Parliament very recently, in October of this year [2011] – that it appears that the press are now behaving themselves in this particular area."

¶5.20 Such empirical evidence as Mr Thomas offers for this conclusion appears to amount to accepting the word of the industry.136 Without asserting the contrary, absence of evidence that undermines that assertion is not the same as saying that there is evidence that it is so. In the circumstances, it is necessary to consider the claims made by Mr Thomas for his strategy in general and to examine the paths that the ICO chose not to follow in parallel and, from H there, to review whether, in more recent times, the press has, in fact, ceased to be any real source of interest to the ICO.

1031

¶Chapter 3 Other Possible Regulatory Options 1. Criminal proceedings in respect of journalists 1.1 No journalist was ever subject to prosecution as a result of Operation Motorman. Indeed, the ICO never got as far even as interviewing any journalist in connection with examining the possibility of criminal proceedings (however limited the value of doing so might have been). There is considerable dispute as to why that happened. 1.2 The account provided by Alex Owens is that, within weeks of the commencement of work on the electronic discs of the Motorman material, they were:1 "informed that we were not to make contact with any of the newspapers identified and we were not to speak to, let alone, interview any journalists. Despite our protests we were told this was the decision of Richard Thomas and that he would deal with the press involvement by way of the Press Complaints Council. It was at this moment we knew no journalist could or ever would be prosecuted in relation to our investigation. No journalist or Newspaper Group was ever spoken to by anyone from the Information Commissioner's Investigations Unit in relation to Operation Motorman. We also now knew that one of the major questions that needed to be asked but could never be asked, let alone answered was 'Why did you want all these ex-directory / mobile / family and friend telephone numbers and most importantly what were you doing with them?'"

¶He was, he said, given to understand that the focus of continuing criminal investigation was to be exclusively on the private investigators, the blaggers and the corrupt officials and employees:2 "Basically they'd drawn a red line, with the press and the reporters above that line and we dealt with anything below that line." 1.3 He described the way in which the team continued to prepare papers for conspiracy charges in respect of the remaining defendants (specimen charges relating to breach of s55 of the Act), H interviewed some 50 to 60 victims and (under caution) all persons suspected of the unlawful obtaining, disclosing or blagging on behalf of Mr Whittamore. This material was passed to the ICO legal department for action and, by February 2004, the work was completed. He described having attended a conference with external counsel, in October 2003, in order to consider the weight of the evidence, and the written advice received that December which supported taking forward the conspiracy charges. counsel also directly addressed the question of criminal proceedings against journalists, advising:3 "Having regard to the sustained and serious nature of the journalistic involvement in the overall picture, there can be little doubt that many, perhaps all, of the journalists involved have committed offences.

1032

¶"The inference, overwhelming, it seems to me, is that several editors must have been well aware of what their staff were up to and therefore party to it. I understand that policy considerations have led to the view that enforcement of some sort rather than prosecution is the way forward in respect of the journalists/newspapers.

¶"I understand and sympathise with that approach. This is, I believe, the first occasion upon which the scale of the problem has come to light and it may not be unreasonable to give the Press Complaints Commission the chance to put their house in order." 1.4 On the basis of that policy, counsel considered whether journalists or editors should be cautioned in the light of the evidence of the extent of their involvement and the 'often unpleasant' nature of the offending. He also registered a measure of anxiety about taking forward the conspiracy charges to the exclusion of press defendants:4

¶"Those defending in the prosecution might seek to make capital from the fact that the journalists are not being prosecuted. The judge might also comment on the basis that the journalists are the ones (it seems) who created the demand for this offending.

¶With this in mind, it is a sensible precaution to equip me at some point before trial with the detail of the reasoning not to prosecute. I may need to explain or even defend the decision to the judge." There is no evidence that a detailed statement was in fact produced. 1.5 After completing work on the files, on Mr Owens's account:5

¶"we received no feed back whatsoever as to what action was being taken in relation to the press's involvement. On those occasions we did ask the question the only response we received was that 'Richard [the Commissioner] was dealing with it'." The prosecution was ultimately conducted by the CPS and he describes how the ICO was neither formally aware of or involved in the prosecution of Mr Whittamore; the next they heard, in April 2005, was that he had been conditionally discharged by the Crown Court at Blackfriars. Mr Owens left the ICO at around this time, with, he said, unanswered questions about what if any action had been taken in respect of the press, and why such prosecution as had proceeded seemed to have involved Mr Whittamore but none of the other conspirators. He concluded that 'something had gone drastically wrong with the prosecution case', H producing an outcome which did not begin to do justice to the Motorman material.⁶⁶ Engagement with the public: the website 37 Chapter 3: Further issues of law 38 The protection of sources and other legal privileges of the press 68 Chapter 3: Competing public interests 69 http://www.levesoninquiry.org.uk/people/assessors/lord-david-currie/ This obligation of confidence is owed by the Inquiry team to any recipient of the letter and by that recipient to me, as Chairman of the Inquiry: see para. 14(1) of the Inquiry Rules 2006 Great Britain, Royal Commission on the Press: 1961-1962: Report (Cmnd 1811) p1, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Witness-Statement-of-Dr-Rowan-Cruft.pdf p32, lines 16-21, Professor John Tasioulas, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/ Transcript-of-Morning-Hearing-16-July-2012.pdf Claire Enders, Competitive Pressures on the Press, Seminar 6 October 2011, http://www.levesoninquiry.org.uk/wp- content/uploads/2012/07/Claire-Enders-Competitive-pressures-on-the-press.pdf ibid http://downloads.bbc.co.uk/bbctrust/assets/files/pdf/about/how_we_govern/charter.pdf p3, lines 4-10, Robin Foster http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of- Afternoon-Hearing-17-July-2012.pdf Political and Economic Planning, Report on the British Press http://www.pcc.org.uk/index.html p9, para 8, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Witness-Statement-of-T-ACC-Russell- Middleton.pdf Information Commissioner's Office, What Price Privacy?, p15, para 5.1 p33, para 89, ibid p2, para 6, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Fourth-Witness-Statement-of-DAC-Sue- Akers.pdf http://www.levesoninquiry.org.uk/hearing/2011-11-14am/ http://www.levesoninquiry.org.uk/hearing/2011-11- p53, lines 23-24, Michael Gove, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Transcript-of- Afternoon-Hearing-29-May-2012.pdf p28, lines 22-25, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Morning-Hearing-25-April-2012.pdf p3, para 10, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Witness-Statement-of-Sally-Bob- Dowler.pdf pp14-17, lines 17-3, Charlotte Church http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Transcript-of- Afternoon-Hearing-28-November-20111.pdf p5, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Witness-Statement-of-Michelle-Stanistreet.pdf http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Report-by-Elizabeth-Filkin.pdf pp4-5, paras 11-13, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Lord- Condon.pdf p35, lines 10-12, Brian Paddick, ibid pp25-26, lines 12-11, Neil Wallis, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Afternoon-Hearing-2-April-2012.pdf p75, line 13, Richard Thomas, ibid, emphasis added. Mr Thomas suggested, however, that s55 of the DPA which founded the prosecution powers was most likely to be the most relevant provision of the regime to the terms of reference: p3, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/First-Witness-Statement-of-Richard- Thomas-CBE.pdf pp41-42, lines 25-3, Francis Aldhouse, ibid pp11-12, paras 4.18-4.19, Alexander Owens, ibid pp6-16, para 3.3-3.26, ibid p2, para 7, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Second-Witness-Statement-of-John- Witherow.pdf Part H, Chapter 5, para 2.64 p36, lines 4-24, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Morning-Hearing-25-April-2012.pdf p53, lines 18-19, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Morning-Hearing-25-April-2012.pdf pp4-5, lines 16-2, David Cameron, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Transcript-of- Morning-Hearing-14-June-2012.pdf pp7-8, ibid pp58-59, Lord Justice Leveson, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Transcript-of- Morning-Hearing-10-May-2012.pdf; p5, lines 5-11, Lord Justice Leveson, http://www.levesoninquiry.org.uk/wp- content/uploads/2012/05/Transcript-of-Afternoon-Hearing-15-May-2012.pdf pp87-88, lines 6-2, ibid p52, lines 14-21, ibid pp3-4, lines 19-3, Robin Foster, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of- Afternoon-Hearing-17-July-2012.pdf Home Office Large Major Enquiry System p46, lines 20-21, Lionel Barber, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Transcript-of- J Morning-Hearing-10-January-2012.pdf pp8-9, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Professor-Roy-Greenslade-of- City-University.pdf p14, lines 13-14, Lord Black, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Transcript-of-Morning- Hearing-1-February-2012.pdf p10, lines 10-22, Lord Black, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of-Morning- K Hearing-9-July-2012.pdf p3, para 6, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Media-Regulation- Round-Table.pdf p53, lines 9-22, Professor John Horgan, ibid Part K, Chapter 2 Part K, Chapter 3, para 5.14 Part K, Chapter 7, para 4.16 See for example: Application 22954/93, Ahmed v United Kingdom (1998) 29 EHRR1 at para 70, and Application 11800/85, Ezelin v France (1991) 14 EHRR 362 at paras 37 and 51Show full note 1.6 On Mr Owens's account, therefore, the suggestion within the Motorman material of prima facie criminality within the press could and should have been taken forward to prosecution. He said "we were in a position to prosecute everyone in the chain from the 'blagger' right up to the journalists and possibly even the newspaper groups".7 However, he said that the intervention of a policy decision by Mr Thomas to proceed with the matter himself and exclusively in dialogue with the PCC as a result of, or additionally because of, a reluctance to engage directly in enforcement action in relation to the press prevented this from happening. 1.7 This account was vigorously disputed by both Mr Aldhouse and Mr Thomas. The evidence of Mr Aldhouse was that there was no policy, or none that he was aware of, of holding back from the prosecution of journalists. He was clear that he was not involved in the operational decision-making at all; however, if he had been asked, he would have considered that there was indeed a case for taking the involvement of journalists and newspapers in criminal behaviour further. Nor would he have thought resourcing problems a conclusive argument against doing so: he thought that it would have been possible to have discussed the possibility of supplementary funding with the sponsoring government department. But he did not apply his mind to such considerations at the time; it was not his place to do so. He was aware of a measure of frustration in the investigations team that no action had been taken in relation to the press, and of some discussion about the disappointing criminal process in the office, but could recall no detail.8 1.8 Mr Thomas also denied any positive policy decision or instruction being given not to proceed with criminal investigations into press conduct. This denial was emphatic and can be enumerated: (a) "there was no such policy decision, certainly not at the early stage";9 (b) "[it] is possible that Mr Owens has somehow confused or conflated all the dates and interpreted that [Mr Thomas going to the PCC] as some sort of policy or some sort of instruction, but that was not the case";10 (c) "[if] there was a policy, it was not one which I had any hand in, one which I knew about, which I made or which I was told about";11 (d) "as far as I'm aware, there was absolutely no such policy and I can't think why there would have been such a policy";12 (e) "what I'm trying to say – and I hope I'm coming across very clearly – is that there was no policy from the outset that we weren't going to go against the press";13 (f) "Q: Your evidence is that the policy steer didn't come from you?

1033

¶A: Absolutely not";14 (g) "there is clear evidence that there was not a policy conclusion even at that point [the approach to the PCC]";15 (h) "I don't accept that there was a policy decision. I don't accept that we abandoned the possibility of prosecuting journalists."16 1.9 Indeed, Mr Thomas was insistent in his evidence that there was no 'conscious decision' at all not to prosecute journalists.17 He explained that in two different ways although, on the face of it, these are not entirely straightforward to reconcile. He said both that he assumed that

¶H in fact the office was making progress with the prosecution of journalists as they would with any other criminal investigation,18 and also that there was an active plan to keep the option of prosecution alive but to wait and see first how the conspiracy prosecutions being undertaken by the CPS fared, and in due course, if all went well, to activate them.19

1034

¶1.10 Taking the second of these first, the problem with any 'wait and see' strategy was articulated by Mr Owens. He described his response to the way in which the discontinuance of the criminal proceedings for conspiracy was described in What Price Privacy? in the following terms:20

¶"This was a great disappointment to the ICO, especially at it seemed to underplay the seriousness of section 55 offences. It also meant that it was not in the public interest to proceed with the ICO's own prosecutions, nor could the Information Commissioner contemplate bringing prosecutions against the journalists or others to whom confidential information had been supplied."

¶1.11 As Mr Owens explained:21

¶"It may be correct in relation to the others, you know, the blaggers and the thing, but you could never go back after three years and contemplate prosecuting journalists.

¶They'd never even been investigated. And I – there's enough legal people here to know if I – I kept evidence – you can't put – if you have a conspiracy, you can't put five people on the back-burner and wait and see how you got on with the same five people in the front that's getting prosecuted, because you got a good result, right, we'll go and prosecute them as well. Well, they're all part of one conspiracy. You either investigate them all, or those five you have to say we're not going to investigate them which means we're not going to prosecute them. I don't know whether that would be - is the correct word abuse of the justice system?"

¶1.12 In my judgment, as a matter of criminal process, the proposition that the journalists were not investigated because there was a deliberate strategy which had been thought through (in the light of evidence that was known about and understood) simply to see how the prosecutions against the 'middle men' went before proceeding against the press is neither credible nor sustainable. In any event, there is no contemporaneous evidence that this was indeed the strategy. This is very different from a decision not to proceed for good operational reasons, followed by a later re-evaluation.

¶1.13 The other argument advanced by Mr Thomas was that there was indeed an active policy to pursue criminal inquiries into the activities of the press, but that they ran their operational H course to no effect. He suggested a number of operational reasons for the ICO not, in the end, proceeding with criminal proceedings in respect of the press. They included:

¶(a) the inevitability that severe and disproportionate logistical difficulties would be faced, including the commitment of significant resources;22 (b) legal uncertainty about the difficulty of proving 'procuring' of disclosure by the press (which would require establishing knowledge or recklessness about the lack of the individual's consent) and about the possible deployment of public interest defences by journalists;23

1035

¶(c) an understanding that Mr Owens's extended sick leave and anxieties about his reliability as a witness, influencing legal advice to withdraw from prosecution action;24 (d) a strategic view that it would be preferable to defer conclusively to the CPS prosecution of the corruption cases, "giving precedence" to the corruption proceedings because they were "more serious" and carried higher sentence maxima than the cases which the ICO could prosecute;25 (e) a strategic preference for proceeding against the 'middle-men', at the heart of the organised trade in confidential personal information;26 (f) the 'perversity' of the outcome in the Whittamore prosecution: the conditional discharge was a reason any further prosecutions would not be in the public interest, and in particular "completely extinguished any possibility whatsoever of prosecuting journalists";27 and (g) a sense that "any formal action, particularly a prosecution, was likely to be, if you like, that much more difficult because there will be less sympathy for the celebrity." This is a jury point, perhaps, about the unattractiveness of bringing cases in respect of celebrity victims who might, however unfairly, be considered to have compromised their own data protection entitlements.28 1.14 The difficulty with any or all of these explanations is that, on Mr Thomas's own account, the Inquiry saw no evidence that at the time the ICO went through a strategic decision-making process which actively considered any of these points and reached a conclusion on them. There clearly would have been the need for major decisions to have been taken one way or the other about the allocation of resources, significant operational planning and close liaison with the police and the CPS. There is no evidence that any of this happened. On the contrary, the best evidence available to the Inquiry suggests that:

¶(a) there was prima facie evidence of criminal behaviour by journalists; (b) this was investigated up to a point within the ICO by paper analysis and by interviewing a selected group of victims; (c) external counsel encouraged the view that the evidence of criminal conduct by journalists was persuasive and that there were merits in taking the matter further; but (d) the matter was not taken any further by the ICO in relation to data protection offences, not even to the stage of approaching a single journalist either to be interviewed or for a statement.

1036

¶1.15 Mr Thomas was either unaware that the matter was not proceeding within his office, or aware of it without challenging that state of affairs. Either is problematic. The first suggests a disconnection from one of the biggest operational cases the ICO ever dealt with to a degree which is difficult to understand. After all, this was a case on which he himself spent many years pursuing at a strategic and political level. There was this exchange:29

¶"Q: When the prosecution started, there were no journalists there. Did you not think about that?

¶A: I wasn't involved in these meetings.

¶Q: No … not the meetings, but you were alert as to what was going on with the prosecution process?

¶A. Only in very general terms and I have no recollection." At the very least, the second explanation raises questions about the extent of the interest that Mr Thomas had in this aspect of the enforcement of the data protection regime notwithstanding the extent of the abuse revealed by Operation Motorman.

¶1.16 This important matter was directly put in this way by Robert Jay QC to Mr Thomas when he gave evidence:30

¶"May I try and sum up the position in this way? Given two facts which we know, Mr

¶Thomas – the first fact is that the journalists were never interviewed by your office and the second fact is that such an interview would be a sine qua non to a prosecution, out of fairness to the journalists on the one hand, in order to obtain further evidence does it not follow that either there was a policy decision not to pursue that course or, alternatively, there were operational failures or decisions by the investigators not to carry out an elementary step, namely to interview?"

¶1.17 Mr Thomas challenged that dichotomy, but only by way of suggesting that an alternative was the 'wait and see' policy which is not, itself, obviously compatible with an omission to interview any journalist in a timely fashion. Mr Jay therefore put the analysis to him even more directly:31

¶Q. "So at the moment I am thrashing around mentally to see what other alternative H there might be beyond a policy decision on the one hand or incompetence in your investigation officers on the other."

¶A. "Well, if you want to put it in those terms, I have to put it to the latter, but I am absolutely – you know, absolutely clear because I wouldn't have done any of the things

¶I had done right through 2005, 2006, 2007 if I had thought at any time that I or anybody else had said: 'Back off the journalists'." 1.18 This is an answer which has difficulties at many levels and, in fairness to Mr Thomas, may not bear too close an analysis. As between a policy or an operational failure there are perhaps levels of intermediate gradation. It is, however, necessary to take stock of the issue of non- prosecution of journalists by the ICO.

1037

¶1.19 In the first place, it does not seem that there need have been any reason from the outset for the ICO not to have proceeded down the path towards active pursuit of prosecution. Mr Jay put it this way:32

¶"But if all one needed to do: "Let's cherry pick the best cases of illegality. The friends and family cases, the one or two police national computer cases. We'll interview the journalists in those cases. We might interview the editors." That is a fairly narrow exercise. You can then assess how strong the case is. After all, if the evidence is strong enough, you might even get guilty pleas. Who knows?"

¶1.20 A lot of evidence was available, and a good deal of work was done in the early stages. Mr Owens took the point that it might not have required a huge amount of delving and interrogation by him in relation to the relevant journalists to get the answers he needed to the questions in his mind (which principally concerned why they wanted the material). Some might have declined to answer; of those who answered, some answers might have incriminated journalists, others might have exonerated them.33 But the questions were never asked. It would not have been operationally impossible, and ought perhaps to have been operationally rather attractive, to have proceeded in the way Mr Jay hypothesised. But there was no indication that this was ever contemplated, far less attempted.

¶1.21 In the second place, although I recognise that the conditional discharge imposed on Mr Whittamore meant that there was little practical prospect of resuming criminal investigations in relation to the press for the reasons outlined above, such an outcome was hardly possible to foresee. The record that the ICO made of the hearing before His Honour Judge Samuels QC in the Crown Court at Blackfriars in April 2005 (including his sentencing remarks)34 does not on the face of it even support the proposition that the prosecution of journalists was out of the question following the conditional discharge of Mr Whittamore.

¶1.22 From this note, it is possible to derive the following propositions:

¶(a) The sentence in this case was clearly to a degree based on the particular position of a co-defendant (previously sentenced in ignorance of this prosecution) and the unchallenged personal circumstances of Mr Whittamore who was described as of previous good character; in a state of depression; 'reclusive'; 'probably a broken man' of limited means, unemployed and effectively unemployable in his previous line of work. H (b) There were procedural considerations militating strongly in favour of a swift disposal of the case. (c) There is no indication at all that the sentencing judge considered the offending behaviour not to be serious in nature; on the contrary, he observed: "The vice of the primary conspiracy was to make known to the press information which on any view ought to have been confidential … I refer to the vice and I do so again as a warning to others; others cannot expect leniency as seen today."

¶1.23 To be fair to Mr Thomas and the ICO, it is right to record that there were some issues about the nature and extent of the co-operation between the ICO on the one hand and the police on the other. Mr Owens said of the prosecution:35

1038

¶"We had never been advised that the matter was due before the courts. We were never given the opportunity to attend even though we had been the investigating officers and were never given any details of what had happened in relation to all the other defendants we had anticipated would be jointly charged with Whittamore for conspiracy… we did hear that there had been some conflict between the ICO legal team and the Crown Prosecution Service/Metropolitan Police…"

¶1.24 Mr Thomas put the matter in this way:36

¶"I also understand that there was a feeling that the prosecutor had not accurately conveyed some of the material to the court vis-a-vis the journalistic aspect, and I can't turn it up straight away now, but some of the notes you've had from the ICO's legal file indicated that the barrister for the CPS had not perhaps conveyed the full picture. We'd sort of – if you like, were not actively engaged or involved in that."

¶1.25 It is neither possible nor necessary to reach any conclusion about the extent to which a failure of liaison impacted on this prosecution, although a close and mutually supportive relationship between ICO, police and CPS in this type of case is clearly important.

¶1.26 Putting to one side the issues which flow from a consideration of the result of the prosecution, and reverting to the initial decisions, the conflict between the investigator, Mr Owens, and Mr Thomas remains real. Mr Owens bluntly put the matter in this way:37

¶"In conclusion I would summarize by saying it is my opinion that:

¶• ICO's decision not to investigate any journalist in relation to Operation

¶Motorman was a wrong decision.

¶• This decision was certainly not based on any advice given by counsel or on any

lack of evidence, as ICO would have everyone believe. The decision had been made long before the involvement of any Counsel or opinions being requested and there was overwhelming evidence that many of the journalists did know or at least should have known the information they were requesting could only be obtained illegally and what they were requesting was not for a purpose which would carry any form of 'public interest' defence.

¶H • The decision not to pursue any journalist was based solely on fear - fear of

the power, wealth and influence of the Press and the fear of the backlash that could follow if the press turned against ICO.

¶• The publication in May 2006 of 'What price privacy' was no more than an

attempt to lock the stable door after the horse had bolted in an effort to cover up the fact that ICO had failed in its duty to conduct a full and proper investigation into the conduct of journalists at the time when they could and should have.

¶"Throughout the whole of the time the Motorman investigation was on going there was never any mention or suggestion of any report being commissioned for Parliament. I feel it was no coincidence that this report was not published until May 2006, only a few weeks before the Mulcaire scandal broke. It is my belief that when ICO became aware that the Metropolitan Police were conducting yet another investigation involving more wrong doings by the Press, they decided to pre-empt and deflect any criticism which was bound to be directed towards them in relation to their lack of action against the Press in Operation Motorman. "All the evidence published in this report had been gathered and had been available since March 2003, so if as David Smith stated, again in the Panorama Report, ICO wanted to send "an effective and final warning" then why did it take over three years to prepare it, and not publish it until 13 months after the prosecution against Whittamore had concluded."

1039

¶1.27 These are stark allegations, which Mr Thomas firmly invited the Inquiry to reject. One of his reasons was that Mr Owens' evidence must be regarded as unreliable as he had parted from the ICO on unhappy terms and that must be taken to have clouded his judgment on this matter. However, insofar as this Report comes to any conclusions on these issues it does so on their own merits rather than on the basis of speculation by Mr Owens on matters not within his personal knowledge. On the other hand there is no reason to doubt that Mr Owens' evidence was, at least, an authentic description of his own perspective. Furthermore, it cannot be overlooked that, by their own accounts, the senior management of the ICO had placed Mr Owens and his immediate superior in a position in which their perspectives were operationally determinative: it was a matter for them.

¶1.28 I start from this proposition. The evidential 'treasure trove' of the Motorman material, the questions of public interest and of the integrity of the data protection regime, the seriousness of the breaches of trust evidently involved and the potential harm occasioned to a very large number of individuals all make it very hard to reconcile the evident lack of analysis or a discernible action plan in the ICO for consideration of criminal investigations into press misconduct. Whether, in the end, the decision was taken to pursue those investigations or not, the matter should have been consciously and conscientiously considered and decided upon from an operational and strategic point of view. The decisions should have been reasoned and recorded. The evidence is that this did not happen. It is possible (although I do not say more) that a significant opportunity was thereby lost to challenge and check elements in the culture, practices and ethics of the press that were insufficiently mindful of the law, the rights and entitlements of individuals, the public interest and the obligations of good practice.

¶1.29 Before reaching any firm conclusions, however, it is also necessary to provide the context of the alternatives available to the ICO, the choices made and the outcomes in practice. Mr H Thomas said:38

¶"it's important to record that prosecution is not the only way to deal with a particular problem." Operation Motorman was clear evidence of a problem in the culture, practices and ethics of the press. It was not dealt with by criminal investigation and prosecution. The ICO was, on its own account, not primarily a prosecuting authority; it was a statutory regulator, provided with a range of standard regulatory powers and had a range of other powers and operational choices available.

¶1.30 Mr Thomas shared with the Inquiry the thought that there might even have been a causative relationship between his understanding from his staff that the prosecution of journalists was not a plausible option, and his decision to take the matter to the PCC. He accepted that thought was to a degree ex post facto rationalisation, and it is not certain from the chronology that it can have been the case (he also said elsewhere that the reason he refused to go into operational detail with the PCC was that the prosecutions were still "under way.")39 But, in the light of the eclipse of the prosecution option, the way he put the position of the ICO in relation to what the evidence discovered in Operation Motorman revealed about the culture, practices and ethics of the press must surely be regarded as authentic:40

1040

¶"We can't leave it there. We must do something." The 'something' in Mr Thomas's mind was his twin-track political strategy. But the question also has powerful operational resonance. If the ICO was not to tackle the press by the route of criminal investigation, the 'something' else must be considered.

2. The use of regulatory powers 2.1 One of the striking features of the narrative that started with Operation Motorman is that neither during the criminal investigation nor at any time thereafter does it appear that there was any evaluation of alternative operational steps which remained available. On the contrary, the ICO appears to have put faith only in prosecution and the twin track strategy championed personally by Mr Thomas. However, the 'treasure trove' of material gave rise to a number of important operational issues and permitted a variety of regulatory responses. 2.2 There was certainly the question of future deterrence, which featured so prominently in Mr Thomas' campaign. There was also the wider operational question already noted: it was unlikely that Mr Whittamore was the sole operator in this evidently lucrative market, so how big, in fact, was the problem? This was something to which only the press, as drivers of the market as evidenced by the Motorman material, were likely to be able to provide a clear answer. 2.3 There were issues at a more specific level as well. The Motorman material suggested that the press was in possession of a quantity of material in breach of the data protection principles and of the rights of the individuals involved. If their acquisition of that material was unlawful, then their continuing holding and use of the material was likely to be unlawful and unfair also. Motorman raised questions not merely of past illegality (obtaining the information) but of present and continuing illegality. H 2.4 That, indeed, was the distinguishing feature of the role of the press in the narrative. The blaggers and the corrupt officials and employees could be identified and their practices terminated. But, unless they had taken active steps (which might include destruction) in relation to the personal information, the press were likely to be persisting in conduct unlawful under the data protection regime on a daily basis. Even holding information unlawfully and unfairly is a potential breach, whether or not accompanied by further breaches, intended breaches, or indeed any further plans or actions at all. Every day which passed raised acute practical and operational issues in relation to the press. How much personal information were they holding unlawfully, and how should the situation be remedied and lawfulness assured? These issues were live and acute, and not even prosecution of the press would have been a complete answer to them. Although criminal investigation would have got to the bottom of the specimen cases pursued and no doubt would have had a salutary chilling effect of some sort on unlawful practice, it could never have been the thorough-going systemic look at the Motorman material in the hands of the press, nor the systemic rectification of any continuing unlawfulness, which the evidence required.

1041

¶2.5 The seizure of the Motorman material was, in other words, a very major case of the sort which statutory regulators are created (and given practical powers) to deal with. The press were under continuing legal obligations to consider what steps were needed to clean up their own operations from the products of the unlawful trade in personal information. Even if defences may have been available in some cases to criminal charges, a significant number of questions would have been outstanding as to the extent to which the press had complied with their civil legal obligations and with standards of good practice under the data protection regime.

