An Inquiry into the Culture, Practices and Ethics of the Press
Following up Operation Motorman
Following up Operation Motorman
¶3.1 As is frequently repeated, Operation Motorman was the single biggest case of deliberate and
systemic interference with personal information with which the ICO had had to deal since its inception. The ICO had taken no operational measures in respect of the case since handing over the Whittamore prosecution to the CPS. There had been modest progress in issuing general guidance to the industry after years of discussion with the PCC. A custodial penalty for s55 offences had been provisionally introduced but not activated. This fell short of the steps Mr Thomas had wanted to see in order to put a stop to Motorman-type practices in the press for the future. The ICO remained very concerned about the evidence it continued to encounter of an extensive illegal market in personal information beyond the activities of the press. It had no reason to believe that private investigators similar to Mr Whittamore were not operating in the market. It is therefore necessary to consider whether there was (or should have been) a question mark in the mind of the ICO as to whether or not the objective of putting a stop to the engagement by the press in the illegal market in personal information had in fact been achieved.
¶3.2 That general question might resolve itself into a number of specific questions. Firstly, what
had happened to the information which the press had acquired prima facie in breach of the data protection regime from Mr Whittamore? Secondly, what effect had the What Price Privacy? reports and the guidance had on the industry? Finally, what steps had the newspaper titles involved taken (particularly in relation to the journalists who had been identified as customers of Mr Whittamore) to eliminate this sort of conduct from their culture, practices and ethics?
¶3.3 On the follow-up to the question of press conduct in relation to blagging and related
activities, Mr Graham confirmed to the Inquiry the position he had taken in front of the Select Committee. The ICO had made no active investigations of any nature in relation to the Motorman material itself. No material had been brought to its attention suggesting that there was any problem. In the absence of that, it was not its role to pursue enquiries. It had other current priorities.7
¶3.4 There was also, in his view, no case for a proactive approach to the victims. But he did say that "so far as the individuals are concerned, I'm still very ready for subject access requests by H those who may be concerned."8
- Following up the political campaign
¶4.1 Before the Select Committee, Mr Graham appeared to be continuing to connect the s55
campaign with the issue of press misconduct. This exchange with Mr Watson was interesting in that context:9
1059Q. "But the evidence you have in front of you shows that there was law-breaking on an industrial scale from the newsrooms of some of the major newspapers in the United Kingdom.
¶Chapter 4 | The ICO and the Press today
A. "I am afraid I am going to become repetitive. You simply cannot run regulatory bodies on the basis that you go chasing after every detail that a particular investigative journalist decides should be the agenda for the day when you have got other very big and important questions. I am not pleading poverty here, I am just saying that you can only do what you can do. We thought, possibly naively, that, by telling Parliament about this back in 2006 and calling for the custodial sentence, we could close the thing down. I think they still can, but it is taking too long."
¶4.2 As noted above, the ICO has continued to press for the activation of the custodial penalties
for s55 offences, but no longer apparently with any direct focus on making an impact on the press. Although not directly a matter for the Inquiry, no account has been offered of how the case for the activation of those penalties has been affected by the more recent availability of civil penalties. In any event, however, the case for the activation of the s55 penalties in so far as it has a bearing on the matters before the Inquiry is considered on its own merits below.
¶4.3 If the ICO has yet to realise the benefits of the s55 campaign (and there remains no evidence
of any active planning within the office for doing so – the effect still appears to be considered to be self-activating), it seems to be continuing to reap the dividend of general press hostility. That too requires consideration.
- Phone hacking and the ICO 5.1 The What Price Privacy Now? follow-up report to Parliament noted the arrest and charging of
¶Clive Goodman and Glenn Mulcaire in these terms:10
"the circumstances appear to have parallels with the Section 55 offence and to reinforce the evidence gathered during Operation Motorman". In terms of pure personal information, the parallels between phone hacking and the Motorman activities are very clear. Shorn of the labels provided by the criminal law, both come down to the press employing unscrupulous external agents to obtain confidential personal information about other people. Further, that information is provided without their knowledge or consent and obtained by unlawful means whether by deceit, corruption, or the exploitation of technology. In respect of any individual piece of information, the journalists may or may not have had good reasons or formal defences for doing so. But prima facie these H were the sort of invasive practices from which the data protection regime (along with its principles and rights) was designed to protect people.
¶5.2 There were on the face of it two reasons why the ICO might have taken a keen interest in the
Goodman/Mulcaire developments In the first place, there was the indication that even in the post-Motorman environment, sections of the press were still involved in the unlawful trade in personal information. This was a clear warning signal in its own right that all might not be well in the approach and practice of the press regarding personal information, and raised a question mark against the efficacy of the strategy of the ICO for responding to Motorman.
¶5.3 In the second place, there was the concern whether there could be any direct relationship
1060between Motorman and Goodman/Mulcaire. This was the question which had occurred to Mr Owens:11 was it possible that the private phone numbers obtained by the press via
¶PART H | The Press and Data Protection
Mr Whittamore (not just the ex-directory numbers of the 'targets' but the multiplicity of 'friends and family' numbers), had been used to hack their phones? Were these precisely the private lines most likely to have been used by the 'targets' for the purposes of confidential conversations, texts or voicemails? Mr Owens told the Inquiry that he took these questions and thoughts to Nick Davies of the Guardian. He also told the Inquiry that there seemed to be considerable overlap between the target names in the Motorman material and in the Mulcaire material.
¶5.4 If the connection was made in the mind of the ICO, whether at either the general or the
specific levels, the Inquiry had no evidence of it beyond the reference in What Price Privacy Now? Mr Thomas told the Inquiry, somewhat obliquely, that notwithstanding the connection made in its own report, the ICO thought that "the Goodman-Mulcaire case appeared to be a completely separate group".12 For his part, Mr Graham maintained in his evidence to the Inquiry the position he had taken in front of the Select Committee two years previously, namely that hacking and blagging were separate activities and that the ICO had no formal role in relation to the former because it had no prosecution or criminal investigation powers in relation to hacking, which was a police matter.13 He had put it bluntly to the Select Committee:14
"We were not involved, so far as I know and I cannot think of any reason why we would be, in the most recent PCC investigation which was into the Goodman case which, I will repeat, was about hacking and not about blagging, so I would have been surprised if they had come to us and, if they had, I would have had to say, 'Can't help you, chum'."
¶5.5 Counsel to the Inquiry pressed Mr Graham on the broader question; the newspaper industry
had claimed, and the ICO appear to have accepted that claim, that after the ICO's 2006 reports, it had cleaned up its act. How could we know that was true, given that we did know it hadn't cleaned up its act in relation to phone hacking? Mr Graham's answer was that they were different things.
¶The ICO's current stance
¶5.6 Mr Graham's position that the ICO had no particular reason to take an interest in the press was challenged in the course of his oral evidence to the Inquiry. His response was that it was H a matter for the politicians, the PCC or indeed for the Inquiry itself to find out whether there
was a problem with the press' approach to personal information.15 Furthermore, the ICO had many other current priorities.16
¶5.7 Mr Graham explained that he had no present intention of using his powers, or taking any
1061other step formally or informally, to consider the culture, practices and ethics of the press in relation to personal information. Put to him that he had positive responsibilities to promote compliance and good practice, that he had appropriate investigatory powers to take proactive steps to consider the position of the press in this regard, and that it would not on the face of it involve any great exercise to do so, he remained clear that he had other competing demands
¶Chapter 4 | The ICO and the Press today
on his time. He did conclude, however, that should the Inquiry recommend that he consider deploying his resources in this way, that view would be something the ICO would have to take very seriously.17 I return to this.
¶5.8 As an independent statutory regulator, the ICO has a prerogative to set its own priorities
within the overall scheme of the powers and duties entrusted to it by Parliament. For the behaviour of the press to have no part in those priorities is not, on the face of it however, easy to understand. The ICO was created to have custody of the issue of the law and practice of information privacy as articulated in the data protection regime. This Inquiry was established to address arguably the greatest crisis in public confidence in information privacy since the creation of the data protection regime. A great deal of the evidence received by the Inquiry about press misconduct related to personal information privacy (including inaccuracy). The persistence of the ICO, even in the face of the commissioning of the Inquiry and the evidence received by it, in seeking to recuse itself from any proactive engagement in addressing the crisis in public confidence was troubling. Even allowing for the inevitably particular perspective that the Inquiry has, I do not find it easy to accept the proposition that the lack of priority which the ICO accorded to the press issue is obviously reconcilable with its overall public responsibilities.
¶5.9 Before reaching a final conclusion on that point, however, it is necessary to reflect on whether
there were in fact other, possibly structural, explanations for its unwillingness to put itself forward as a significant part of the answer to the concerns before the Inquiry.
¶H
1062Chapter 5 Issues about the Legal Framework
- The current views of the ICO
¶1.1 The account that Mr Graham himself provided of the role, functions and powers of the ICO drew attention to the way in which they had more recently developed:1
"The Information Commissioner's role in regulating the use of personal data has evolved over the years. The role was originally intended primarily as an educator, ensuring data protection compliance by promoting good practice. Significant enforcement powers of the Commissioner, such as civil monetary penalties, have been introduced by amendment over the last few years, partly in response to high profile data losses. Section 51 [of the Data Protection Act 1998] sets out the general functions of the Information Commissioner. These are generally about promoting good practice rather than punishing poor practice. This educator function is still central to how I approach my role as Information Commissioner."
¶1.2 The power to impose civil monetary penalties of up to half a million pounds was introduced in April 2010. Mr Graham described it as:2
"beginning to have a very salutary effect, both on public authorities and on commercial companies. They realise that the Information Commissioner has teeth."
¶1.3 He also explained his view that the way in which the Data Protection Act (DPA) bore on the
press was complex; it was not easy to explain in clear and simple terms to individuals what their rights were, what the role of the ICO was in enforcing those rights, and what its relationship was to other organisations with functions in the area of law enforcement and good practice. This, in his view, meant that individuals sometimes expected more of the DPA than it was capable of doing in this area.3 That might be thought likely to suggest two consequences in particular. These are an increased emphasis on the explanatory and educational role of the ICO which Mr Graham had previously emphasised, and an increased burden on the ICO itself
¶H to give a clear lead in relation to compliance and good practice by the press, since individuals were evidently relatively less well placed to proactively enforce their own rights.
¶1.4 The conclusion reached by Mr Graham was different. He put it that, had Parliament intended
1063to give the Information Commissioner a significant role in overseeing the use of personal information for journalistic purposes, "it would have provided him with a very different and much simpler legal framework within which to do so".4 He was clear that the ICO was never intended to play a major role in the regulation of the press and that while the data protection regime was designed to protect information privacy it was not intended to impinge on the use of personal information for the purposes of journalism. The enforcement role of the ICO in this context was intended to be very limited; there was to be no challenge available
¶Chapter 5 | Issues About the Legal Framework
on data protection grounds to the use of personal information for journalism, and certainly none prior to publication. The principal effect of the DPA on journalism therefore was in the application of the criminal offence created by s55.5
¶1.5 However, Mr Graham's more detailed consideration of the scheme of the DPA in relation to
the press necessarily qualifies that very general proposition.6 In this, he set out the significant restrictions placed by the exemption provisions of s32 on the enforcement powers of the ICO in relation to journalists' use of private information, concluding that therefore the Act largely leaves it to individuals to pursue court action after publication if they want to assert their rights: this is, of course, a problem if the legislation makes it hard for them to understand what those rights are.
¶1.6 He also drew attention to the fact that the exemption is made to turn on the reasonable belief
of the journalist that publication would be in the public interest. In considering whether a journalist's belief about the public interest is reasonable, the DPA provides that regard may be had to his or her compliance with any relevant Code which has been designated for that purpose by the Secretary of State: the Codes so far designated are the PCC Editors' Code, the Ofcom Broadcasting Code and the BBC Producers' Guidelines.
¶1.7 It was Mr Graham's view that the role given to journalists' reasonable belief in the public interest meant that:7
"it is not the Information Commissioner's judgment about where the public interest lies or whether the provisions of the Act are compatible with journalism that counts and he has limited power to investigate or challenge the [journalist] data controller's opinion."
¶1.8 He did accept, however, that the Information Commissioner has powers, albeit 'specific
and limited', to challenge whether the press exemption is being properly relied on. They are specific and limited because the DPA inserts a lot of procedural hurdles to their use, including the restriction that action cannot generally be taken unless the ICO is invited to do so by an individual or a court (irrespective of the fact that individuals may not be well-placed to issue such an invitation). But the powers do confer a function on the ICO of, in effect, policing the boundary between proper and improper claims on the journalism exemption:8
"In essence the investigative and enforcement powers at the Information H Commissioner's disposal exist to enable me to ascertain whether personal data are being processed for purposes other than journalism and to act in relation to those other purposes, rather than enabling me to regulate the actual processing of personal data for journalistic purposes."
¶1.9 To the extent, therefore, that there is any issue that journalists were, for example, seeking
1064and using personal information for a range of unethical purposes other than with a view to publication, a regulatory question does arise. An example might be to threaten publication for collateral purposes or otherwise to put pressure on individuals to act or refrain from acting in certain ways. That, he recognised, would be expected directly to engage the functions of the ICO.
¶PART H | The Press and Data Protection
¶1.10 Mr Graham also acknowledged that ss32 and 55 did not exhaust the application of the DPA
to the press. Quite apart from specific provisions (for example, the express provision that individuals have enhanced rights to damages for breaches of the legal requirements of the regime by the press),9 the general duty of the ICO to promote compliance and good practice applies in relation to the press. About that general duty, Mr Graham observed:10 "I also have a duty under section 51 of the Act to issue guidance and promote good practice. This duty is not specific to the press, journalism or other special purposes. I am aware that during my predecessor's time in office significant efforts were made to provide advice to the PCC in relation to guidance we were encouraging the PCC to produce for journalists, focusing on the section 55 offence. So far as I am aware, the PCC did not go any further than producing general, high level guidance on journalism and the Act at the time and we have not received any further approaches to discuss such guidance during my time in office." Of course, the general duty to promote compliance and good practice, and the power to issue guidance, is free-standing and not dependent on the receipt of an approach.