¶2.6 It is therefore significant that Mr Thomas confirmed that the ICO did not, at any point, come close to considering the use of the civil enforcement powers at their disposal either to seek further information from the press or to require them to comply with the data protection regime. Evidently, "some sort of passing thought was given to it but nothing materialised". That was for two principal reasons. The first was that these powers were, in any event, rarely used. The second was that "everybody knew that to a very large extent the powers of the office were very constrained indeed when it came to dealing with the media".41

¶2.7 It is evident, as considered at the outset of this Part of the Report, that there were questions about the operational experience in the ICO at the time of the deployment of its formal regulatory powers, and particularly so in relation to the press. That is further considered below, as is the question whether the investigative and enforcement powers of the ICO in relation to the press were, indeed, as a matter of law insufficient to allow the questions raised for the press by Motorman to be effectively tackled by the regulator.

¶2.8 At this stage, it is sufficient to articulate the following concerns:

¶(a) The Inquiry saw no evidence that any of these matters were the subject of serious consideration within the ICO. (b) The Inquiry received a quantity of evidence as to how far the Motorman material could be considered prima facie evidence of criminality on the part of journalists (not least because of the question of intent), but it is not credible to argue otherwise than that it was prima facie evidence of extensive unlawful and unethical data protection practice. (c) Whether the press would have had an answer to that prima facie unlawfulness certainly fell to be considered and, to such extent as it did, so the evidence is that the ICO was of the view that that was highly unlikely to be the case.42 The substantive exemptions from the principles and rights of the data protection regime in favour of the press may have

¶H been extensive, but they were not limitless. It was not open to the ICO on the evidence of the Motorman material to conclude with any confidence that the press had been acting within its rights so far as personal information privacy was concerned. (d) The procedural hurdles standing in the way of formal proceedings by the ICO against the press may have been daunting – but it is not credible that Parliament intended them to be insuperable. If ever an operational data protection issue arose where active contemplation of regulatory action in respect of the press presented itself (I put it no higher), Motorman was surely that case.

1042

¶(e) Not only was there no evidence that serious operational attention was given to these issues, either at the time or at any point since, it is noteworthy that at no stage since the Motorman material was found has the ICO raised as an issue the sufficiency of its powers to tackle breach of the data protection regime by the press. 2.9 In relation to this last point, at no point during his long campaign on custodial penalties did Mr Thomas seek reform of the provisions applying the civil law to the press. The present Information Commissioner, Christopher Graham, does not do so today. That left the Inquiry with the question of whether the powers available to the ICO were in fact adequate for the task of pursuing with the press the continuing operational issues raised by Motorman, but were neglected by the ICO; or whether they were inadequate, and the ICO has chosen, for whatever reason, not to draw attention to their inadequacy. Both Commissioners have strongly argued on these points that they have other priorities and that, whatever the legal position, it would not have been right for them to place the practices of the press among those priorities. I reflect on that in due course. 2.10 Not for the last time in this Report, a haunting question asked by Mr Owens arises. He described himself musing on the operational implications for the press of the Motorman material in this way:43

¶"It's our job to take them or indeed anyone else on, that's what we are paid to do. If we do not do it, then who does?" The question is even more pertinent in relation to civil law enforcement under the data protection regime than it was to the question of prosecution. The CPS can always take prosecution decisions (including in relation to s55) and consider the matter from the perspective of the totality of any apparent criminality. Only the ICO is able to take regulatory enforcement action. If anything, the pertinence of this question has only increased over time. 2.11 None of this is to suggest that the ICO should have had recourse to testing its formal investigatory and enforcement powers in practice in this case, but simply that it might have been expected to give the question urgent and detailed consideration. No regulator would expect as a matter of routine to make the formal assertion of its powers its first reaction, although in an egregious or systemic case (and Motorman was surely such a case) that may be appropriate. To the extent that criminal proceedings remained in active contemplation there H would in any event have been a need for detailed consideration of the potential interactions between criminal and civil investigations. However, if not formal action, possibly as a prelude to the active consideration of formal action, the operational imperative to 'do something' about the Motorman problem with the press might at least have been expected to direct the mind of the ICO to the possible effectiveness of a range of informal steps.

3. Engagement with the industry: guidance and promoting good practice 3.1 Under the DPA, the ICO has a general legal obligation to:44

¶"promote the following of good practice by data controllers and, in particular, so to perform his functions under this Act as to promote the observance of the requirements of this Act by data controllers".

1043

¶The press organisations involved in the Motorman case were undoubtedly data controllers for these purposes and 'good practice' can refer to standards over and above the strict legal requirements of the data protection regime. Therefore, even assuming that the ICO had considered that, in the case of the press, its own powers were too restricted or restrictive for formal regulatory action to be the best way to proceed, its duty to promote good practice would still have been engaged. Mr Thomas described his entire twin-track strategy to have been undertaken in furtherance of his duty to promote good practice but the duty was also relevant to the operational imperative. That imperative was to tackle the questions raised by the fact that, so far as the ICO had reason to believe, the Motorman material remained in the hands of the press in circumstances which, at the very least, raised specific and systemic questions of good practice, standards and ethics.

¶3.2 The first recourse of a regulator is not usually to formal proceedings. In those circumstances, it is more usual to make informal contact in order to follow up an apparent problem (which is any practice falling short of desirable standards), hear the other side of the case, and seek to engage in a detailed dialogue about the nature and extent of the problem and the steps which might be taken to address it satisfactorily. At the very least, the Motorman material revealed to the ICO that the press had engaged in questionable practice in relation to individuals' information, that it remained in possession of that information in circumstances which, again at the very least, raised questions about their conformity with good practice, and that good practice would require some contemplation from the individuals' point of view as to whether steps were needed to improve the situation. But the Inquiry saw no evidence that any of these matters, any informal approach to the press data controllers or any assessment of the immediate practical steps suggested by good practice, were actively contemplated let alone put into effect.

¶3.3 Mr Thomas said that he did, indeed, have it in mind to write to the various journalists and editors involved, drawing attention to the fact that they were 'incredibly lucky' not to have been prosecuted (or, it might have been added, not to have been made the subject of formal investigatory or regulatory action).45 Pressed as to why no attempt was in fact ever made to engage with the individual newspapers, his answer was that, in going to the PCC, he had "dealt with them all collectively".46 Apart from the identified concern that this suggests a lack of understanding of the role and responsibilities of the PCC, it implies that these were mutually exclusive approaches. It also suggests that there was no imperative to deal with the problem in the short term and in a practical way: that is to say, to address the issue not just

¶H of the press ceasing to commission further unlawful trade in personal information but also of what it was doing with the information already in its possession as a result of that trade. As noted above, the PCC itself urged Mr Thomas to engage directly with the industry and, in any event, showed little appetite to take the responsibility that Mr Thomas wished to pass on.

¶3.4 It is also significant that there seems to have been no attempt to engage directly with the press (even indirectly, through the PCC) in the run up to the publication of What Price Privacy?47 That report was of course conceived principally from the perspective of a policy decision to the effect that the introduction of custodial penalties for s55 was to be the principal means of impacting on the unlawful trade in personal data. Considered, however, from an operational point of view, the lack of engagement with the press or any part of it on either the text or the data tables is both striking and surprising. It afforded the industry no possibility of verifying the data (the consequences of which, in at least one case, are considered further below). It also missed what might very well have been the prime opportunity to discuss with the industry what practical lessons could be learned and what steps they ought to have taken or be taking not only to remedy any persistent problems, but also to secure good practice for the future. A not insignificant 'carrot' might have been a willingness to include an account on that exchange in the report to Parliament, thereby demonstrating that the press were taking the issue seriously.

1044

¶3.5 Mr Thomas, however, said that he simply relied on the publications of his reports to Parliament to engender awareness amongst proprietors and editors at the national level of the ICO's concerns.48 In relation to What Price Privacy? he reported:49

¶"I would say that was promoting good practice, and sending it to a hundred organisations with specific personalised letters saying 'this is not acceptable' … I would say this is very much promoting good practice."

¶3.6 In reality, however, this was all rather late. It was three years after the event by which time the audit trail in relation to the Motorman material in the hands of the press was likely to have gone very cold indeed. Three aspects of the conduct of the ICO are difficult to understand. The first is that if it was possible to prepare a large individual awareness exercise, complete with personalised letters in order to draw attention to What Price Privacy?, and if that was seen as an effective way to discharge the duty of the ICO to promote good practice, there is no reason why similar attempts could not have been made at the time to contact the industry directly. Second, while making every allowance for the decision to approach the PCC as a form of collective engagement with the press, the ICO did not recommend specific good practice steps to be promulgated to the industry as well as 'general condemnation'. Third, when it was becoming increasingly clear that the PCC was not going to act as an effective interlocutor with the industry on behalf of the ICO's operational concerns, even then, the ICO did not seek to communicate directly with the industry itself.

¶3.7 Even after the publication of What Price Privacy? the process of preparing and issuing effective good practice guidance to the press was faltering and inconclusive. Of the document eventually produced, Mr Thomas said:50 H "It was a useful guidance note but I suppose I was a little concerned that it buried the section 55 warnings into a wider context of talking about the Data Protection Act and its application to the media more generally, and I think even now I would say that it was a shame it didn't just focus on section 55 in the way that our own note, which we produced, I think, in 2006 or 2007, what we call a good practice note, that was a very, very clear one and a half pager as to how the press should take seriously section 55." 3.8 In reality, the ICO did not direct the press towards the practical steps it needed to take, not least in the maintenance of proper audit trails in relation to its handling of personal information (especially, as Mr Thomas had noted, in the event of an intention to rely on the public interest as a defence to s55). Rather, the process had become absorbed into managing the defensive stance of the press in response to the s55 campaign. A part of that response was the alleged discomfort of the press with applying legal public interest tests, notwithstanding the obvious centrality of judgments on the public interest to the routine standards and ethics issues with which the press is inevitably concerned on a day to day basis. Public interest judgements were also the daily bread and butter of the FOI regime which also fell within the ICO's regulatory remit and on which extensive and detailed guidance has been published. Rather than pursuing the idea that the PCC would guide the press on this matter operationally, along with the other possible lines of approach, it was eminently feasible for the ICO simply to grip the issue both efficiently and expeditiously. 3.9 Furthermore, the ICO was under a continuing legal obligation to promote good practice, including by considering the issue of guidance, either specific or general. It is not easy to understand why the ICO persisted for years in trying to force the hand of the PCC to issue guidance when it had statutory powers of its own to do so; moreover, these were statutory powers which it was under a legal obligation to keep under constant review. Having diagnosed a need for guidance, and in the absence of a satisfactory and timely response from the PCC, it could have propelled the process forward with a comprehensive draft of its own, if necessary in direct consultation with the industry. There is no evidence that it contemplated doing so. 3.10 As noted above, one of the issues of contention between the ICO and the PCC over the course of its dialogue was the demand of the PCC for access to the detail of the Motorman material before it would consider itself able to take direct action on any matter with the press (this was Sir Christopher Meyer's request for 'beef'). The DPA includes a number of provisions inhibiting disclosure by the ICO of confidential material it has acquired in the exercise of its functions;51 this is a very standard feature of regulatory regimes. Those provisions would have inhibited the public disclosure of the Motorman material, and were an operative reason for the presentation of the material in the What Price Privacy? reports in summarised form only. Those provisions might also have rightly restrained the ICO from detailed disclosure to the PCC. But they would not have restrained discussion by the ICO of the relevant parts of the Motorman material with the individual press organisations (data controllers) concerned for the purposes of furthering their compliance with the legal or good practice requirements of the regime. At the point at which Mr Thomas declined to share the detail of the Motorman material with the PCC, he effectively acknowledged that detailed and specific discussions could only ever have taken place directly between the ICO and the individual press organisations. 3.11 On his own account, Mr Thomas was emphatic about the lack of engagement directly by the ICO with the press. When giving evidence, he told the Inquiry that "I don't think I've ever had a conversation to this day with an editor"52 (although when prompted he recalled that he had, of course, spoken to editors, including Mr Dacre, in the context of his interactions with the H Editors' Code Committee). But again, it was only the ICO that could have conversations with individual press organisations about their continued retention of the Motorman material; there was nobody else.

1045

4. Engagement with victims 4.1 The Motorman material was evidence in the hands of the ICO that a very large number of people appeared to have been the victims of unlawful use of their personal information. Those individuals had rights and entitlements under the DPA, and in the civil law more generally, including rights in relation to confidence and privacy. The data protection regime, in common with very many other regulatory regimes, provides for two routes of law enforcement. These are the exercise of investigatory and enforcement powers by the regulator and the availability of rights of action by individuals for the enforcement of the law in their own cases.

1046

¶4.2 One of the defining features of contravention of information privacy law is that, characteristically, the victim may not be aware that it has happened or, if aware, may have no means to find out how it happened, who was responsible, or indeed to move beyond the realms of speculation.53 This feature was both obvious and commonplace when consideration was directed to the Motorman material, and was equally a very real concern which was underlined in the evidence of a number of Core Participants who complain about press intrusion.54 The ignorance of victims of the nature, or even existence, of the wrong done to them is, indeed, a principal reason for the existence of a regulatory authority with investigative legal powers. 4.3 The two approaches to law enforcement are not, of course, mutually exclusive. Christopher Graham expressed the connection by describing what he saw as a core element of the ICO's job: 'to arm the consumer, to educate and empower the consumer to exercise their information rights and to help them to assert them.'55 That role operates at both the general, educative level, and at the level of assisting individuals who have concerns, including for example by helping them to make subject access requests.56 Where the ICO comes upon evidence of unlawful activity of which the victim is not aware, it has some important operational choices to make. Matters to be taken into account will include the quality of the evidence, the nature and extent of the apparent breach, whether or not it is continuing, the practicalities of contacting victims, and so on. These were considerations which were brought to bear, for example, in the operation the ICO undertook in the wake of the loss by HMRC in late 2007 of discs containing large quantities of personal information relating to the recipients of child benefit. In part, at least, that was for the purposes of alerting the victims to the potential need to take security measures against the possibility of the information falling into the wrong hands and being used for fraudulent or other unlawful purposes in the future. 4.4 No such exercise appears to have been contemplated in the Motorman case, a matter which was directly raised in the Inquiry by potentially affected Core Participants. As noted above, Mr Owens' team did approach some 30 to 40 victims for the purposes of their criminal investigation, and obtained witness statements. But engaging victims on the footing of a criminal investigation is a specific and limited kind of exercise and there is no evidence that the ICO engaged even those victims it approached for any broader purpose. 4.5 Aside from the primacy given to the criminal investigation at the time, Mr Thomas suggested that there were two principal reasons for failing to engage with the victims. The first was H logistics, given the large number involved. The second was considerations of privacy, on the basis that alerting victims could raise questions about possible further invasions of their privacy, as might occur, for example, if third parties (including the victims' family members) came to be aware of information about them which the victim had been at pains to conceal.57 4.6 Neither of these explanations fully accounts for the failure to take any operational hold of the situation affecting the Motorman victims, although both concerns are certainly important and relevant. The former is a strategic challenge of a sort which the ICO has addressed on other occasions. The latter is a matter of process, and of a nature which the ICO was well- placed to address. Neither points to complete inaction; neither would be insuperable given case by case consideration.

1047

¶4.7 The consequences of the failure to alert the victims were much debated before the Inquiry. The ICO had placed considerable faith in the success of the political measures they took in response to Motorman to ensure that there was an effective stop to further victimisation for the future. It is, however, hard to avoid the conclusion that the position from the point of view of the victims was insufficiently taken into account, not merely operationally for the ICO, but also as a matter of respect for their rights and entitlements and so that they could properly consider their own law enforcement options, and take measures to deal with the risks of further victimisation to which they could be subjected. That conclusion was also part of Mr Owens' reflections:58

¶"We also had the unanswered outstanding question relating to the remaining thousands of people who had never been told they had been a victim of crime having had their car checked, their ex directory telephone number unlawfully obtained, their private lists of family and friends sold to the Press and so on…. I also felt very strongly that the thousands of victims identified in Operation Motorman also had a right to know they had been victims."

¶4.8 The extent to which the perspective of the victims was overlooked may be connected with the fact that the seriousness of the wrongdoing suggested by the Motorman material led the ICO in two directions (prosecution and the campaign on s55) which were both in the criminal domain. Exclusive focus on the criminal aspects of what had been discovered, without consideration of the wider regulatory context, carried a potential (if not an inevitable) risk that the victims would be left out of the picture. That risk is evident in both the operational and political reaction of the ICO to Motorman.

¶4.9 The obvious question arising from the failure to alert the victims has come to the fore in relation to all of the paths not taken by the ICO in response to Motorman: why, given the obvious operational magnitude and seriousness of this case, was action evidently given such a low priority? This is not a theoretical or historical question. The position of the victims was a contemporary issue for the Inquiry. While the prospects, in practical reality, of the ICO taking criminal or regulatory action in relation to Motorman may be regarded (absent further, fresher, evidence) as long since extinguished, individual victims expressed their concerns in terms of whether their involvement in Motorman might not have been part of a much wider context of their treatment at the hands of the press. There remained alive in their minds that question which Mr Owens said he had wanted to pursue: why did the press want their H information? And the follow-up questions also arose, including what did they do with it and where was it now? This was the subject of a further ruling.59

¶4.10 Of all of the questions which arose before the Inquiry about the operational steps which the ICO could have taken in response to the Motorman material, this question of alerting the victims has clearly remained the most acute, notwithstanding the intervening years. For individuals, the question of what information a business holds about them, and what that business is doing with that information, is one of the core entitlements afforded by the data protection regime. The affected Core Participants indeed felt sufficiently strongly about this issue that they pressed the Inquiry itself to undertake a disclosure exercise in relation to the Motorman material. For reasons set out in a further ruling the Inquiry concluded that that was not an appropriate focus of its own attention.60 But it clearly remains a live issue for at least some of the victims; and of course in referring to victims, only a very small proportion of those who were the subjects of material acquired by the press via Mr Whittamore, have had that fact confirmed to them to this day.

1048

¶4.11 In the circumstances, the Inquiry considered it appropriate to seek the views of the current Information Commissioner, Mr Graham, on the position of the Motorman victims from the perspective of the present day. The relevant Core Participants are also understood to have approached him with a general inquiry. In his oral evidence, Mr Graham responded in this way:61

¶"I had a letter last night, and no doubt this will be coming up later in the evidence, saying why have I not made contact with every individual whose name is mentioned in the Motorman file? And part of the answer to that is going to be I would have to take on a veritable army of extra people. I'm also going to say I don't think it's necessary, but this isn't practical. All regulators have to pick their battles, prioritise their resources, and I just need some evidence of there being a problem before I divert resources to do it."

¶4.12 Mr Graham was not here necessarily disputing that there was evidence of a problem at the time of the discovery of the Motorman material, but was questioning whether there was still a problem today. That line in his thinking, and the question of the prioritisation of operational resources, are considered more fully below. But Mr Graham also suggested that there were two further practical problems.

¶4.13 In the first place, he reiterated Mr Thomas's anxiety about occasioning further invasions of privacy:62

¶"I think Richard Thomas put the point very well in his response to you on this matter, when he said: if, having established the identity of the individual and their address, we wrote to them to say simply, "Your details appear in the Motorman file, we can't tell you why", that might be an even greater breach of privacy than the original offence, because there would be a suggestion that there's no smoke without fire. Other members of the family might see the letter and say, "Hey, what's going on?" and I H couldn't tell them any more than a name appears in a file." The Inquiry is not persuaded that what is a perfectly fair concern about further invasions of privacy provides a reason for declining to contemplate alerting victims, nor that the risk of alerting third parties is one which could not, and cannot, reasonably be managed both through the means of communication and through the content.

¶4.14 Mr Graham advanced a second practical problem:63

¶"The difficulty about simply contacting everybody lies in the nature of the dossiers themselves. Mr Jay, you've seen them. I don't know whether all the core participants are in that position, but these are notebooks, and sometimes the information contained in them is deeply obscure. I said in my witness statement that the individual who made the notes must have had a perfect understanding of what he was intending, but it isn't always clear. That partly explains why there's sometimes a discrepancy between the spreadsheets that we've compiled and the notebooks. If you said to me, "You ought to notify everybody whose name appears in the Motorman files", I'd be hard pressed to do that. It isn't just a question of resources, it's it isn't immediately clear who is being referred to, because it isn't just celebrities, it's all sorts of people who may or may not be part of a story concerning a celebrity or whatever it is; it's just a name. Sometimes it's just a surname….It would be a phenomenal undertaking. Just because there's a name, John Smith, I would then have to work out which John Smith. The example I gave to the Select Committee was Ziggy Stardust, that's a bit easier to do, but there are an awful lot of very anonymous names and it simply isn't practical." That may be a convincing explanation for the impossibility of contacting everyone involved in the Motorman material. It is not a convincing explanation for not contacting anyone.

1049

¶4.15 There can be no doubt that a serious piece of work would be required for the ICO to undertake a wholesale review of the Motorman victims, and legitimate questions do arise about resources and priority. Mr Graham had his own suggestion about the way ahead:64

¶"So far as the individuals are concerned, I'm still very ready for subject access requests by those who may be concerned….if Hacked Off and their lawyers are representing particular individuals, then that's what we're here for; subject access requests, off we go." Subject access requests allow individuals to exercise their entitlement under the data protection regime to know from any business whether it holds information about them and, if so, what. They are not a straightforward answer to the problem. Unless individuals are already aware that a given title holds their information, the right could be exercised only by a speculative correspondence across a range of newspapers and periodicals, at some inconvenience and expense to both the person requesting and the subject of the request. This therefore appears to be a paradigm case in which a statutory regulator could be expected actively to consider providing assistance.

¶4.16 There is, no doubt, a range of practical solutions to this issue which both the ICO and the industry could have offered to the Motorman victims at any point up to and including the present. One possible way forward would be for concerned individuals to be able to apply to H the ICO seeking to obtain confirmation (in so far as the ICO is able to offer it) as to whether they can be identified among the Motorman victims and, if so, information as to the title or titles concerned and assistance, if necessary, in making a suitable request to those titles.

¶4.17 If interest in exercising that right reached proportions beyond the capability of the ICO, then perhaps the press organisations could be directed or encouraged each to undertake its own victim contact exercise under the ICO's supervision.65 So far as the ICO is concerned, at any rate, this suggests a course of action within its easily accessible knowledge and, subject to reasonable prioritisation, within its capability. This could have discharged its general functions to satisfactory effect. There is no evidence that it was willing to turn its mind to any such possibility, either at the time or since.

1050

5. Conclusions and the questions raised by Operation Motorman 5.1 Operation Motorman was prima facie evidence of systemic and serious malpractice by the press in relation to the acquisition and use of personal information. It was also one of the biggest cases of deliberate and systemic data abuse of any sort to come to the attention of the ICO. In the view of the ICO itself the journalistic practices it disclosed on the face of it:

¶(a) were widespread and systemic; (b) were probably criminal; (c) suggested extensive and continuing breaches of the data protection principles; (d) suggested large-scale and continuing breach of individual rights; (e) at the least raised serious questions about standards and proper practices by the press; (f) were unlikely to be an isolated example; and (g) had implications for the integrity of personal information, a number of public and private databases, and the data protection regime as a whole. Additionally, it was apparent to the ICO that the industry was not (at any rate at the time) denying that there was a problem.66

¶5.2 This called for a commensurate response from the ICO which dealt with all aspects of the problem and included challenging the practices and safeguarding both the information and the position of the victims involved. It also presented a clear opportunity for a regulatory body to demonstrate publicly the importance and effectiveness of the data protection regime in safeguarding the public interest in information privacy. The ICO was the best-placed organisation to grasp the implications of the Motorman material as a whole and to take a decisive lead, working with other public authorities including the police and with the industry itself, to ensure that a comprehensive and effective response was made to the evidence that it disclosed of problems in the culture, practices and ethics of the press.

¶5.3 From an operational point of view, the ICO's response to the Motorman material was not H commensurate with the scale of the problem disclosed. The Information Commissioner ultimately considered that the problem was big enough for it to trouble Parliament and Government at the highest levels, including the Prime Minister. The contrast with the insufficiency of its operational response is all the more obvious. The ICO is principally an operational regulator, endowed with legal powers and functions to be exercised in the public interest. Its principal role is not to act as a political campaigning body but to discharge its regulatory functions at a practical level.

¶5.4 In particular, from an operational perspective, it appears that:

¶(a) there was an insufficiently strategic grasp of the operational issues and options facing the organisation as a result of the material for fully informed decisions to be taken, or for the results to be followed through; (b) the senior management of the ICO in practice gave insufficient priority to the operational dimension of the Motorman material;

1051

¶(c) the course of conduct of the criminal investigations was unsatisfactorily managed, with the result that opportunities were missed to address potential criminality in the culture, practices and ethics of the press; (d) insufficient consideration was given to alternative operational strategies, both formal and informal, for addressing the matter; (e) in particular, the failure to give serious contemplation to engaging directly with either the data controllers in the press or the data subject victims is difficult to reconcile with the general duties of the ICO or with a recognisably considered approach to weighing up its operational priorities.

¶5.5 It also appears that there was insufficient connection between the operational work of the ICO on the Motorman case and the strategic or political choices made by the Information Commissioner to respond to the issue at a higher level, that is to say, by engaging in dialogue with the PCC and campaigning on s55. As a result, those choices were insufficiently well- informed and effective, and not appropriately targeted at the issues about the culture, practices and ethics of the press disclosed by the Motorman material.

¶5.6 In particular, while it was not unreasonable to think it worth exploring the contribution the PCC could make to addressing the problem presented by the Motorman material, the strategy lacked from the outset:

¶(a) clearly-defined objectives and outcomes; putting a stop to the practice, condemnation and Code changes were propositions at too high a level of generality to be capable of generating a timetable or plan of action measurable in terms of identifiable changes in the culture, practices and ethics of the press; (b) a clear, informed and realistic apprehension of the nature, role and functions of the PCC and the contribution it might be expected to make (which is a point that Mr Thomas accepted); it was not satisfactory for the ICO to seek to discharge its own functions to any extent through an organisation such as the PCC without being very clear about its ability to take on and deliver that charge satisfactorily, and there is insufficient evidence that this was properly researched; (c) a detailed plan for how the ICO's own functions would have to be brought to bear to H ensure that the two organisations' contributions would work together to produce the desired regulatory outcome; (d) a thought-through analysis of how the strategy of trying to engage the PCC on the one hand, and the political campaign on s55 on the other were likely to interact, particularly given the personalities involved, and plans for dealing with the potential (which might be thought obvious) for the objectives of each to conflict.

¶5.7 These problems were compounded by persistence in the dialogue with the PCC in a way which failed to be sufficiently focused and realistic, proportionate to its likely effect and effectiveness, failed to keep in view the ICO's own role and responsibilities. In particular, as it became apparent that the response of the PCC was falling short of what ICO hoped, opportunities were missed to reappraise the strategy which could have been replaced or supplemented by the direct exercise of its own powers and functions, including by way of issuing good practice guidance or otherwise engaging directly with the industry.

1052

¶5.8 Both Mr Thomas and, latterly, Mr Graham are to be commended for the extent to which they have robustly sought, in the face of sustained hostility and lobbying from the press, to make the case publicly for better standards and to encourage rational consideration of the merits of the argument for increasing the sentencing maxima for s55 offences. To the extent that the s55 campaign can be regarded as a response to the Motorman case (and I recognise that it had other motivations also), it is arguable that it was problematic in:

¶(a) the extent to which it drew the ICO into the contested political arena and away from its primary regulatory obligations under the DPA; (b) the extent to which it focused exclusively on the criminal law as a potential solution, and its lack of practical engagement with the limitations on the effectiveness of such solutions; and (c) not identifying the context, either within the wider role and functions of the ICO or in any plan for realising any benefits that it might have been capable of yielding.

¶5.9 In the light of the analysis of the response to the Motorman material, it is appropriate to conclude that ICO did not effectively grasp the full implications, and indeed opportunities, of the case. As a result:

¶(a) previous misconduct was inadequately brought to justice and was not otherwise addressed as a matter of law enforcement; (b) the risk of continuing breaches of law and standards was not effectively addressed; (c) the interests of the victims were inadequately protected; and (d) an important opportunity was missed to address problems in the culture, practices and ethics of the press in relation to the acquisition and use of personal information, which could have had an impact beyond the facts of the Motorman case.

¶In the circumstances, a real question must remain as to whether these missed opportunities contributed, either at a general or a specific level, to later manifestations of disregard for the rights of others in relation to information privacy which were subsequently exhibited by certain parts of the press, of which phone hacking was the most serious. H 5.10 I should make very clear that there is no evidence to suggest, as Mr Owens invited the Inquiry to do, that the political campaign and the publication of the What Price Privacy? reports were a deliberate attempt to deflect attention from the ICO's operational inactivity. To the extent that they drew public and political attention to the problem, they did themselves perform a function of acting as a warning to others in positions of authority to take action. To that extent, Mr Graham's description of the role of the ICO in the Motorman story ("we are the good guys") may fairly be endorsed.

¶5.11 The principal outstanding questions, therefore, to which the remainder of this Part of the Report is addressed, are these:

¶(a) Is there any reason to think that there are still causes for concern about the culture, practices and ethics of the press in relation to personal information, whether as a matter of law or as a matter of good practice? (b) To what extent do issues persist about the perception of the ICO that its role and powers are inadequate or inappropriate to address evidence of any such problems?

1053

¶(c) To what extent, on an objective analysis, are there genuine shortcomings in the legal framework, and are there any changes which could be made to improve the situation? (d) Are there any other impediments to the ICO making a more effective contribution to supporting law enforcement and good practice in relation to the press which it is necessary or desirable to remove?

1054

¶Chapter 4 The ICO and the Press today 1.1 The current Information Commissioner, Christopher Graham, took over from Mr Thomas in the summer of 2009. In the context of this Inquiry, it is of interest that his previous career was in journalism, broadcasting and regulation (he was a former Director General of the Advertising Standards Authority), rather than in law.

¶1.2 He told the Inquiry that the culture, practices and ethics of the press were not drawn to his attention on handover as an issue of top priority. He was, however, aware that commencement of the legislative changes to s55 was outstanding and he made a connection between legislative change and press conduct saying that there was:1

¶"a sword of Damocles hanging over the press. If there was any repetition of the behaviour that Operation Motorman had uncovered that would be accessed pretty quickly."

¶1.3 In the event, he had what he described as a 'wake up call' a few weeks after taking up his appointment when the story by Nick Davies about phone hacking was published in the Guardian. His principal focus thereafter was not, however, operational but political: he had to prepare for his appearance on 2 September 2009 before the Culture Media and Sport Select Committee2 which was then taking evidence specifically as a result of the emergence of the Goodman/Mulcaire case and the coverage in the Guardian, but linking it also with the history of Operation Motorman. This was therefore an opportunity for Mr Graham to take stock of the history of Motorman, the role of the ICO, and the signs from the emerging hacking scandal that the story of press abuse of personal information was taking a new direction.

¶1.4 His evidence to the Select Committee was that:

¶(a) phone hacking was a matter for the police and the ICO had 'no involvement whatsoever'; H (b) any operational steps the ICO could have taken in relation to Motorman (including criminal investigations into journalists) would have been too difficult practically and legally and were not a priority call on resources at the time; (c) the priority of the ICO in relation to Motorman was to 'sound the alarm, to warn the industry, to talk to the PCC, to urge the provision of a custodial penalty' and the latter remained the priority; (d) there was little more that could now be done in relation to the Motorman material without more, not least because it was old and not straightforward to interpret; and (e) he had no intention at this point of proactively reviewing the Motorman evidence, because it would serve little purpose and the ICO had many other priorities.

¶1.5 The question of priorities was a matter of some concern to the Committee at the time. Mr Graham was pressed particularly hard on the position of the victims, some of whom were

¶1 p4, line 19-22, Christopher Graham, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Transcript-of- Morning-Hearing-26-January-2012.pdf http://www.publications.parliament.uk/pa/cm200910/cmselect/cmcumeds/362/9090205.htm expressing anger at not having been notified by the ICO of their appearance in the Motorman material. Mr Graham indicated that he would treat approaches from individuals inquiring about their possible appearance in the Motorman material on a case by case basis. He was also pressed on whether the ICO had worked with the organisations, both public and private sector, whose information had been wrongly disclosed in the Motorman case; a certain amount of work had been done but various factors had limited the extent of the engagement. These included the increasing general insecurity of information of all sorts, the flourishing illegal trade in information procurement, and the risk that any investigation would itself present a risk of the further dissemination of the personal information in question

1055

¶1.6 It is not necessary to consider Mr Graham's evidence to the Select Committee in detail, because the same ground was explored in the course of his evidence to the Inquiry. His general update to the Committee on the work of the ICO work with the press at that time is, however, interesting. He said:3

¶"We started off by a general call to the industry which, indeed, was heeded to some extent in that the Editors' Code Committee eventually amended clause 10 of the Code, made it much tougher, and we have done a lot of work with the PCC in training editors. We have done a couple of seminars, one in London and one in Scotland, to make sure that journalists understand that this is serious. I saw a copy of the Editors' Code Handbook the other day and it makes it very clear that you mix with the Data Protection Act at your peril and you had better have a very solid public interest story very well documented, in order to do that. Chairman, the interesting question is why did not any of those titles that were listed in What Price Privacy Now? contact the Information Commissioner's Office and say, "This is terrible,⁴⁵⁴⁵ p11, Professor Baroness O'Neill, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Witness- Statement-of-Professor-Baroness-ONeil.pdf HC Hansard 27 January 1981, Volume 997, Column 806 onwards, ibid ibid p24, para 61, ibid O'Malley, T and C Soley, Op Cit, p82 Shannon, R. (2001) Op. Cit., p38 p5, paras 1.10-1.11, ibid pp74-75 lines 15-2, Lord Macdonald, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Morning-Hearing-4-April-2012.pdf http://www.newsint.co.uk/compensationscheme/index.html p58, line 21, William Lewis, ibid Part F, Chapter 6 p70, lines 15-21, Paul McMullan, ibid Exhibit PWH3 to the witness statement of Peter Hill (which included circulation figures for the Daily Express between pp52-53, lines 25-16, Garry Flitcroft, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Transcript- of-Morning-Hearing-22-November-20111.pdf; pp3-4, para 20-22, http://www.levesoninquiry.org.uk/wp-content/ uploads/2011/11/Witness-Statement-of-Garry-Flitcroft.pdf pp32-33, lines 15-14, Paul Silva, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Transcript-of- Morning-Hearing-11-January-2012.pdf; p73, lines 9-20, Peter Wright, http://www.levesoninquiry.org.uk/wp-content/ uploads/2012/01/Transcript-of-Morning-Hearing-11-January-2012.pdf; p9, para 38, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-John-Twomey. pdf p15, para 43, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Lord-Stevens. pdf p43, lines 19-23, Francis Aldhouse, ibid p72, lines 2-11, Richard Thomas, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Transcript-of- Afternoon-Hearing-9-December-2011.pdf Part I, Chapter 5 p93, lines 1-3, Philip Webster, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Transcript-of- Morning-Hearing-25-June-20121.pdf p4, line 18, Tony Blair, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Transcript-of-Morning- Hearing-28-May-2012.pdf; he later referred to the "few people" of the press having "substantial power", p56, line 24, ibid p62, lines 15-22, George Osborne, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Transcript-of- Afternoon-Hearing-11-June-2012.pdf pp9-10, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of-Morning- Hearing-25-April-2012.pdf p3, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Exhibit-KRM-18.pdf pp69-70, lines 11-23, George Osborne, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Transcript- of-Afternoon-Hearing-11-June-2012.pdf pp61-62, lines 22-21, Sir John Major, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Transcript-of- Morning-Hearing-12-June-2012.pdf p7, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Coordinating-Committee-for- Media-Reform.pdf pp12-13, paras 3.2-3.3, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Closing-submussion-from- MPS.pdf Para 134, http://www.publications.parliament.uk/pa/jt201012/jtselect/jtprivinj/273/273.pdf p47, line 17, p48, line 14, Lord Grade, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Transcript- of-Afternoon-Hearing-31-January-2012.pdf p34, para 63, ibid p106, lines 11-15, Lord Black, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of- Morning-Hearing-9-July-2012.pdf pp4-6, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Submission-by-The-Campaign-for-Press- and-Broadcasting-Freedom.pdf p79, lines 15-21, ibid. p80, lines 3-13, ibid p21, para 28, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Lord-Black-of- Brentwood1.pdf Part K, Chapter 7, para 4.35 Douglas v Hello! Ltd [2001] QB 967 at para 150, per Keene LJ in the CA, approved in A v B (a company) [2002] EWCA Civ 337 at para 11(iii), per Lord Woolf LCJShow full note of our journalists apparently have been doing this thing which we utterly condemn, tell us who they are", and we then might have been able to talk turkey. Interestingly, of 305 journalists, and we listed the total in the document, we have not had a single inquiry from a journalist saying, "Am I on that list? Was I doing something wrong?"

¶1.7 The Inquiry has also had to consider the question of the lack of press interest in pursuing the Motorman evidence but it is also important to look at the position from the perspective of the ICO. Its own stocktake, at the end of 2009, was that it was aware that Mr Thomas' political campaign had at best been only partially successful, and had also established a hostile response from the press. It knew that neither the ICO itself, nor evidently the press, H had followed up the Motorman evidence operationally, either in relation to the particulars of the state and use of the information itself, the conduct of individual journalists, or its own practices. Finally, it was on notice of the emergence of the phone hacking scandal.

¶1.8 Notwithstanding this assessment, the ICO had concluded that there was no imperative for it to engage further with the culture, practices and ethics of the press. In particular, Mr Graham expressed the view to the Select Committee in relation to the PCC that "We do not have any formal relationship with them, but I just accept that they do press standards and we do data protection and, where those two things cross over, then we probably need to talk."

¶1.9 The two things clearly do cross over. In concluding this Part of the Report, assessing the current state of the role and functions of the ICO, and making recommendations for the future, the focus returns to the key themes of the Motorman case, but viewed now from the contemporary perspective. Those themes are:³³ Visits 9 Chapter 2: the approach 10 Challenging the evidence 31 The nature and standard of proof 43 Chapter 4: the Report 49 Timing and content 50 PARt B: the PRess And the PuBlIC InteRest 53 Chapter 1: Introduction 55 Chapter 2: the freedom of the press and democracy 56 The importance of a free press: free communication 61 Personal autonomy and civil liberties 73 Prime Minister Blair: 1997-2007 1143 Prime Minister Cameron: 2010-present 1209 Human Rights Act 1998 1262 In particular, in relation to the knowledge and understanding (a) in 2002 of Surrey Police as to the interception of the mobile phone of Milly Dowler and (b) in 2008 of Cleveland Police in relation to e mail hacking of John Darwin who had faked his own death in a canoe 'The Freedom of the Press'-proposed preface to 'Animal Farm', publication of which was delayed until the end of the war to avoid causing offence to the Soviet Union pp361-363, ibid p3, ibid ibid http://www.newscorp.com/investor.html http://stakeholders.ofcom.org.uk/binaries/research/cmr/cmr11/UK_Doc_Section_1.pdf Communications Act 2003 s375 (1)(2C)(a) http://www.legislation.gov.uk/ukpga/2003/21/section/375 ibid, p4 p16, lines 12-18, Alexander Owens, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Transcript-of- Afternoon-Hearing-30-November-2011.pdf p42, para 83, ibid pp2-3, para 5, ibid para 46, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Application-of-Rule-13-of-the-Inquiry- Rules-2006.pdf Transcript of the proceedings before Gross J on 26 January 2007, p70E This submission has not been published on the Inquiry website, but was shared with the Core Participants to the Inquiry pp4-5, lines 17-12, Charlotte Church, ibid p34, lines 16-25, James Hipwell, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Transcript-of- Morning-Hearing-21-December-20111.pdf p4, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Commissioner-Bernard- Hogan-Howe1.pdf pp12-13, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Jeff-Edwards.pdf p15, para 3.1.3, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Report-by-Elizabeth-Filkin.pdf pp4-5, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Witness-Statement-of-Alexander-Owens1. pdf pp32-33, lines 4-22, Alexander Owens, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Transcript- of-Morning-Hearing-5-December-2011.pdf p26, para 6.10, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Witness-Statement-of-Christopher- Graham.pdf http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Fourth-Witness-Statement-of-Richard-Thomas-CBE. pdf; http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Sixth-Witness-Statement-of-Richard-Thomas.pdf Part H, Chapter 5, para 2.62 p6, lines 15-16, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Morning-Hearing-25-April-2012.pdf p22, lines 7-14, Jack Straw, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Transcript-of-Morning- Hearing-16-May-2012.pdf p4, lines 6-12, David Cameron, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Transcript-of- Morning-Hearing-14-June-2012.pdf p6, ibid http://www.publications.parliament.uk/pa/cm201011/cmhansrd/cm110713/debtext/110713-0003. htm#11071379000002 p9, lines 20-25, ibid pp1-2, para 4, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/10/Submission-from-Professor-Steven- Barnett-on-plurality.pdf p9, line 8, Ian Hislop, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Transcript-of-Morning- Hearing-18-January-2012.pdf p4, para 18, and p18, para 85, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Witness-Statement- of-Nick-Clegg-MP2.pdf; pp10-11, lines 15-24, Nick Clegg MP, http://www.levesoninquiry.org.uk/wp-content/ uploads/2012/06/Transcript-of-Morning-Hearing-13-June-2012.pdf p14, para 42, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Lord-Hunt-of-Wirral. pdf p36, lines 9-20, Lord Black, ibid p3, para 7, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Lord-Black-of-Brentwood1.pdf p15, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Submission-by-Campaign-for-Press-and- Broadcasting-Freedom1.pdf p51, lines 11-15, Professor John Horgan, ibid K Part F, Chapter 6 Part K, Chapter 7, para 4.28 K Part K, Chapter 7, para 4.8 In McCartan Turkington Breen v Times Newspapers Ltd [2001] 1 AC 277, Lord Steyn noted that even before the coming into force of the HRA 1988, "the principle of freedom of expression [had] attained the status of a constitutional right with high attendant normative force", with reference made to Reynolds v Times Newspapers Ltd [2001] 2 AC 127 at 207G-HShow full note Q1807, Christopher Graham, http://www.publications.parliament.uk/pa/cm200910/cmselect/ cmcumeds/362/9090206.htm

1056

¶(a) the extent to which there are problematic issues today which fall within the purview of the Information Commissioner and concern the culture, practices and ethics of the press in relation to personal information; (b) the powers available to the ICO to tackle any such problematic issues, and whether they are sufficient to the task; and (c) the governance, capability and priorities of the ICO and whether they too are sufficient and appropriate to the task.

2. Personal information privacy and press practices 2.1 Mr Graham's evidence to the Inquiry was that he did not believe that the press was significantly involved in breaches of the Data Protection Act since the publication of the What Price Privacy? reports, and that therefore, by implication, they had learned the lessons of those reports. This evidence is at the heart of the Inquiry's terms of reference, and, given the way in which the phone hacking scandal developed, is not entirely obvious. It thus requires close analysis.

¶2.2 Mr Graham put the matter in this way:4

¶"I can only speak of what's in my own knowledge, and I can only speak of those aspects of press conduct that fall within the responsibilities of my office, and that's primarily Section 55. I know that the Inquiry was triggered by concerns about hacking of phones and hacking of emails, these are criminal offences that don't come under the Information Commissioner's office, but Section 55 certainly does. I can't prove a negative. All I can say is I've seen no further evidence beyond what we published in

¶2006, and that of course was about behaviour before when Mr Whittamore's office was raided, and much of it related to activity between 1999 and 2003. I simply offer a view that this is an issue of such high salience, many investigative journalists working in the area, great rivalry between newspaper groups, lots of campaigners, that if there was evidence of further breaches of Section 55 by the press, it would have been drawn to my attention, and it hasn't been."

¶2.3 The latter point was one on which he expanded:5 H

¶"…there's been so much feverish activity over the past two years in relation to this with the various newspaper groups, with the journalists, with the books written on the subject, with the campaigning groups. If the best that critics can do is to turn up further evidence of what was going on between 1999 and 2003, it doesn't amount to much."

¶2.4 The questions raised by this evidence were many, and included: (a) why s55 (the criminal offence of unlawfully obtaining information) was being used as the benchmark for contravention of the regime rather than the wider scheme of principles and rights created by the regime; (b) why Mr Graham would have expected investigative journalists or other campaigners to have been likely to excavate issues about the press and personal information which the ICO, charged with legal responsibilities in that respect, was not itself minded to pursue;⁴⁴ Other material 35 The importance of a free press: public debate and holding power to account 63 Other public goods 75 i Prime Minister Brown: 2007-2010 1150 Reflections 1231 Chapter 5: Media policy: examples from recent history 1233 Data Protection Act 1998 1270 http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Application-of-Rule-13-of-the-Inquiry-Rules-in- relation-to-the-MPS-4-May-2012.pdf Great Britain, Royal Commission of the Press, 1947-1949: Report, p3 para 3, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Key-Questions-Module-4.pdf p6, ibid Claire Enders, Competitive Pressures on the Press, Seminar 6 October 2011, http://www.levesoninquiry.org.uk/wp- content/uploads/2012/07/Claire-Enders-Competitive-pressures-on-the-press.pdf ibid http://www.freeview.co.uk/ p11, para 3.8, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Ofcom-Measuring- Media-Plurality1.pdf Great Britain, Royal Commission on the Press 1947-1949: Report, p3 p86, lines 1-9, Lord Justice Leveson, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Transcript-of- Morning-Hearing-9-May-2012.pdf p3, para 3.3, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Witness-Statement-of-Alexander- Owens1.pdf p43, para 84, ibid p9, para 32, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Third-Witness-Statement-of-DAC-Sue- Akers.pdf http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Application-of-Rule-13-of-the-Inquiry-Rules-2006. pdf p66, lines 4-11, James Dingemans QC, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of- Afternoon-Hearing-23-July-2012.pdf para. 1.38-1.39, in Part A for an explanation of the term pp1-2, para 5, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Witness-Statement-of-Sally-Bob- Dowler.pdf p7, para 23, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Witness-Statement-of-Charlotte- Church.pdf pp9-10, paras 43-44, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Witness-Statement-of-Piers- Morgan.pdf pp14-15, lines 19-20, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Robert-Jay-opening- submission-for-Module-23.pdf p4, para 10, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Lord-Condon. pdf pp109-110, lines 19-2, Elizabeth Filkin, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Transcript- of-Morning-Hearing-5-March-2012.pdf p47, lines 18-21, Lord Condon, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Transcript-of- Morning-Hearing-6-March-20122.pdf p32, lines 1-25, Alexander Owens, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/Transcript-of- Morning-Hearing-5-December-2011.pdf p34, lines 16-24, Alexander Owens,ibid p14, para 3.21, ibid pp57-60, lines 23-25, Alexander Owens, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Transcript- of-Afternoon-Hearing-30-November-2011.pdf; http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Third- ws-of-Alexander-Owens.pdf Part H, Chapter 5, para 2.46 p15, lines 5-13, Rupert Murdoch, ibid The Sun, 9 April 1992; see p2, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by- Professor-Steven-Barnett-University-of-Westminster.pdf See paragraphs 3.18-19 and 3.38 below James Evans' memorandum to The Secretary of State for Trade, 23 January 1981, pp4-5, ibid p8, paras 3.17-3.18, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Witness-Statement-of-James- Rupert-Jacob-Murdoch.pdf p2, line 22, ibid p2, para 5 ibid pp55-56, lines 7-14, Michael Gove, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Transcript-of- Afternoon-Hearing-29-May-2012.pdf pp17-18, Ed Miliband, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Exhibit-EM-22.pdf p1, lines 15-17, Lord Hunt, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of-Morning- Hearing-10-July-2012.pdf K pp66-67, lines 13-2, David Cameron, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Transcript-of- Afternoon-Hearing-14-June-2012.pdf pp2-3, para 5, ibid p11, para 3, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Coordinating- Committee-for-Media-Reform.pdf pp51-52, lines 24-4, Professor John Horgan, ibid Part J, Chapter 4 Part K, Chapter 4, para 5.41 Part K, Chapter 7, para 4.10 Article 11 of the EU Charter of Fundamental Rights of the European Union. See also C-353/89 EC Commission v Netherlands [1991] ECR I-40689 at para 30Show full note pp6-7, lines 10-3, Christopher Graham, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Transcript- of-Morning-Hearing-26-January-2012.pdf 5 p27, lines 6-12, Christopher Graham, ibid

1057

¶(c) why the ICO did not appear to consider that the phone hacking scandal itself and the wider issues of the culture, practices and ethics of the press before the Inquiry were a cause of acute concern within its own sphere; (d) why the ICO was able to conclude that the Motorman evidence was of no continuing interest or relevance in relation to the data protection regime; and (e) if the ICO was unaware of any problems in relation to the press, to what extent that was a reasonable conclusion based on due diligence.

¶2.5 The due diligence point had particularly exercised Tom Watson MP in putting the following questions to Mr Graham (and his ICO colleague Mr Clancy) on behalf of the Select Committee:6

¶"Q. What I am trying to do is ascertain responsibility in the system for getting this right. … Are you convinced that these practices have now ended in newsrooms up and down the country?" A: "I am not in a position to know." Q. "What I am trying to understand is that the decision you took, which, by the way, I think was the right decision, to blow this open, bring it into the public domain and try and effect massive change in the way journalists run about their work, I can understand why in a resource-sensitive area that is what you did, but what I cannot understand is why you have not gone back to see whether that has been successful or not or what gauge of success there is." A: "How can we measure it? Do we go to editors and say, 'Have you come across any examples of journalists that have stepped over the line?'" Q. "Is there anyone in this country who would know whether these practices are still going on other than editors and journalists in the newsrooms?" A: "Well, editors and journalists must know; it is a self-regulatory system." Q. "So, when they tell us that they think that they have thoroughly investigated the matter and they have put it right, do you think they could possibly have done that if they do not know the list of journalists that you have got on your files?" A: "I think there might be information which would identify some of those journalists because some of the invoices quite clearly indicate that there have been blags in relation to particular stories and invoice numbers. Surely, their records should be able to cross-reference that to a particular journalist, and sometimes the invoices cross-reference the stories, so editors could examine their business and perhaps identify which journalists were or were not." H " Q: " I think you could perhaps be a little proactive just to ensure that they have certainly done that or that they certainly have the information about the people who were at it?" A: "I understand what the Committee is saying, but you are not dealing with a regulator who is not proactive; we are proactive on a very wide front. … There are lots of ways we could spend our time."

¶2.6 The due diligence point itself resolved itself into a number of sub-issues relating to the question of specific follow-up to Motorman; the strategic follow-up to Mr Thomas's political campaign, the response to the phone hacking scandal, and the position of the ICO in relation to the press today. These will be discussed in turn.⁶⁶ Engagement with the public: the website 37 Chapter 3: Further issues of law 38 The protection of sources and other legal privileges of the press 68 Chapter 3: Competing public interests 69 http://www.levesoninquiry.org.uk/people/assessors/lord-david-currie/ This obligation of confidence is owed by the Inquiry team to any recipient of the letter and by that recipient to me, as Chairman of the Inquiry: see para. 14(1) of the Inquiry Rules 2006 Great Britain, Royal Commission on the Press: 1961-1962: Report (Cmnd 1811) p1, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Witness-Statement-of-Dr-Rowan-Cruft.pdf p32, lines 16-21, Professor John Tasioulas, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/ Transcript-of-Morning-Hearing-16-July-2012.pdf Claire Enders, Competitive Pressures on the Press, Seminar 6 October 2011, http://www.levesoninquiry.org.uk/wp- content/uploads/2012/07/Claire-Enders-Competitive-pressures-on-the-press.pdf ibid http://downloads.bbc.co.uk/bbctrust/assets/files/pdf/about/how_we_govern/charter.pdf p3, lines 4-10, Robin Foster http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of- Afternoon-Hearing-17-July-2012.pdf Political and Economic Planning, Report on the British Press http://www.pcc.org.uk/index.html p9, para 8, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Witness-Statement-of-T-ACC-Russell- Middleton.pdf Information Commissioner's Office, What Price Privacy?, p15, para 5.1 p33, para 89, ibid p2, para 6, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Fourth-Witness-Statement-of-DAC-Sue- Akers.pdf http://www.levesoninquiry.org.uk/hearing/2011-11-14am/ http://www.levesoninquiry.org.uk/hearing/2011-11- p53, lines 23-24, Michael Gove, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Transcript-of- Afternoon-Hearing-29-May-2012.pdf p28, lines 22-25, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Morning-Hearing-25-April-2012.pdf p3, para 10, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Witness-Statement-of-Sally-Bob- Dowler.pdf pp14-17, lines 17-3, Charlotte Church http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Transcript-of- Afternoon-Hearing-28-November-20111.pdf p5, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Witness-Statement-of-Michelle-Stanistreet.pdf http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Report-by-Elizabeth-Filkin.pdf pp4-5, paras 11-13, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Lord- Condon.pdf p35, lines 10-12, Brian Paddick, ibid pp25-26, lines 12-11, Neil Wallis, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Afternoon-Hearing-2-April-2012.pdf p75, line 13, Richard Thomas, ibid, emphasis added. Mr Thomas suggested, however, that s55 of the DPA which founded the prosecution powers was most likely to be the most relevant provision of the regime to the terms of reference: p3, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/12/First-Witness-Statement-of-Richard- Thomas-CBE.pdf pp41-42, lines 25-3, Francis Aldhouse, ibid pp11-12, paras 4.18-4.19, Alexander Owens, ibid pp6-16, para 3.3-3.26, ibid p2, para 7, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Second-Witness-Statement-of-John- Witherow.pdf Part H, Chapter 5, para 2.64 p36, lines 4-24, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Morning-Hearing-25-April-2012.pdf p53, lines 18-19, Rupert Murdoch, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Transcript-of- Morning-Hearing-25-April-2012.pdf pp4-5, lines 16-2, David Cameron, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Transcript-of- Morning-Hearing-14-June-2012.pdf pp7-8, ibid pp58-59, Lord Justice Leveson, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Transcript-of- Morning-Hearing-10-May-2012.pdf; p5, lines 5-11, Lord Justice Leveson, http://www.levesoninquiry.org.uk/wp- content/uploads/2012/05/Transcript-of-Afternoon-Hearing-15-May-2012.pdf pp87-88, lines 6-2, ibid p52, lines 14-21, ibid pp3-4, lines 19-3, Robin Foster, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of- Afternoon-Hearing-17-July-2012.pdf Home Office Large Major Enquiry System p46, lines 20-21, Lionel Barber, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Transcript-of- J Morning-Hearing-10-January-2012.pdf pp8-9, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Professor-Roy-Greenslade-of- City-University.pdf p14, lines 13-14, Lord Black, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Transcript-of-Morning- Hearing-1-February-2012.pdf p10, lines 10-22, Lord Black, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of-Morning- K Hearing-9-July-2012.pdf p3, para 6, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Submission-by-Media-Regulation- Round-Table.pdf p53, lines 9-22, Professor John Horgan, ibid Part K, Chapter 2 Part K, Chapter 3, para 5.14 Part K, Chapter 7, para 4.16 See for example: Application 22954/93, Ahmed v United Kingdom (1998) 29 EHRR1 at para 70, and Application 11800/85, Ezelin v France (1991) 14 EHRR 362 at paras 37 and 51Show full note Q1844-Q1851, Christopher Graham, http://www.publications.parliament.uk/pa/cm200910/cmselect/ cmcumeds/362/9090208.htm

1058

3. Following up Operation Motorman 3.1 As is frequently repeated, Operation Motorman was the single biggest case of deliberate and systemic interference with personal information with which the ICO had had to deal since its inception. The ICO had taken no operational measures in respect of the case since handing over the Whittamore prosecution to the CPS. There had been modest progress in issuing general guidance to the industry after years of discussion with the PCC. A custodial penalty for s55 offences had been provisionally introduced but not activated. This fell short of the steps Mr Thomas had wanted to see in order to put a stop to Motorman-type practices in the press for the future. The ICO remained very concerned about the evidence it continued to encounter of an extensive illegal market in personal information beyond the activities of the press. It had no reason to believe that private investigators similar to Mr Whittamore were not operating in the market. It is therefore necessary to consider whether there was (or should have been) a question mark in the mind of the ICO as to whether or not the objective of putting a stop to the engagement by the press in the illegal market in personal information had in fact been achieved.

¶3.2 That general question might resolve itself into a number of specific questions. Firstly, what had happened to the information which the press had acquired prima facie in breach of the data protection regime from Mr Whittamore? Secondly, what effect had the What Price Privacy? reports and the guidance had on the industry? Finally, what steps had the newspaper titles involved taken (particularly in relation to the journalists who had been identified as customers of Mr Whittamore) to eliminate this sort of conduct from their culture, practices and ethics?

¶3.3 On the follow-up to the question of press conduct in relation to blagging and related activities, Mr Graham confirmed to the Inquiry the position he had taken in front of the Select Committee. The ICO had made no active investigations of any nature in relation to the Motorman material itself. No material had been brought to its attention suggesting that there was any problem. In the absence of that, it was not its role to pursue enquiries. It had other current priorities.7

¶3.4 There was also, in his view, no case for a proactive approach to the victims. But he did say that "so far as the individuals are concerned, I'm still very ready for subject access requests by H those who may be concerned."8

4. Following up the political campaign 4.1 Before the Select Committee, Mr Graham appeared to be continuing to connect the s55 campaign with the issue of press misconduct. This exchange with Mr Watson was interesting in that context:9

¶Q. "But the evidence you have in front of you shows that there was law-breaking on an industrial scale from the newsrooms of some of the major newspapers in the United Kingdom.