¶1.11 Mr Graham's perspective on the role of the ICO in relation to the press also included an
important acknowledgement that the correct approach to its more specific regulatory functions had to be on a case by case basis and not on the basis of generalised assumptions about the exclusion of journalism from the purview of the regime. What Mr Graham said in this respect is set out in full here because I am content to adopt it for the purposes of this Report as an accurate and succinct summary of the legal and practical position, and one on the basis of which the outstanding questions about the detail of the regime in its application to the press should be considered:11 "The fact that there is a public interest in a free press being able to go about its business is reflected in the treatment of the "special purposes" under the Act. However, it cannot be the case that any and every activity carried out in the name of journalism should be regarded as exempt from the provisions of the Act. Indeed, I do not believe that that extreme position is seriously advanced by any significant strand of opinion within the journalistic profession. There will, in certain circumstances, always need to be a judgment around the public interest in particular stories. This point is explicitly provided for in the various journalistic codes, for example the PCC Editors' Code,
¶H Ofcom Code, BBC Producers' Guidelines, and so on. This is also the position reflected
in the recitals to the Directive itself. The balance to be struck between Article 8 and Article 10 of the Human Rights Act 1998 has to be considered on a case by case basis. The inevitable tension between "the right to privacy" and "freedom of expression" demands that the issues at stake in each situation are properly evaluated. I observe in passing that making judgments on where the balance of the public interest lies on the facts of each case is something that the information Commissioner is called upon to do under both the Act and the FOIA."
¶1.12 The last point is particularly significant. Although it is the journalist's honest belief that he
1065or she is working towards a publication in the public interest that counts, a challenge as to whether that belief is a reasonable one in all the circumstances is a matter for the Information Commissioner to consider on a case by case basis, and a matter on which the ICO has a general measure of experience and expertise.
¶Chapter 5 | Issues About the Legal Framework
¶1.13 In my judgment, on the face of it, a combination of this kind of case by case approach to the
ICO's law enforcement function in relation to the press, and the application to the press of the ICO's general duties to promote compliance and good practice, do add up to a significant potential role in guaranteeing public confidence in the culture, practices and ethics of the press in relation to personal information. However, the Inquiry saw little evidence of the realisation of that potential, or, in practice, of that role having been fulfilled. It was particularly hard to reconcile this potential with Mr Graham's resistance to the suggestion that the ICO should be actively making a connection between its role and functions and the activities of the press in relation to personal information privacy.
¶1.14 In looking for any possible explanation for that within the legal framework itself, the question
which has to be considered is whether there are features of the current data protection regime in relation to the press (including perhaps the needless complexity cited by the Information Commissioner himself) which were themselves inhibiting that role and which are capable of improvement.
- A different perspective on the legal framework 2.1 The Inquiry was greatly assisted by the evidence of Philip Coppel QC who reflected on the
history and substance of the provisions of the DPA with a particular bearing on journalism.12 By way of introduction, Mr Coppel pointed out that the predecessor legislation to the DPA, that is to say the Data Protection Act 1984 (which was not the product of a European Directive), had no exemption provisions for the press equivalent to those in the modern legislation. It was the EU Data Protection Directive of 199513 which required Member States to introduce measures into domestic law to: "provide for exemptions or derogations … for processing personal data carried out solely for journalistic purposes only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression"
¶2.2 As Mr Coppel explained, in this way the Directive itself represents the balance that has been
struck in relation to personal information privacy, between the individual right to privacy and the individual right to freedom of expression found, respectively, in Article 8 and Article 10 of the European Convention on Human Rights (now incorporated into UK law by the Human Rights Act 1998). H
¶2.3 Mr Coppel explained that the Data Protection Act 1998 in turn gives effect to the required
1066balance in three main ways:14 "(1) Through the s32 exemption. This relieves a data controller from all obligations under the DPA to an individual (and correspondingly removes protection conferred by the DPA on an individual – §§37-45 above) where the data controller is processing that individual's data only for purposes of journalism, for artistic purposes or for literary purposes, and then only provided that three conditions are satisfied."
¶PART H | The Press and Data Protection
"The three conditions that must be satisfied in order for personal information processed for the special purposes to enjoy the s 32 exemption are: i. the processing is being undertaken with a view to the publication by any person of journalistic, literary or artistic material; ii. the data controller reasonably believes that, having regard to the special importance of the public interest in freedom of expression, publication would be in the public interest; and iii. the data controller reasonably believes that, in all the circumstances, compliance with the data subject's rights is incompatible with the special purposes." "(2) By the procedural relief conferred by s 32(4)-(5). Proceedings against a data controller must be stayed where the data controller claims that the data are being processed only for the special purposes and with a view to publishing by any person of journalistic etc material. The stay remains in place until the Commissioner has made a determination under s 45 that the data is not being so processed. "(3) By creating a special enforcement regime (see §§54-55 above), which largely displaces the ordinary enforcement regime."
Civil law enforcement: the exemptions in s32 of the Data Protection Act Legal analysis and suggestions for reform
¶2.4 The first thing to note about s32, as Mr Coppel explained, is the extent to which it disapplies
the protection for individuals which is effected by the Act itself.15 Mr Coppel's analysis of s32 began by highlighting the notable features of the exemption:16
"(1) It exempts the data controller from compliance with the great majority of obligations under the DPA owed to a data subject …, rather than just the limited group of obligations termed "the subject information provisions" or "the non- disclosure provisions". This includes compliance with the data protection principles. "(2) The processing by the data controller must be both: – "only for the special purposes"; and
¶H
– with a view to the publication by any person (i.e. not just the data controller) of any journalistic, literary or artistic material (i.e. it need not be the data being processed nor need it be related to the data being processed). "(3) The second and third limbs needed to engage the exemption turn on the reasonable belief of the data controller, rather than on fact. The only matter identified by the section as inform that belief when assessing its reasonableness are various press codes of conduct, prepared by the press."
¶2.5 Mr Coppel described the legislative and caselaw history of the s32 provision; this is important context and is therefore set out as follows in full:
¶"Parliamentary history of s.32 exemption
1067¶Chapter 5 | Issues About the Legal Framework
¶"The s 32 exemption originated as clause 31 in the Data Protection Bill. In giving the Bill its second reading speech in the House of Lords, Lord Williams of Mostyn recorded the paramountcy which the clause was intended to give to freedom of expression:
"The Government believe that both privacy and freedom of expression are important rights and that the directive is not intended to alter the balance..."
¶This view was endorsed by Lord Wakeham, chairman of the Press Complaints Commission, who commended the Bill for:
"...steer[ing] a sensible path which avoids the perils of a privacy law and achieves the crucial balancing act - of privacy and freedom of expression - in a clever and constructive way....The Data Protection Bill does not introduce a back-door privacy regime. The Human Rights Bill does. The Data Protection Bill safeguards the position of effective self-regulation. The Human Rights Bill may end up undermining it."
¶The Solicitor-General (Lord Falconer of Thoroton) then endorsed Lord Wakeham's view:
"No one could have expressed the arguments in favour [of cl 31] more eloquently."
¶"Disquiet was expressed in the House by others: – that, as a result of cl 31, the Bill failed to protect privacy, – that cl 31 was too wide and significantly undermined the function of the legislation, and – that the notion of the public interest was too wide and vague a basis upon which to disapply the protection conferred by the Bill. Amendments were unsuccessfully introduced to address these misgivings. In supporting the amendments, Lord Lester of Herne Hill warned at length that, as drafted and because of cl 31, the DPA failed to implement the Directive and authorised interference by the press with the right to privacy in breach of Art 8 of the ECHR.
1068¶PART H | The Press and Data Protection
that the published information (i.e. the nature and details of her therapy) constituted sensitive personal data relating to the claimant; that that was not lawful since it constituted a breach of confidence; that that processing was not fair as the information was acquired surreptitiously; that that processing did not satisfy any of the conditions in Schedule 2; that that processing did not satisfy any of the conditions in Schedule 3; and that the exemption in s 32 only applied to processing out "with a view to publication" and not to the processing involved in the publication itself. The court assessed damages at £2,500 and aggravated damages at £1,000. "The Court of Appeal allowed the newspaper's appeal on both the confidentiality claim and the DPA claim. The Court of Appeal accepted that "processing" included publication in print. However, the Court, reversing the High Court, extended the duration of s 32 exemption to cover processing on and after publication. This division between processing before and after publication had limited s 32's disapplication of the DPA's protection up until, but not including, the most invasive activity - publication. In construing the section to give press freedom paramountcy throughout and with no opportunity to balance the individual's interest in maintaining privacy, the judgment renders the DPA unlikely to be compliant with the Directive. "The claimant appealed to the House of Lords. The claimant put the breach of confidence claim at the forefront of the appeal, with the parties agreeing that the DPA claim "stands or falls with the outcome of the main claim" and that it "add[ed] nothing to the claim for breach of confidence." In this way, protection of privacy in personal information came to be secured through the adaptation of the action for breach of confidence. In so doing, the House of Lords absorbed into the action the competition between freedom of expression as protected by Art 10 and respect for an individual's privacy as protected by Art 8 – the very balancing exercise which the Directive articulates and which the DPA is supposed to implement. "On one analysis, the House of Lord's judgment appears to leave untouched the Court of Appeal's treatment of the DPA. This would be unfortunate. The misgivings which had been expressed in Parliament during the passage of the Bill (see above)
¶H materialised with the Court of Appeal's judgment. The better analysis is that,
1069given the parties' agreement that the DPA claim stood or fell with the breach of confidence claim, the latter's success means that the DPA claim enjoyed equal, if unspoken, success in the House of Lords. "Personal privacy protection since Campbell v MGN "The practical effect of the Campbell litigation has been that breach of privacy claims are now principally brought under the HRA, rather than under the DPA. This is borne out by the treatment of privacy in the main media law practitioner text, which recognises that the DPA: "contains the most comprehensive privacy provisions now affecting the media" but goes on to comment that "misuse of private information" (i.e. the evolved breach of confidence action): "...will be of most relevance in the majority of privacy cases involving the media"
¶Chapter 5 | Issues About the Legal Framework
and that: "..the other [action], much less significant in practice, is reliance on statutory rights such as those afforded by the Data Protection Act 1998." The explanation offered for this is that: "Data protection law is technical and unfamiliar to most judges. Claims under this legislation will rarely offer tangible advantages over a claim for breach of confidence or misuse of private information. Given the paucity of current authority on how the Data Protection Act 1998 is to be interpreted and applied, applications for summary judgment on such claims are 'for the moment at least, unlikely to find favour." "Given that the stated objective of the Directive was to protect personal privacy in information in a way which reconciled Arts 8 and 10 of the ECHR, this practical result suggests a shortfall in the implementation of the Directive."
¶2.6 Mr Coppel concluded by summarising the current position with the following propositions:17
1070(a) "The DPA provides a code to protect the privacy of an individual's personal information, in whatever form recorded other than in ad hoc manual records. (b) The protection required by the Directive and provided by the DPA begins from the moment a person handling personal information acquires it and only ends once that person no longer holds it. (c) The Directive – to which the DPA is intended to give effect – permits Member States to relieve the press of obligations otherwise applicable to the processing of personal information where that it required to reconcile the ECHR right of privacy with the ECHR right to freedom of expression. (d) Freed of judge-made authority, the DPA provides an individual with a measure of protection against press invasions of personal information privacy, but, because the s 32 exemption does not provide for any balancing of the fundamental right to privacy against the fundamental right to freedom of expression, the measure of protection is less than that provided under Art 8 of the ECHR. (e) The DPA, in articulating: i. degrees of sensitivity of personal information; H ii. the uses of that information against which protection is provided; iii. the purposes for which those uses will be relieved of obligations securing the protection, iv. and in adjusting the protection according the sensitivity of the information, offers a sophistication and predictability which is unmatched by the jurisprudence on ECHR-based privacy claims. (f) In reported practice, press invasions of an individual's personal information privacy have mostly been remedied through ECHR-based privacy claims. (g) Judge-made law has substantially reduced the efficacy of the DPA as a means of remedying press invasions of an individual's personal information privacy, possibly to the point that the DPA, so construed, no longer gives full effect to the Directive."
¶PART H | The Press and Data Protection
¶2.7 The result, in Mr Coppel's view, is that where journalism is concerned:18
"undoubtedly, once you're in section 32 territory, then the protection which is given to an individual's privacy almost entirely falls away. All you have to do is touch section 32 in some way, shape or form and the contest which the Act is supposed to embody between the right of expression, freedom of [expression], and an individual's personal privacy has all been tilted one way."
¶2.8 In other words, the journalist is made arbiter of the balance, and the balance in turn falls to
be made on the basis of matters exclusively within the knowledge of the journalist, including matters inaccessible because of the extensive protection provided for journalists' sources. He goes on to argue that s32:19
"does not recognise any right to privacy. It's there, its sole objective is to cut away at the right of privacy, and at the end of it, certainly after the decisions of the court, there is nothing left of that right."
¶2.9 In practical terms, the argument goes, the approach of the courts to the substantive law,
coupled with the procedural inhibitions provided in other parts of the DPA (considered below) together with the very low level of damages which the courts have awarded have, between them, atrophied the principles and individual rights in their practical application to the press.
¶2.10 As a matter of law, there is more than one way to reflect on the tenor of Mr Coppel's arguments.
Put at its highest, his case would be that on the current state of the UK authorities, s32 fails to implement the Directive from which it derives, and is inconsistent with the relevant parts of the ECHR to which it is intended to give effect, because the relationship between privacy and expression rights has got out of balance. A proper balance is a fundamental obligation. The UK is therefore positively required to change the law to restore the balance. That is indeed Mr Coppel's own contention: that UK data protection law currently fails to implement our obligations, and that Lord Lester's concerns had proved to be prescient.20
¶2.11 Without going so far as that, even if the current balance were within the spectrum permitted
by our international obligations, the argument could be expressed in terms that it is at an extreme end of that spectrum, and the UK can as a matter of law, and should as a matter of policy, restore a more even-handed approach, not least given the asymmetry of risks and
¶H harms as between the individual and the press.
¶2.12 Put at its very lowest, the point could be made that the effect of the development of the
1071case law has been to push personal privacy law in media cases out of the data protection regime and into the more open seas of the Human Rights Act. This has happened for no better reason than the slowness of the legal profession to assimilate data protection law and, in the case of the judiciary, its greater familiarity with (and, he suggests, perhaps a preference for) the latitude afforded by the human rights regime over the specificity of data protection.21 But this, the argument goes, is undesirable because the data protection regime is much more predictable, detailed and sophisticated in the way it protects and balances rights, and significantly reduces the risks, uncertainties and expense of litigation concomitant on more open-textured law dependent on a court's discretion.22 Where the law has provided specific
¶Chapter 5 | Issues About the Legal Framework
answers, the fine-nibbed pen should be grasped and not the broad brush. The balancing of competing rights in a free democracy is a highly sophisticated exercise; appropriate tools have been provided for the job and should be used.