1059

¶A. "I am afraid I am going to become repetitive. You simply cannot run regulatory bodies on the basis that you go chasing after every detail that a particular investigative journalist decides should be the agenda for the day when you have got other very big and important questions. I am not pleading poverty here, I am just saying that you can only do what you can do. We thought, possibly naively, that, by telling Parliament about this back in 2006 and calling for the custodial sentence, we could close the thing down. I think they still can, but it is taking too long." 4.2 As noted above, the ICO has continued to press for the activation of the custodial penalties for s55 offences, but no longer apparently with any direct focus on making an impact on the press. Although not directly a matter for the Inquiry, no account has been offered of how the case for the activation of those penalties has been affected by the more recent availability of civil penalties. In any event, however, the case for the activation of the s55 penalties in so far as it has a bearing on the matters before the Inquiry is considered on its own merits below.

¶4.3 If the ICO has yet to realise the benefits of the s55 campaign (and there remains no evidence of any active planning within the office for doing so – the effect still appears to be considered to be self-activating), it seems to be continuing to reap the dividend of general press hostility. That too requires consideration.

5. Phone hacking and the ICO 5.1 The What Price Privacy Now? follow-up report to Parliament noted the arrest and charging of Clive Goodman and Glenn Mulcaire in these terms:10

¶"the circumstances appear to have parallels with the Section 55 offence and to reinforce the evidence gathered during Operation Motorman". In terms of pure personal information, the parallels between phone hacking and the Motorman activities are very clear. Shorn of the labels provided by the criminal law, both come down to the press employing unscrupulous external agents to obtain confidential personal information about other people. Further, that information is provided without their knowledge or consent and obtained by unlawful means whether by deceit, corruption, or the exploitation of technology. In respect of any individual piece of information, the journalists may or may not have had good reasons or formal defences for doing so. But prima facie these H were the sort of invasive practices from which the data protection regime (along with its principles and rights) was designed to protect people.

¶5.2 There were on the face of it two reasons why the ICO might have taken a keen interest in the Goodman/Mulcaire developments In the first place, there was the indication that even in the post-Motorman environment, sections of the press were still involved in the unlawful trade in personal information. This was a clear warning signal in its own right that all might not be well in the approach and practice of the press regarding personal information, and raised a question mark against the efficacy of the strategy of the ICO for responding to Motorman.

¶5.3 In the second place, there was the concern whether there could be any direct relationship between Motorman and Goodman/Mulcaire. This was the question which had occurred to Mr Owens:11 was it possible that the private phone numbers obtained by the press via

1060

¶Mr Whittamore (not just the ex-directory numbers of the 'targets' but the multiplicity of 'friends and family' numbers), had been used to hack their phones? Were these precisely the private lines most likely to have been used by the 'targets' for the purposes of confidential conversations, texts or voicemails? Mr Owens told the Inquiry that he took these questions and thoughts to Nick Davies of the Guardian. He also told the Inquiry that there seemed to be considerable overlap between the target names in the Motorman material and in the Mulcaire material.

¶5.4 If the connection was made in the mind of the ICO, whether at either the general or the specific levels, the Inquiry had no evidence of it beyond the reference in What Price Privacy Now? Mr Thomas told the Inquiry, somewhat obliquely, that notwithstanding the connection made in its own report, the ICO thought that "the Goodman-Mulcaire case appeared to be a completely separate group".12 For his part, Mr Graham maintained in his evidence to the Inquiry the position he had taken in front of the Select Committee two years previously, namely that hacking and blagging were separate activities and that the ICO had no formal role in relation to the former because it had no prosecution or criminal investigation powers in relation to hacking, which was a police matter.13 He had put it bluntly to the Select Committee:14

¶"We were not involved, so far as I know and I cannot think of any reason why we would be, in the most recent PCC investigation which was into the Goodman case which, I will repeat, was about hacking and not about blagging, so I would have been surprised if they had come to us and, if they had, I would have had to say, 'Can't help you, chum'."

¶5.5 Counsel to the Inquiry pressed Mr Graham on the broader question; the newspaper industry had claimed, and the ICO appear to have accepted that claim, that after the ICO's 2006 reports, it had cleaned up its act. How could we know that was true, given that we did know it hadn't cleaned up its act in relation to phone hacking? Mr Graham's answer was that they were different things.

¶The ICO's current stance 5.6 Mr Graham's position that the ICO had no particular reason to take an interest in the press was challenged in the course of his oral evidence to the Inquiry. His response was that it was H a matter for the politicians, the PCC or indeed for the Inquiry itself to find out whether there was a problem with the press' approach to personal information.15 Furthermore, the ICO had many other current priorities.16

¶5.7 Mr Graham explained that he had no present intention of using his powers, or taking any other step formally or informally, to consider the culture, practices and ethics of the press in relation to personal information. Put to him that he had positive responsibilities to promote compliance and good practice, that he had appropriate investigatory powers to take proactive steps to consider the position of the press in this regard, and that it would not on the face of it involve any great exercise to do so, he remained clear that he had other competing demands on his time. He did conclude, however, that should the Inquiry recommend that he consider deploying his resources in this way, that view would be something the ICO would have to take very seriously.17 I return to this.

1061

¶5.8 As an independent statutory regulator, the ICO has a prerogative to set its own priorities within the overall scheme of the powers and duties entrusted to it by Parliament. For the behaviour of the press to have no part in those priorities is not, on the face of it however, easy to understand. The ICO was created to have custody of the issue of the law and practice of information privacy as articulated in the data protection regime. This Inquiry was established to address arguably the greatest crisis in public confidence in information privacy since the creation of the data protection regime. A great deal of the evidence received by the Inquiry about press misconduct related to personal information privacy (including inaccuracy). The persistence of the ICO, even in the face of the commissioning of the Inquiry and the evidence received by it, in seeking to recuse itself from any proactive engagement in addressing the crisis in public confidence was troubling. Even allowing for the inevitably particular perspective that the Inquiry has, I do not find it easy to accept the proposition that the lack of priority which the ICO accorded to the press issue is obviously reconcilable with its overall public responsibilities.

¶5.9 Before reaching a final conclusion on that point, however, it is necessary to reflect on whether there were in fact other, possibly structural, explanations for its unwillingness to put itself forward as a significant part of the answer to the concerns before the Inquiry.

1062

¶Chapter 5 Issues about the Legal Framework 1. The current views of the ICO 1.1 The account that Mr Graham himself provided of the role, functions and powers of the ICO drew attention to the way in which they had more recently developed:1

¶"The Information Commissioner's role in regulating the use of personal data has evolved over the years. The role was originally intended primarily as an educator, ensuring data protection compliance by promoting good practice. Significant enforcement powers of the Commissioner, such as civil monetary penalties, have been introduced by amendment over the last few years, partly in response to high profile data losses. Section 51 [of the Data Protection Act 1998] sets out the general functions of the Information Commissioner. These are generally about promoting good practice rather than punishing poor practice. This educator function is still central to how I approach my role as Information Commissioner."

¶1.2 The power to impose civil monetary penalties of up to half a million pounds was introduced in April 2010. Mr Graham described it as:2

¶"beginning to have a very salutary effect, both on public authorities and on commercial companies. They realise that the Information Commissioner has teeth."

¶1.3 He also explained his view that the way in which the Data Protection Act (DPA) bore on the press was complex; it was not easy to explain in clear and simple terms to individuals what their rights were, what the role of the ICO was in enforcing those rights, and what its relationship was to other organisations with functions in the area of law enforcement and good practice. This, in his view, meant that individuals sometimes expected more of the DPA than it was capable of doing in this area.3 That might be thought likely to suggest two consequences in particular. These are an increased emphasis on the explanatory and educational role of the ICO which Mr Graham had previously emphasised, and an increased burden on the ICO itself H to give a clear lead in relation to compliance and good practice by the press, since individuals were evidently relatively less well placed to proactively enforce their own rights.

¶1.4 The conclusion reached by Mr Graham was different. He put it that, had Parliament intended to give the Information Commissioner a significant role in overseeing the use of personal information for journalistic purposes, "it would have provided him with a very different and much simpler legal framework within which to do so".4 He was clear that the ICO was never intended to play a major role in the regulation of the press and that while the data protection regime was designed to protect information privacy it was not intended to impinge on the use of personal information for the purposes of journalism. The enforcement role of the ICO in this context was intended to be very limited; there was to be no challenge available on data protection grounds to the use of personal information for journalism, and certainly none prior to publication. The principal effect of the DPA on journalism therefore was in the application of the criminal offence created by s55.5

1063

¶1.5 However, Mr Graham's more detailed consideration of the scheme of the DPA in relation to the press necessarily qualifies that very general proposition.6 In this, he set out the significant restrictions placed by the exemption provisions of s32 on the enforcement powers of the ICO in relation to journalists' use of private information, concluding that therefore the Act largely leaves it to individuals to pursue court action after publication if they want to assert their rights: this is, of course, a problem if the legislation makes it hard for them to understand what those rights are.

¶1.6 He also drew attention to the fact that the exemption is made to turn on the reasonable belief of the journalist that publication would be in the public interest. In considering whether a journalist's belief about the public interest is reasonable, the DPA provides that regard may be had to his or her compliance with any relevant Code which has been designated for that purpose by the Secretary of State: the Codes so far designated are the PCC Editors' Code, the Ofcom Broadcasting Code and the BBC Producers' Guidelines.

¶1.7 It was Mr Graham's view that the role given to journalists' reasonable belief in the public interest meant that:7

¶"it is not the Information Commissioner's judgment about where the public interest lies or whether the provisions of the Act are compatible with journalism that counts and he has limited power to investigate or challenge the [journalist] data controller's opinion."

¶1.8 He did accept, however, that the Information Commissioner has powers, albeit 'specific and limited', to challenge whether the press exemption is being properly relied on. They are specific and limited because the DPA inserts a lot of procedural hurdles to their use, including the restriction that action cannot generally be taken unless the ICO is invited to do so by an individual or a court (irrespective of the fact that individuals may not be well-placed to issue such an invitation). But the powers do confer a function on the ICO of, in effect, policing the boundary between proper and improper claims on the journalism exemption:8

¶"In essence the investigative and enforcement powers at the Information H Commissioner's disposal exist to enable me to ascertain whether personal data are being processed for purposes other than journalism and to act in relation to those other purposes, rather than enabling me to regulate the actual processing of personal data for journalistic purposes."

¶1.9 To the extent, therefore, that there is any issue that journalists were, for example, seeking and using personal information for a range of unethical purposes other than with a view to publication, a regulatory question does arise. An example might be to threaten publication for collateral purposes or otherwise to put pressure on individuals to act or refrain from acting in certain ways. That, he recognised, would be expected directly to engage the functions of the ICO.

1064

¶1.10 Mr Graham also acknowledged that ss32 and 55 did not exhaust the application of the DPA to the press. Quite apart from specific provisions (for example, the express provision that individuals have enhanced rights to damages for breaches of the legal requirements of the regime by the press),9 the general duty of the ICO to promote compliance and good practice applies in relation to the press. About that general duty, Mr Graham observed:10 "I also have a duty under section 51 of the Act to issue guidance and promote good practice. This duty is not specific to the press, journalism or other special purposes. I am aware that during my predecessor's time in office significant efforts were made to provide advice to the PCC in relation to guidance we were encouraging the PCC to produce for journalists, focusing on the section 55 offence. So far as I am aware, the PCC did not go any further than producing general, high level guidance on journalism and the Act at the time and we have not received any further approaches to discuss such guidance during my time in office." Of course, the general duty to promote compliance and good practice, and the power to issue guidance, is free-standing and not dependent on the receipt of an approach. 1.11 Mr Graham's perspective on the role of the ICO in relation to the press also included an important acknowledgement that the correct approach to its more specific regulatory functions had to be on a case by case basis and not on the basis of generalised assumptions about the exclusion of journalism from the purview of the regime. What Mr Graham said in this respect is set out in full here because I am content to adopt it for the purposes of this Report as an accurate and succinct summary of the legal and practical position, and one on the basis of which the outstanding questions about the detail of the regime in its application to the press should be considered:11 "The fact that there is a public interest in a free press being able to go about its business is reflected in the treatment of the "special purposes" under the Act. However, it cannot be the case that any and every activity carried out in the name of journalism should be regarded as exempt from the provisions of the Act. Indeed, I do not believe that that extreme position is seriously advanced by any significant strand of opinion within the journalistic profession. There will, in certain circumstances, always need to be a judgment around the public interest in particular stories. This point is explicitly provided for in the various journalistic codes, for example the PCC Editors' Code, H Ofcom Code, BBC Producers' Guidelines, and so on. This is also the position reflected in the recitals to the Directive itself. The balance to be struck between Article 8 and Article 10 of the Human Rights Act 1998 has to be considered on a case by case basis. The inevitable tension between "the right to privacy" and "freedom of expression" demands that the issues at stake in each situation are properly evaluated. I observe in passing that making judgments on where the balance of the public interest lies on the facts of each case is something that the information Commissioner is called upon to do under both the Act and the FOIA." 1.12 The last point is particularly significant. Although it is the journalist's honest belief that he or she is working towards a publication in the public interest that counts, a challenge as to whether that belief is a reasonable one in all the circumstances is a matter for the Information Commissioner to consider on a case by case basis, and a matter on which the ICO has a general measure of experience and expertise.

1065

¶1.13 In my judgment, on the face of it, a combination of this kind of case by case approach to the ICO's law enforcement function in relation to the press, and the application to the press of the ICO's general duties to promote compliance and good practice, do add up to a significant potential role in guaranteeing public confidence in the culture, practices and ethics of the press in relation to personal information. However, the Inquiry saw little evidence of the realisation of that potential, or, in practice, of that role having been fulfilled. It was particularly hard to reconcile this potential with Mr Graham's resistance to the suggestion that the ICO should be actively making a connection between its role and functions and the activities of the press in relation to personal information privacy. 1.14 In looking for any possible explanation for that within the legal framework itself, the question which has to be considered is whether there are features of the current data protection regime in relation to the press (including perhaps the needless complexity cited by the Information Commissioner himself) which were themselves inhibiting that role and which are capable of improvement.

2. A different perspective on the legal framework 2.1 The Inquiry was greatly assisted by the evidence of Philip Coppel QC who reflected on the history and substance of the provisions of the DPA with a particular bearing on journalism.12 By way of introduction, Mr Coppel pointed out that the predecessor legislation to the DPA, that is to say the Data Protection Act 1984 (which was not the product of a European Directive), had no exemption provisions for the press equivalent to those in the modern legislation. It was the EU Data Protection Directive of 199513 which required Member States to introduce measures into domestic law to: "provide for exemptions or derogations … for processing personal data carried out solely for journalistic purposes only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression" 2.2 As Mr Coppel explained, in this way the Directive itself represents the balance that has been struck in relation to personal information privacy, between the individual right to privacy and the individual right to freedom of expression found, respectively, in Article 8 and Article 10 of the European Convention on Human Rights (now incorporated into UK law by the Human Rights Act 1998). H 2.3 Mr Coppel explained that the Data Protection Act 1998 in turn gives effect to the required balance in three main ways:14 "(1) Through the s32 exemption. This relieves a data controller from all obligations under the DPA to an individual (and correspondingly removes protection conferred by the DPA on an individual – §§37-45 above) where the data controller is processing that individual's data only for purposes of journalism, for artistic purposes or for literary purposes, and then only provided that three conditions are satisfied."

1066

¶"The three conditions that must be satisfied in order for personal information processed for the special purposes to enjoy the s 32 exemption are:

¶i. the processing is being undertaken with a view to the publication by any person of journalistic, literary or artistic material;

¶ii. the data controller reasonably believes that, having regard to the special

importance of the public interest in freedom of expression, publication would be in the public interest; and

¶iii. the data controller reasonably believes that, in all the circumstances, compliance with the data subject's rights is incompatible with the special purposes."

¶"(2) By the procedural relief conferred by s 32(4)-(5). Proceedings against a data controller must be stayed where the data controller claims that the data are being processed only for the special purposes and with a view to publishing by any person of journalistic etc material. The stay remains in place until the Commissioner has made a determination under s 45 that the data is not being so processed.

¶"(3) By creating a special enforcement regime (see §§54-55 above), which largely displaces the ordinary enforcement regime."

¶Civil law enforcement: the exemptions in s32 of the Data Protection Act Legal analysis and suggestions for reform 2.4 The first thing to note about s32, as Mr Coppel explained, is the extent to which it disapplies the protection for individuals which is effected by the Act itself.15 Mr Coppel's analysis of s32 began by highlighting the notable features of the exemption:16

¶"(1) It exempts the data controller from compliance with the great majority of obligations under the DPA owed to a data subject …, rather than just the limited group of obligations termed "the subject information provisions" or "the nondisclosure provisions". This includes compliance with the data protection principles.

¶"(2) The processing by the data controller must be both:

¶– "only for the special purposes"; and H

¶– with a view to the publication by any person (i.e. not just the data controller) of any journalistic, literary or artistic material (i.e. it need not be the data being processed nor need it be related to the data being processed).

¶"(3) The second and third limbs needed to engage the exemption turn on the reasonable belief of the data controller, rather than on fact. The only matter identified by the section as inform that belief when assessing its reasonableness are various press codes of conduct, prepared by the press."

¶2.5 Mr Coppel described the legislative and caselaw history of the s32 provision; this is important context and is therefore set out as follows in full:

¶"Parliamentary history of s.32 exemption

1067

¶"The s 32 exemption originated as clause 31 in the Data Protection Bill. In giving the Bill its second reading speech in the House of Lords, Lord Williams of Mostyn recorded the paramountcy which the clause was intended to give to freedom of expression: "The Government believe that both privacy and freedom of expression are important rights and that the directive is not intended to alter the balance..." This view was endorsed by Lord Wakeham, chairman of the Press Complaints Commission, who commended the Bill for: "...steer[ing] a sensible path which avoids the perils of a privacy law and achieves the crucial balancing act - of privacy and freedom of expression - in a clever and constructive way....The Data Protection Bill does not introduce a back-door privacy regime. The Human Rights Bill does. The Data Protection Bill safeguards the position of effective self-regulation. The Human Rights Bill may end up undermining it."

¶The Solicitor-General (Lord Falconer of Thoroton) then endorsed Lord Wakeham's view: "No one could have expressed the arguments in favour [of cl 31] more eloquently." "Disquiet was expressed in the House by others: – that, as a result of cl 31, the Bill failed to protect privacy, – that cl 31 was too wide and significantly undermined the function of the legislation, and – that the notion of the public interest was too wide and vague a basis upon which to disapply the protection conferred by the Bill. Amendments were unsuccessfully introduced to address these misgivings. In supporting the amendments, Lord Lester of Herne Hill warned at length that, as drafted and because of cl 31, the DPA failed to implement the Directive and authorised interference by the press with the right to privacy in breach of Art 8 of the ECHR.

¶H "The authorities "Judicial pronouncements have acknowledged that the DPA is concerned with the protection of an individual's ECHR rights to privacy. "The principal judicial authority on the s 32 exemption is the Court of Appeal's judgment in Campbell v MGN Ltd. The claimant had claimed against a newspaper for its having published articles which disclosed details of the therapy the claimant was receiving for her drug addiction. These included covertly taken photographs of her leaving a therapy group meeting. The claimant alleged that these amounted to a breach of confidence (based on her right to privacy under ECHR arts 8 and 10) and a breach of the data protection principles (entitling her to claim a breach of the s 4(4) DPA statutory duty). "In the High Court, judgment was entered for the claimant on both claims. In relation to the DPA claim, the newspaper agreed that publishing the articles it had processed sensitive personal data relating to the claimant. The court held: – that the published information (i.e. the nature and details of her therapy) constituted sensitive personal data relating to the claimant; that that was not lawful since it constituted a breach of confidence; that that processing was not fair as the information was acquired surreptitiously; that that processing did not satisfy any of the conditions in Schedule 2; that that processing did not satisfy any of the conditions in Schedule 3; and that the exemption in s 32 only applied to processing out "with a view to publication" and not to the processing involved in the publication itself. The court assessed damages at £2,500 and aggravated damages at £1,000. "The Court of Appeal allowed the newspaper's appeal on both the confidentiality claim and the DPA claim. The Court of Appeal accepted that "processing" included publication in print. However, the Court, reversing the High Court, extended the duration of s 32 exemption to cover processing on and after publication. This division between processing before and after publication had limited s 32's disapplication of the DPA's protection up until, but not including, the most invasive activity - publication. In construing the section to give press freedom paramountcy throughout and with no opportunity to balance the individual's interest in maintaining privacy, the judgment renders the DPA unlikely to be compliant with the Directive. "The claimant appealed to the House of Lords. The claimant put the breach of confidence claim at the forefront of the appeal, with the parties agreeing that the DPA claim "stands or falls with the outcome of the main claim" and that it "add[ed] nothing to the claim for breach of confidence." In this way, protection of privacy in personal information came to be secured through the adaptation of the action for breach of confidence. In so doing, the House of Lords absorbed into the action the competition between freedom of expression as protected by Art 10 and respect for an individual's privacy as protected by Art 8 – the very balancing exercise which the Directive articulates and which the DPA is supposed to implement. "On one analysis, the House of Lord's judgment appears to leave untouched the Court of Appeal's treatment of the DPA. This would be unfortunate. The misgivings which had been expressed in Parliament during the passage of the Bill (see above) H materialised with the Court of Appeal's judgment. The better analysis is that, given the parties' agreement that the DPA claim stood or fell with the breach of confidence claim, the latter's success means that the DPA claim enjoyed equal, if unspoken, success in the House of Lords. "Personal privacy protection since Campbell v MGN "The practical effect of the Campbell litigation has been that breach of privacy claims are now principally brought under the HRA, rather than under the DPA. This is borne out by the treatment of privacy in the main media law practitioner text, which recognises that the DPA:

1068

"contains the most comprehensive privacy provisions now affecting the media"

¶but goes on to comment that "misuse of private information" (i.e. the evolved breach of confidence action):

"...will be of most relevance in the majority of privacy cases involving the media"

1069

¶and that:

"..the other [action], much less significant in practice, is reliance on statutory rights such as those afforded by the Data Protection Act 1998."

¶The explanation offered for this is that: "Data protection law is technical and unfamiliar to most judges. Claims under this legislation will rarely offer tangible advantages over a claim for breach of confidence or misuse of private information. Given the paucity of current authority on how the Data Protection Act 1998 is to be interpreted and applied, applications for summary judgment on such claims are 'for the moment at least, unlikely to find favour." "Given that the stated objective of the Directive was to protect personal privacy in information in a way which reconciled Arts 8 and 10 of the ECHR, this practical result suggests a shortfall in the implementation of the Directive."

¶2.6 Mr Coppel concluded by summarising the current position with the following propositions:17

¶(a) "The DPA provides a code to protect the privacy of an individual's personal information, in whatever form recorded other than in ad hoc manual records. (b) The protection required by the Directive and provided by the DPA begins from the moment a person handling personal information acquires it and only ends once that person no longer holds it. (c) The Directive – to which the DPA is intended to give effect – permits Member

¶States to relieve the press of obligations otherwise applicable to the processing of personal information where that it required to reconcile the ECHR right of privacy with the ECHR right to freedom of expression. (d) Freed of judge-made authority, the DPA provides an individual with a measure of protection against press invasions of personal information privacy, but, because the s 32 exemption does not provide for any balancing of the fundamental right to privacy against the fundamental right to freedom of expression, the measure of protection is less than that provided under Art 8 of the ECHR. (e) The DPA, in articulating:

¶i. degrees of sensitivity of personal information; H ii. the uses of that information against which protection is provided;

¶iii. the purposes for which those uses will be relieved of obligations securing the protection, iv. and in adjusting the protection according the sensitivity of the information,

offers a sophistication and predictability which is unmatched by the jurisprudence on ECHR-based privacy claims.

¶(f) In reported practice, press invasions of an individual's personal information privacy have mostly been remedied through ECHR-based privacy claims. (g) Judge-made law has substantially reduced the efficacy of the DPA as a means of remedying press invasions of an individual's personal information privacy, possibly to the point that the DPA, so construed, no longer gives full effect to the Directive."

1070

¶2.7 The result, in Mr Coppel's view, is that where journalism is concerned:18

¶"undoubtedly, once you're in section 32 territory, then the protection which is given to an individual's privacy almost entirely falls away. All you have to do is touch section 32 in some way, shape or form and the contest which the Act is supposed to embody between the right of expression, freedom of [expression], and an individual's personal privacy has all been tilted one way." 2.8 In other words, the journalist is made arbiter of the balance, and the balance in turn falls to be made on the basis of matters exclusively within the knowledge of the journalist, including matters inaccessible because of the extensive protection provided for journalists' sources. He goes on to argue that s32:19

¶"does not recognise any right to privacy. It's there, its sole objective is to cut away at the right of privacy, and at the end of it, certainly after the decisions of the court, there is nothing left of that right."

¶2.9 In practical terms, the argument goes, the approach of the courts to the substantive law, coupled with the procedural inhibitions provided in other parts of the DPA (considered below) together with the very low level of damages which the courts have awarded have, between them, atrophied the principles and individual rights in their practical application to the press.

¶2.10 As a matter of law, there is more than one way to reflect on the tenor of Mr Coppel's arguments. Put at its highest, his case would be that on the current state of the UK authorities, s32 fails to implement the Directive from which it derives, and is inconsistent with the relevant parts of the ECHR to which it is intended to give effect, because the relationship between privacy and expression rights has got out of balance. A proper balance is a fundamental obligation. The UK is therefore positively required to change the law to restore the balance. That is indeed Mr Coppel's own contention: that UK data protection law currently fails to implement our obligations, and that Lord Lester's concerns had proved to be prescient.20

¶2.11 Without going so far as that, even if the current balance were within the spectrum permitted by our international obligations, the argument could be expressed in terms that it is at an extreme end of that spectrum, and the UK can as a matter of law, and should as a matter of policy, restore a more even-handed approach, not least given the asymmetry of risks and H harms as between the individual and the press.

¶2.12 Put at its very lowest, the point could be made that the effect of the development of the case law has been to push personal privacy law in media cases out of the data protection regime and into the more open seas of the Human Rights Act. This has happened for no better reason than the slowness of the legal profession to assimilate data protection law and, in the case of the judiciary, its greater familiarity with (and, he suggests, perhaps a preference for) the latitude afforded by the human rights regime over the specificity of data protection.21 But this, the argument goes, is undesirable because the data protection regime is much more predictable, detailed and sophisticated in the way it protects and balances rights, and significantly reduces the risks, uncertainties and expense of litigation concomitant on more open-textured law dependent on a court's discretion.22 Where the law has provided specific answers, the fine-nibbed pen should be grasped and not the broad brush. The balancing of competing rights in a free democracy is a highly sophisticated exercise; appropriate tools have been provided for the job and should be used.

1071

¶2.13 Mr Coppel suggested that the opportunity should be taken to redraft s32 in order better to reflect the balance between freedom of expression and the protection of privacy envisaged both in the Directive and in the ECHR. He suggested two changes in particular. The first is to modify the test for reliance on s32 so that it will be available only where:

¶(a) "the acquisition or use of the information is necessary for publication rather than simply being in fact undertaken with a view to publication;

¶(b) "there is a reasonable belief that publication would be in the public interest,

with no special weighting of the balance between the public interest in freedom of information and in privacy; and

¶(c) "objectively, that the likely interference with privacy is outweighed by the public interest in freedom of information."

¶2.14 The second change is to amend s32 so that it gives exemption from fewer rights and principles, and in particular no longer allows for exemption from:

¶(a) "the requirement to obtain and use information in accordance with statute law;

¶(b) "the requirement to obtain the information only for specific purposes and not to use it in any way incompatible with those purposes;

¶(c) "the requirement for information to be accurate and up to date;

¶(d) "the rights of individuals under the Act; and

¶(e) "restrictions on exporting the information."

¶2.15 Mr Coppel provided the Inquiry with an illustrative revised version of s32 to indicate the sort of changes which would need to be made.23 I should make it clear at once that I do not express any view on the drafting suggestions that Mr Coppel makes, nor is it appropriate for this Report to frame recommendations in the form of draft legislation. For that reason, the Report's consideration is strictly limited to the policy objectives underlying Mr Coppel's H suggestions which are not simply to be inferred from the drafting but as explained by Mr Coppel in his evidence; it would of course be a matter for Parliamentary Counsel in due course to reflect on how any policy recommendations of this nature would best be captured in drafting terms.