¶2.13 Mr Coppel suggested that the opportunity should be taken to redraft s32 in order better to
reflect the balance between freedom of expression and the protection of privacy envisaged both in the Directive and in the ECHR. He suggested two changes in particular. The first is to modify the test for reliance on s32 so that it will be available only where:
(a) "the acquisition or use of the information is necessary for publication rather than simply being in fact undertaken with a view to publication; (b) "there is a reasonable belief that publication would be in the public interest, with no special weighting of the balance between the public interest in freedom of information and in privacy; and (c) "objectively, that the likely interference with privacy is outweighed by the public interest in freedom of information."
¶2.14 The second change is to amend s32 so that it gives exemption from fewer rights and principles, and in particular no longer allows for exemption from:
(a) "the requirement to obtain and use information in accordance with statute law; (b) "the requirement to obtain the information only for specific purposes and not to use it in any way incompatible with those purposes; (c) "the requirement for information to be accurate and up to date; (d) "the rights of individuals under the Act; and (e) "restrictions on exporting the information."
¶2.15 Mr Coppel provided the Inquiry with an illustrative revised version of s32 to indicate the
sort of changes which would need to be made.23 I should make it clear at once that I do not express any view on the drafting suggestions that Mr Coppel makes, nor is it appropriate for this Report to frame recommendations in the form of draft legislation. For that reason, the Report's consideration is strictly limited to the policy objectives underlying Mr Coppel's H suggestions which are not simply to be inferred from the drafting but as explained by Mr Coppel in his evidence; it would of course be a matter for Parliamentary Counsel in due course to reflect on how any policy recommendations of this nature would best be captured in drafting terms.
¶2.16 Considered purely in terms of what it might be desirable to achieve in terms of outcomes by
any changes in the law, the underlying rationale of Mr Coppel's analysis and conclusions can be stated relatively simply. Firstly, it is to express more clearly the even-handed approach required by human rights law to the balance between individual civil liberties on the one hand, and the public interest in the liberties of the press on the other. Secondly, it is to improve the prospects of law enforcement and the restoration of that balance where the press goes too far in transgressing individual civil liberties.
¶2.17 The suggested reforms would seek to achieve these objectives by focusing the mind of the
1072journalist much more explicitly on the balanced judgment he or she has to make in the first place, with a reminder that the journalist is not above the law, and cannot be the sole arbiter
¶PART H | The Press and Data Protection
in the end of whether the public has been well-served by his or her actions. In other words, the changes are designed to promote conscious awareness in journalism and accountability to the public. Furthermore, they are intended to do so without imposing any burdens on honest and reasonably conscientious journalism24 beyond what is practicable and workable as a matter of day to day practice. The question is whether these intentions, from which it is hard to dissent, were indeed likely to be achievable along the lines Mr Coppel was proposing.
¶News International's objections to Mr Coppel's proposals
¶2.18 News International (NI) made submissions to the Inquiry to the effect that what Mr Coppel suggested was misconceived.25 This part of the Report considers these objections in turn.
¶(a) The 'fundamental objection'
¶2.19 In the first place, NI raised what it described as a 'fundamental objection'.26 This relates to the
proposed narrowing of the exemption in s32 on the basis of its divergence from the broad interpretation given to s32 by the Court of Appeal in Campbell v MGN Ltd.27 It was further argued that the effect of Campbell is that the existing provisions of s32, provided they are widely interpreted, strike the appropriate balance between Article 8 and Article 10.
¶2.20 As a matter of law, I do not see that this concern constitutes a 'fundamental objection' to
the policy. Mr Coppel's submission is precisely that Campbell, in its interpretation of s32, unduly widened an already excessively wide s32 as enacted in the DPA 1998. His argument is that the current s32 is framed in a way that effectively means journalism nearly always trumps privacy and therefore fails properly to implement the Directive. On that basis, the narrowing of the s32 exemption is better understood as returning s32 to its intended remit. It is of course open to Parliament to amend the wording of the exemption in s32 irrespective of the terms of the judgment of the Court of Appeal in Campbell, provided that any amended s32 does not conflict with the underlying Directive to which it is intended to give effect, nor is incompatible with Article 10 or other provisions of EU law. The issue is not whether the policy of the proposed amendments conflict with Campbell, but whether they are necessarily incompatible with Article 10.
¶H 2.21 It is not apparent to me that there is a necessary incompatibility, or that s32 as currently
1073drafted is the least generous formulation from journalism's point of view which is conceivably consistent with the ECHR if, indeed, it is consistent at all. Article 10 is a qualified right, inherently requiring a balance with other rights (including the right to privacy). I do not consider that Campbell can be read in the way that NI appears to contend, namely that a wide interpretation of s32 is necessarily required to give effect to Article 10 and that any narrowing of the scope of s32(1) is necessarily incompatible with Article 10. It must be remembered that the wide construction in Campbell concerned the temporal element of the exemption, i.e. whether it was confined to pre-publication activity or included publication itself. Campbell itself is entirely silent on the need to strike a balance between privacy and Article 10.
¶Chapter 5 | Issues About the Legal Framework
¶(b) The objection to a necessity test 2.22 It is argued by NI that the proposed replacement of the test of processing "undertaken with
a view to publication", with a test of processing "necessary for the publication" would be inconsistent with authority and unworkable in practice. NI makes the point that it is self- evident that for the s32 exemption to work it must cover, as it does at present, the processing of information which a journalist or editor ultimately decides to leave out of a published article.28 This point was, in fact, squarely addressed by Mr Coppel in oral evidence to the Inquiry.29 The exchange between Counsel to the Inquiry and Mr Coppel went like this:
Q. "Can we just look at a paradigm case of investigative journalism, that there's a lot of preparatory work … before publication. If the journalist can show that all the work is necessary for the publication, then he or she is protected both in relation to the preparatory work and to the publication itself." A. "Correct." Q. "Is that the correct analysis?" A. "It recognises that particularly for investigative journalism, in which there may be a long trail leading up to the publication itself – and some of those sub-trails may turn out to be fruitless in themselves but are nevertheless necessary in order to explore all the avenues to produce the article itself. That will be captured by my proposed 32(1) paragraph (a)."
¶2.23 The policy intention here would be to tighten the nexus, or causal link, which the legislation
requires between the acquisition and handling of the personal information and the ultimate publication but certainly not to the (obviously unworkable) extent that the exemption would apply only to material actually published. The idea would be to protect bona fide research or investigatory work without which publication could not happen, and that would have to apply from the point of view of the work at the time and not with hindsight. But it would not protect dealing in personal information unless it was properly necessary for research and publication. I do not see that that policy aim is either legally repugnant or necessarily unachievable in law and practice. As currently drafted, s32 of the Act requires the Court (or Commissioner) to consider whether the processing is undertaken with a view to publication, and that requires the Court (or the Commissioner) to consider the link between the processing and its ultimate purpose and the publication. Exactly the same conceptual process would be required under H Mr Coppel's proposals, but more would be being asked of the journalist to demonstrate the necessary link.
(c) Replacing the requirement in s32(1)(b) to have particular regard to the 'special importance of the public interest in the freedom of expression' with a more neutral balance, and an explicit balancing test
¶2.24 The NI submission30 suggests that this would be inconsistent both with Article 10 and s12(4)
1074of the Human Rights Act. Dealing with the latter point first, I do not think that there is any arguable technical inconsistency with s12(4), which is essentially a procedural mechanism,
¶PART H | The Press and Data Protection
directing a court when proceedings before it concern journalistic material to have particular regard to the importance of freedom of expression. In the event that a DPA claim engaging s12(4) were before the court, it would operate as a free standing provision and there is no need for the further incorporation of an equivalent provision in s32 in order to give effect to it. Where there are no proceedings before a court, for example where a journalist is considering whether s32 is met, s12(4) has no direct application.
¶2.25 It may be asked whether the recognition given in s12(4) to the importance of freedom of
expression is not a reflection of the more fundamental point in the NI submission, namely that as a matter of ECHR law there is in fact special importance attached to freedom of expression, and beyond that to a lack of constraint on journalism, to which the removal of the formulation in s32 is repugnant. Undoubtedly, there is a very special public interest in freedom of expression, as formulated in Article 10. But it certainly puts the argument very high to say that the existing language of s32 is a minimum imperative required by the ECHR. Indeed, as is apparent, during the passage of the Data Protection Bill, some anxiety was expressed by expert opinion in Parliament to the effect that the pull it exerted on the scales balancing the public interest in freedom of expression as against other public interests (including privacy) was itself not compatible with the language of the Convention.
¶2.26 I do not consider, as the NI submission seems to suggest, that the current drafting of s32
can be held up as the only and immutable expression of the balance between personal information privacy and the value in a free society of journalistic (or artistic or literary) endeavour. An expression of that balance in UK data protection law, which occupies a more central zone of the margin of appreciation, and which is expressed in language more close to that of Articles 8 and 10 themselves and which encourages those exercising precious freedoms to be mindful in doing so of other people's precious freedoms is something which it seems to me to be both possible and desirable to achieve. None of the provisions of s32 at present contains any explicit recognition of the wider context of public interest within which journalism must fairly operate. Mr Coppel's suggestion of introducing an explicit balancing test seems to me to be both truer to the letter and spirit of the Convention, and an important and necessary encouragement to mindfulness where journalism handles, as it often must, private information.
¶H (d) Taking individual subject access rights out of the automatic exemption provision
¶2.27 The NI submission describes this as "perhaps the most worrying of Mr Coppel's proposals".31
The right of individuals to know what information is held about them is of course at the heart of the data protection regime, and a very fundamental privacy entitlement in its own right. But its application in the modern world of journalism would be a change of some significance, and it is right that the idea should be considered with great care. The NI submission makes a number of points about the idea, some of which certainly need to be taken very seriously.
¶2.28 It is, for example, argued that it would seriously undermine the protection of sources.
1075Journalists' sources enjoy a considerable degree of legal protection, not least under Article 10 of the Convention.32 Any change to that protection would have to be considered most carefully, and in its own right rather than simply as the by-product of another policy. Sources (although not in a way specifically addressed to journalism) are, however, given considerable general protection by the data protection regime. That is because where access to one's own data would necessarily involve the disclosure of information about a third party (including a
¶Chapter 5 | Issues About the Legal Framework
source), the privacy entitlements of that third party have to be respected as well as one's own. In conferring the right of access to one's own information, s7 of the existing DPA, therefore, makes this further specific provision:
"(4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless— (a) the other individual has consented to the disclosure of the information to the person making the request, or (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual. (5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise. (6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to— (a any duty of confidentiality owed to the other individual, (b) any steps taken by the data controller with a view to seeking the consent of the other individual, (c) whether the other individual is capable of giving consent, and (d) any express refusal of consent by the other individual."
¶2.29 It is an important, if technical, point to note that the subject access right is a compound
right, including not just a right of access to the information, but a right to know whether information is held at all about one. So if even to confirm whether information is held would disclose a source, s7 makes provision for an answer which will neither confirm nor deny it. H
¶2.30 I do not express a concluded view as to whether the existing provisions of the DPA are a
complete answer to the challenge that introducing at least the possibility of a right of subject access has to be reconciled with the need to protect journalists' sources. I simply observe that it is not apparent to me that the importance of protecting journalists' sources cannot be captured in suitable amendment to these provisions, should any be needed. The more fundamental point is that there does not seem to me to be an argument from first principles that the protection of journalists' sources necessitates a complete and blanket dis-application of the subject access right in all circumstances. And if it is not necessary to disapply a fundamental privacy right in all circumstances, it is necessary not to.
¶2.31 It is further argued by NI that there are other reasons why it would be necessary to take a blanket approach to this right in the world of journalism. These are:
1076(a) "the need for legitimate investigative journalism to be able to operate covertly, and over a period of time, without the object of the investigations being able to find out that the press are interested in them;
¶PART H | The Press and Data Protection
(b) "the burden on newspapers' resources, particularly given the motivation of individuals to find out what is being held about them at regular intervals; (c) "'it would spell the end of the exclusive' if individuals could get hold of a possible story and provide it on their own terms to another newspaper – or indeed take to the internet with their own pre-emptive version; and (d) "that it fails to respect the balance required between Article 10 and 8 more generally."
¶2.32 Care must be taken in this context to avoid rhetorical elision between matters of commercial
convenience or profit, on the one hand, and a challenge to the current business model of the newspapers so fundamental as to amount to an abridgement of free speech, on the other. With the first of the four points noted above, it is possible to readily to agree. With the second and third, there are issues of degree. With the third in particular in relation to the question of exclusive stories, the business model may well be under rather more acute threat from the internet generally and the highly ephemeral nature of exclusivity once any publication takes place, than from any legislative change relating to the entitlement of individuals to know whether information is held about them. Similarly, the issue is to a degree less concerned with the exercise of freedom of expression than with the abridgement of the rights of others to receive and impart information. In reality, the key question, therefore, is the fourth, of which the first is an aspect. Does a fair balance between Articles 10 and 8 prohibit any possibility of subject access to journalistic material in all circumstances?
¶2.33 I am not persuaded that it does. It is evident that a fair balance would require an entitlement
for a subject access request to be refused to any degree where to comply with it would compromise the protections envisaged by Article 10. But I am inclined to think that this could properly be done on a case by case basis rather than by wholesale ouster of the right. This point needs to be borne in mind: a significant aspect of the importance of the subject access right lies in the ability it gives individuals to test for themselves whether their information is being dealt with lawfully and in accordance with the data protection regime (including, of course, whether the information is accurate). That includes being able to test whether any exemptions are being properly claimed (although not to the extent that properly claimed exemptions are themselves thereby compromised). The complete exclusion of subject access from all journalistic activity removes a principal check on its lawfulness. Who then is to
¶H perform that function? The obvious answer would be the Information Commissioner, but that answer in itself takes us to a second area which Mr Coppel has identified as problematic.
Civil law enforcement: journalism, access to justice and the powers of the Information Commissioner
¶2.34 As well as the substantive exemptions provided by s32, the DPA creates a number of special
1077procedural provisions which apply whenever it is claimed that personal information is being acquired or used for journalism. Their effects are both very significant for the purposes of the Inquiry and also very complicated. Their very complexity adds to their impact. It is necessary to engage with and unravel the detail of these provisions in order properly to understand and address their effect.