¶2.16 Considered purely in terms of what it might be desirable to achieve in terms of outcomes by any changes in the law, the underlying rationale of Mr Coppel's analysis and conclusions can be stated relatively simply. Firstly, it is to express more clearly the even-handed approach required by human rights law to the balance between individual civil liberties on the one hand, and the public interest in the liberties of the press on the other. Secondly, it is to improve the prospects of law enforcement and the restoration of that balance where the press goes too far in transgressing individual civil liberties.

¶2.17 The suggested reforms would seek to achieve these objectives by focusing the mind of the journalist much more explicitly on the balanced judgment he or she has to make in the first place, with a reminder that the journalist is not above the law, and cannot be the sole arbiter in the end of whether the public has been well-served by his or her actions. In other words, the changes are designed to promote conscious awareness in journalism and accountability to the public. Furthermore, they are intended to do so without imposing any burdens on honest and reasonably conscientious journalism24 beyond what is practicable and workable as a matter of day to day practice. The question is whether these intentions, from which it is hard to dissent, were indeed likely to be achievable along the lines Mr Coppel was proposing.

1072

¶News International's objections to Mr Coppel's proposals 2.18 News International (NI) made submissions to the Inquiry to the effect that what Mr Coppel suggested was misconceived.25 This part of the Report considers these objections in turn.

¶(a) The 'fundamental objection' 2.19 In the first place, NI raised what it described as a 'fundamental objection'.26 This relates to the proposed narrowing of the exemption in s32 on the basis of its divergence from the broad interpretation given to s32 by the Court of Appeal in Campbell v MGN Ltd.27 It was further argued that the effect of Campbell is that the existing provisions of s32, provided they are widely interpreted, strike the appropriate balance between Article 8 and Article 10.

¶2.20 As a matter of law, I do not see that this concern constitutes a 'fundamental objection' to the policy. Mr Coppel's submission is precisely that Campbell, in its interpretation of s32, unduly widened an already excessively wide s32 as enacted in the DPA 1998. His argument is that the current s32 is framed in a way that effectively means journalism nearly always trumps privacy and therefore fails properly to implement the Directive. On that basis, the narrowing of the s32 exemption is better understood as returning s32 to its intended remit. It is of course open to Parliament to amend the wording of the exemption in s32 irrespective of the terms of the judgment of the Court of Appeal in Campbell, provided that any amended s32 does not conflict with the underlying Directive to which it is intended to give effect, nor is incompatible with Article 10 or other provisions of EU law. The issue is not whether the policy of the proposed amendments conflict with Campbell, but whether they are necessarily incompatible with Article 10.

¶H 2.21 It is not apparent to me that there is a necessary incompatibility, or that s32 as currently drafted is the least generous formulation from journalism's point of view which is conceivably consistent with the ECHR if, indeed, it is consistent at all. Article 10 is a qualified right, inherently requiring a balance with other rights (including the right to privacy). I do not consider that Campbell can be read in the way that NI appears to contend, namely that a wide interpretation of s32 is necessarily required to give effect to Article 10 and that any narrowing of the scope of s32(1) is necessarily incompatible with Article 10. It must be remembered that the wide construction in Campbell concerned the temporal element of the exemption, i.e. whether it was confined to pre-publication activity or included publication itself. Campbell itself is entirely silent on the need to strike a balance between privacy and Article 10.

1073

¶(b) The objection to a necessity test 2.22 It is argued by NI that the proposed replacement of the test of processing "undertaken with a view to publication", with a test of processing "necessary for the publication" would be inconsistent with authority and unworkable in practice. NI makes the point that it is self- evident that for the s32 exemption to work it must cover, as it does at present, the processing of information which a journalist or editor ultimately decides to leave out of a published article.28 This point was, in fact, squarely addressed by Mr Coppel in oral evidence to the Inquiry.29 The exchange between Counsel to the Inquiry and Mr Coppel went like this:

¶Q. "Can we just look at a paradigm case of investigative journalism, that there's a lot of preparatory work … before publication. If the journalist can show that all the work is necessary for the publication, then he or she is protected both in relation to the preparatory work and to the publication itself." A. "Correct." Q. "Is that the correct analysis?" A. "It recognises that particularly for investigative journalism, in which there may be a long trail leading up to the publication itself – and some of those sub-trails may turn out to be fruitless in themselves but are nevertheless necessary in order to explore all the avenues to produce the article itself. That will be captured by my proposed 32(1) paragraph (a)."

¶2.23 The policy intention here would be to tighten the nexus, or causal link, which the legislation requires between the acquisition and handling of the personal information and the ultimate publication but certainly not to the (obviously unworkable) extent that the exemption would apply only to material actually published. The idea would be to protect bona fide research or investigatory work without which publication could not happen, and that would have to apply from the point of view of the work at the time and not with hindsight. But it would not protect dealing in personal information unless it was properly necessary for research and publication. I do not see that that policy aim is either legally repugnant or necessarily unachievable in law and practice. As currently drafted, s32 of the Act requires the Court (or Commissioner) to consider whether the processing is undertaken with a view to publication, and that requires the Court (or the Commissioner) to consider the link between the processing and its ultimate purpose and the publication. Exactly the same conceptual process would be required under H Mr Coppel's proposals, but more would be being asked of the journalist to demonstrate the necessary link.

¶(c) Replacing the requirement in s32(1)(b) to have particular regard to the 'special importance of the public interest in the freedom of expression' with a more neutral balance, and an explicit balancing test 2.24 The NI submission30 suggests that this would be inconsistent both with Article 10 and s12(4) of the Human Rights Act. Dealing with the latter point first, I do not think that there is any arguable technical inconsistency with s12(4), which is essentially a procedural mechanism, directing a court when proceedings before it concern journalistic material to have particular regard to the importance of freedom of expression. In the event that a DPA claim engaging s12(4) were before the court, it would operate as a free standing provision and there is no need for the further incorporation of an equivalent provision in s32 in order to give effect to it. Where there are no proceedings before a court, for example where a journalist is considering whether s32 is met, s12(4) has no direct application.

1074

¶2.25 It may be asked whether the recognition given in s12(4) to the importance of freedom of expression is not a reflection of the more fundamental point in the NI submission, namely that as a matter of ECHR law there is in fact special importance attached to freedom of expression, and beyond that to a lack of constraint on journalism, to which the removal of the formulation in s32 is repugnant. Undoubtedly, there is a very special public interest in freedom of expression, as formulated in Article 10. But it certainly puts the argument very high to say that the existing language of s32 is a minimum imperative required by the ECHR. Indeed, as is apparent, during the passage of the Data Protection Bill, some anxiety was expressed by expert opinion in Parliament to the effect that the pull it exerted on the scales balancing the public interest in freedom of expression as against other public interests (including privacy) was itself not compatible with the language of the Convention.

¶2.26 I do not consider, as the NI submission seems to suggest, that the current drafting of s32 can be held up as the only and immutable expression of the balance between personal information privacy and the value in a free society of journalistic (or artistic or literary) endeavour. An expression of that balance in UK data protection law, which occupies a more central zone of the margin of appreciation, and which is expressed in language more close to that of Articles 8 and 10 themselves and which encourages those exercising precious freedoms to be mindful in doing so of other people's precious freedoms is something which it seems to me to be both possible and desirable to achieve. None of the provisions of s32 at present contains any explicit recognition of the wider context of public interest within which journalism must fairly operate. Mr Coppel's suggestion of introducing an explicit balancing test seems to me to be both truer to the letter and spirit of the Convention, and an important and necessary encouragement to mindfulness where journalism handles, as it often must, private information.

¶H (d) Taking individual subject access rights out of the automatic exemption provision 2.27 The NI submission describes this as "perhaps the most worrying of Mr Coppel's proposals".31 The right of individuals to know what information is held about them is of course at the heart of the data protection regime, and a very fundamental privacy entitlement in its own right. But its application in the modern world of journalism would be a change of some significance, and it is right that the idea should be considered with great care. The NI submission makes a number of points about the idea, some of which certainly need to be taken very seriously.

¶2.28 It is, for example, argued that it would seriously undermine the protection of sources. Journalists' sources enjoy a considerable degree of legal protection, not least under Article 10 of the Convention.32 Any change to that protection would have to be considered most carefully, and in its own right rather than simply as the by-product of another policy. Sources (although not in a way specifically addressed to journalism) are, however, given considerable general protection by the data protection regime. That is because where access to one's own data would necessarily involve the disclosure of information about a third party (including a source), the privacy entitlements of that third party have to be respected as well as one's own. In conferring the right of access to one's own information, s7 of the existing DPA, therefore, makes this further specific provision:

1075

¶"(4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless— (a) the other individual has consented to the disclosure of the information to the person making the request, or (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual. (5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise. (6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to— (a any duty of confidentiality owed to the other individual, (b) any steps taken by the data controller with a view to seeking the consent of the other individual, (c) whether the other individual is capable of giving consent, and (d) any express refusal of consent by the other individual."

¶2.29 It is an important, if technical, point to note that the subject access right is a compound right, including not just a right of access to the information, but a right to know whether information is held at all about one. So if even to confirm whether information is held would disclose a source, s7 makes provision for an answer which will neither confirm nor deny it.

¶H 2.30 I do not express a concluded view as to whether the existing provisions of the DPA are a complete answer to the challenge that introducing at least the possibility of a right of subject access has to be reconciled with the need to protect journalists' sources. I simply observe that it is not apparent to me that the importance of protecting journalists' sources cannot be captured in suitable amendment to these provisions, should any be needed. The more fundamental point is that there does not seem to me to be an argument from first principles that the protection of journalists' sources necessitates a complete and blanket dis-application of the subject access right in all circumstances. And if it is not necessary to disapply a fundamental privacy right in all circumstances, it is necessary not to.

¶2.31 It is further argued by NI that there are other reasons why it would be necessary to take a blanket approach to this right in the world of journalism. These are:

¶(a) "the need for legitimate investigative journalism to be able to operate covertly, and over a period of time, without the object of the investigations being able to find out that the press are interested in them;

1076

¶(b) "the burden on newspapers' resources, particularly given the motivation of individuals to find out what is being held about them at regular intervals;

¶(c) "'it would spell the end of the exclusive' if individuals could get hold of a

possible story and provide it on their own terms to another newspaper – or indeed take to the internet with their own pre-emptive version; and

¶(d) "that it fails to respect the balance required between Article 10 and 8 more generally." 2.32 Care must be taken in this context to avoid rhetorical elision between matters of commercial convenience or profit, on the one hand, and a challenge to the current business model of the newspapers so fundamental as to amount to an abridgement of free speech, on the other. With the first of the four points noted above, it is possible to readily to agree. With the second and third, there are issues of degree. With the third in particular in relation to the question of exclusive stories, the business model may well be under rather more acute threat from the internet generally and the highly ephemeral nature of exclusivity once any publication takes place, than from any legislative change relating to the entitlement of individuals to know whether information is held about them. Similarly, the issue is to a degree less concerned with the exercise of freedom of expression than with the abridgement of the rights of others to receive and impart information. In reality, the key question, therefore, is the fourth, of which the first is an aspect. Does a fair balance between Articles 10 and 8 prohibit any possibility of subject access to journalistic material in all circumstances?

¶2.33 I am not persuaded that it does. It is evident that a fair balance would require an entitlement for a subject access request to be refused to any degree where to comply with it would compromise the protections envisaged by Article 10. But I am inclined to think that this could properly be done on a case by case basis rather than by wholesale ouster of the right. This point needs to be borne in mind: a significant aspect of the importance of the subject access right lies in the ability it gives individuals to test for themselves whether their information is being dealt with lawfully and in accordance with the data protection regime (including, of course, whether the information is accurate). That includes being able to test whether any exemptions are being properly claimed (although not to the extent that properly claimed exemptions are themselves thereby compromised). The complete exclusion of subject access from all journalistic activity removes a principal check on its lawfulness. Who then is to H perform that function? The obvious answer would be the Information Commissioner, but that answer in itself takes us to a second area which Mr Coppel has identified as problematic.

¶Civil law enforcement: journalism, access to justice and the powers of the Information Commissioner 2.34 As well as the substantive exemptions provided by s32, the DPA creates a number of special procedural provisions which apply whenever it is claimed that personal information is being acquired or used for journalism. Their effects are both very significant for the purposes of the Inquiry and also very complicated. Their very complexity adds to their impact. It is necessary to engage with and unravel the detail of these provisions in order properly to understand and address their effect.

1077

¶2.35 The relevant provisions are identified in this way by Mr Coppel:33

¶"Once a data controller claims that the personal data are being processed for a "special purpose" (i.e. journalism, artistic or literary purposes) or with a view to the publication by any person of any journalistic, literary or artistic material: (a) the Commissioner cannot ordinarily serve an enforcement notice or an information notice (s 46); and (b) where a person has brought a claim under the DPA seeking a remedy for breach of any of the data subject's rights (see §§37-45 above), the Court must stay the proceedings until there has been a determination under s 45 of the data controller's claim (s 32(4)). Where the proceedings are so stayed or the Commissioner has received a s 42 request for assessment, he may serve a "special information notice" (s 44). The object of the notice is to enable the Commissioner to carry out the s 45 determination. A data controller has a right of appeal against a special information notice (s 48). "Under s 45(1), where it appears to the Commissioner that the personal data are not being processed only for a special purpose or are not being processed with a view to the publication by any person of any journalistic, literary or artistic material, the Commissioner may make a determination to that effect. A data controller has a right of appeal against the determination. Once the determination takes effect, the Commissioner may serve an information notice. And, if a court gives leave, the Commissioner may serve an enforcement notice. If the Commissioner decides otherwise, proceedings for breach of the DPA may be stayed indefinitely…"

¶2.36 Broadly speaking then, the Information Commissioner cannot exercise his regulatory powers in relation to the press (and a court cannot decide an action brought by an individual for breach by the press of the rights contained within the data protection regime) unless the Information Commissioner has first made a formal determination that the newspaper is not, in relation to given personal information, using it wholly for the purposes of journalism. The only power he can use to help him make that determination is the power to issue a 'special information notice' for the purpose. And he cannot issue one of those unless either litigation is already on foot or he receives a specific request from a complainant. Where he does issue a special information notice, the newspaper can appeal it. And if he does finally make a H 'determination' the newspaper can appeal that too. Any enforcement steps he is then able to take, whether investigative or compliance, each brings its own appeal rights.

¶2.37 Mr Coppel explained some of the cumulative practical impact of these provisions:34

¶"It results in a disapplication of the power to serve an enforcement notice – that's the first important thing that it does – and then secondly, where an individual has brought a claim, a section 4(4) claim for breach of statutory duty through the DPA, then the court must stay those proceedings until there has been a determination under section 45, and section 45 is a special procedure relating to the so-called special purposes, ie journalism, literature and art, to see whether in fact that is the case. "In practice, what happens is that it becomes so convoluted – the individual disgruntled has commenced proceedings under section 4(4). If they – if the point is taken that these are special purposes, then a satellite set of proceedings is effectively launched, namely the section 45 one. That, if one ever gets to the end of it, reaches its end, it might come up with a conclusion. If the conclusion is in favour of the individual, then they resume their claim, by which time, of course, matters have marched on significantly and it may be of cold comfort, any such relief – [they may quite possibly have lost interest in living by then] and particularly if one realises that at the end of it all one is going to get like, for example, Catherine Zeta Jones, £50, one can well understand why interest might be a little bit diminished." 2.38 During the course of the Inquiry, it has frequently been asserted that most or all of the evident problems with the culture, practices and ethics of the press would be solved if the existing law were to be properly enforced. Where press compliance with the legal requirements of the data protection regime is concerned, enforcing the civil law is a two-stage process. It must first ensure that the boundary between exempt and non-exempt activity in relation to dealings in personal information is properly observed by the press, and this is a point which applies wherever that boundary is drawn by the substantive law. Secondly, it must also ensure proper compliance with the regime where exemptions do not apply. 2.39 Law enforcement in these respects takes place in two different ways. First, it is by individuals bringing cases in the courts, and, secondly, by the exercise of his powers by the Information Commissioner. Both as regards litigation procedure on the one hand and as regards the assertion of the powers of public authorities on the other, there are already significant inhibitions in the general law which impact on the possibility of proper law enforcement in respect of the press because of the balance which must be struck between the public interest in law enforcement and the public interest in the protection of journalists' sources. The additional procedural thicket which the DPA erects in the way of anyone attempting to find out whether the press is complying with the law, that is to say whether their activities are genuinely covered by exemptions and if not whether they are complying with what is legally required of them, is for practical purposes near-insuperable. The press, so this analysis goes, is effectively beyond the reach of law enforcement. In that regard, the legal regime can be and is disregarded for any practical purposes. Whether what the press are doing with people's information is or is not specifically exempted from the regime hardly matters in practice since the question is effectively prevented from arising. 2.40 Mr Coppel suggested that this aspect of the problem should be addressed in two ways, that is H to say by removing the elaborate tangle of red tape which stops the Information Commissioner doing his job in relation to the press, and by providing more straightforward access to justice for individuals.

1078

¶Powers of the Information Commissioner 2.41 Here, Mr Coppel's proposal is very straightforward: the DPA should be amended to repeal the entirety of the complex special regime limiting the Information Commissioner's powers in relation to the press. Specifically, he recommends:35 "removing the provisions for special information notices (s 44), special purpose determinations (s 45) and special purposes restrictions (s 46), thereby aligning the DPA's enforcement procedures as they apply to the press with those that apply to others, i.e. the ordinary provisions for enforcement (s 40), assessment (s 42) and information notices (s 43)".

1079

¶2.42 These provisions of the DPA are highly redolent of a policy context in which the self-interest of the press was a powerful advocate, rather than one in which law enforcement was an active concern. Given the specificity and elaborate nature of the provision made for testing the compliance of the press with the law, however, this much can be said: it cannot have been the intention of the legislation that the compliance of the press with the law should, in reality, be incapable of being tested in practice. No doubt concerns were vocally expressed that legitimate journalism should be able to go about its business without interference or 'chill' from overzealous regulators or nuisance litigation. But there is no policy intention on the face of the legislation that it should be impossible, in the usual ways, to establish whether the journalism was in fact legitimate in the first place. Such an intention would have been very simple to express legislatively although it would, of course, have been incompatible with the spirit and letter of the Directive. However wide the boundaries of an exemption are set, those boundaries have to be given some real meaning. Making those boundaries inaccessible, and the question on which side of them any activity falls effectively incapable of being answered, strips those boundaries of meaning.

¶2.43 The risks of applying the ordinary regime of information and enforcement notices to the press are capable of being overstated. An information notice could not be issued unless the Commissioner reasonably required any information for the purposes of determining whether the press were complying with the law. Similarly, an enforcement notice could not be issued unless the Commissioner was satisfied that the press had contravened or was contravening the law. In each case, the Commissioner would have to bear in mind any genuine risk to freedom of expression. Each measure, if deployed, has an appeal mechanism through which its compatibility with freedom of expression could readily be tested, case by case. It is not my view that the mere existence of the possibility of law enforcement measures of this sort would itself be an improper inhibition to journalistic activity, nor that the press would be slow to understand and make use of the sort of procedural safeguards which the standard data protection regime provides.

¶2.44 None of this is of course intended to give any encouragement to the idea of over-zealous reliance by the ICO on formal powers. As successive Information Commissioners have repeatedly emphasised, in general, the first recourse of a regulator with concerns about compliance should always be to seek to resolve matters informally and cooperatively. But it has not been my perspective that over-zealous recourse to formal powers has been a major concern about the way in which the ICO has engaged with the press and there are, in H any event, plenty of inhibitions in law and practice to any such tendency. On the contrary, it appears that the most pressing concern is the need to address the extent to which the ICO is shy about performing its proper role in relation to the press as a member of its field of regulation, not least by addressing the evident cultural inhibitions to doing so created by the DPA's complicated procedural regime. If the ICO has entertained a view that it is somehow unable to apply the law to the press, that it is not really supposed to do so, the process provisions are likely to have been a significant encouragement to that view, however overstated that view may be.

¶2.45 From the point of view of legitimate journalism, it is right that the ICO should not interfere or over-regulate. It is also right that journalism should be judged primarily by what it prints rather than be held to account at the newsgathering stage. A theme of this part of the Report, however, is that this does not mean that blanket exclusion from regular law enforcement measures is the only, or a very sensible, response. It is my conclusion that it is a part of the culture, practices and ethics of some sections of the press that there is a sense of comparative impunity and, in the main, of being beyond the reach of the law. This has not been in the public interest, and needs to be rebalanced by a greater sense of awareness of the law and what is the continuum between the constraints of the law and aspiration towards good practice. The existing procedural provisions of the DPA in relation to the press appear to be an unnecessary and unwelcome inhibition to making progress towards that goal.

1080

¶Access to justice 2.46 In general, the DPA provides36 for individuals who suffer damage as a result of breach of the legal requirements of the regime to be entitled to financial compensation from the person or organisation responsible. It is a defence in such proceedings for the latter to show they had taken reasonable care to try to act in a way that is compliant with the law. If any individual has suffered damage, compensation is also payable for distress. Where, however, the contravention relates to acquiring or using personal for the purposes of journalism, literature or art, compensation is payable for distress alone, without the need to prove physical damage. This is in recognition of the fact that the unlawful widespread public dissemination of someone's personal information is capable of having a distressing impact in its own right; this is the impact about which very many of the witnesses before the Inquiry have eloquently spoken.

¶2.47 In practice, however, the way that the courts have interpreted this entitlement to compensation has been very limiting indeed. As a result, claims are rarely successful, and even when successful have resulted in very small awards.37 At its root the problem is that the courts have been reluctant to award compensation for anything other than measurable financial loss caused by the breach of the regime. Nothing, in other words, is awarded for the distress in its own right, but only if it has occasioned economic loss. But by its nature, the subject matter of the regime, that is to say privacy, is unlikely to produce circumstances in which breach straightforwardly causes pecuniary loss. The harm done is the invasion of privacy itself.38

¶2.48 In other areas of the civil law, the courts have solved this problem by evolving a tariff of compensation to be paid for non-pecuniary loss. The best example is in relation to compensation for pain, suffering and loss of amenity in personal injury case. A more recent (and perhaps more relevant) illustration is the award of damages for breach of contract where holidaymakers have been let down by travel companies or holiday operators. The whole point of the contract was the pleasure of a holiday with the result that compensation H will be payable for the disappointment.

¶2.49 On the face of it, the inability of victims of data protection breaches to obtain compensation for distress in its own right is an anomaly for a regime whose principal purpose is to safeguard individuals from unlawful intrusion into their private lives. The practical problem facing any attempt to address that lacuna, however, would be how to put a price on privacy in the way that the courts have evolved tariffs of compensation in other areas of 'immeasurable' psychological or emotional harm.

¶2.50 It must immediately be acknowledged that this is an issue which is relevant to activities in relation to private information which go beyond journalism, and beyond public dissemination of information in breach of the data protection principles. Damages for non-pecuniary loss in privacy cases is a potentially large subject in its own right, and one which has an extremely large and detailed context in the law of damages more generally.39 On the other hand, as indicated above, the DPA makes special provision for compensation for distress unlawfully caused by the press although this is a provision to which the courts have not in practice given substantive effect. 2.51 Mr Coppel tested the issue with the example of the medical records of an individual being published in a newspaper in breach of the DPA, that is to say, unfairly and without legitimate public interest justification.40 To that example might be added the example of the dissemination of intimate sexual details or nude photographs, again, for the purposes of the argument, unfairly and without legitimate public interest justification. Mr Coppel suggested: "That, it seems to me, is a fundamental breach of what the Act is there to protect". Should the measure of recompense be simply how much money the individual may lose as a result – and if none, should the individual be left to endure any amount of distress and personal devastation uncompensated? 2.52 The DPA has been amended in recent years to make provision for the Information Commissioner to be able to impose monetary penalties, including in cases of this sort.41 But monetary penalties of course, while they may have a deterrent or punitive effect, still leave the victim uncompensated. 2.53 Mr Coppel's own suggested solution has two elements. First, the Information Commissioner should be empowered to set a tariff of financial solace for breaches of the data protection principles, referable to the duration, extent, gravity and profitability of their contravention, such amounts to be in addition to amounts for damage and distress resulting from the contravention and to be followed by the Commissioner and the Courts. Secondly, a wronged individual should be provided with the choice of an alternative system to claim the tariff only, with no provision for damages, legal costs or fees, such a system to be administered by the Information Commissioner.42 2.54 Within Mr Coppel's analysis and conclusions, there are proposals that are specifically directed to the law relating to data protection; others have far wider ramifications into the law of damages. As for the proposed way forward in relation to the DPA, I accept that, at their heart, they reflect a recognition that changes need to be made in order to provide a response to the demand repeatedly expressed for the law to be properly enforced in relation to press misconduct and for individuals to have proper access to ways in which they can enforce their H rights. 2.55 More specifically, in relation to the 'special enforcement regime' provided in the 1998 Act in relation to the press, there are good grounds to conclude that it has had an unintended and damaging effect on the ability of the ICO to perform its functions. Exceptionally complex and largely unworkable in practice, it appears to have had a chilling effect on reasonable law enforcement and, equally, to have a high risk of impacting unfairly on individuals. In my judgment, Mr Coppel's view is correct: its removal would promote the overall public interest and a balanced improvement in the culture, practices and ethics of the press in its approach to personal information.

1081 1082

¶2.56 In reaching that conclusion, I am very conscious of the need to ensure that legitimate journalism is not unduly impeded by attempts at pre-publication law enforcement on the one hand, albeit at the same time that individual liberties are not unduly stripped of their content by being rendered wholly unenforceable before publication (and then to be defeated by the act of publication) on the other. It is my provisional view that this difficult, but essential balance, is one which can and must be performed on a case by case basis by the ICO in considering the exercise of its powers, and that it is not one for which it is necessary or appropriate to attempt to make further provision by law. If, however, it were thought desirable to do so, it would perhaps be possible to preserve expressly in the Act the principle that, in considering the exercise of any powers in relation to the press or other publishers, the ICO should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime.

¶2.57 Built into this balancing exercise should be a requirement on the ICO, when considering the exercise of any of its powers, to have regard to the fact of membership of an accredited press regulator by the relevant title: this should be capable of establishing the proposition that the title subscribes to recognised and approved standards of conduct which are, themselves, enforceable.

¶2.58 The proposals for adjusting the boundaries and operation of the press exemption in s32 is a more difficult exercise. Although I am minded to the view that there is, indeed, an issue about compatibility, I do not consider that it is necessary for me to resolve whether there is any incompatibility between the provision as interpreted by UK courts and the UK's European and international obligations. What I am, however, clear about is that there is room within the latitude afforded by those obligations for a fairer, more even-handed balance, and that improvement in that respect is, both as a matter of both law and policy, desirable.

¶2.59 I therefore recommend that the policy represented by the suggested revisions to section 32 of the DPA should be given effect to by suitable amendment to the Act. In doing so, I consider that particular attention should be addressed to one area where further refinement of that policy seems to me to be desirable.

¶2.60 The removal of the blanket exemption from the fundamental right of subject access currently provided by s32 seems to me to be right for the reasons considered above. But there are H special considerations relating to the exercise of a right of this nature in relation to the press to which careful attention needs to be paid. It remains necessary for the right to be balanced against the special protections afforded by the law to journalists' sources. That protection is not absolute as the law stands, but it is extensive. On the face of it, the existing general limitations on the subject access right which are designed to safeguard third party information do appear generally apt to follow the existing (important) protection for journalists' sources. If it were thought that there was any doubt about the matter, however, that doubt should be resolved by a provision to the effect that the right of subject access is not intended to displace the general law on the inaccessibility of journalists' sources.

¶2.61 Turning to the question of damages, I do not consider that it is appropriate for the Information Commissioner to be setting a tariff of financial solace for breaches of data protection or why this should be different from damages for distress (which might themselves be linked to damages for breach of other privacy rights). The proper place for the assessment of damages (or non pecuniary compensation) is allied to the consideration of damages across this area of the law. I return to this topic when dealing with the civil law.43

1083

¶2.62 In making these recommendations, I accept that the current state of the legal framework in relation to the ICO's civil law enforcement powers goes some way to explain the indications of reluctance by the ICO to take an active, or any significant, interest in the formal exercise of their regulatory functions in relation to the press. I do not, however, accept that as a complete explanation. In reality, there is a lack of evidence that the ICO has, over the years:

¶(a) regarded the symptoms of deficiencies in the culture, practices and ethics of the press in relation to personal information as a serious operational priority; (b) shown a will to test in practice the powers and procedures conferred by law specifically for the purposes of ensuring compliance with the legal obligations of the regime by the press – however attenuated those obligations and however difficult those procedures; or (c) drawn attention politically to any perceived shortcomings in the legal framework in this respect. This raises questions about a possibly deeper reluctance to accept an active role in relation to the press. Neither do I accept that other operational priorities must be accepted without more as an explanation for ICO inactivity in an area which the very existence of this Inquiry demonstrates to be a matter of acute public concern.

¶2.63 While recommending changes to the law, I do not intend to encourage the idea that the ICO should continue to take no steps to address the culture, practices and ethics of the press in the meantime. I therefore additionally recommend that the ICO should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime. I explain elsewhere, it is also my recommendation that in future such a policy should expressly provide that membership of an effective and independent self-organised system of standards regulation should be able to be taken into account by the ICO in contemplating the exercise of those functions.

¶2.64 I further recommend that the ICO take immediate steps to publish advice aimed at individuals concerned that they are or may have been victims of unlawful use of their personal information by the press. That might, for example, take the form suggested above, of enabling individuals, on application to the ICO, to obtain confirmation in so far as the office is able to offer it of whether they can be identified among the Motorman victims, and if so in relation to which H title or titles, and to obtain assistance if necessary in making a suitable request to those titles. It might also take the form of engaging with victims' representative organisations to those ends.

¶Promoting good practice: journalism and ss51-52 DPA 2.65 In considering the role of the ICO in relation to the conduct of the press in connection with the handling of personal information, it is sensible to start with ss51-52 of the DPA.44 These are among the simpler and more straightforward aspects of the application of the data protection regime to the press and it has not been suggested that the provisions should not be taken at other than face value. In short, they provide that:

¶(a) the ICO has a positive duty to promote the following of good practice in relation to the handling of personal information by the press, no less than in the case of any other business;

1084

¶(b) the ICO also has a positive duty to promote the observance of the legal requirements of the DPA by the press, in so far as they apply; (c) the powers of the ICO in relation to the dissemination of public information and industry guidance apply in the context of the press industry; (d) the powers of the ICO to encourage sections of industry to develop and apply codes of good practice in the handling of personal information apply to the press sector; (e) the duty of the ICO to make an annual report to Parliament on the exercise of its functions includes a power to cover press aspects in that report; and (f) the power of the ICO to make special reports to Parliament includes the ability to make special reports about the intersection between the data protection regime in practice, and the culture, practices and ethics of the press in relation to personal information (which provision provided the basis for the laying of the What Price Privacy? Reports). 2.66 As a matter of ordinary public law, the exercise of any of these powers has to be kept under review, considered within the overall framework and purposes of the data protection regime as a whole, and both reasonable and proportionate in all the circumstances. On the face of it, relevant considerations in that context would include matters such as the extent of objective evidence of poor practice along with the nature and seriousness of that poor practice and levels of public concern. Evidence of widespread ignorance of the requirements of law and good practice (whether on the part of industry or individual) would be particularly relevant, especially if that ignorance were related to the genuine complexity of those requirements. As an expert regulator, the ICO would then be in a unique position to address the problem with explanation, education and support.

¶2.67 Of course, the exercise of any of these powers in relation to the press would also have to take into account the wider legal context, including respecting in full the balance to be struck both in law and in policy between the liberties of the individual and the vital requirements of a free press. That wider context would certainly affect the manner in which the powers were exercised, and the content of any guidance, codes, reports and so on. But it does not on the face of it appear to constitute a limitation on the existence or potential value of these powers in relation to the press.

¶2.68 For my part, I do not see any defect in these provisions which could limit their ability to H contribute to the promotion of good standards of behaviour in the press in the handling of private information: none has been overtly suggested. There has been no suggestion, for example, that throughout the period in which Mr Thomas was trying to encourage the PCC to promote good practice in the industry, including by means of its own Codes and guidance, he was in any way inhibited as a matter of law by the legislation governing the ICO from acting in those areas or fulfilling those requirements himself.

¶2.69 If there were any real doubt in the matter, legislation could put its application to the press beyond doubt. Indeed, it would also be possible to introduce new positive duties in relation to the press, for example to insert positive duties into the legislation as follows:

¶(a) into s1(3) for the ICO, in consultation with the industry and the public, to exercise the power to issue comprehensive guidance to the press on good practice in the handling of personal information; (b) into s51(2) to exercise the power to issue comprehensive guidance to the public on their individual rights in relation to the obtaining and use by the press of their information, and how to exercise them; and

1085

¶(c) into s52 to include in the ICO's annual report to Parliament an account of its perspective on press compliance with law and good practice in the handling of personal information and to draw special attention to any concerns. Having said that, I should make it clear that I do not see any reason to doubt that the ICO could exercise his powers in these ways as the law presently stands. 2.70 I do not accept that there is any reason in law to explain the failure of the ICO to use these powers by taking active steps to address the need for improvement in the standards of the practices of the press in relation to the handling of personal information. Successive Commissioners have emphasised that this drive for good practice function is the cornerstone of the entire regulatory regime. Unfortunately, evidence to justify serious concern about the standards of the press in this respect has been available and well publicised: an informed, well-targeted, proactive and engaged approach to the problem might have made a real difference. It is a matter of regret to record that the failure by the ICO to address this issue must be regarded as a regulatory opportunity missed. 2.71 In those circumstances, I recommend that, in discharge of its functions and duties to promote good practice in areas of public concern, the ICO should take immediate steps, in consultation with the press, to prepare and issue comprehensive good practice guidelines and advice. This should include the articulation of principles and standards dealing with the acquisition and use of personal information. I hope and anticipate that the press will actively cooperate in the preparation and implementation of such guidelines and advice, not least so as to ensure that its Article 10 rights are fully recognised and reflected in the work. In those circumstances I would expect the guidelines and advice to be prepared and implemented no later than six months from the date of this Report. 2.72 I also recommend that the ICO take steps to prepare and issue comprehensive guidance to the public on their individual rights in relation to the obtaining and use by the press of their information, and how to exercise them. To demonstrate the effect of this guidance, the ICO should include regular updates on the practices of the press in relation to handling of personal information in its annual reports to Parliament.

¶Criminal Law: the sentence for breach of s55 DPA 2.73 The history of the campaign started by Mr Thomas to amend s55 DPA to introduce the H possibility of custodial penalties on conviction (by providing a statutory maximum of two years imprisonment) has been set out. The position is that the Criminal Justice and Immigration Act 2008 introduced that amendment, but the changes had not been brought into force. A statutory instrument, to be laid before Parliament by the Government, is required. 2.74 As a matter of principle, the existence of uncommenced legislation on the statute books is potentially problematic. The power of the Secretary of State to commence legislation must, by law, be kept under review, so it always remains a live issue. As described elsewhere,45 the legislative process by which the maximum penalty was increased and the defence to the substantive offence available to journalists broadened, with both changes left uncommenced, was strongly indicative of a political compromise, designed as much as anything to quieten two opposing campaigning voices rather than as a response to a thought through policy analysis for which there was genuine empirical evidence. It is not surprising to find that the delicate balance of the compromise has not proved something which succeeding Secretaries of State for Justice have been in a hurry to revisit.

1086

¶Recent history of the ICO's s55 campaign 2.75 In October 2009, the Government published a consultation paper in seeking views on the commencement of both parts of the changes.46 Responses were sought by January 2010, with a view to assessing the possibility of activating the changes in the April of that year, at the same time as it was proposed to confer on the ICO enhanced powers in relation to civil penalties. It does not appear that the responses to that consultation exercise have been published by the Ministry of Justice. However, the press has consistently opposed the commencement of the provisions and the then Government did not bring the new provisions into force in what were the final weeks before the General Election. Neither has the current Administration advanced the position: a decision is now said to await this Report.

¶2.76 Successive Information Commissioners have continued to press for the increased penalties to be brought into force. Mr Thomas repeated his case in his first witness statement to the Inquiry:47

¶"The main reform, in my view, should be an immediate ministerial Order to activate the prison sentence for s55 offences. The public controversy of the last two months, and public outrage at press misconduct, make the case for that reform more pressing than ever. Even if there has been improvement in press conduct since 2006 there is still no guarantee that this will remain indefinitely and I understand that illegal activity remains rife in other sectors. A strong deterrent is needed and it is vital that a clear signal should be sent that s55 offences are not trivial or "technical"."

¶His exasperation was evident in his oral evidence to the Inquiry:48

¶"I cannot for the life of me understand why the Government has now not activated that provision. … I am very disappointed as an individual now that still, despite all the material that has surfaced in recent months, the order has not been activated. It would be a very simple matter to bring that into force now, and my broad understanding back in 2008 was that it would only be a delay of six months or so, but that has not yet materialised."

¶2.77 The ICO campaign on s55 has continued under Mr Graham, but with a perceptible change of emphasis. The ICO submitted evidence to the consultation on activation of the new H provisions at the end of 200949 but, by this time, Motorman was presented as somewhat distant history. The ICO submission focused instead on examples, including half a dozen case studies, of the blagging of personal information by deceit in the routine criminal contexts of unscrupulous debt-collection, commercial espionage and profiteering, and personal grudge and intimidation. Judicial sentencing remarks in cases prosecuted are cited to the effect that the sentence maxima on s55 conviction did not allow a sentence to be passed commensurate with the criminality of the behaviour. An example is given of ICO investigators executing a search warrant:

1087

¶"They were greeted at the premises, by an individual who had a previous conviction for a section 55 offence, with the following comments. 'What's the maximum fine for this, £5000? I will write the cheque out now.'" At the other end of spectrum, Mr Graham explained in evidence that he wanted to:50

¶"…deal with the problem of the courts being limited to fines and then dealing with people who are of limited means and can only be fined about £100, and the court doesn't have the option of doing anything about a community sentence or tagging or curfew or whatever else might be involved. It's just the going rate is £100. It happened again the week before last. It's nothing." 2.78 Other general points are made in the ICO submission to the consultation exercise about the consequences of s55 not being capable of attracting a custodial penalty. Two points in particular should be noted:

¶"At present the offence of unlawful obtaining etc is not a recordable offence. It is not therefore recorded on the Police National Computer. Fingerprint impressions, DNA samples and descriptive details are not currently taken from those individuals who are prosecuted by the ICO for the section 55 offence (a descriptive form contains personal information relative to the accused person, for example, ethnic appearance, build, shoe size, glasses, hair, facial hair, marks, scars and abnormalities etc). If the penalties for this offence are increased to imprisonment the offence will become a recordable offence. This will not only underline the serious nature of the offence but will ensure that those convicted carry a meaningful criminal record."

¶The criminal record is both a matter of deterrence in its own right and also of assisting detection. The second point made is that, with a custodial penalty available, s55 crime could fit within the framework of the European arrest warrants; data crime is an easy cross-border activity, and the availability of simple extradition procedures would overcome jurisdictional inhibitions to criminal enforcement.

¶2.79 Subsequently, including in an update report to the Ministry of Justice in August 201151 and in the evidence that Mr Graham provided to the Inquiry, the ICO has sought to turn the spotlight in relation to s55 definitively away from the press altogether. As discussed above, that is articulated by way of an assertion that the practices of the press are no longer an H issue in relation to information blagging. From the perspective of the ICO, however, given the history of the s55 campaign, there is no doubt a degree to which the press are simply seen as the principal inhibition to the commencement of these provisions. The policy is now to seek to neutralise the hostility of the press and emphasising that the policy aim to be achieved now has little to do with their activities no doubt has that in mind. Mr Graham illustrated this in his evidence when he said:52

¶"In fact, I went to the Society of Editors conference in 2009 and said: 'it's so not about you. It's about NHS workers, it's about private investigators, it's about bank clerks, and it's frustrating not to be able to deal with that real challenge, which the Information Commissioner's office is concerned to deal with, because we're constantly met by the press saying, "This is terrible, the sky is falling, the sky is falling". It really isn't.'"

1088

¶2.80 That the tension between the ICO and the press on the s55 issue is still very much a current source of heat was vividly illustrated by exchanges between Mr Graham and Mr Rhodri Davies QC, asking questions on behalf of News International. This exchange is set out at some length here because it illustrated in microcosm, and in many ways can be regarded as the summation of, the long years of debate and lobbying on this subject, in Parliament, in successive Governments, and in other public fora. Mr Davies put it to Mr Graham that, if the behaviour of the press was not itself the current operational focus of the campaign, nevertheless:53 "The political problem, if I can call it that, that you have in getting the existing legislation into force is what we might call the perceived effect on the press. It's not the bank clerks who are campaigning against this; it's the perceived effect on the press which is your problem? "A. My problem is the press. It's not the perceived effect on the press, it's the behaviour of the press, worrying away at a penalty designed to deal with a problem which they say doesn't apply to them, and I say, "If it doesn't apply to you, get out of the way." "Q. Isn't the way through this, which might perhaps satisfy both parties, simply to exempt from the threat of a prison sentence anyone who is acting for the special purposes of journalism, artistic or literary matters, using the phraseology in Section 32? "A. How much of a good deal do you guys want? Excuse me, sir, for being heated about this, but you fought everyone to a standstill back in 2006/7. You did it again in 2009/10. You've got so many privileges and exemptions. It's perfectly possible for a journalist to do a decent job legally. There is Section 78 [of the Criminal Justice and Immigration Act 2008] on the statute book, applying the reasonable belief of the journalist that what they were doing for publication was in the public interest. It's going to be very difficult for anyone to strike that down, but there are some people who believe that that's more generous to the press than really should have been the case, but that was the deal. Now, if I understand it, you're sort of coming back for more - on behalf of your clients. "Q. What I'm trying to do, Mr Graham, is to point out a route through the problem, or one that bypasses the Gordian Knot, and I'm not quite understanding why this solution is not acceptable to you. H "A. Well, this isn't a negotiation about these things, but it sounds to me as if the representatives of the press want to be somehow above the law. Surely a free press operates within a framework of law, and a vibrant and healthy press, challenging those in authority and doing the job that it should be doing and the job that I joined the profession to do, operates within the law. Yes, okay, you sometimes have to apply the dark arts to get the story, and then you're accountable for it. And if you're really in trouble, that's the mitigation that you put to the court. But we can't keep having more and more carve-outs and reductions and special cases, surely. "Q. The point is, Mr Graham, that prison sentences do have a more chilling effect than the lesser sanctions available to the court - "LORD JUSTICE LEVESON: Is that right, Mr Rhodri Davies? I'd be very interested to see evidence about that, because one thing is for rock solid certain: interception of communications did have a custodial sentence attached to it, and it didn't seem to have stopped a great deal of activity.

1089

¶"MR DAVIES: Well, that certainly was true-up to 2006/7, I entirely understand that. "LORD JUSTICE LEVESON: I'm not, I think, trying to make a cheap point. I'm not doing that at all. But I am concerned about the evidence base for the assertion. I'm not stopping you, I understand the point, and of course you can pursue it. "MR DAVIES: Well, I think - really, what I'm putting to you, Mr Graham, is your own assumption, which is that if the sentences available for breach of Section 55 are increased and the range of sanctions available to the court is widened, then you think that that will have a beneficially chilling effect on people who would otherwise contemplate a breach of Section 55? "A. It would have a beneficially chilling effect on DVLC workers handing out car numbers and addresses based on those car numbers in exchange for money. It will have a beneficial chilling effect on health workers who apparently think it's perfectly okay to access someone's medical records in order to find the telephone numbers of their in-laws, who they're having a fight with, or the bank clerk in Haywards Heath who thinks it's fine to look at someone's bank records in order to provide the case in her husband's defence in a sex attack trial. That's what we're dealing with. What's that got to do with the press? If you're not doing this stuff, get out of the way. "Q. Yes. I entirely understand those problems."

¶2.81 Mr Davies took Mr Graham through some practical examples of where the public interest defence might be relied on by a journalist in a s55 case. These drew on the sort of material which emerged in Motorman. The exchange continued:54

¶"MR DAVIES: So that is a situation, Mr Graham, where, as I understand it, you think that the journalist might very well have a public interest defence? "A. I say it's arguable, anyway. "Q. It's arguable. That's the difficulty, isn't it? Because once we're into the territory of it's arguable, and it's a prison sentence if you're wrong, do we not have a chilling effect? "A. But all you have to advance is the reasonable belief that the story you're pursuing was in the public interest. Really, if you can't make that case, you shouldn't be in journalism. It's a very, very good increased defence for journalists. H "Q. I'm just wondering how far that goes. So you say if there's a reasonable belief that the story you're pursuing is in the public interest, then that would be a public interest defence to obtaining an ex-directory telephone number? "LORD JUSTICE LEVESON: I'm not going to allow you, Mr Davies, to use the opportunity to try and tie the Information Commissioner down. Let me say what I presently believe, and then people can make submissions in due course. I presently believe that the new potential provision contains both subjective and objective elements, so not only must the journalist believe that it's in the public interest to do so, but there must be reasonable grounds for that belief. Thereafter, if I follow up your earlier question, the Information Commissioner would have to decide whether there was evidence to rebut that defence before he thought of bringing a prosecution. If he thought of bringing a prosecution because he thought he could rebut the defence, it would be open to the journalist to advance the defence in court. If the court decided against the journalist, then it would have to decide on a scale how grave the particular offence was, and in my experience of sentencing criminal cases, which extends over 27 years, I don't think you'll find that there would be any question of a mandatory sentence in those circumstances at all."

1090

¶2.82 No further formal submissions were in fact received by the Inquiry on this subject and it now falls therefore to reflect on the extent to which this Report should seek to resolve the matter on way or the other. I do not, for the reasons set out above, accept that I should avoid doing so on the grounds that I can be confident that the culture, practices and ethics of the press are such that it is simply no longer a live issue within the Terms of Reference of the Inquiry. Bearing in mind those Terms of Reference, however, it is important to make clear two points.

¶2.83 The first point is that the thread of argument in Mr Thomas's original campaign (that increasing the sentencing maxima for s55 was a necessary element in increasing the profile of the data protection regime generally, and the seriousness with which it is regarded, whether politically of forensically), is not the concern of this Inquiry and not something on which this Report can or should express a view. Secondly, since the operational considerations currently being advanced in favour of commencing the increased maxima are explicitly said to be directed elsewhere than in the direction of the press, these are not considerations within the purview of this Inquiry and not matters on which it would be appropriate for this Report to have a determinative effect

¶2.84 S55, in other words, is not a provision of exclusive application to the press, and it is necessary that I should be suitably circumspect about any effect of considering the matter otherwise than in relation to the press. S55 is, however, a provision which, as amended, has a specific and modified application to the press, and to that extent the uncommenced amendments must be considered to be part of the special approach to journalism that is evident throughout the data protection regime. It is also a provision the history of which, up to and including the present day, has been dominated by the press's policy interests. It is impossible therefore to avoid reflecting on the history of the s55 issue in the context of this Report at any rate in relation to the press dimension to the policy.

¶2.85 This is not in any event, as indicated above, simply a policy issue at large. Parliament has considered this matter in extensive detail and legislated on it. The very strong presumption H must be that Parliament does not legislate in idleness. Deferred implementation of legislation, in the rare instances in which that is deliberate policy, is usually a matter of making provision for preliminary practical issues or, as in this case, to allow for contingent events. The s55 contingency might be described as a policy of waiting to see whether the mere uncommenced existence of the possibility of a prison sentence would itself prove to be a deterrent to criminal activity. There appears to be ample evidence that criminal activity comprising the knowing or reckless misuse of personal information continues to be a real problem, and that specifically the absence of a potential custodial sentence (which would therefore permit sentences short of custody such as a community penalty) has emerged as a contributory factor. This is not least because, as Mr Graham made clear, a financial penalty must be related to means to pay and those of limited means will therefore face potential sanctions which have little correlation with the gravity of the offence and the potential for harm.

¶2.86 The only reason which has been cited to the Inquiry for failure to commence the provisions for increasing the maximum potential sentence is the potentially damaging effect that it would have on journalism. These are not considerations which, in my view, can reasonably argued to be persuasive, let alone determinative.

1091

¶2.87 In the first place, the argument that the prospect of custody would have a differential 'chilling' effect on lawful and ethical journalism from the prospect of a financial penalty is one which it is barely respectable for national press organisations to advance at all. Its necessary implication is that the prospect of a criminal conviction can, of itself, be regarded as a tolerable business risk, and a criminal fine a tolerable overhead, in journalism. This says little more than that 'unchilled' journalism is an activity which takes calculated risks with deliberate and indefensible criminality. This is an argument for criminal impunity including (as it was put before the Inquiry) by way of a plea for indemnity from the otherwise universal application of criminal penalties; it amounts to special pleading to be placed above the law. I put the matter starkly, because no-one reading this Report should be in any doubt as to the true nature of the argument being advanced on behalf of the press in its most unqualified form.

¶2.88 There is a more respectable version of the argument that there is a chilling effect in this provision. That version is not a contention that the press should be indulged in committing calculated criminality. It is an argument that the boundaries in this territory between what is criminal and what is not are not clear enough to make it safe for journalists to operate confidently. It is not an argument therefore about the consequences of criminality but about the risks of crossing criminal boundaries unwittingly. Where the boundaries are unclear, the possibility of a custodial penalty raises the stakes to the extent that decent journalists will have to take a risk-averse approach and give them a wide berth. The result, so the argument goes, is that some areas of investigative journalism on the right side of the law will be lost and that this would be contrary to the public interest.

¶2.89 This remains an argument which envisages journalism tracking the boundaries of crime in a way which is not, and has not been over the years in which the s55 issue has been debated, empirically evidenced as a genuine operational problem to any degree; neither does it deal with the ethical (and indeed legal) questions which are raised by behaviour which is only just on the right side of crime. But the important point is that it is essentially an argument about whether the provision made in the new defence to cater for journalistic operations where they do sail close to the wind is adequate. If the defence deals satisfactorily with the boundaries between criminal and lawful journalism, then the question of the ultimate penalty must be a genuine second-order issue.

¶2.90 It is hard to see how the new defence could go any further. If a journalist engages in a course H of conduct which prima facie crosses the criminal boundary marking the unlawful acquisition of personal information, but can show that he or she was acting with a view to publication and in the reasonable belief that it was in the public interest, there can be no conviction. Note that it is not even necessary to show that the conduct was in fact, in the end, in the public interest. There is no alternative to asking the journalist to establish that the belief was genuine, because its basis will be uniquely within his or her own knowledge. And if the belief was neither genuine nor rational it is hard to see the case for a defence to crime. The provision made by the new defence to give honest journalists trying to respect the boundaries of the criminal law confidence in doing so, appears to be straightforward to understand, and more than adequate in giving honesty the benefit of the doubt.

¶2.91 I am, therefore, entirely unpersuaded that the argument that there is a possible chilling effect on legitimate journalism is a reasonable one, and should be regarded as a proper reason in itself for continuing to resist giving effect to the legislation. Much more the point: Parliament has already settled the matter from a policy point of view. To the extent that the press effectively wishes to reopen not the question of penal policy but the matter of the substantive law itself, it is both too late and devoid of merit. Without suggesting that no other formulation of the new defence is imaginable, Parliament has given very close attention to the alternatives, and settled on something which, on any fair analysis, is fully capable of being made to work for the press. 2.92 I am conscious that in recommending the activation of the amendments to the Data Protection Act created by the Criminal Justice and Immigration Act 2008, this Report is dealing with an issue with considerable history, and not just as a matter of addressing the culture, practices and ethics of the press in relation the acquisition and use of private personal information. It is also addressing the operations of the press as powerful lobbyists on self-interested questions of media law and policy. On both of these grounds, I conclude that the public interest, taken in the round, favours there being no further delay in the implementation of this measure. 2.93 As indicated in the Government consultation paper,55 therefore, I recommend that the necessary steps are taken (by statutory instrument) to increase the sentence maxima on conviction for an offence under s55, to include, in addition to the current fines, custodial penalties up to the statutory maximum on summary conviction, and, on conviction on indictment, up to two years' imprisonment. 2.94 It is important to underline that I also recommend that the enhanced defence for public interest journalism be activated at the same time.

1092

¶Prosecution powers of the ICO 2.95 Before concluding this part of the Report, a number of further aspects of the criminal law functions of the ICO in relation to the press fall to be considered. One particularly important piece of context to the s55 debate is the fact that this is the only offence in respect of which the ICO has prosecution powers. There are other criminal offences which are also contraventions of the data protection regime when committed in relation to personal information (which, incidentally, already attract the possibility of custodial sentences). There may be considerable overlap between these other offences and s55. Examples include: (a) phone hacking contrary to the Regulation of Investigatory Powers Act 2000;56 (b) computer hacking contrary to the Computer Misuse Act 1990;57 (c) offences of corruption, bribery and aiding and abetting misconduct in public office; and H (d) inchoate and accessory offences including attempt and conspiracy. 2.96 There is indeed an argument that, since the first data protection principle requires that all acquisition and use of personal information must be fair and lawful, all criminal offences in relation to personal information within the meaning of the data protection regime will also constitute a breach of that regime.58 In practice, in any case in which a breach of the data protection regime may also constitute a criminal offence other than under s55, the ICO will effectively hand the matter in its entirety, and defer wholly, to the police and the CPS. That is at least in part because all of the other offences comprehend, including by way of higher sentencing maxima, a much wider spectrum of seriousness. That is important context for the decision in Motorman itself which, effectively, was to stand back from the prosecution process while the police and CPS proceeded with corruption and conspiracy prosecutions. But it has two important practical consequences.

1093

¶2.97 The first consequence is that it effectively relegates s55 to a wholly residuary position, in practice only of real use in cases where all other criminal possibilities have been eliminated. But the process of elimination itself may, including by reason of delay, weaken the prospect in the end of bringing s55 charges. Secondly, it also puts the ICO at a disadvantage in considering cases of breach of the data protection principles in the round, including giving full consideration to alternatives to prosecution. So in cases at the extreme end of breaches of the principles and rights of the regime, the expert regulator is in danger of being left out of the picture altogether.

¶2.98 Mr Graham explained the position in his witness statement to the Inquiry:59

¶"In some circumstances, such as an allegation of unlawful processing, I have to rely on the police and the CPS to indicate whether they consider that an offence under another relevant Act has been committed before I can properly assess whether there has also been an associated breach of the data protection principle on which I might act. On the other hand if my office comes into possession of evidence which suggests that an offence has been committed under other legislation, I would pass this directly to the police or suggest to a complainant that he or she does so….. "It is possible that, in some circumstances, personal data could be obtained in a way that suggests the commission of offences under both another Act and under section 55 of the Act. The investigation of offences which carry a custodial penalty takes precedence over the investigation of offences, such as those under the Act, which do not. Usually, the police will take the lead in investigating where penalties that carry a custodial penalty are suspected. They can consider the offence under section 55 of the Act as part of their investigation if they choose to do so. Whilst my office will pass relevant information on to the police to assist them in any investigation, it does not make good sense for us to run our own investigation in parallel."

¶2.99 As considered at length above, this cannot stand as a full account of the operational inaction of the ICO in relation to the press and its involvement in Operation Motorman. But it does suggest a weakness in the scheme of the powers and functions of the ICO. It is a weakness which would be remedied in part by the activation of the higher sentence maxima for s55 because, at least, it would address the problem of its role as an offence of last resort by strengthening the ability of the ICO to prosecute s55 cases which also constitute other offences. But it would not address the position of the ICO as a prosecutor of last resort or the H disabling effect of that on its consideration of the exercise of its other regulatory functions in relation to serious abuses of personal information.

¶2.100 This is a point of considerable importance for that strand of opinion in relation to phone hacking that urged that the primary response of this Inquiry should be to ensure that the existing law (and, in particular, the existing criminal law) is properly enforced. As fully set out above,60 the huge investment of the resources of the Metropolitan Police in their current Operations Weeting (phone hacking), Tuleta (computer hacking), and Elveden (corruption) is both unsustainable indefinitely and unrepeatable in the future. It is, however, noteworthy that all concern the possibility of the press committing crimes which involves the acquisition of personal information in breach of the data protection principles.

1094

¶2.101 Information crime in contexts involving neither national security issues nor the furtherance of other criminal purposes (that is to say, crime constituted wholly by the extreme violation of personal information privacy), is a matter which cannot hold a place at the top of the police agenda in competition with the many other priorities that the police face. Nor, in any event, can the police be expected to invest in the deep expertise in personal information privacy which the data protection regime envisages in for its own regulatory authority. Furthermore, the handling by the police of these cases is effectively binary: charges are either brought or dropped, without consideration of law enforcement issues falling short of criminal liability. The present disposition of prosecution powers therefore presents a threat to the proper enforcement of privacy crime in the future, including in relation to the press.