¶Chapter 5 | Issues About the Legal Framework
¶2.35 The relevant provisions are identified in this way by Mr Coppel:33
"Once a data controller claims that the personal data are being processed for a "special purpose" (i.e. journalism, artistic or literary purposes) or with a view to the publication by any person of any journalistic, literary or artistic material: (a) the Commissioner cannot ordinarily serve an enforcement notice or an information notice (s 46); and (b) where a person has brought a claim under the DPA seeking a remedy for breach of any of the data subject's rights (see §§37-45 above), the Court must stay the proceedings until there has been a determination under s 45 of the data controller's claim (s 32(4)). Where the proceedings are so stayed or the Commissioner has received a s 42 request for assessment, he may serve a "special information notice" (s 44). The object of the notice is to enable the Commissioner to carry out the s 45 determination. A data controller has a right of appeal against a special information notice (s 48). "Under s 45(1), where it appears to the Commissioner that the personal data are not being processed only for a special purpose or are not being processed with a view to the publication by any person of any journalistic, literary or artistic material, the Commissioner may make a determination to that effect. A data controller has a right of appeal against the determination. Once the determination takes effect, the Commissioner may serve an information notice. And, if a court gives leave, the Commissioner may serve an enforcement notice. If the Commissioner decides otherwise, proceedings for breach of the DPA may be stayed indefinitely…"
¶2.36 Broadly speaking then, the Information Commissioner cannot exercise his regulatory powers
in relation to the press (and a court cannot decide an action brought by an individual for breach by the press of the rights contained within the data protection regime) unless the Information Commissioner has first made a formal determination that the newspaper is not, in relation to given personal information, using it wholly for the purposes of journalism. The only power he can use to help him make that determination is the power to issue a 'special information notice' for the purpose. And he cannot issue one of those unless either litigation is already on foot or he receives a specific request from a complainant. Where he does issue a special information notice, the newspaper can appeal it. And if he does finally make a H 'determination' the newspaper can appeal that too. Any enforcement steps he is then able to take, whether investigative or compliance, each brings its own appeal rights.
¶2.37 Mr Coppel explained some of the cumulative practical impact of these provisions:34
1078"It results in a disapplication of the power to serve an enforcement notice – that's the first important thing that it does – and then secondly, where an individual has brought a claim, a section 4(4) claim for breach of statutory duty through the DPA, then the court must stay those proceedings until there has been a determination under section 45, and section 45 is a special procedure relating to the so-called special purposes, ie journalism, literature and art, to see whether in fact that is the case. "In practice, what happens is that it becomes so convoluted – the individual disgruntled has commenced proceedings under section 4(4). If they – if the point is taken that
¶PART H | The Press and Data Protection
these are special purposes, then a satellite set of proceedings is effectively launched, namely the section 45 one. That, if one ever gets to the end of it, reaches its end, it might come up with a conclusion. If the conclusion is in favour of the individual, then they resume their claim, by which time, of course, matters have marched on significantly and it may be of cold comfort, any such relief – [they may quite possibly have lost interest in living by then] and particularly if one realises that at the end of it all one is going to get like, for example, Catherine Zeta Jones, £50, one can well understand why interest might be a little bit diminished."
¶2.38 During the course of the Inquiry, it has frequently been asserted that most or all of the evident
problems with the culture, practices and ethics of the press would be solved if the existing law were to be properly enforced. Where press compliance with the legal requirements of the data protection regime is concerned, enforcing the civil law is a two-stage process. It must first ensure that the boundary between exempt and non-exempt activity in relation to dealings in personal information is properly observed by the press, and this is a point which applies wherever that boundary is drawn by the substantive law. Secondly, it must also ensure proper compliance with the regime where exemptions do not apply.
¶2.39 Law enforcement in these respects takes place in two different ways. First, it is by individuals
bringing cases in the courts, and, secondly, by the exercise of his powers by the Information Commissioner. Both as regards litigation procedure on the one hand and as regards the assertion of the powers of public authorities on the other, there are already significant inhibitions in the general law which impact on the possibility of proper law enforcement in respect of the press because of the balance which must be struck between the public interest in law enforcement and the public interest in the protection of journalists' sources. The additional procedural thicket which the DPA erects in the way of anyone attempting to find out whether the press is complying with the law, that is to say whether their activities are genuinely covered by exemptions and if not whether they are complying with what is legally required of them, is for practical purposes near-insuperable. The press, so this analysis goes, is effectively beyond the reach of law enforcement. In that regard, the legal regime can be and is disregarded for any practical purposes. Whether what the press are doing with people's information is or is not specifically exempted from the regime hardly matters in practice since the question is effectively prevented from arising.
¶2.40 Mr Coppel suggested that this aspect of the problem should be addressed in two ways, that is H to say by removing the elaborate tangle of red tape which stops the Information Commissioner
doing his job in relation to the press, and by providing more straightforward access to justice for individuals.
¶Powers of the Information Commissioner
¶2.41 Here, Mr Coppel's proposal is very straightforward: the DPA should be amended to repeal the
1079entirety of the complex special regime limiting the Information Commissioner's powers in relation to the press. Specifically, he recommends:35 "removing the provisions for special information notices (s 44), special purpose determinations (s 45) and special purposes restrictions (s 46), thereby aligning the DPA's enforcement procedures as they apply to the press with those that apply to others, i.e. the ordinary provisions for enforcement (s 40), assessment (s 42) and information notices (s 43)".
¶Chapter 5 | Issues About the Legal Framework
¶2.42 These provisions of the DPA are highly redolent of a policy context in which the self-interest
of the press was a powerful advocate, rather than one in which law enforcement was an active concern. Given the specificity and elaborate nature of the provision made for testing the compliance of the press with the law, however, this much can be said: it cannot have been the intention of the legislation that the compliance of the press with the law should, in reality, be incapable of being tested in practice. No doubt concerns were vocally expressed that legitimate journalism should be able to go about its business without interference or 'chill' from overzealous regulators or nuisance litigation. But there is no policy intention on the face of the legislation that it should be impossible, in the usual ways, to establish whether the journalism was in fact legitimate in the first place. Such an intention would have been very simple to express legislatively although it would, of course, have been incompatible with the spirit and letter of the Directive. However wide the boundaries of an exemption are set, those boundaries have to be given some real meaning. Making those boundaries inaccessible, and the question on which side of them any activity falls effectively incapable of being answered, strips those boundaries of meaning.
¶2.43 The risks of applying the ordinary regime of information and enforcement notices to the
press are capable of being overstated. An information notice could not be issued unless the Commissioner reasonably required any information for the purposes of determining whether the press were complying with the law. Similarly, an enforcement notice could not be issued unless the Commissioner was satisfied that the press had contravened or was contravening the law. In each case, the Commissioner would have to bear in mind any genuine risk to freedom of expression. Each measure, if deployed, has an appeal mechanism through which its compatibility with freedom of expression could readily be tested, case by case. It is not my view that the mere existence of the possibility of law enforcement measures of this sort would itself be an improper inhibition to journalistic activity, nor that the press would be slow to understand and make use of the sort of procedural safeguards which the standard data protection regime provides.
¶2.44 None of this is of course intended to give any encouragement to the idea of over-zealous
reliance by the ICO on formal powers. As successive Information Commissioners have repeatedly emphasised, in general, the first recourse of a regulator with concerns about compliance should always be to seek to resolve matters informally and cooperatively. But it has not been my perspective that over-zealous recourse to formal powers has been a major concern about the way in which the ICO has engaged with the press and there are, in H any event, plenty of inhibitions in law and practice to any such tendency. On the contrary, it appears that the most pressing concern is the need to address the extent to which the ICO is shy about performing its proper role in relation to the press as a member of its field of regulation, not least by addressing the evident cultural inhibitions to doing so created by the DPA's complicated procedural regime. If the ICO has entertained a view that it is somehow unable to apply the law to the press, that it is not really supposed to do so, the process provisions are likely to have been a significant encouragement to that view, however overstated that view may be.
¶2.45 From the point of view of legitimate journalism, it is right that the ICO should not interfere
1080or over-regulate. It is also right that journalism should be judged primarily by what it prints rather than be held to account at the newsgathering stage. A theme of this part of the Report, however, is that this does not mean that blanket exclusion from regular law enforcement measures is the only, or a very sensible, response. It is my conclusion that it is a part of the culture, practices and ethics of some sections of the press that there is a sense of comparative impunity and, in the main, of being beyond the reach of the law. This has not been in the public interest, and needs to be rebalanced by a greater sense of awareness of the law and what is
¶PART H | The Press and Data Protection
the continuum between the constraints of the law and aspiration towards good practice. The existing procedural provisions of the DPA in relation to the press appear to be an unnecessary and unwelcome inhibition to making progress towards that goal.
¶Access to justice
¶2.46 In general, the DPA provides36 for individuals who suffer damage as a result of breach of the
legal requirements of the regime to be entitled to financial compensation from the person or organisation responsible. It is a defence in such proceedings for the latter to show they had taken reasonable care to try to act in a way that is compliant with the law. If any individual has suffered damage, compensation is also payable for distress. Where, however, the contravention relates to acquiring or using personal for the purposes of journalism, literature or art, compensation is payable for distress alone, without the need to prove physical damage. This is in recognition of the fact that the unlawful widespread public dissemination of someone's personal information is capable of having a distressing impact in its own right; this is the impact about which very many of the witnesses before the Inquiry have eloquently spoken.
¶2.47 In practice, however, the way that the courts have interpreted this entitlement to
compensation has been very limiting indeed. As a result, claims are rarely successful, and even when successful have resulted in very small awards.37 At its root the problem is that the courts have been reluctant to award compensation for anything other than measurable financial loss caused by the breach of the regime. Nothing, in other words, is awarded for the distress in its own right, but only if it has occasioned economic loss. But by its nature, the subject matter of the regime, that is to say privacy, is unlikely to produce circumstances in which breach straightforwardly causes pecuniary loss. The harm done is the invasion of privacy itself.38
¶2.48 In other areas of the civil law, the courts have solved this problem by evolving a tariff
of compensation to be paid for non-pecuniary loss. The best example is in relation to compensation for pain, suffering and loss of amenity in personal injury case. A more recent (and perhaps more relevant) illustration is the award of damages for breach of contract where holidaymakers have been let down by travel companies or holiday operators. The whole point of the contract was the pleasure of a holiday with the result that compensation
¶H will be payable for the disappointment.
¶2.49 On the face of it, the inability of victims of data protection breaches to obtain compensation
for distress in its own right is an anomaly for a regime whose principal purpose is to safeguard individuals from unlawful intrusion into their private lives. The practical problem facing any attempt to address that lacuna, however, would be how to put a price on privacy in the way that the courts have evolved tariffs of compensation in other areas of 'immeasurable' psychological or emotional harm.
¶2.50 It must immediately be acknowledged that this is an issue which is relevant to activities in
1081relation to private information which go beyond journalism, and beyond public dissemination of information in breach of the data protection principles. Damages for non-pecuniary loss in
¶Chapter 5 | Issues About the Legal Framework
privacy cases is a potentially large subject in its own right, and one which has an extremely large and detailed context in the law of damages more generally.39 On the other hand, as indicated above, the DPA makes special provision for compensation for distress unlawfully caused by the press although this is a provision to which the courts have not in practice given substantive effect.
¶2.51 Mr Coppel tested the issue with the example of the medical records of an individual
being published in a newspaper in breach of the DPA, that is to say, unfairly and without legitimate public interest justification.40 To that example might be added the example of the dissemination of intimate sexual details or nude photographs, again, for the purposes of the argument, unfairly and without legitimate public interest justification. Mr Coppel suggested: "That, it seems to me, is a fundamental breach of what the Act is there to protect". Should the measure of recompense be simply how much money the individual may lose as a result – and if none, should the individual be left to endure any amount of distress and personal devastation uncompensated?
¶2.52 The DPA has been amended in recent years to make provision for the Information
Commissioner to be able to impose monetary penalties, including in cases of this sort.41 But monetary penalties of course, while they may have a deterrent or punitive effect, still leave the victim uncompensated.
¶2.53 Mr Coppel's own suggested solution has two elements. First, the Information Commissioner
should be empowered to set a tariff of financial solace for breaches of the data protection principles, referable to the duration, extent, gravity and profitability of their contravention, such amounts to be in addition to amounts for damage and distress resulting from the contravention and to be followed by the Commissioner and the Courts. Secondly, a wronged individual should be provided with the choice of an alternative system to claim the tariff only, with no provision for damages, legal costs or fees, such a system to be administered by the Information Commissioner.42
¶2.54 Within Mr Coppel's analysis and conclusions, there are proposals that are specifically directed
to the law relating to data protection; others have far wider ramifications into the law of damages. As for the proposed way forward in relation to the DPA, I accept that, at their heart, they reflect a recognition that changes need to be made in order to provide a response to the demand repeatedly expressed for the law to be properly enforced in relation to press misconduct and for individuals to have proper access to ways in which they can enforce their H rights.
¶2.55 More specifically, in relation to the 'special enforcement regime' provided in the 1998 Act
1082in relation to the press, there are good grounds to conclude that it has had an unintended and damaging effect on the ability of the ICO to perform its functions. Exceptionally complex and largely unworkable in practice, it appears to have had a chilling effect on reasonable law enforcement and, equally, to have a high risk of impacting unfairly on individuals. In my judgment, Mr Coppel's view is correct: its removal would promote the overall public interest and a balanced improvement in the culture, practices and ethics of the press in its approach to personal information.
¶PART H | The Press and Data Protection
¶2.56 In reaching that conclusion, I am very conscious of the need to ensure that legitimate journalism
is not unduly impeded by attempts at pre-publication law enforcement on the one hand, albeit at the same time that individual liberties are not unduly stripped of their content by being rendered wholly unenforceable before publication (and then to be defeated by the act of publication) on the other. It is my provisional view that this difficult, but essential balance, is one which can and must be performed on a case by case basis by the ICO in considering the exercise of its powers, and that it is not one for which it is necessary or appropriate to attempt to make further provision by law. If, however, it were thought desirable to do so, it would perhaps be possible to preserve expressly in the Act the principle that, in considering the exercise of any powers in relation to the press or other publishers, the ICO should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime.