¶2.102 One possible way to address that problem would be to enable the ICO to prosecute breaches of the data protection regime which constituted criminal offences whether or not they did so as a result of s55. This would, in particular, enable the ICO to deal with cases of data abuse going beyond the processes of first acquisition of the information. It would have a number of specific advantages. It would:

¶(a) relieve the police and CPS of the pressure of privacy crime on their priorities and resources; (b) place prosecution in the hands of an expert regulator who would be well placed to investigate cases and if appropriate place their full criminality before the criminal courts; (c) enable cases to be dealt with within the rounded context of a regulatory regime which has a range of other operational options falling short of prosecution.

¶Three matters would, however, have to be addressed in taking forward thinking in this context.

¶2.103 The first is the necessity of acknowledging, again, that this is not an issue of sole application to the press, and that it is beyond the purview of this Inquiry to address its implications in areas which have nothing to do with its terms of reference. As against that, however, it is necessary to note the very close association of the issue of prosecution powers with the s55 issue as discussed extensively above. And whereas it is to a degree speculative to reflect on the Motorman case itself from this perspective, there are genuine questions, including those raised at the time and since by the ICO itself, as to whether in the circumstance an H information regulator, alive to the magnitude and nature of the breach of the law and good practice of the data protection regime and armed with a full range of responses up to and including prosecution for serious offences, would not have afforded the best prospects of effective law enforcement and of making the case a turning point for the good in the culture, practices and ethics of the press in the handling of personal information.

¶2.104 The second matter that would need to be addressed would be the capability and governance of the ICO itself in handling any enhanced prosecution functions. In so far as those questions have wider implications they are addressed more generally below. But it would be highly desirable to ensure that in all of its prosecution functions there was excellent liaison between the ICO and the police and CPS. It might, for example, be desirable to make the exercise of any powers to prosecute s55 cases which also constitute or may constitute other criminal offences and criminal breaches of the data protection regime falling outside s55 formally the subject of a duty to consult with the CPS.

¶2.105 The third matter concerns the position of the press as the potential subjects of criminal investigation by the ICO. Under that heading two issues in particular present themselves. The first relates to the circumstances in which the ICO might bring a prosecution as opposed to relying on its civil regulatory powers. That is a question which would need to be addressed by reference to the public interest. At the invitation of the Inquiry and following consultation, the Director of Public Prosecutions has issued guidelines for prosecutors on assessing the public interest in cases affecting the media.61 The ICO would be expected to follow these guidelines in the exercise of any enhanced prosecution powers and indeed in relation to its current powers. Mr Graham has already indicated that he is:62

1095

¶"happy to give an assurance that I will not seek to prosecute journalists who are genuinely pursuing enquiries in the public interest, even if those enquiries do not ultimately bear fruit."

¶2.106 Subject to the point of generality noted above, my conclusion, therefore, is that proper and proportionate enforcement of the criminal law in relation to press abuse of personal information would be enhanced by extending the prosecution powers of the ICO to include offences which comprehend a breach of the data protection principles in addition to the offence created by s55 of the DPA, coupled with a duty (whether formal or informal) to consult the CPS on such prosecutions, and the formal adoption by the ICO of the CPS guidelines on media prosecutions.

¶2.107 I recommend also that the ICO take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to handling the issue in the aftermath of Operations Weeting, Tuleta and Elveden, on the basis that the priority currently being given by the police to addressing this form of alleged criminal behaviour is not sustainable indefinitely, and with a view to ensuring that the ICO is well placed to fulfil any necessary role in this respect in future.

¶2.108 The position of the ICO as prosecutor of last resort does not fully account for evident weaknesses in its handling of the question of criminal investigations in relation to the journalists involved in Operation Motorman. The ICO has prosecution powers at all because it is uniquely placed to view personal information privacy crime in the full context of its regulatory regime as a whole. This includes the perspective of the victim in such a context. That is a responsibility which it does not appear was fully engaged let alone discharged. I consider, however, that the enhancement of the prosecution powers of the ICO has a potential positively to support that position of overview and overall direction regarding information privacy breaches that are so serious as to enter the criminal spectrum. Further, it is reasonable to conclude that it could H help to dissolve artificial boundaries, avoid confusion of accountabilities and support a better focus on the nature of the conduct and its impact on the individual.

¶2.109 A final issue to be considered within the framework of formal criminal law enforcement is the matter of sentencing. When dealing with the criminal law generally,63 I recommend that the Sentencing Council of England and Wales be asked to prepare guidelines in relation to information privacy and misuse offences (including computer misuse): for the sake of completeness, it is sufficient simply to repeat the recommendation and refer to the reasons for it.

1096

¶Conclusions and recommendations on the legal framework 2.110 The recommendations set out above are not intended to do other than provide for more effective enforcement of the existing principles of law as they stand, and for a fairer, more even handed approach to the reconciliation of existing rights within those principles in cases in which they may conflict. They are also intended, importantly, substantially to simplify the law and make it more accessible to those, that is to say both press and the public, whom it is designed to serve. There are implications in these recommendations also for the legal system, the legal profession and the courts. Although the data protection regime is intended to sit lightly on businesses and not regularly to trouble the world of litigation, that is precisely because it is explicit in the provision it makes as a matter of law; in the rare cases where it does need to enter the legal system to resolve a disputed issue, the fundamental liberties with which it deals, and the sensitivity with which it deals with them need to be recognised for what they are.

¶2.111 As Mr Coppel has pointed out, the European Commission is currently considering replacing the existing Data Protection Directive with a directly applicable regulation. The present proposed Regulation would leave it to individual Member States to provide in detail for the exemptions or derogations it sets out. Those include provision relating to the processing of personal data for journalistic purposes. That means that it would be for Parliament in due course to come up with a suitable formulation, within the limits of what the regulation eventually requires. In other words, the expectation is that Parliament will have to revisit this topic in any event.

¶2.112 It would be unfortunate if that were regarded as reason for legislative inaction in the meantime. Any new regulation would itself, of course, have to make general provision within the overall requirement of the ECHR for a balance between Articles 8 and 10, and indeed would any UK domestic legislation. The risk posed by the prospect of a new regulation that any legislation prompted by this Report would have to be revisited seems to me in this respect to be of modest proportions, and to be outweighed by the need to make progress on amendment to the 1998 Act, both as a matter of law and of policy.

1097

¶Chapter 6 The Relationship: the ICO and the Press 1. "Too big for us?" 1.1 This section of the Report takes its title from the passage in Mr Owens' evidence where he describes an exchange in a meeting he says took place with Mr Thomas and Mr Aldhouse in which he sought to explain the full extent of the Motorman 'treasure trove'. Mr Owens said:1

¶"Well, it was at the end, I basically said what we have here, if we haven't got any public defence we can go for everybody, from the blagger right up to the newspaper, at which point there was a look of horror on Mr Aldhouse's face and he said, "We can't take them on, they're too big for us", and Mr Thomas just sort of bemused, deep in thought, just said, "Fine, thanks very much, Alex, pass my compliments on and congratulations to the team for me, job well done." And that was basically it."

¶Both Mr Thomas and Mr Aldhouse have said that they had no recollection of the meeting and disclaimed the language attributed to them by Mr Owens in any event.

¶1.2 Mr Owens, however, amplified in his evidence that he had formed the clear impression that there was, if not an express instruction or even express language, a cultural understanding within the ICO that the press were too big for the office to take on:2

¶"The decision not to pursue any journalist was based solely on fear – fear of the power, wealth and influence of the Press and the fear of the backlash that could follow if the press turned against ICO."

¶1.3 Mr Thomas specifically challenged Mr Owens' reliability as a witness in this context, even suggesting that he may have had a motive, in the light of "a number of performance, disciplinary and grievance issues between Mr Owens and the ICO", to put the latter in a poor light3 this is an inference that Mr Owens, in turn, resisted.4 H 1.4 Mr Thomas and Mr Aldhouse were also emphatic that there was not at any time in the ICO a deliberate or explicit policy of holding back from taking action in respect of the press, or from engaging directly with the press, whether from fear or otherwise. As we have seen, a number of operational rationales have been given in explanation of the 'roads not taken'.

¶1.5 It is not appropriate now for me to seek to resolve the evident dispute between Mr Owens and the ICO and, in particular, it is not necessary to determine whether the conversation as recounted by Mr Owens took place or not. It is not even necessary for me to determine whether there was a deliberate, explicit or promulgated policy in the ICO of not 'taking on' the press which was operative during the course of the Motorman decision-making. The question addressed in this part of the Report relates to something more fundamental, and at the same time less easy to pinpoint, which is the extent to which there may have underlying assumptions in the culture of the ICO and its leadership which instinctively held them back from an engagement with the press which their knowledge of the extent of the problem, and an objective assessment of their available powers, functions and options, might otherwise have suggested. Regardless of whether the words were ever uttered, it is legitimate to ask whether 'the press are too big for us' did, in fact, accurately identify some reluctance, or lack of confidence, in dealing with the press which goes some way to explaining events.

1098

¶1.6 With the single (and, in the event, salutary) exception discussed below, the ICO does not appear ever seriously to have tested its regulatory powers in relation to the press. Successive Information Commissioners have taken the view that the law must be understood to discourage them from doing so. Although it is clear that there are features of the current data protection regime which seem to make it unnecessarily difficult for the ICO to apply the law to the press, the conclusion that the press is not the business of the ICO is not one for which any authority in law can, in the end, be claimed. Moreover successive Information Commissioners have never sought to draw attention to problems in applying the current law to the press. If there was a case for political campaigning for changes to the law, it is legitimate to ask why it was not addressed to the impediments to mainstream civil law enforcement rather than the relatively more peripheral issue of criminal penalties.

¶1.7 Even more notable has been the reluctance of the ICO to engage informally with the industry (otherwise than by way of the PCC or other intermediary bodies), whether as a matter of law enforcement, of promoting good practice or simply of business education and communication. Successive Information Commissioners assured the Inquiry that the press was simply not a priority for the ICO's attention. And yet Operation Motorman was one of the biggest operational cases to confront the ICO and the basis for two reports to Parliament and years of campaigning with the PCC and successive Governments. This was a case with the culture, practices and ethics of the press at its heart. Furthermore, the current press issues relating to phone hacking have created one of the biggest crises of confidence in the integrity of private information to have been experienced in the UK.

¶H 1.8 On the face of it, this phenomenon is not straightforward to understand. The question before the Inquiry was whether there is evidence of a failure of regulatory will on the part of the ICO in relation to the press, going beyond the specifics of the Motorman case, and the technical imperfections of the legal regime, to a more general reluctance to discharge its functions in this area.

¶The ICO and The Sunday Times 1.9 In considering this question, it is interesting to turn first to a series of events which predate many of the key developments in the Motorman case. It was put to Mr Thomas in oral evidence that the ICO had invited the editor of The Sunday Times, Mr Witherow, to attend interview under caution in 2003 in respect of possible breaches of s55 of the DPA in relation to the tax affairs of Lord Levy. Mr Thomas said he had no knowledge of this whatever, but having been put on notice of the question earlier he had checked with Mr Aldhouse, with whom the account 'rang a faint bell'. Mr Thomas offered this thought:5

1099

¶"If that had been the case – and can I speculate? If the Office had invited the editor and had been rebuffed, that might perhaps have influenced people at the investigatory level as to the problems of interviewing people from the press. I don't know." He suggested that it might have been before his time. 1.10 The history appears to have been that The Sunday Times had published an article in 2000 about the tax affairs of Lord Levy which the latter had sought to prevent by means of an application for an injunction which had come before the then Mr Justice Toulson. According to Mr Witherow,6 that attempt failed "because the judge decided that publication of the information was firmly in the public interest"; Mr Witherow described Mr Thomas as subsequently seeking to interview him under caution about the Lord Levy story but "again this was rebuffed because of our public interest defence", in support of which the judgment of Toulson J was deployed. Mr Witherow thought the ICO had accepted that.7 Eventually, the Sunday Times ran a front page story on 29 October 2006 connecting Lord Levy with a 'cash for honours' scandal. 1.11 The matter was explored further with Mr Thomas by Mr Rhodri Davies QC on behalf of News International.8 Mr Thomas had taken up his post in November 2002 and it was in fact on 11 December 2002 that the ICO wrote to Mr Witherow inviting him to attend an interview under caution. The signatory of the letter was an investigator in the ICO junior to Alex Owens. The proposition which, in effect, Mr Davies put to Mr Thomas was that the attempt to interview Mr Witherow was the direct result of powerful and well-connected pressure being applied to the ICO by Lord Levy rather than any independent operational consideration, and was in effect misconceived in the first place because it was plain that nothing other than investigative journalism in the public interest was in issue. Whether or not that was the case is not to the purpose of this Inquiry, although Mr Thomas accepted that Lord Levy had, around the relevant time, "expressed quite strong frustration that my office had not been much use at sorting out his complaints" and that this was not the first time the office had been subject to high profile criticism from a public figure who had gone to them with a problem. 1.12 This episode is of interest to the Inquiry not because of any light it may shed on the susceptibility of the ICO to operational pressure from high profile complainants, but because it stands out as the only occasion on which, so far as we have been able to establish, the ICO attempted to exert its functions directly in relation to the press. Mr Davies put it to Mr Thomas that this was, in fact, the only occasion upon which "the big stick of an interview H under caution was wielded" by the ICO against the press; Mr Thomas confirmed that he was not aware of any other example in which the ICO "directly approached a journalist or editor". Moreover, Mr Thomas sought to distance himself from the Witherow decision; he suggested that it was taken at a junior level and that it did not look entirely defensible. The contrast with the absence of any approach to a journalist or editor in the Motorman case was made by Mr Davies for a different purpose from that of the Inquiry, but is nevertheless memorable. 1.13 The issue of the impact on the ICO of its rebuff at the hands of the Mr Witherow is not unimportant. The episode evidently remained in the memory of The Sunday Times, and it is interesting to note that the one or two subsequent occasions on which that title and the ICO had occasion to interact had a distinctively adversarial quality.

1100

¶1.14 The first concerns the editorial published in The Sunday Times on 29 October 2006 which is the day the paper led on its front page with the Lord Levy 'cash for honours' story. The thrust of the editorial was in opposition to the campaign by Mr Thomas for an increase to the maximum penalty for breach of s55 of the DPA; it cast the proposition as offensive to democracy and free speech and it was not sparing in the aspersions cast on Mr Thomas's intentions in this respect. A couple of brief excerpts will give a flavour:9

¶"…the role of the press in protecting the public by exposing the abuses of the powerful. Newspapers had already been doing this for centuries when he took up his post four years ago. This duty of the media is vital in the struggle to maintain an open society. Yet Mr Thomas would send reporters to prison for fulfilling it." "Mr Thomas is complicit in placing another brick in the wall that the state is building to protect itself from unwanted scrutiny. This newspaper's front page story today on cash for honours is precisely the sort of investigation that political parties would prefer not to happen. Mr Thomas is doing his bit to help them."

¶The editorial also alluded to What Price Privacy? as a 'little noticed report'. Mr Thomas wrote to the paper a couple of days later in response, but his letter does not appear to have been published.

¶1.15 Mr Thomas characterised this editorial as an unfair representation of his campaign, and accordingly as a recognisable part of the concerted press campaign to oppose it.10 More controversially, he said that he made a connection in his mind between the editorial and the meeting he had had with Les Hinton and others on the previous Friday as part of his PCC campaign, at which of course the difference of views on the s55 issue had played a prominent part. When he aired this thought in the Inquiry, it was subjected both to detailed rebuttal and to further challenge of his attitude to the press more generally. Mr Witherow made explicit the belief of The Sunday Times that, because the ICO had sought to interview him under caution in 2002, it was a matter of concern that Mr Thomas would not have adequately considered issues of the public interest in investigative journalism in running his s55 campaign.11 Further, Mr Davies, on behalf of News International, put it to Mr Thomas that it was relevant that, on the intervening Saturday, The Times had published an interview with Mr Thomas that he had given a few weeks previously in an effort to obtain some press coverage for an international H data protection conference in London the following week.12

¶1.16 Mr Thomas accepted the evidence that there was no connection between the meeting with Mr Hinton and the editorial, concluding: "It appears I'm even wrong to raise questions…".13 But it appears significant that, in rebutting the idea of a connection between the editorial and a meeting two days earlier, NI chose instead to make a connection between the editorial and the ICO attempt to interview the editor of the newspaper four years earlier. Whatever Mr Thomas and the ICO had learned from that attempt, the impact on The Sunday Times was manifest.

1101

¶1.17 A further exchange took place several weeks after the publication of the editorial. The managing editor of The Sunday Times, then Richard Caseby, wrote to Mr Thomas on 14 December 2006,14 in the aftermath of the publication of What Price Privacy Now? (and after battle lines had effectively been drawn over the s55 policy issue) to express "grave concerns" over the publication in that report of further details of the Motorman information, particularly as it related to The Sunday Times. The tone of the letter can be described as confrontational; it alleges that the report was "clearly defamatory" of the publishers and managing editor (Mr Caseby himself), raises a number of points about the Motorman evidence and, before concluding with a request for an explanation and remedial steps as soon as possible, states that the writer did "not believe that your conduct in this matter can be described as fair, or that it meets the standards which one should be entitled to expect from a regulator".

¶1.18 Mr Thomas' response of 2 February 200715 was a measured explanation of why the ICO had been entitled, or to an extent required, by virtue of its role and functions to deal as it had with the information published in What Price Privacy Now? but indicated that, on revisiting the figures connected with The Sunday Times, it had discovered an error in the report. Rather than identifying the title with 52 alleged transactions involving 7 journalists, it should have identified it with only 4 transactions and a single journalist. For this the letter offered an unqualified apology, and Mr Thomas explained that the error was corrected in letters to Parliament and to all the recipients of the report.16

¶1.19 This account of interactions between the ICO and The Sunday Times is set out in detail here because it brings into focus the following issues:

¶(a) It raises again the question of distance between the senior leadership of the ICO and operational decision-making with very high profile and long lasting strategic consequences. Mr Thomas was apparently not involved in and had no foreknowledge of the decision to try to interview Mr Witherow, and accepted that the way the decision was taken was unsatisfactory. There were lessons to be learned in this about the vital need for the senior leadership to be sighted on and involved in major operational decisions of this reputational nature. (b) It illustrates with some clarity what might be described as the ideological opposition of the press to the assertion of law enforcement powers, even in criminal matters, and the lack of objectivity and restraint with which that resistance is manifested; this is a matter considered extensively elsewhere in this Report. H (c) On the other hand, it also illustrates the dangers to the operational credibility of a regulator such as the ICO in investing so heavily, prominently and persistently in a political campaign to which a regulated sector was obviously deeply antagonistic. (d) It can hardly be doubted that the reverberations of these adversarial encounters (many of which were played out in public) would have been felt personally by Mr Thomas and by the staff of the ICO. Whether or not Mr Thomas and Mr Aldhouse felt or articulated the view that the press was 'too big for us', I consider it almost inevitable that Mr Owens and his small team (to whom operational decision-making was effectively consigned) learned that lesson from the experience of trying to utilise their powers on the press in the form of the editor of The Sunday Times.

1102

¶Operational 'monkey tricks' 1.20 With that significant narrative thread in mind, it falls to consider what can be known or can be deduced about the thinking of the ICO more generally in relation to the press. Mr Aldhouse denied being party to any "timorous approach" to the press17; as well as disclaiming the attitude that 'the press are too big to take on' he cited his experience of discussions in 1996 which was the run up to the passage of the 1998 Act. He said that:

¶"we were quite happy to stand up to the media and try to negotiate with them. I wish I still had the copies of the press gazette articles roundly attacking Elizabeth France [the then Data Protection Registrar - the ICO predecessor body] and myself. So I don't fear the media…"

¶It might be observed, however, that these experiences were evidently not on the operational side of the business, and that, in any event, Mr Aldhouse evidently considered his role to be at some distance from the operational decisions where fear of the press might have played a material role.

¶1.21 The Inquiry pursued explicitly with Mr Thomas himself the question of whether the power or influence of the press, or his perception of it, in any way affected the operational decisions taken in the Motorman case. He said that it did not, nor did he have any fear himself of the press.18 As we have seen, both Mr Thomas and Mr Aldhouse rejected any suggestion that there had been a deliberate, explicit or promulgated policy of holding back from taking any proactive operational measures in respect of evidence of press contravention of the legal requirements of the data protection regime or in respect of promoting good practice in data protection matters within the industry. Again, it is not the concern of this Part of the Report to establish the existence or otherwise of a formal policy, but to explore the nature of any significant cultural or psychological predispositions within the ICO and its leadership not to assert itself with the press or at least not to do so in an adversarial or confrontational way.

¶1.22 Standing back to consider the explanations for the various paths not taken by the office in the Motorman case, the following reflections presented themselves. The explanation for targeting the 'middlemen' (that is to say, the investigation agencies) rather than the commissioning journalists proceeded by reference to an analogy with drug dealers which H I consider misconceived.19 This was not a market in which the private investigators were a dominant power, controlling supplies of standard goods and pushing them on a disadvantaged clientele. It was a market in which the press were the dominant power, commissioning bespoke products from what must be assumed to be a limited number of investigators willing to obtain them at some risk to themselves.

¶1.23 Indeed, Mr Thomas himself, in explaining the stance taken in What Price Privacy?, stated that it was the journalists who were driving this market.20 He said the same thing in explaining his policy decision to proceed by engagement with the PCC: the focus there also was on stopping the market.21 Accordingly, it is difficult to accept at face value the logic of concentrating exclusively on the middlemen on the grounds that they were "organising the illegal trade".22 The middlemen were on the supply-side, but it was the power of the demand-side which must account to a large degree account for the existence of the trade. The conclusions of What Price Privacy? put the point rather well:23

1103

¶"These offences occur because there is a market for this kind of information. At a time when senior members of the press were publicly congratulating themselves for having raised journalistic standards across the industry, many newspapers were continuing to subscribe to an undercover economy devoted to obtaining a wealth of personal information forbidden to them by law. One remarkable fact is how well documented this underworld turned out to be."

¶1.24 At least one operative reason why the ICO took no direct enforcement action against any journalist, editor or proprietor in response to Motorman (and, in particular, no prosecution action) was evident apprehension about the likely response of the press to any attempt to do so. Mr Thomas told the Inquiry that, in planning to wait and see how criminal proceedings against the investigators and public officials fared before actively considering any further enforcement action:24

¶"I was also conscious that any action against journalists would be a major logistical, evidential and legal challenge, would almost certainly be strongly resisted and would be very expensive for an Office with very limited resources."

¶1.25 The evidential and legal challenges in the way of prosecution (which including the protection afforded to journalistic materials and sources) may have been significant, but the prospects of facing combative defence litigation appeared to be a disincentive in its own right. Counsel instructed by the CPS in Operation Glade was reported to have described the experience of dealing with press defendants in these memorable terms:25

¶"London counsel indicated that the journalists were interviewed and were found to be tricky, well armed and well briefed, effectively a barrel of monkeys."

¶1.26 Pressed as to whether this suggested an excessively circumspect approach on the part of the ICO in the face of potentially powerful prima facie evidence of criminality, Mr Thomas put it this way:26

¶H "Well, I have to look at it from all points of view, I suppose, but I can see that the media would not like any of their journalists being prosecuted and I suspect they would, for example, argue there's a public interest in being able to ensure freedom of expression. Now, I don't believe that, I don't accept that, but I – it's one thing as to whether or not that would be successful, but one can anticipate that that sort of point would have been raised and it would have engaged the office and bogged down the office for many years."

¶1.27 In other words, there was an apprehension of the unreasonable or unfair deployment of the rhetoric of freedom of expression as a litigation tactic to deterrent effect. Without commenting on its justification in this context, this perception is noteworthy in its own right not least because it was evidently a general perception within the ICO team. Mr Thomas recalled a conversation within the office around 2007 along the lines:27

1104

¶"Thank God we didn't take the journalists to court. They'd have gone all the way to Strasbourg." In other words, they would have challenged any action we would have taken, we would have gone right to Strasbourg, the Court of Human Rights, Article 10 issues coming in. We'd seen all the material being thrown at us during What Price Privacy? and the Bill."

¶1.28 There was a gut instinct that litigation against the press would present the ICO with enormous difficulties.28 These were evidently perceived to be difficulties over and above the normal litigation issues of accessing and deploying evidence, navigating the law, and the overall strengths and weaknesses of the case. It can be reasonably inferred from the evidence that the perception extended to:

¶(a) the likelihood of a generally aggressive stance; (b) the generalised deployment of the rhetoric of freedom of expression beyond the fair articulation of balance contained in the law; and (c) the expectation that that approach would extend beyond the confines of any single case of criminal litigation, and even beyond the bounds of any single attempt at regulatory action of whatever nature, to a generalised stance of hostility towards the function of the ICO as a regulator. The evidence the Inquiry considered29 suggests that this apprehension was almost certainly justified on the basis that the press have a cultural inclination to be defensive and to utilise attack as the best form of defence. It was plainly operative.

¶1.29 The press, in other words, as an object of regulatory contemplation, was seen as trouble. That is so whether it was actively making operational mischief in response to regulatory attention or impassively declining to address its culture, practices and ethics itself (as Mr Graham memorably developed the metaphor, "if we're talking monkeys, it's see no evil, hear no evil.")30

¶H 2. The struggle for a profile: political campaigning and the power of the press 2.1 At the beginning of this section of the Report, reference is made to the problematic reputation of the data protection regime. This is a burden with which successive Information Commissioners and their predecessor bodies have struggled constantly. Trying to get the issues surrounding data protection to be better known and understood is a vital precursor to improving compliance and standards. Communication and profile are in turn vital components of raising awareness. The ICO needs publicity for its functions. To a degree, it needs the press, and therefore has a motivation or predisposition to court it, or at least to view it as a potentially ally. To what may be a significantly greater degree, it is also vulnerable to press hostility and suppression or damage to its reputation which can translate directly into weakened operational capability.

1105

¶2.2 Raising the profile of data protection is an important part of the remit of the office and of the personal remit of its figurehead Commissioner. Both Mr Thomas and Mr Graham have clearly and commendably shown real commitment to, and significant leadership and personal investment in, that very challenging remit. Mr Thomas put it in this way:31

¶"When I started, data protection had quite a poor reputation. It was seen as a bit nerdy, not taken very seriously across many organisations. I think my office probably had some responsibility. I used to say that, you know, we were seen outside as the temple of data protection and being the high priests of data protection, and I wanted to destroy that sort of approach, and therefore I was trying to make us much less esoteric, much more avoiding the technical language. I mean, a data subject is a man, a woman, a child, not a data subject. So I took a much more practical down to earth approach. Our slogan was that we are here to help organisations who want to get it right, but we'll be tough on those organisations which don't want to get it right…"

¶2.3 Mr Thomas also explained his profile-raising function with particular reference to the wider role he saw for the two What Price Privacy? reports:32

¶"I was personally involved in this promotional activity to a very considerable extent. The Commissioner – as the personification and leader of the ICO - is obviously expected to be a visible part of all major activity. In this case, I attached particular priority to the issue and also viewed promoting the reports as a tangible way of fulfilling a wider ambition to get data protection taken more seriously."

¶2.4 The potential power of the press as a friend of data protection however, also confronted the ICO with an awareness of its potential power as an opponent. Mr Thomas was aware of the obvious risk inherent in his strategic response to Motorman by way of the publication of the What Price Privacy? reports and the s55 campaign:33

¶"We were aware from the outset that the media would probably ignore or show hostility to our reports. This presented two problems:

¶H • The media usually play an important and influential role in any campaign by an independent body to secure legislative and other change. In this case we anticipated hostility through both editorial and proprietorial influence. • We had worked very hard to secure a "good press" for the ICO across a very wide range of other DPA and FOI functions and had been largely successful. There was a real fear that this could be jeopardised."

¶That was a fear which proved to be entirely well-founded. Furthermore, if it was a fear which was clearly present in Mr Thomas mind in relation to his strategic and political response to Operation Motorman, it does not seem a large step to infer that that was a fear understood more generally in the office, not excluding its (more junior) operational staff.

1106

¶2.5 Although the risk of press hostility to the objectives of the ICO was present from the outset, it is evident that the sheer scale of the risk and its potential to affect not only the outcome of a particular political campaign but the fundamental nature of the relationship between the press and the regulator was only a gradual revelation over the months and years. Towards the end of his oral evidence to the Inquiry about the course of the s55 campaign, Mr Thomas said this:34

¶"I think there was a general feeling that people at the head of newspapers were very influential with the politicians and this perhaps was an example of that. And although they rested their case, as I said just now, on the threats to investigative journalism, I was surprised by how hard they were fighting, and it really left me with a message that we were challenging something which went to the heart of much of the - certainly the tabloid press activity. Someone once said to me: "You do realise that you are actually challenging their whole business model?" Maybe that's one reason they were fighting so hard, because on the one hand, they were not publicly accepting this sort of thing went on. On the other hand, they were fighting very hard to avoid the consequences of the law as we saw it."