¶2.57 Built into this balancing exercise should be a requirement on the ICO, when considering the
exercise of any of its powers, to have regard to the fact of membership of an accredited press regulator by the relevant title: this should be capable of establishing the proposition that the title subscribes to recognised and approved standards of conduct which are, themselves, enforceable.
¶2.58 The proposals for adjusting the boundaries and operation of the press exemption in s32 is
a more difficult exercise. Although I am minded to the view that there is, indeed, an issue about compatibility, I do not consider that it is necessary for me to resolve whether there is any incompatibility between the provision as interpreted by UK courts and the UK's European and international obligations. What I am, however, clear about is that there is room within the latitude afforded by those obligations for a fairer, more even-handed balance, and that improvement in that respect is, both as a matter of both law and policy, desirable.
¶2.59 I therefore recommend that the policy represented by the suggested revisions to section 32
of the DPA should be given effect to by suitable amendment to the Act. In doing so, I consider that particular attention should be addressed to one area where further refinement of that policy seems to me to be desirable.
¶2.60 The removal of the blanket exemption from the fundamental right of subject access currently provided by s32 seems to me to be right for the reasons considered above. But there are H special considerations relating to the exercise of a right of this nature in relation to the press
to which careful attention needs to be paid. It remains necessary for the right to be balanced against the special protections afforded by the law to journalists' sources. That protection is not absolute as the law stands, but it is extensive. On the face of it, the existing general limitations on the subject access right which are designed to safeguard third party information do appear generally apt to follow the existing (important) protection for journalists' sources. If it were thought that there was any doubt about the matter, however, that doubt should be resolved by a provision to the effect that the right of subject access is not intended to displace the general law on the inaccessibility of journalists' sources.
¶2.61 Turning to the question of damages, I do not consider that it is appropriate for the Information
1083Commissioner to be setting a tariff of financial solace for breaches of data protection or why this should be different from damages for distress (which might themselves be linked to damages for breach of other privacy rights). The proper place for the assessment of damages (or non pecuniary compensation) is allied to the consideration of damages across this area of the law. I return to this topic when dealing with the civil law.43
¶Chapter 5 | Issues About the Legal Framework
¶2.62 In making these recommendations, I accept that the current state of the legal framework in
relation to the ICO's civil law enforcement powers goes some way to explain the indications of reluctance by the ICO to take an active, or any significant, interest in the formal exercise of their regulatory functions in relation to the press. I do not, however, accept that as a complete explanation. In reality, there is a lack of evidence that the ICO has, over the years:
(a) regarded the symptoms of deficiencies in the culture, practices and ethics of the press in relation to personal information as a serious operational priority; (b) shown a will to test in practice the powers and procedures conferred by law specifically for the purposes of ensuring compliance with the legal obligations of the regime by the press – however attenuated those obligations and however difficult those procedures; or (c) drawn attention politically to any perceived shortcomings in the legal framework in this respect. This raises questions about a possibly deeper reluctance to accept an active role in relation to the press. Neither do I accept that other operational priorities must be accepted without more as an explanation for ICO inactivity in an area which the very existence of this Inquiry demonstrates to be a matter of acute public concern.
¶2.63 While recommending changes to the law, I do not intend to encourage the idea that the ICO
should continue to take no steps to address the culture, practices and ethics of the press in the meantime. I therefore additionally recommend that the ICO should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime. I explain elsewhere, it is also my recommendation that in future such a policy should expressly provide that membership of an effective and independent self-organised system of standards regulation should be able to be taken into account by the ICO in contemplating the exercise of those functions.
¶2.64 I further recommend that the ICO take immediate steps to publish advice aimed at individuals
concerned that they are or may have been victims of unlawful use of their personal information by the press. That might, for example, take the form suggested above, of enabling individuals, on application to the ICO, to obtain confirmation in so far as the office is able to offer it of whether they can be identified among the Motorman victims, and if so in relation to which H title or titles, and to obtain assistance if necessary in making a suitable request to those titles. It might also take the form of engaging with victims' representative organisations to those ends.
¶Promoting good practice: journalism and ss51-52 DPA 2.65 In considering the role of the ICO in relation to the conduct of the press in connection with
the handling of personal information, it is sensible to start with ss51-52 of the DPA.44 These are among the simpler and more straightforward aspects of the application of the data protection regime to the press and it has not been suggested that the provisions should not be taken at other than face value. In short, they provide that:
1084(a) the ICO has a positive duty to promote the following of good practice in relation to the handling of personal information by the press, no less than in the case of any other business;
¶PART H | The Press and Data Protection
(b) the ICO also has a positive duty to promote the observance of the legal requirements of the DPA by the press, in so far as they apply; (c) the powers of the ICO in relation to the dissemination of public information and industry guidance apply in the context of the press industry; (d) the powers of the ICO to encourage sections of industry to develop and apply codes of good practice in the handling of personal information apply to the press sector; (e) the duty of the ICO to make an annual report to Parliament on the exercise of its functions includes a power to cover press aspects in that report; and (f) the power of the ICO to make special reports to Parliament includes the ability to make special reports about the intersection between the data protection regime in practice, and the culture, practices and ethics of the press in relation to personal information (which provision provided the basis for the laying of the What Price Privacy? Reports).
¶2.66 As a matter of ordinary public law, the exercise of any of these powers has to be kept under
review, considered within the overall framework and purposes of the data protection regime as a whole, and both reasonable and proportionate in all the circumstances. On the face of it, relevant considerations in that context would include matters such as the extent of objective evidence of poor practice along with the nature and seriousness of that poor practice and levels of public concern. Evidence of widespread ignorance of the requirements of law and good practice (whether on the part of industry or individual) would be particularly relevant, especially if that ignorance were related to the genuine complexity of those requirements. As an expert regulator, the ICO would then be in a unique position to address the problem with explanation, education and support.
¶2.67 Of course, the exercise of any of these powers in relation to the press would also have to take
into account the wider legal context, including respecting in full the balance to be struck both in law and in policy between the liberties of the individual and the vital requirements of a free press. That wider context would certainly affect the manner in which the powers were exercised, and the content of any guidance, codes, reports and so on. But it does not on the face of it appear to constitute a limitation on the existence or potential value of these powers in relation to the press.
¶2.68 For my part, I do not see any defect in these provisions which could limit their ability to H contribute to the promotion of good standards of behaviour in the press in the handling of
private information: none has been overtly suggested. There has been no suggestion, for example, that throughout the period in which Mr Thomas was trying to encourage the PCC to promote good practice in the industry, including by means of its own Codes and guidance, he was in any way inhibited as a matter of law by the legislation governing the ICO from acting in those areas or fulfilling those requirements himself.
¶2.69 If there were any real doubt in the matter, legislation could put its application to the press
beyond doubt. Indeed, it would also be possible to introduce new positive duties in relation to the press, for example to insert positive duties into the legislation as follows:
1085(a) into s1(3) for the ICO, in consultation with the industry and the public, to exercise the power to issue comprehensive guidance to the press on good practice in the handling of personal information; (b) into s51(2) to exercise the power to issue comprehensive guidance to the public on their individual rights in relation to the obtaining and use by the press of their information, and how to exercise them; and
¶Chapter 5 | Issues About the Legal Framework
(c) into s52 to include in the ICO's annual report to Parliament an account of its perspective on press compliance with law and good practice in the handling of personal information and to draw special attention to any concerns. Having said that, I should make it clear that I do not see any reason to doubt that the ICO could exercise his powers in these ways as the law presently stands.
¶2.70 I do not accept that there is any reason in law to explain the failure of the ICO to use these
powers by taking active steps to address the need for improvement in the standards of the practices of the press in relation to the handling of personal information. Successive Commissioners have emphasised that this drive for good practice function is the cornerstone of the entire regulatory regime. Unfortunately, evidence to justify serious concern about the standards of the press in this respect has been available and well publicised: an informed, well-targeted, proactive and engaged approach to the problem might have made a real difference. It is a matter of regret to record that the failure by the ICO to address this issue must be regarded as a regulatory opportunity missed.
¶2.71 In those circumstances, I recommend that, in discharge of its functions and duties to promote
good practice in areas of public concern, the ICO should take immediate steps, in consultation with the press, to prepare and issue comprehensive good practice guidelines and advice. This should include the articulation of principles and standards dealing with the acquisition and use of personal information. I hope and anticipate that the press will actively cooperate in the preparation and implementation of such guidelines and advice, not least so as to ensure that its Article 10 rights are fully recognised and reflected in the work. In those circumstances I would expect the guidelines and advice to be prepared and implemented no later than six months from the date of this Report.
¶2.72 I also recommend that the ICO take steps to prepare and issue comprehensive guidance to
the public on their individual rights in relation to the obtaining and use by the press of their information, and how to exercise them. To demonstrate the effect of this guidance, the ICO should include regular updates on the practices of the press in relation to handling of personal information in its annual reports to Parliament.
¶Criminal Law: the sentence for breach of s55 DPA 2.73 The history of the campaign started by Mr Thomas to amend s55 DPA to introduce the H
possibility of custodial penalties on conviction (by providing a statutory maximum of two years imprisonment) has been set out. The position is that the Criminal Justice and Immigration Act 2008 introduced that amendment, but the changes had not been brought into force. A statutory instrument, to be laid before Parliament by the Government, is required.
¶2.74 As a matter of principle, the existence of uncommenced legislation on the statute books is
1086potentially problematic. The power of the Secretary of State to commence legislation must, by law, be kept under review, so it always remains a live issue. As described elsewhere,45 the legislative process by which the maximum penalty was increased and the defence to the substantive offence available to journalists broadened, with both changes left uncommenced, was strongly indicative of a political compromise, designed as much as anything to quieten two opposing campaigning voices rather than as a response to a thought through policy analysis for which there was genuine empirical evidence. It is not surprising to find that the delicate balance of the compromise has not proved something which succeeding Secretaries of State for Justice have been in a hurry to revisit.
¶PART H | The Press and Data Protection
¶Recent history of the ICO's s55 campaign
¶2.75 In October 2009, the Government published a consultation paper in seeking views on the
commencement of both parts of the changes.46 Responses were sought by January 2010, with a view to assessing the possibility of activating the changes in the April of that year, at the same time as it was proposed to confer on the ICO enhanced powers in relation to civil penalties. It does not appear that the responses to that consultation exercise have been published by the Ministry of Justice. However, the press has consistently opposed the commencement of the provisions and the then Government did not bring the new provisions into force in what were the final weeks before the General Election. Neither has the current Administration advanced the position: a decision is now said to await this Report.
¶2.76 Successive Information Commissioners have continued to press for the increased penalties
to be brought into force. Mr Thomas repeated his case in his first witness statement to the Inquiry:47
"The main reform, in my view, should be an immediate ministerial Order to activate the prison sentence for s55 offences. The public controversy of the last two months, and public outrage at press misconduct, make the case for that reform more pressing than ever. Even if there has been improvement in press conduct since 2006 there is still no guarantee that this will remain indefinitely and I understand that illegal activity remains rife in other sectors. A strong deterrent is needed and it is vital that a clear signal should be sent that s55 offences are not trivial or "technical"."
¶His exasperation was evident in his oral evidence to the Inquiry:48
"I cannot for the life of me understand why the Government has now not activated that provision. … I am very disappointed as an individual now that still, despite all the material that has surfaced in recent months, the order has not been activated. It would be a very simple matter to bring that into force now, and my broad understanding back in 2008 was that it would only be a delay of six months or so, but that has not yet materialised."
¶2.77 The ICO campaign on s55 has continued under Mr Graham, but with a perceptible change of emphasis. The ICO submitted evidence to the consultation on activation of the new H provisions at the end of 200949 but, by this time, Motorman was presented as somewhat
1087distant history. The ICO submission focused instead on examples, including half a dozen case studies, of the blagging of personal information by deceit in the routine criminal contexts of unscrupulous debt-collection, commercial espionage and profiteering, and personal grudge and intimidation. Judicial sentencing remarks in cases prosecuted are cited to the effect that the sentence maxima on s55 conviction did not allow a sentence to be passed commensurate with the criminality of the behaviour. An example is given of ICO investigators executing a search warrant:
¶Chapter 5 | Issues About the Legal Framework
"They were greeted at the premises, by an individual who had a previous conviction for a section 55 offence, with the following comments. 'What's the maximum fine for this, £5000? I will write the cheque out now.'" At the other end of spectrum, Mr Graham explained in evidence that he wanted to:50
"…deal with the problem of the courts being limited to fines and then dealing with people who are of limited means and can only be fined about £100, and the court doesn't have the option of doing anything about a community sentence or tagging or curfew or whatever else might be involved. It's just the going rate is £100. It happened again the week before last. It's nothing."
¶2.78 Other general points are made in the ICO submission to the consultation exercise about
the consequences of s55 not being capable of attracting a custodial penalty. Two points in particular should be noted:
"At present the offence of unlawful obtaining etc is not a recordable offence. It is not therefore recorded on the Police National Computer. Fingerprint impressions, DNA samples and descriptive details are not currently taken from those individuals who are prosecuted by the ICO for the section 55 offence (a descriptive form contains personal information relative to the accused person, for example, ethnic appearance, build, shoe size, glasses, hair, facial hair, marks, scars and abnormalities etc). If the penalties for this offence are increased to imprisonment the offence will become a recordable offence. This will not only underline the serious nature of the offence but will ensure that those convicted carry a meaningful criminal record."
The criminal record is both a matter of deterrence in its own right and also of assisting detection. The second point made is that, with a custodial penalty available, s55 crime could fit within the framework of the European arrest warrants; data crime is an easy cross-border activity, and the availability of simple extradition procedures would overcome jurisdictional inhibitions to criminal enforcement.
¶2.79 Subsequently, including in an update report to the Ministry of Justice in August 201151 and
in the evidence that Mr Graham provided to the Inquiry, the ICO has sought to turn the spotlight in relation to s55 definitively away from the press altogether. As discussed above, that is articulated by way of an assertion that the practices of the press are no longer an H issue in relation to information blagging. From the perspective of the ICO, however, given the history of the s55 campaign, there is no doubt a degree to which the press are simply seen as the principal inhibition to the commencement of these provisions. The policy is now to seek to neutralise the hostility of the press and emphasising that the policy aim to be achieved now has little to do with their activities no doubt has that in mind. Mr Graham illustrated this in his evidence when he said:52
1088"In fact, I went to the Society of Editors conference in 2009 and said: 'it's so not about you. It's about NHS workers, it's about private investigators, it's about bank clerks, and it's frustrating not to be able to deal with that real challenge, which the Information Commissioner's office is concerned to deal with, because we're constantly met by the press saying, "This is terrible, the sky is falling, the sky is falling". It really isn't.'"
¶PART H | The Press and Data Protection
¶2.80 That the tension between the ICO and the press on the s55 issue is still very much a current
source of heat was vividly illustrated by exchanges between Mr Graham and Mr Rhodri Davies QC, asking questions on behalf of News International. This exchange is set out at some length here because it illustrated in microcosm, and in many ways can be regarded as the summation of, the long years of debate and lobbying on this subject, in Parliament, in successive Governments, and in other public fora. Mr Davies put it to Mr Graham that, if the behaviour of the press was not itself the current operational focus of the campaign, nevertheless:53 "The political problem, if I can call it that, that you have in getting the existing legislation into force is what we might call the perceived effect on the press. It's not the bank clerks who are campaigning against this; it's the perceived effect on the press which is your problem? "A. My problem is the press. It's not the perceived effect on the press, it's the behaviour of the press, worrying away at a penalty designed to deal with a problem which they say doesn't apply to them, and I say, "If it doesn't apply to you, get out of the way." "Q. Isn't the way through this, which might perhaps satisfy both parties, simply to exempt from the threat of a prison sentence anyone who is acting for the special purposes of journalism, artistic or literary matters, using the phraseology in Section 32? "A. How much of a good deal do you guys want? Excuse me, sir, for being heated about this, but you fought everyone to a standstill back in 2006/7. You did it again in 2009/10. You've got so many privileges and exemptions. It's perfectly possible for a journalist to do a decent job legally. There is Section 78 [of the Criminal Justice and Immigration Act 2008] on the statute book, applying the reasonable belief of the journalist that what they were doing for publication was in the public interest. It's going to be very difficult for anyone to strike that down, but there are some people who believe that that's more generous to the press than really should have been the case, but that was the deal. Now, if I understand it, you're sort of coming back for more - on behalf of your clients. "Q. What I'm trying to do, Mr Graham, is to point out a route through the problem, or one that bypasses the Gordian Knot, and I'm not quite understanding why this solution is not acceptable to you.
¶H "A. Well, this isn't a negotiation about these things, but it sounds to me as if the
1089representatives of the press want to be somehow above the law. Surely a free press operates within a framework of law, and a vibrant and healthy press, challenging those in authority and doing the job that it should be doing and the job that I joined the profession to do, operates within the law. Yes, okay, you sometimes have to apply the dark arts to get the story, and then you're accountable for it. And if you're really in trouble, that's the mitigation that you put to the court. But we can't keep having more and more carve-outs and reductions and special cases, surely. "Q. The point is, Mr Graham, that prison sentences do have a more chilling effect than the lesser sanctions available to the court - "LORD JUSTICE LEVESON: Is that right, Mr Rhodri Davies? I'd be very interested to see evidence about that, because one thing is for rock solid certain: interception of communications did have a custodial sentence attached to it, and it didn't seem to have stopped a great deal of activity.
¶Chapter 5 | Issues About the Legal Framework
"MR DAVIES: Well, that certainly was true-up to 2006/7, I entirely understand that. "LORD JUSTICE LEVESON: I'm not, I think, trying to make a cheap point. I'm not doing that at all. But I am concerned about the evidence base for the assertion. I'm not stopping you, I understand the point, and of course you can pursue it. "MR DAVIES: Well, I think - really, what I'm putting to you, Mr Graham, is your own assumption, which is that if the sentences available for breach of Section 55 are increased and the range of sanctions available to the court is widened, then you think that that will have a beneficially chilling effect on people who would otherwise contemplate a breach of Section 55? "A. It would have a beneficially chilling effect on DVLC workers handing out car numbers and addresses based on those car numbers in exchange for money. It will have a beneficial chilling effect on health workers who apparently think it's perfectly okay to access someone's medical records in order to find the telephone numbers of their in-laws, who they're having a fight with, or the bank clerk in Haywards Heath who thinks it's fine to look at someone's bank records in order to provide the case in her husband's defence in a sex attack trial. That's what we're dealing with. What's that got to do with the press? If you're not doing this stuff, get out of the way. "Q. Yes. I entirely understand those problems."
¶2.81 Mr Davies took Mr Graham through some practical examples of where the public interest
defence might be relied on by a journalist in a s55 case. These drew on the sort of material which emerged in Motorman. The exchange continued:54
1090"MR DAVIES: So that is a situation, Mr Graham, where, as I understand it, you think that the journalist might very well have a public interest defence? "A. I say it's arguable, anyway. "Q. It's arguable. That's the difficulty, isn't it? Because once we're into the territory of it's arguable, and it's a prison sentence if you're wrong, do we not have a chilling effect? "A. But all you have to advance is the reasonable belief that the story you're pursuing was in the public interest. Really, if you can't make that case, you shouldn't be in journalism. It's a very, very good increased defence for journalists. H "Q. I'm just wondering how far that goes. So you say if there's a reasonable belief that the story you're pursuing is in the public interest, then that would be a public interest defence to obtaining an ex-directory telephone number? "LORD JUSTICE LEVESON: I'm not going to allow you, Mr Davies, to use the opportunity to try and tie the Information Commissioner down. Let me say what I presently believe, and then people can make submissions in due course. I presently believe that the new potential provision contains both subjective and objective elements, so not only must the journalist believe that it's in the public interest to do so, but there must be reasonable grounds for that belief. Thereafter, if I follow up your earlier question, the Information Commissioner would have to decide whether there was evidence to rebut that defence before he thought of bringing a prosecution. If he thought of bringing a prosecution because he thought he could rebut the defence, it would be open to the journalist to advance the defence in court. If the court decided against the
¶PART H | The Press and Data Protection
journalist, then it would have to decide on a scale how grave the particular offence was, and in my experience of sentencing criminal cases, which extends over 27 years, I don't think you'll find that there would be any question of a mandatory sentence in those circumstances at all."
¶2.82 No further formal submissions were in fact received by the Inquiry on this subject and it now
falls therefore to reflect on the extent to which this Report should seek to resolve the matter on way or the other. I do not, for the reasons set out above, accept that I should avoid doing so on the grounds that I can be confident that the culture, practices and ethics of the press are such that it is simply no longer a live issue within the Terms of Reference of the Inquiry. Bearing in mind those Terms of Reference, however, it is important to make clear two points.
¶2.83 The first point is that the thread of argument in Mr Thomas's original campaign (that increasing
the sentencing maxima for s55 was a necessary element in increasing the profile of the data protection regime generally, and the seriousness with which it is regarded, whether politically of forensically), is not the concern of this Inquiry and not something on which this Report can or should express a view. Secondly, since the operational considerations currently being advanced in favour of commencing the increased maxima are explicitly said to be directed elsewhere than in the direction of the press, these are not considerations within the purview of this Inquiry and not matters on which it would be appropriate for this Report to have a determinative effect
¶2.84 S55, in other words, is not a provision of exclusive application to the press, and it is necessary
that I should be suitably circumspect about any effect of considering the matter otherwise than in relation to the press. S55 is, however, a provision which, as amended, has a specific and modified application to the press, and to that extent the uncommenced amendments must be considered to be part of the special approach to journalism that is evident throughout the data protection regime. It is also a provision the history of which, up to and including the present day, has been dominated by the press's policy interests. It is impossible therefore to avoid reflecting on the history of the s55 issue in the context of this Report at any rate in relation to the press dimension to the policy.
¶2.85 This is not in any event, as indicated above, simply a policy issue at large. Parliament has considered this matter in extensive detail and legislated on it. The very strong presumption H must be that Parliament does not legislate in idleness. Deferred implementation of legislation,
in the rare instances in which that is deliberate policy, is usually a matter of making provision for preliminary practical issues or, as in this case, to allow for contingent events. The s55 contingency might be described as a policy of waiting to see whether the mere uncommenced existence of the possibility of a prison sentence would itself prove to be a deterrent to criminal activity. There appears to be ample evidence that criminal activity comprising the knowing or reckless misuse of personal information continues to be a real problem, and that specifically the absence of a potential custodial sentence (which would therefore permit sentences short of custody such as a community penalty) has emerged as a contributory factor. This is not least because, as Mr Graham made clear, a financial penalty must be related to means to pay and those of limited means will therefore face potential sanctions which have little correlation with the gravity of the offence and the potential for harm.
¶2.86 The only reason which has been cited to the Inquiry for failure to commence the provisions
1091for increasing the maximum potential sentence is the potentially damaging effect that it would have on journalism. These are not considerations which, in my view, can reasonably argued to be persuasive, let alone determinative.
¶Chapter 5 | Issues About the Legal Framework
¶2.87 In the first place, the argument that the prospect of custody would have a differential
'chilling' effect on lawful and ethical journalism from the prospect of a financial penalty is one which it is barely respectable for national press organisations to advance at all. Its necessary implication is that the prospect of a criminal conviction can, of itself, be regarded as a tolerable business risk, and a criminal fine a tolerable overhead, in journalism. This says little more than that 'unchilled' journalism is an activity which takes calculated risks with deliberate and indefensible criminality. This is an argument for criminal impunity including (as it was put before the Inquiry) by way of a plea for indemnity from the otherwise universal application of criminal penalties; it amounts to special pleading to be placed above the law. I put the matter starkly, because no-one reading this Report should be in any doubt as to the true nature of the argument being advanced on behalf of the press in its most unqualified form.
¶2.88 There is a more respectable version of the argument that there is a chilling effect in this
provision. That version is not a contention that the press should be indulged in committing calculated criminality. It is an argument that the boundaries in this territory between what is criminal and what is not are not clear enough to make it safe for journalists to operate confidently. It is not an argument therefore about the consequences of criminality but about the risks of crossing criminal boundaries unwittingly. Where the boundaries are unclear, the possibility of a custodial penalty raises the stakes to the extent that decent journalists will have to take a risk-averse approach and give them a wide berth. The result, so the argument goes, is that some areas of investigative journalism on the right side of the law will be lost and that this would be contrary to the public interest.
¶2.89 This remains an argument which envisages journalism tracking the boundaries of crime in a
way which is not, and has not been over the years in which the s55 issue has been debated, empirically evidenced as a genuine operational problem to any degree; neither does it deal with the ethical (and indeed legal) questions which are raised by behaviour which is only just on the right side of crime. But the important point is that it is essentially an argument about whether the provision made in the new defence to cater for journalistic operations where they do sail close to the wind is adequate. If the defence deals satisfactorily with the boundaries between criminal and lawful journalism, then the question of the ultimate penalty must be a genuine second-order issue.
¶2.90 It is hard to see how the new defence could go any further. If a journalist engages in a course H
of conduct which prima facie crosses the criminal boundary marking the unlawful acquisition of personal information, but can show that he or she was acting with a view to publication and in the reasonable belief that it was in the public interest, there can be no conviction. Note that it is not even necessary to show that the conduct was in fact, in the end, in the public interest. There is no alternative to asking the journalist to establish that the belief was genuine, because its basis will be uniquely within his or her own knowledge. And if the belief was neither genuine nor rational it is hard to see the case for a defence to crime. The provision made by the new defence to give honest journalists trying to respect the boundaries of the criminal law confidence in doing so, appears to be straightforward to understand, and more than adequate in giving honesty the benefit of the doubt.
¶2.91 I am, therefore, entirely unpersuaded that the argument that there is a possible chilling
1092effect on legitimate journalism is a reasonable one, and should be regarded as a proper reason in itself for continuing to resist giving effect to the legislation. Much more the point: Parliament has already settled the matter from a policy point of view. To the extent that the press effectively wishes to reopen not the question of penal policy but the matter of the substantive law itself, it is both too late and devoid of merit. Without suggesting that no other
¶PART H | The Press and Data Protection
formulation of the new defence is imaginable, Parliament has given very close attention to the alternatives, and settled on something which, on any fair analysis, is fully capable of being made to work for the press.
¶2.92 I am conscious that in recommending the activation of the amendments to the Data Protection
Act created by the Criminal Justice and Immigration Act 2008, this Report is dealing with an issue with considerable history, and not just as a matter of addressing the culture, practices and ethics of the press in relation the acquisition and use of private personal information. It is also addressing the operations of the press as powerful lobbyists on self-interested questions of media law and policy. On both of these grounds, I conclude that the public interest, taken in the round, favours there being no further delay in the implementation of this measure.
¶2.93 As indicated in the Government consultation paper,55 therefore, I recommend that the
necessary steps are taken (by statutory instrument) to increase the sentence maxima on conviction for an offence under s55, to include, in addition to the current fines, custodial penalties up to the statutory maximum on summary conviction, and, on conviction on indictment, up to two years' imprisonment.
¶2.94 It is important to underline that I also recommend that the enhanced defence for public interest journalism be activated at the same time.
¶Prosecution powers of the ICO
¶2.95 Before concluding this part of the Report, a number of further aspects of the criminal law
functions of the ICO in relation to the press fall to be considered. One particularly important piece of context to the s55 debate is the fact that this is the only offence in respect of which the ICO has prosecution powers. There are other criminal offences which are also contraventions of the data protection regime when committed in relation to personal information (which, incidentally, already attract the possibility of custodial sentences). There may be considerable overlap between these other offences and s55. Examples include: (a) phone hacking contrary to the Regulation of Investigatory Powers Act 2000;56 (b) computer hacking contrary to the Computer Misuse Act 1990;57 (c) offences of corruption, bribery and aiding and abetting misconduct in public office; and
¶H (d) inchoate and accessory offences including attempt and conspiracy.
¶2.96 There is indeed an argument that, since the first data protection principle requires that all
1093acquisition and use of personal information must be fair and lawful, all criminal offences in relation to personal information within the meaning of the data protection regime will also constitute a breach of that regime.58 In practice, in any case in which a breach of the data protection regime may also constitute a criminal offence other than under s55, the ICO will effectively hand the matter in its entirety, and defer wholly, to the police and the CPS. That is at least in part because all of the other offences comprehend, including by way of higher sentencing maxima, a much wider spectrum of seriousness. That is important context for the decision in Motorman itself which, effectively, was to stand back from the prosecution process while the police and CPS proceeded with corruption and conspiracy prosecutions. But it has two important practical consequences.