¶2.6 Mr Thomas mature reflections on the lessons he learned from the experience of the s55 campaign are worth pondering in this context:35

¶"Whatever was precisely known about the nature and extent of press misconduct across the industry as a whole, it became increasingly clear that the press were able to assert very substantial influence on public policy and the political processes. I have, throughout my career, been involved in a wide range of activities where it has been essential to attract media attention and, better still, active media support. The ICO press team was very effective at giving strategic, tactical and practical advice and securing favourable media coverage on many occasions. But, in the matters covered by this Statement, the press had a direct interest and a hostile attitude which made it very difficult to achieve our objectives. The history of the campaign over the Criminal Justice and Immigration Bill … left me in no doubt about the power of the press. I can recall saying to my colleagues in 2007 and 2008 that, with hindsight, it may have been a mistake on our part to have highlighted press misconduct in our reports. We H may have made better progress if we had concentrated more on breaches of s55 by other sectors."

3. Independent regulation of the press: lessons learned 3.1 It is hard to avoid the conclusion that the ICO did indeed consider itself disadvantaged in the task of discharging its functions in relation to the press. That was expressed in a number of dimensions which include insufficiency of legal powers, deference to other authorities, competing operational priorities, practical resourcing and capability issues. Having said that, although each of those dimensions contains important truths, they do not give a full account. Despite the abundant evidence, both patent and latent, of problems in the culture, practices and ethics of the press in handling personal information, the ICO has not been keen to exercise the powers and functions reposed in it by Parliament in the public interest to address the matter. That is not simply a historical matter; it is perceptible in its approach today. In a context in which public concern about press standards and respect for the law has reached sufficiently acute proportions to warrant the commissioning of a judicial inquiry, that must be seen as a regulatory failure within the Terms of Reference of the Inquiry.

1107

¶3.2 It is an understandable failure. The lessons to be learned from the narrative of the ICO and the press are entirely congruent with the evidence to the Inquiry of the approach of the press more generally. That approach is too often characterised by:

¶(a) resistance to independent regulation of both law and standards; (b) a confrontational, aggressive and personal approach to its critics; (c) powerful behind the scenes political lobbying in its own interests; and (d) the deployment, through a very loud megaphone, of the rhetoric of the freedom of the press to stifle rational criticism and debate about where the public interest lies.

¶3.3 Although it is a failure to which the ICO may be considered to have contributed by reason of its own choices, for example by engaging in the political arena on contested policy matters to a degree beyond what was likely to be constructive and productive, and in relation to operational decision making, I do not attribute it wholly or mainly to the individual leadership of the ICO. If, however, there is a perception of inequality of arms in the relationship between the ICO and the press, and if it is one which for understandable reasons the ICO has been reluctant to articulate or seek to remedy itself, then Mr Owens' rhetorical question takes on certain urgency for the Inquiry:36

¶"It's our job to take them or indeed anyone else on, that's what we are paid to do. If we do not do it then who does?"

¶3.4 The ICO has to be capable of performing its function in relation to the press, however balanced and light touch the exercise of that function should be. It keeps wicket in this respect, on behalf of the public and at public expense. It does not have an option simply to leave the field open. As was observed in recent High Court proceedings, which also took a wider view of the ICO's functions in relation to journalism than it was minded to take itself:37

¶"there is a need for someone to protect the public."

¶H 3.5 The final part of this part of the Report therefore briefly identifies the structural and governance issues which are likely to need to be addressed to put the ICO in a position in which it is capable of discharging its functions in relation to the press. This is at the margins of the Terms of Reference but, in the light of the analysis to which the ICO has been subject, I have no doubt that it is appropriate to identify the parameters of a solution before leaving the matter to the more detailed consideration both of the Ministry of Justice and the ICO itself.

1108

4. Powers, governance and capability of the ICO: reflections for the future 4.1 The legal structure of the ICO is such that the entirety of the functions of the office is devolved through the office and the person of the Information Commissioner. The organisation of the office (that is to say, the division of functions, decision-making processes, accountabilities, staff mix and so on) are matters within the personal discretion of the Commissioner.

¶4.2 In looking at the issues raised in this section of the Report, some issues of governance appeared to be raised by the narrative. In particular, the importance of the connection between the strategic leadership and the operational activities of the office, and the question of the circumspection that the ICO evidently felt and feels about fulfilling its functions in relation to the press raised questions about its organisational capability to act effectively in this area.

¶4.3 The data protection regime has specific application to journalism, as indeed it does to other sectors for which special provision is made in the law. To operate successfully in specialist areas, a regulator needs to have access to two forms of specialist knowledge. This includes legal expertise in the operation of the relevant statutory provisions, and business knowledge of the sector concerned. In the person of Mr Graham, of course, the ICO is currently led by a Commissioner with direct experience in the sector, but it is essential that the relevant expertise is also accessible at operational levels. The historic lack of direct engagement between the ICO and the industry may not only be a symptom of the ICO's lack of operational familiarity with the press, but also a cause of it. I recommend that the opportunity should be taken by the ICO to review the availability of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it.

¶4.4 A fruitful exchange of knowledge, experience and perspective between the strategic and operational levels of a regulator such as the ICO is fundamental to the success of both. In the history of its engagement on matters relating to the press, I have some questions about whether the organisation and decision-making processes of the ICO have been such as to support the necessary exchange and that its success in discharging its functions has suffered as a result. I therefore recommend that the opportunity should be taken by the ICO to review H its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions, such as the intersection between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other, can be satisfactorily considered and addressed in the round.

¶4.5 The model of a single post holder is not one which is generally encountered in modern regulatory regimes, especially those whose responsibilities extend to powerful business sectors. There has in recent years been a fairly general trend away from individual decision- makers to boards. The Director-General for Fair Trading was replaced several years ago by a Chairman, Chief Executive and Board. The DG for electricity and gas regulation was replaced in the late 1990s by the Gas and Electricity Markets Authority (a board in which non-executives form the majority), and subsequently the executive role was divided between Chairman and Chief Executive. With the creation of Ofcom, the DG for telecommunications was replaced with a full board (which spanned other areas); Ofwat made the same transition in the mid- 2000s; and the health regulator, Monitor, recently moved from a combined executive role (with board oversight) to separate chairman/CEO roles.

1109

¶4.6 There are a number of reasons why the single model has drawbacks:

¶(a) It can render an organisation particularly vulnerable to pressure as its profile and reputation are focused on an individual personality. (b) The absence of an effective senior executive board with non-executive input can expose the office to a presidential style of leadership, with insufficient internal checks and balances to ensure that its overall priorities remain congruent with its statutory functions. (c) The absence of an effective senior executive board can also, as a simple matter of business management, mean that priorities, business risks, resources and performance are not managed and monitored coherently.

¶4.7 The merits by contrast of a formal Board constitution potentially include the following:

¶(a) The benefits of collective decision making. This includes being able to bring a range of different expertise, experience and mindset to issues of strategy, priority and direction, and an enrichment of analysis, debate and perspective as a result. (b) Firmer discipline can be maintained in decision-making, including the need to proceed by means of structured agendas, formal papers and recorded minutes. This is of particular importance in relation to decisions not to take action; when such decisions are taken individually or informally they are much more likely not to have been made from a structured position of strength. (c) There are formal and precisely defined delegations and it is beyond doubt where decisions are to be delegated to the executive as not requiring Board approval.

¶All of these have a potential to promote collective decision-making as much more transparent and accountable. Each decision will thus both be more considered in itself and more susceptible to structured follow-through to specific outcomes.

¶4.8 The evidence before the Inquiry suggested that the constitution of the ICO as a corporation sole may, in at least some of these dimensions, have risked its ability to discharge effectively its functions in relation to the press. Unresolved questions must remain, for example, as to whether:

¶(a) the informal approach adopted by the ICO to its regulatory functions (partly a matter, H perhaps, of presiding over a regime struggling for a profile, also possibly a matter of personal leadership style) has contributed to a reluctance to bring issues to a head through the use of regulatory powers, and has allowed inaction to be an unremarked default within its own structure; (b) the tendencies of Information Commissioners to see themselves as having a major, even dominant, outward-facing role with a political or campaigning dimension has been at the expense of their ability to provide clear, engaged, understood and accountable leadership in the decisions made within their office, to the detriment of the quality of those decisions, and has posed some risk to the regulatory reputation of the ICO, including in relation to its quasi-judicial functions; and (c) its current constitution leaves the ICO with insufficient strength to match major business sectors with power and influence, such as the press.

¶4.9 I recommend therefore that the opportunity be taken by the Ministry of Justice to consider amending the DPA formally to reconstitute the ICO as an Information Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public administration, law and business, and that active consideration be given in that context to the desirability of including on the Board a Commissioner from the media sector. In making this recommendation I do not, however, consider that the recommendations directed to reflecting on the governance of the ICO as currently constituted should be delayed in the meantime.

1110 1111

¶Chapter 7 Summary of recommendations 1.1 I am conscious of both the length and complexity of this Part of the Report. For ease of reference, I have decided to place all my recommendations in summary form at the conclusion of this Part rather than to follow the approach I have pursued elsewhere.

¶I recommend to the Ministry of Justice that: The exemption in section 32 of the Data Protection Act 1998 should be amended so as to make it available only where:1 (a) the processing of data is necessary for publication, rather than simply being in fact undertaken with a view to publication; (b) the data controller reasonably believes that the relevant publication would be or is in the public interest, with no special weighting of the balance between the public interest in freedom of expression and in privacy; and (c) objectively, that the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication. The exemption in section 32 of the Data Protection Act 1998 should be narrowed in scope, so that it no longer allows, by itself, for exemption from:2 (a) the requirement of the first data protection principle to process personal data fairly (except in relation to the provision of information to the data subject under paragraph 2(1)(a) of Part II Schedule 1 to the 1998 Act) and in accordance with statute law; (b) the second data protection principle (personal data to be obtained only for specific purposes and not processed incompatibly with those purposes); (c) the fourth data protection principle (personal data to be accurate and kept up to date); (d) the sixth data protection principle (personal data to be processed in accordance with the rights of individuals under the Act);

¶H (e) the eighth data protection principle (restrictions on exporting personal data); and (f) the right of subject access. The recommendation on the removal of the right of subject access from the scope of section 32 is subject to any necessary clarification that the law relating to the protection of journalists' sources is not affected by the Act. It should be made clear that the right to compensation for distress conferred by section 13 of the Data Protection Act 1998 is not restricted to cases of pecuniary loss, but should include compensation for pure distress.3

1112

¶The procedural provisions of the Data Protection Act 1998 with special application to journalism in: (a) section 32(4) and (5) (b) sections 44 to 46 inclusive should be repealed.4 In conjunction with the repeal of those procedural provisions, consideration should be given to the desirability of including in the Data Protection Act 1998 a provision to the effect that, in considering the exercise of any powers in relation to the media or other publishers, the Information Commissioner's Office should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime.5 Specific provision should be made to the effect that, in considering the exercise of any of its powers in relation to the media or other publishers, the Information Commissioner's Office must have regard to the application to a data controller of any relevant system of regulation or standards enforcement which is contained in or recognised by statute.6 The necessary steps should be taken to bring into force the amendments made to section 55 of the Data Protection Act 1998 by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism).7 The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.8 A new duty should be introduced (whether formal or informal) for the Information Commissioner's Office to consult with the Crown Prosecution Service in relation to the exercise of its powers to undertake criminal proceedings.9 The opportunity should be taken to consider amending the Data Protection Act 1998 formally to reconstitute the Information Commissioner's Office as an Information H Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public administration, law and business, and active consideration should be given in that context to the desirability of including on the Board a Commissioner from the media sector.10

1113

¶Chapter 7 | Summary of recommendations

¶I recommend to the Information Commissioner's Office that: The Information Commissioner's Office should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime.11 In discharge of its functions and duties to promote good practice in areas of public concern, the Information Commissioner's Office should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. This should be prepared and implemented within six months from the date of this Report.12 The Information Commissioner's Office should take steps to prepare and issue guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights.13 In particular, the Information Commissioner's Office should take immediate steps to publish advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice.14 The Information Commissioner's Office, in the Annual Report to Parliament which it is required to make by virtue of section 52(1) of the Act, should include regular updates on the effectiveness of the foregoing measures, and on the culture, practices and ethics of the press in relation to the processing of personal data.15 The Information Commissioner's Office should immediately adopt the Guidelines for Prosecutors on assessing the public interest in cases affecting the media, issued by the Director of Public Prosecutions in September 2012.16 The Information Commissioner's Office should take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to ensuring that the Office is well placed to fulfil any necessary role in this respect in the future, and in particular in the aftermath of Operations Weeting, Tuleta and Elveden.17 The Information Commissioner's Office should take the opportunity to review the H availability to it of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it.18 The Information Commissioner's Office should take the opportunity to review its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions (including the relationship between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other) can be satisfactorily considered and addressed in the round.19 parT I

¶The Press and politicians

1117

¶Chapter 1 1.1 In addition to addressing other concerns, the Terms of Reference require the Inquiry to examine the relationship between national newspapers and politicians and the conduct of each. That this issue should have been considered relevant to an Inquiry into the culture, practices and ethics of the press is a matter of considerable significance. It implies the existence of legitimate questions of public concern about the nature of that relationship and conduct, and about the connection between that relationship and the current state of press standards and accountabilities. It asks, in other words, whether anything about the relationship between the press and the politicians has amounted to 'part of the problem' of press standards.

¶1.2 In doing so, and in putting these questions before a judge-led inquiry, the Terms of Reference required reflection on the relationship between press and politicians in a way which was relevant to and directed towards the issue of press culture, practices and ethics, and of course to do so in an objective, evidenced, analytical and politically neutral way. That too is significant. If there have been failures of public interest in the relationship between press and politicians, then our democracy provides ways in which politicians can account for that directly to the public. However, if there were failures of what might be called generic political culture (a pattern across time and across parties) and if there were failures in the democratic mechanisms for accountability, then the ordinary political means of challenging and investigating such matters might not have been effective. The politicians would themselves have been, or at least appeared, too close to the problem itself to address it in a way which would leave no doubts in the mind of the public.

¶1.3 An issue of closeness is at the heart of this part of the Terms of Reference. More specifically, the issue is whether that relationship between politicians and the press had become too close in respects which might not have best served the public interest. The Prime Minister himself said that he believed that to be the case, first in July 2011 and subsequently when interviewed by Andrew Marr on 29 April 2012 when he said this:

¶"Have we all got too close? Yes. Do we spend too much time on this short-term news management agenda? Yes, we do. Should we try and have a better relationship where we fight the daily fire fight with the media, but we focus on the long-term change our economy needs, our society needs? Yes. And if that comes out of Leveson, great."

¶1.4 To put the matter in context from the outset, however, it is essential first to reflect the overwhelming evidence that relations between politicians and the press on a day to day I basis are in robust good health and performing the vital public interest functions of a free press in a vigorous democracy, providing an open forum for public debate, enabling a free flow of information and challenge and holding power to account. If there were any doubts about that they would have been dispelled by the perceptive insights of both politicians and political journalists and commentators among the Inquiry's witnesses, and by the remarkable quantity and quality of contemporary coverage of this module of the Inquiry's work.

¶1.5 Political journalism is one of the most highly-prized aspects of a free press operating in a developed democracy. It has often been referred to as the 'lifeblood of democracy', invigorating the body politic and supporting the effectiveness of democratic accountabilities. It is in this area (although not just in this area) that the press performs some of the most essential public interest functions on which we all depend. Some excellent examples were seen first-hand during the course of the Inquiry's deliberations. I make very clear at the outset therefore that political journalism is not the focus of this Part of the Report, and indeed the Inquiry has had clearly in mind throughout the importance of ensuring that political journalism is fostered and encouraged to the greatest degree possible for the future.

1118

¶1.6 This Part of the Report is not therefore directed at the relationships of everyday political journalism other than by way of background, nor particularly to the issue of press standards as they might apply to such journalism. Nor did the Inquiry pursue as a separate issue the status of individual politicians as actual or potential victims of media misconduct (although in the course of evidence there have been a number of accounts of the impact of personal attacks upon politicians by the press and concern about the potential for such attacks).

¶1.7 The narrative of this Part of the Report explores instead a very different aspect of the closeness of the relationship between press and politicians, the one that is in my view most directly relevant to the public interest concerns that prompted the setting up of this Inquiry in the first place. That is the question of a closeness which may have, or appear to have, impacted on the willingness or ability of the politicians to decide matters of public policy about the media, and specifically of policy on press standards, fairly and impartially in the public interest.

¶1.8 As I have already said,1 this Inquiry takes its place in responding to the latest in a long sequence of spikes in public concern about press standards; this time it is phone hacking. That history is also a history of what has been described as failures by the politicians to make appropriate responses to those spikes in public concern. The Inquiry has taken a brief but informative look at what has happened in the past, with the invaluable privilege of access to the perspectives of many of those directly involved. In doing so, it has considered whether there was any discernible pattern in that history, and if so whether it was a pattern which could be related to a relationship that was 'too close'. The historical approach, which is reflected in this Part of the Report, is not therefore academic (and certainly does not pretend to any degree of historical discipline or originality); but is, as should be expected of an Inquiry of this nature, thematic and inquisitorial.

¶1.9 Module Three of the Inquiry has focused on the more recent manifestations of this issue, but it is an issue which I recognise (as has been pointed out) goes back in time very much further than that. The fact that I have not heard oral evidence about relations between the national press and politicians at a period any earlier than the middle of the last century certainly does not mean that I am blind to the very considerable influence which the press barons of the late nineteenth and early twentieth centuries are generally agreed to have had on politicians. I am well aware from written evidence and other material in the public domain of I the role in public life which Lords Northcliffe, Beaverbrook and Rothermere had in their day. The power wielded in the past by these proprietors, and their influential relationships with the politicians of their time, demonstrates that the issues which the Inquiry is now addressing are far from new. However, these earlier events are not sufficiently proximate to the current culture to merit detailed examination: the primary focus of the Inquiry has been on what should happen in the future in the light of what has happened more recently.

¶1.10 Chronologically, the Inquiry began its focus on the relationship with evidence about the acquisition in 1981 by Rupert Murdoch of The Times and The Sunday Times and it has reflected on events from then to the present. To have gone back further would have demanded too much of any witness and was highly unlikely to have added to the understanding which emerged from the oral evidence which itself spanned a period of 31 years. That oral evidence Part D Chapter 1

1119

¶Chapter 1 | Introduction is, of course, supplemented by documentary evidence some of which goes back considerably before 1981.

¶1.11 From this, a clear pattern has in my view emerged about the relationship between the press and the politicians in recent years at the most senior levels of influence. There is of course no evidence at all of explicit, covert deals between senior politicians and newspaper proprietors or editors; no-one should seriously have expected that there would be. These very powerful relationships are more subtle than that, the extent to which interests coincide or diverge is more complicated, and the dialogue more sophisticated. But there can be no doubt that within these relationships, some of them having the quality of personal friendships (and some of active hostility), there have been exchanges of influence on matters of public policy which have given rise to legitimate questions about the trust and confidence the public can have that they have been conducted scrupulously in the public interest.

¶1.12 Care has to be taken in talking about 'influence'. It is the prerogative of a free and partisan press in a democracy to campaign, lobby and seek to influence both public opinion and public policy. Where the issues arise is in the nature, visibility and accountability of the politicians' response. Nor is the existence of personal relationships and friendships at senior levels between press and politicians anything other than entirely natural and to be expected. The issues arise here in relation to the conduct of public affairs in the context of such relationships, and in the boundaries between public and private, accountable and unaccountable.

¶1.13 The pattern which emerges is one in which senior press/political relationships have been too close to give sufficient grounds for confidence that fear or favour have not been operative factors in the determination and implementation of media policy. That has been the position for some years at least. It is not a state of affairs confined to any one political party.

¶1.14 This section examines in particular the decision to permit Mr Murdoch's News Corporation to acquire The Times and The Sunday Times; the terms of the Broadcasting Act 1990 (insofar as they concerned foreign and cross media ownership) which were such as to permit Sky TV to continue in the ownership of News Corporation; the passage of the Communications Act 2003, in particular the development of its provisions on foreign and cross media ownership, which in their final form would not have prevented News Corporation from acquiring Channel 5; and finally, the bid by News Corporation for the remaining shares in BSkyB which came to an end shortly before the Inquiry was set up (and for connected reasons). Evidence on the last of these matters brought into sharp focus the pressures, from more than one direction, on governing politicians charged with making a decision of great importance to the media. In particular, it exposed a formidable and relentless lobbying operation which gave rise to serious legal and ethical issues.

¶1.15 On more than one occasion during the period under consideration, concerns about the culture,

¶I practices and ethics of the press surfaced in public debate. However, on each occasion the political reaction was not such as to bring about a lasting solution to the problem. As outlined earlier in this Report, concern during the late 1980s reached such a level that the then Home Secretary commissioned Sir David Calcutt QC to lead a committee which inquired into and reported on press standards, highlighting significant areas of legitimate public concern. The political response to the first Calcutt Report purported to give the press a final chance to put its own house in order before addressing the matter further. The press failed by some margin to meet the challenge, but the establishment of the 'self-regulatory' PCC was the chief exception to a prevalent "do nothing" response from the Government. How and why that was so is examined.

1120

¶1.16 The PCC was (or at least could have been) a step forward from its predecessor, the Press Council. However, it was never endowed by the industry with the full range of powers and resources advocated by the politicians by whom it was presented as a credible response to public concern. In practice, as is discussed more fully elsewhere in this Report2 irrespective of how it described itself or the powers (however limited) that it actually had, it functioned principally as a handler of complaints and latterly an advisory body. When concerns about press behaviour, and of paparazzi photographers in particular, resurfaced in 1997 with the tragic death of Diana, Princess of Wales, there was some tightening of the Editors' Code but, as the then Prime Minister candidly accepted, he took a conscious decision to manage rather than to confront the media, taking the view that to have confronted the press would have been an all consuming task.

¶1.17 There was a further missed opportunity to address press misconduct when the Information Commissioner published his findings about the ways in which private investigators had, in his view, unlawfully obtained confidential data which was then provided to the press in circumstances (including the extent of payments made for the data) which provided ample grounds for profound public concern.3 The Information Commissioner recommended amendments to the Data Protection Act 1998. In the result, the political response was a further compromise and no effective action. How that came about is also illuminating.

¶1.18 This Part of the Report therefore begins by considering some relevant aspects of the relationships between our last five Prime Ministers (including the present holder of that office) and the press. Political leaders have their own approaches to and experiences of the press at a personal level. Personality and individual approach greatly influence the dynamic between a Prime Minister and the opinion-makers of the press. This Part reflects on these relationships for the insights they offer into what they might nevertheless have in common, and into whether any patterns can be said to emerge.

¶1.19 This search for patterns is an exercise which was fundamental to the work of the Inquiry in this module. It would, however, be a mistake to think that the Inquiry can or should try to solve all of the unresolved questions about the relationship between the press and the politicians at the highest levels over the past 35 years. What follows, therefore, attempts simply and briefly to set out some of the narrative history which seemed to be particularly relevant to the Terms of Reference; there is no ambition to be comprehensive or to sit in judgment on political history whether past or contemporary, but only to identify the extent of the issues relevant to the Inquiry and to reflect on any pointers for the future. If the most recent past is considered in the greatest detail, that is, first, because some of these issues were prominent features of the context in which the Inquiry was set up and, second, because contemporary concerns are inevitably uppermost in the public mind, and have had the least I benefit of the longer perspective.

¶1.20 This Part then canvasses some wider contemporary political perspectives. My overall conclusions and recommendations follow.

¶1.21 The Report addresses one final matter in this Part. The public concern which led to this Inquiry stands at the end of a long line of surges in public concern. Each has been followed by a political response which has not adequately addressed that concern. This all has to be viewed in the context of press/political relationships which themselves appear to have had problematic dimensions. Thus, the approach to this Inquiry also deserves consideration.²² Role of the Assessors 6 The gathering and presentation of evidence 19 Rule 13 of the Inquiry Rules 2006: the practice 42 Purpose 49 A brief history of press freedom in the United Kingdom 58 Freedom of expression 71 The 1997 general election 1139 Mr Cameron's relations with the press whilst Leader of the Opposition 1165 Response to the reports of Sir David Calcutt QC 1246 The plurality test and quasi-judicial procedure 1303 vii Barendt, E, Freedom of Speech (2nd ed), pp183 -186 ibid http://stakeholders.ofcom.org.uk/binaries/research/cmr/cmr11/UK_Doc_Section_1.pdf Page, B, The Murdoch Archipelago, p10 http://stakeholders.ofcom.org.uk/binaries/consultations/public-interest-test-nov2010/statement/public-interest-test- report.pdf Communications Act 2003 s375 (1)(2B) http://www.legislation.gov.uk/ukpga/2003/21/section/375 Operation Reproof is considered in detail at Part E, Chapter 2 p42, para 83, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Peter-Clarke.pdf p1, para 2, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Second-Witness-Statement-of-DAC-Sue- Akers1.pdf a to a 'new more effective policy and regulatory regime' (implying that the existing regime is ineffective to address the problem), and paragraph 2b to 'future concerns about press paras 1.38-1.40, Part A, the Introduction p12-13, Charlotte Church, ibid p3, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/03/Witness-Statement-of-Commissioner-Bernard- Hogan-Howe1.pdf p5, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/04/Witness-Statement-of-Dr-Rob-Mawby.pdf Mr Owens was the senior investigating officer in the ICO having previously spent 30 years as a police officer reaching the rank of Detective Inspector. He described having "special responsibility for the investigation of high profile or complicated investigations relating to breaches of the [then] new [Data Protection] Act.": p1, http://www. levesoninquiry.org.uk/wp-content/uploads/2011/11/Witness-Statement-of-Alexander-Owens1.pdf pp30-31, lines 24-1, Alexander Owens, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Transcript- of-Afternoon-Hearing-30-November-2011.pdf p18, lines 2-5, Christopher Graham, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/01/Transcript-of- Morning-Hearing-26-January-2012.pdf p18, para 5.18c, http://www.levesoninquiry.org.uk/wp-content/uploads/2011/11/Witness-Statement-of-Alexander- Owens1.pdf Part H, Chapter 5, para 2.60 p3, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Witness-Statement-of-Lord-Mandelson.pdf p39, lines 14-15 and line 24, Sir John Major, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/ Transcript-of-Morning-Hearing-12-June-2012.pdf p5, para 12, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Witness-Statement-of-David-Cameron- MP.pdf p84, Jeremy Hunt, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/05/Exhibit-JH1-MOD300004241- MOD300004682-docs-1-52.pdf ; see 4.39 below for Mr Hunt's public comments pp94-95, lines 13-1, ibid p12, para 3.11, ibid The Independent, 'PM signals end of Press Complaints Commission', 8 July 2011, http://www.independent.co.uk/ J news/media/press/pm-signals-end-of-press-complaints-commission-2309210.html; pp58-60, lines 19-4, David Cameron MP, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Transcript-of-Afternoon-Hearing-14- June-2012.pdf particularly in Part J, Chapter 5 p36, lines 1-8, Lord Black, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/02/Transcript-of-Morning- Hearing-1-February-2012.pdf K p3, lines 11-15,Lord Hunt, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript-of-Morning- Hearing-10-July-2012.pdf p8, para 9, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/06/Submission-by-working-group-led-by- Lord-Prescott.pdf p51, lines 2-10, Professor John Horgan, http://www.levesoninquiry.org.uk/wp-content/uploads/2012/07/Transcript- of-Morning-Hearing-13-July-20121.pdf journalists from News International, Trinity Mirror and Express Group: http://www.levesoninquiry.org.uk/wp- content/uploads/2012/07/Third-Witness-Statement-of-DAC-Sue-Akers.pdf Part K, Chapter 3, para 4.26 Part K, Chapter 7, para 4.7 Adopted and opened for signature, ratification and accession by UN General Assembly resolution 2200A (XXI) of 16 December 1966, entry into force 23 March 1976 AC 457, at para 111 De G & Sm 652; 1 Mac & G 25, matrimonial secrets, Argyll v Argyll [1967] Ch 302, and information about sexual relationships, Stephens v Avery [1988] 1 Ch 449Show full note Part D, Chapter 1 3 Part H

1121

Chapter 2: The Conservative Years