¶Chapter 5 | Issues About the Legal Framework
¶2.97 The first consequence is that it effectively relegates s55 to a wholly residuary position, in
practice only of real use in cases where all other criminal possibilities have been eliminated. But the process of elimination itself may, including by reason of delay, weaken the prospect in the end of bringing s55 charges. Secondly, it also puts the ICO at a disadvantage in considering cases of breach of the data protection principles in the round, including giving full consideration to alternatives to prosecution. So in cases at the extreme end of breaches of the principles and rights of the regime, the expert regulator is in danger of being left out of the picture altogether.
¶2.98 Mr Graham explained the position in his witness statement to the Inquiry:59
"In some circumstances, such as an allegation of unlawful processing, I have to rely on the police and the CPS to indicate whether they consider that an offence under another relevant Act has been committed before I can properly assess whether there has also been an associated breach of the data protection principle on which I might act. On the other hand if my office comes into possession of evidence which suggests that an offence has been committed under other legislation, I would pass this directly to the police or suggest to a complainant that he or she does so….. "It is possible that, in some circumstances, personal data could be obtained in a way that suggests the commission of offences under both another Act and under section 55 of the Act. The investigation of offences which carry a custodial penalty takes precedence over the investigation of offences, such as those under the Act, which do not. Usually, the police will take the lead in investigating where penalties that carry a custodial penalty are suspected. They can consider the offence under section 55 of the Act as part of their investigation if they choose to do so. Whilst my office will pass relevant information on to the police to assist them in any investigation, it does not make good sense for us to run our own investigation in parallel."
¶2.99 As considered at length above, this cannot stand as a full account of the operational inaction
of the ICO in relation to the press and its involvement in Operation Motorman. But it does suggest a weakness in the scheme of the powers and functions of the ICO. It is a weakness which would be remedied in part by the activation of the higher sentence maxima for s55 because, at least, it would address the problem of its role as an offence of last resort by strengthening the ability of the ICO to prosecute s55 cases which also constitute other offences. But it would not address the position of the ICO as a prosecutor of last resort or the H disabling effect of that on its consideration of the exercise of its other regulatory functions in relation to serious abuses of personal information.
¶2.100 This is a point of considerable importance for that strand of opinion in relation to phone
1094hacking that urged that the primary response of this Inquiry should be to ensure that the existing law (and, in particular, the existing criminal law) is properly enforced. As fully set out above,60 the huge investment of the resources of the Metropolitan Police in their current Operations Weeting (phone hacking), Tuleta (computer hacking), and Elveden (corruption) is both unsustainable indefinitely and unrepeatable in the future. It is, however, noteworthy that all concern the possibility of the press committing crimes which involves the acquisition of personal information in breach of the data protection principles.
¶PART H | The Press and Data Protection
¶2.101 Information crime in contexts involving neither national security issues nor the furtherance
of other criminal purposes (that is to say, crime constituted wholly by the extreme violation of personal information privacy), is a matter which cannot hold a place at the top of the police agenda in competition with the many other priorities that the police face. Nor, in any event, can the police be expected to invest in the deep expertise in personal information privacy which the data protection regime envisages in for its own regulatory authority. Furthermore, the handling by the police of these cases is effectively binary: charges are either brought or dropped, without consideration of law enforcement issues falling short of criminal liability. The present disposition of prosecution powers therefore presents a threat to the proper enforcement of privacy crime in the future, including in relation to the press.
¶2.102 One possible way to address that problem would be to enable the ICO to prosecute breaches
of the data protection regime which constituted criminal offences whether or not they did so as a result of s55. This would, in particular, enable the ICO to deal with cases of data abuse going beyond the processes of first acquisition of the information. It would have a number of specific advantages. It would:
(a) relieve the police and CPS of the pressure of privacy crime on their priorities and resources; (b) place prosecution in the hands of an expert regulator who would be well placed to investigate cases and if appropriate place their full criminality before the criminal courts; (c) enable cases to be dealt with within the rounded context of a regulatory regime which has a range of other operational options falling short of prosecution.
¶Three matters would, however, have to be addressed in taking forward thinking in this context.
¶2.103 The first is the necessity of acknowledging, again, that this is not an issue of sole application
to the press, and that it is beyond the purview of this Inquiry to address its implications in areas which have nothing to do with its terms of reference. As against that, however, it is necessary to note the very close association of the issue of prosecution powers with the s55 issue as discussed extensively above. And whereas it is to a degree speculative to reflect on the Motorman case itself from this perspective, there are genuine questions, including those raised at the time and since by the ICO itself, as to whether in the circumstance an
¶H information regulator, alive to the magnitude and nature of the breach of the law and good
practice of the data protection regime and armed with a full range of responses up to and including prosecution for serious offences, would not have afforded the best prospects of effective law enforcement and of making the case a turning point for the good in the culture, practices and ethics of the press in the handling of personal information.
¶2.104 The second matter that would need to be addressed would be the capability and governance
of the ICO itself in handling any enhanced prosecution functions. In so far as those questions have wider implications they are addressed more generally below. But it would be highly desirable to ensure that in all of its prosecution functions there was excellent liaison between the ICO and the police and CPS. It might, for example, be desirable to make the exercise of any powers to prosecute s55 cases which also constitute or may constitute other criminal offences and criminal breaches of the data protection regime falling outside s55 formally the subject of a duty to consult with the CPS.
¶2.105 The third matter concerns the position of the press as the potential subjects of criminal
1095investigation by the ICO. Under that heading two issues in particular present themselves. The first relates to the circumstances in which the ICO might bring a prosecution as opposed to
¶Chapter 5 | Issues About the Legal Framework
relying on its civil regulatory powers. That is a question which would need to be addressed by reference to the public interest. At the invitation of the Inquiry and following consultation, the Director of Public Prosecutions has issued guidelines for prosecutors on assessing the public interest in cases affecting the media.61 The ICO would be expected to follow these guidelines in the exercise of any enhanced prosecution powers and indeed in relation to its current powers. Mr Graham has already indicated that he is:62
"happy to give an assurance that I will not seek to prosecute journalists who are genuinely pursuing enquiries in the public interest, even if those enquiries do not ultimately bear fruit."
¶2.106 Subject to the point of generality noted above, my conclusion, therefore, is that proper
and proportionate enforcement of the criminal law in relation to press abuse of personal information would be enhanced by extending the prosecution powers of the ICO to include offences which comprehend a breach of the data protection principles in addition to the offence created by s55 of the DPA, coupled with a duty (whether formal or informal) to consult the CPS on such prosecutions, and the formal adoption by the ICO of the CPS guidelines on media prosecutions.
¶2.107 I recommend also that the ICO take immediate steps to engage with the Metropolitan Police
on the preparation of a long-term strategy in relation to alleged media crime with a view to handling the issue in the aftermath of Operations Weeting, Tuleta and Elveden, on the basis that the priority currently being given by the police to addressing this form of alleged criminal behaviour is not sustainable indefinitely, and with a view to ensuring that the ICO is well placed to fulfil any necessary role in this respect in future.
¶2.108 The position of the ICO as prosecutor of last resort does not fully account for evident weaknesses
in its handling of the question of criminal investigations in relation to the journalists involved in Operation Motorman. The ICO has prosecution powers at all because it is uniquely placed to view personal information privacy crime in the full context of its regulatory regime as a whole. This includes the perspective of the victim in such a context. That is a responsibility which it does not appear was fully engaged let alone discharged. I consider, however, that the enhancement of the prosecution powers of the ICO has a potential positively to support that position of overview and overall direction regarding information privacy breaches that are so serious as to enter the criminal spectrum. Further, it is reasonable to conclude that it could H help to dissolve artificial boundaries, avoid confusion of accountabilities and support a better focus on the nature of the conduct and its impact on the individual.
¶2.109 A final issue to be considered within the framework of formal criminal law enforcement
1096is the matter of sentencing. When dealing with the criminal law generally,63 I recommend that the Sentencing Council of England and Wales be asked to prepare guidelines in relation to information privacy and misuse offences (including computer misuse): for the sake of completeness, it is sufficient simply to repeat the recommendation and refer to the reasons for it.
¶PART H | The Press and Data Protection
¶Conclusions and recommendations on the legal framework
¶2.110 The recommendations set out above are not intended to do other than provide for more
effective enforcement of the existing principles of law as they stand, and for a fairer, more even handed approach to the reconciliation of existing rights within those principles in cases in which they may conflict. They are also intended, importantly, substantially to simplify the law and make it more accessible to those, that is to say both press and the public, whom it is designed to serve. There are implications in these recommendations also for the legal system, the legal profession and the courts. Although the data protection regime is intended to sit lightly on businesses and not regularly to trouble the world of litigation, that is precisely because it is explicit in the provision it makes as a matter of law; in the rare cases where it does need to enter the legal system to resolve a disputed issue, the fundamental liberties with which it deals, and the sensitivity with which it deals with them need to be recognised for what they are.
¶2.111 As Mr Coppel has pointed out, the European Commission is currently considering replacing the
existing Data Protection Directive with a directly applicable regulation. The present proposed Regulation would leave it to individual Member States to provide in detail for the exemptions or derogations it sets out. Those include provision relating to the processing of personal data for journalistic purposes. That means that it would be for Parliament in due course to come up with a suitable formulation, within the limits of what the regulation eventually requires. In other words, the expectation is that Parliament will have to revisit this topic in any event.
¶2.112 It would be unfortunate if that were regarded as reason for legislative inaction in the meantime.
Any new regulation would itself, of course, have to make general provision within the overall requirement of the ECHR for a balance between Articles 8 and 10, and indeed would any UK domestic legislation. The risk posed by the prospect of a new regulation that any legislation prompted by this Report would have to be revisited seems to me in this respect to be of modest proportions, and to be outweighed by the need to make progress on amendment to the 1998 Act, both as a matter of law and of policy.
¶H
1097Chapter 6 The Relationship: the ICO and the Press
- "Too big for us?" 1.1 This section of the Report takes its title from the passage in Mr Owens' evidence where he
describes an exchange in a meeting he says took place with Mr Thomas and Mr Aldhouse in which he sought to explain the full extent of the Motorman 'treasure trove'. Mr Owens said:1
"Well, it was at the end, I basically said what we have here, if we haven't got any public defence we can go for everybody, from the blagger right up to the newspaper, at which point there was a look of horror on Mr Aldhouse's face and he said, "We can't take them on, they're too big for us", and Mr Thomas just sort of bemused, deep in thought, just said, "Fine, thanks very much, Alex, pass my compliments on and congratulations to the team for me, job well done." And that was basically it."
Both Mr Thomas and Mr Aldhouse have said that they had no recollection of the meeting and disclaimed the language attributed to them by Mr Owens in any event.
¶1.2 Mr Owens, however, amplified in his evidence that he had formed the clear impression that
there was, if not an express instruction or even express language, a cultural understanding within the ICO that the press were too big for the office to take on:2
"The decision not to pursue any journalist was based solely on fear – fear of the power, wealth and influence of the Press and the fear of the backlash that could follow if the press turned against ICO."
¶1.3 Mr Thomas specifically challenged Mr Owens' reliability as a witness in this context, even
suggesting that he may have had a motive, in the light of "a number of performance, disciplinary and grievance issues between Mr Owens and the ICO", to put the latter in a poor light3 this is an inference that Mr Owens, in turn, resisted.4 H
¶1.4 Mr Thomas and Mr Aldhouse were also emphatic that there was not at any time in the ICO a
deliberate or explicit policy of holding back from taking action in respect of the press, or from engaging directly with the press, whether from fear or otherwise. As we have seen, a number of operational rationales have been given in explanation of the 'roads not taken'.
¶1.5 It is not appropriate now for me to seek to resolve the evident dispute between Mr Owens
1098and the ICO and, in particular, it is not necessary to determine whether the conversation as recounted by Mr Owens took place or not. It is not even necessary for me to determine
¶PART H | The Press and Data Protection
whether there was a deliberate, explicit or promulgated policy in the ICO of not 'taking on' the press which was operative during the course of the Motorman decision-making. The question addressed in this part of the Report relates to something more fundamental, and at the same time less easy to pinpoint, which is the extent to which there may have underlying assumptions in the culture of the ICO and its leadership which instinctively held them back from an engagement with the press which their knowledge of the extent of the problem, and an objective assessment of their available powers, functions and options, might otherwise have suggested. Regardless of whether the words were ever uttered, it is legitimate to ask whether 'the press are too big for us' did, in fact, accurately identify some reluctance, or lack of confidence, in dealing with the press which goes some way to explaining events.
¶1.6 With the single (and, in the event, salutary) exception discussed below, the ICO does not
appear ever seriously to have tested its regulatory powers in relation to the press. Successive Information Commissioners have taken the view that the law must be understood to discourage them from doing so. Although it is clear that there are features of the current data protection regime which seem to make it unnecessarily difficult for the ICO to apply the law to the press, the conclusion that the press is not the business of the ICO is not one for which any authority in law can, in the end, be claimed. Moreover successive Information Commissioners have never sought to draw attention to problems in applying the current law to the press. If there was a case for political campaigning for changes to the law, it is legitimate to ask why it was not addressed to the impediments to mainstream civil law enforcement rather than the relatively more peripheral issue of criminal penalties.
¶1.7 Even more notable has been the reluctance of the ICO to engage informally with the
industry (otherwise than by way of the PCC or other intermediary bodies), whether as a matter of law enforcement, of promoting good practice or simply of business education and communication. Successive Information Commissioners assured the Inquiry that the press was simply not a priority for the ICO's attention. And yet Operation Motorman was one of the biggest operational cases to confront the ICO and the basis for two reports to Parliament and years of campaigning with the PCC and successive Governments. This was a case with the culture, practices and ethics of the press at its heart. Furthermore, the current press issues relating to phone hacking have created one of the biggest crises of confidence in the integrity of private information to have been experienced in the UK.
¶H 1.8 On the face of it, this phenomenon is not straightforward to understand. The question before
the Inquiry was whether there is evidence of a failure of regulatory will on the part of the ICO in relation to the press, going beyond the specifics of the Motorman case, and the technical imperfections of the legal regime, to a more general reluctance to discharge its functions in this area.
¶The ICO and The Sunday Times
¶1.9 In considering this question, it is interesting to turn first to a series of events which predate
1099many of the key developments in the Motorman case. It was put to Mr Thomas in oral evidence that the ICO had invited the editor of The Sunday Times, Mr Witherow, to attend interview under caution in 2003 in respect of possible breaches of s55 of the DPA in relation to the tax affairs of Lord Levy. Mr Thomas said he had no knowledge of this whatever, but having been put on notice of the question earlier he had checked with Mr Aldhouse, with whom the account 'rang a faint bell'. Mr Thomas offered this thought:5
¶Chapter 6 | The relationship: the ICO and the press
"If that had been the case – and can I speculate? If the Office had invited the editor and had been rebuffed, that might perhaps have influenced people at the investigatory level as to the problems of interviewing people from the press. I don't know." He suggested that it might have been before his time.
¶1.10 The history appears to have been that The Sunday Times had published an article in 2000
about the tax affairs of Lord Levy which the latter had sought to prevent by means of an application for an injunction which had come before the then Mr Justice Toulson. According to Mr Witherow,6 that attempt failed "because the judge decided that publication of the information was firmly in the public interest"; Mr Witherow described Mr Thomas as subsequently seeking to interview him under caution about the Lord Levy story but "again this was rebuffed because of our public interest defence", in support of which the judgment of Toulson J was deployed. Mr Witherow thought the ICO had accepted that.7 Eventually, the Sunday Times ran a front page story on 29 October 2006 connecting Lord Levy with a 'cash for honours' scandal.
¶1.11 The matter was explored further with Mr Thomas by Mr Rhodri Davies QC on behalf of News
International.8 Mr Thomas had taken up his post in November 2002 and it was in fact on 11 December 2002 that the ICO wrote to Mr Witherow inviting him to attend an interview under caution. The signatory of the letter was an investigator in the ICO junior to Alex Owens. The proposition which, in effect, Mr Davies put to Mr Thomas was that the attempt to interview Mr Witherow was the direct result of powerful and well-connected pressure being applied to the ICO by Lord Levy rather than any independent operational consideration, and was in effect misconceived in the first place because it was plain that nothing other than investigative journalism in the public interest was in issue. Whether or not that was the case is not to the purpose of this Inquiry, although Mr Thomas accepted that Lord Levy had, around the relevant time, "expressed quite strong frustration that my office had not been much use at sorting out his complaints" and that this was not the first time the office had been subject to high profile criticism from a public figure who had gone to them with a problem.
¶1.12 This episode is of interest to the Inquiry not because of any light it may shed on the
susceptibility of the ICO to operational pressure from high profile complainants, but because it stands out as the only occasion on which, so far as we have been able to establish, the ICO attempted to exert its functions directly in relation to the press. Mr Davies put it to Mr Thomas that this was, in fact, the only occasion upon which "the big stick of an interview H under caution was wielded" by the ICO against the press; Mr Thomas confirmed that he was not aware of any other example in which the ICO "directly approached a journalist or editor". Moreover, Mr Thomas sought to distance himself from the Witherow decision; he suggested that it was taken at a junior level and that it did not look entirely defensible. The contrast with the absence of any approach to a journalist or editor in the Motorman case was made by Mr Davies for a different purpose from that of the Inquiry, but is nevertheless memorable.
¶1.13 The issue of the impact on the ICO of its rebuff at the hands of the Mr Witherow is not
1100unimportant. The episode evidently remained in the memory of The Sunday Times, and it is interesting to note that the one or two subsequent occasions on which that title and the ICO had occasion to interact had a distinctively adversarial quality.
¶PART H | The Press and Data Protection
¶1.14 The first concerns the editorial published in The Sunday Times on 29 October 2006 which
is the day the paper led on its front page with the Lord Levy 'cash for honours' story. The thrust of the editorial was in opposition to the campaign by Mr Thomas for an increase to the maximum penalty for breach of s55 of the DPA; it cast the proposition as offensive to democracy and free speech and it was not sparing in the aspersions cast on Mr Thomas's intentions in this respect. A couple of brief excerpts will give a flavour:9
"…the role of the press in protecting the public by exposing the abuses of the powerful. Newspapers had already been doing this for centuries when he took up his post four years ago. This duty of the media is vital in the struggle to maintain an open society. Yet Mr Thomas would send reporters to prison for fulfilling it." "Mr Thomas is complicit in placing another brick in the wall that the state is building to protect itself from unwanted scrutiny. This newspaper's front page story today on cash for honours is precisely the sort of investigation that political parties would prefer not to happen. Mr Thomas is doing his bit to help them."
The editorial also alluded to What Price Privacy? as a 'little noticed report'. Mr Thomas wrote to the paper a couple of days later in response, but his letter does not appear to have been published.
¶1.15 Mr Thomas characterised this editorial as an unfair representation of his campaign, and
accordingly as a recognisable part of the concerted press campaign to oppose it.10 More controversially, he said that he made a connection in his mind between the editorial and the meeting he had had with Les Hinton and others on the previous Friday as part of his PCC campaign, at which of course the difference of views on the s55 issue had played a prominent part. When he aired this thought in the Inquiry, it was subjected both to detailed rebuttal and to further challenge of his attitude to the press more generally. Mr Witherow made explicit the belief of The Sunday Times that, because the ICO had sought to interview him under caution in 2002, it was a matter of concern that Mr Thomas would not have adequately considered issues of the public interest in investigative journalism in running his s55 campaign.11 Further, Mr Davies, on behalf of News International, put it to Mr Thomas that it was relevant that, on the intervening Saturday, The Times had published an interview with Mr Thomas that he had given a few weeks previously in an effort to obtain some press coverage for an international
¶H data protection conference in London the following week.12
¶1.16 Mr Thomas accepted the evidence that there was no connection between the meeting with
1101Mr Hinton and the editorial, concluding: "It appears I'm even wrong to raise questions…".13 But it appears significant that, in rebutting the idea of a connection between the editorial and a meeting two days earlier, NI chose instead to make a connection between the editorial and the ICO attempt to interview the editor of the newspaper four years earlier. Whatever Mr Thomas and the ICO had learned from that attempt, the impact on The Sunday Times was manifest.
¶Chapter 6 | The relationship: the ICO and the press
¶1.17 A further exchange took place several weeks after the publication of the editorial. The managing
editor of The Sunday Times, then Richard Caseby, wrote to Mr Thomas on 14 December 2006,14 in the aftermath of the publication of What Price Privacy Now? (and after battle lines had effectively been drawn over the s55 policy issue) to express "grave concerns" over the publication in that report of further details of the Motorman information, particularly as it related to The Sunday Times. The tone of the letter can be described as confrontational; it alleges that the report was "clearly defamatory" of the publishers and managing editor (Mr Caseby himself), raises a number of points about the Motorman evidence and, before concluding with a request for an explanation and remedial steps as soon as possible, states that the writer did "not believe that your conduct in this matter can be described as fair, or that it meets the standards which one should be entitled to expect from a regulator".
¶1.18 Mr Thomas' response of 2 February 200715 was a measured explanation of why the ICO had
been entitled, or to an extent required, by virtue of its role and functions to deal as it had with the information published in What Price Privacy Now? but indicated that, on revisiting the figures connected with The Sunday Times, it had discovered an error in the report. Rather than identifying the title with 52 alleged transactions involving 7 journalists, it should have identified it with only 4 transactions and a single journalist. For this the letter offered an unqualified apology, and Mr Thomas explained that the error was corrected in letters to Parliament and to all the recipients of the report.16
¶1.19 This account of interactions between the ICO and The Sunday Times is set out in detail here because it brings into focus the following issues:
1102(a) It raises again the question of distance between the senior leadership of the ICO and operational decision-making with very high profile and long lasting strategic consequences. Mr Thomas was apparently not involved in and had no foreknowledge of the decision to try to interview Mr Witherow, and accepted that the way the decision was taken was unsatisfactory. There were lessons to be learned in this about the vital need for the senior leadership to be sighted on and involved in major operational decisions of this reputational nature. (b) It illustrates with some clarity what might be described as the ideological opposition of the press to the assertion of law enforcement powers, even in criminal matters, and the lack of objectivity and restraint with which that resistance is manifested; this is a matter considered extensively elsewhere in this Report. H (c) On the other hand, it also illustrates the dangers to the operational credibility of a regulator such as the ICO in investing so heavily, prominently and persistently in a political campaign to which a regulated sector was obviously deeply antagonistic. (d) It can hardly be doubted that the reverberations of these adversarial encounters (many of which were played out in public) would have been felt personally by Mr Thomas and by the staff of the ICO. Whether or not Mr Thomas and Mr Aldhouse felt or articulated the view that the press was 'too big for us', I consider it almost inevitable that Mr Owens and his small team (to whom operational decision-making was effectively consigned) learned that lesson from the experience of trying to utilise their powers on the press in the form of the editor of The Sunday Times.
¶PART H | The Press and Data Protection
¶Operational 'monkey tricks'
¶1.20 With that significant narrative thread in mind, it falls to consider what can be known or can be
deduced about the thinking of the ICO more generally in relation to the press. Mr Aldhouse denied being party to any "timorous approach" to the press17; as well as disclaiming the attitude that 'the press are too big to take on' he cited his experience of discussions in 1996 which was the run up to the passage of the 1998 Act. He said that:
"we were quite happy to stand up to the media and try to negotiate with them. I wish I still had the copies of the press gazette articles roundly attacking Elizabeth France [the then Data Protection Registrar - the ICO predecessor body] and myself. So I don't fear the media…"
It might be observed, however, that these experiences were evidently not on the operational side of the business, and that, in any event, Mr Aldhouse evidently considered his role to be at some distance from the operational decisions where fear of the press might have played a material role.
¶1.21 The Inquiry pursued explicitly with Mr Thomas himself the question of whether the power or
influence of the press, or his perception of it, in any way affected the operational decisions taken in the Motorman case. He said that it did not, nor did he have any fear himself of the press.18 As we have seen, both Mr Thomas and Mr Aldhouse rejected any suggestion that there had been a deliberate, explicit or promulgated policy of holding back from taking any proactive operational measures in respect of evidence of press contravention of the legal requirements of the data protection regime or in respect of promoting good practice in data protection matters within the industry. Again, it is not the concern of this Part of the Report to establish the existence or otherwise of a formal policy, but to explore the nature of any significant cultural or psychological predispositions within the ICO and its leadership not to assert itself with the press or at least not to do so in an adversarial or confrontational way.
¶1.22 Standing back to consider the explanations for the various paths not taken by the office
in the Motorman case, the following reflections presented themselves. The explanation for targeting the 'middlemen' (that is to say, the investigation agencies) rather than the commissioning journalists proceeded by reference to an analogy with drug dealers which
¶H I consider misconceived.19 This was not a market in which the private investigators were a
dominant power, controlling supplies of standard goods and pushing them on a disadvantaged clientele. It was a market in which the press were the dominant power, commissioning bespoke products from what must be assumed to be a limited number of investigators willing to obtain them at some risk to themselves.
¶1.23 Indeed, Mr Thomas himself, in explaining the stance taken in What Price Privacy?, stated that
1103it was the journalists who were driving this market.20 He said the same thing in explaining his policy decision to proceed by engagement with the PCC: the focus there also was on stopping the market.21 Accordingly, it is difficult to accept at face value the logic of concentrating
¶Chapter 6 | The relationship: the ICO and the press
exclusively on the middlemen on the grounds that they were "organising the illegal trade".22 The middlemen were on the supply-side, but it was the power of the demand-side which must account to a large degree account for the existence of the trade. The conclusions of What Price Privacy? put the point rather well:23
"These offences occur because there is a market for this kind of information. At a time when senior members of the press were publicly congratulating themselves for having raised journalistic standards across the industry, many newspapers were continuing to subscribe to an undercover economy devoted to obtaining a wealth of personal information forbidden to them by law. One remarkable fact is how well documented this underworld turned out to be."
¶1.24 At least one operative reason why the ICO took no direct enforcement action against any
journalist, editor or proprietor in response to Motorman (and, in particular, no prosecution action) was evident apprehension about the likely response of the press to any attempt to do so. Mr Thomas told the Inquiry that, in planning to wait and see how criminal proceedings against the investigators and public officials fared before actively considering any further enforcement action:24
"I was also conscious that any action against journalists would be a major logistical, evidential and legal challenge, would almost certainly be strongly resisted and would be very expensive for an Office with very limited resources."
¶1.25 The evidential and legal challenges in the way of prosecution (which including the protection
afforded to journalistic materials and sources) may have been significant, but the prospects of facing combative defence litigation appeared to be a disincentive in its own right. Counsel instructed by the CPS in Operation Glade was reported to have described the experience of dealing with press defendants in these memorable terms:25
"London counsel indicated that the journalists were interviewed and were found to be tricky, well armed and well briefed, effectively a barrel of monkeys."
¶1.26 Pressed as to whether this suggested an excessively circumspect approach on the part of the
ICO in the face of potentially powerful prima facie evidence of criminality, Mr Thomas put it this way:26 H "Well, I have to look at it from all points of view, I suppose, but I can see that the media would not like any of their journalists being prosecuted and I suspect they would, for example, argue there's a public interest in being able to ensure freedom of expression. Now, I don't believe that, I don't accept that, but I – it's one thing as to whether or not that would be successful, but one can anticipate that that sort of point would have been raised and it would have engaged the office and bogged down the office for many years."
¶1.27 In other words, there was an apprehension of the unreasonable or unfair deployment of the rhetoric of freedom of expression as a litigation tactic to deterrent effect. Without
1104¶PART H | The Press and Data Protection
commenting on its justification in this context, this perception is noteworthy in its own right not least because it was evidently a general perception within the ICO team. Mr Thomas recalled a conversation within the office around 2007 along the lines:27
"Thank God we didn't take the journalists to court. They'd have gone all the way to Strasbourg." In other words, they would have challenged any action we would have taken, we would have gone right to Strasbourg, the Court of Human Rights, Article 10 issues coming in. We'd seen all the material being thrown at us during What Price Privacy? and the Bill."
¶1.28 There was a gut instinct that litigation against the press would present the ICO with enormous
difficulties.28 These were evidently perceived to be difficulties over and above the normal litigation issues of accessing and deploying evidence, navigating the law, and the overall strengths and weaknesses of the case. It can be reasonably inferred from the evidence that the perception extended to:
(a) the likelihood of a generally aggressive stance; (b) the generalised deployment of the rhetoric of freedom of expression beyond the fair articulation of balance contained in the law; and (c) the expectation that that approach would extend beyond the confines of any single case of criminal litigation, and even beyond the bounds of any single attempt at regulatory action of whatever nature, to a generalised stance of hostility towards the function of the ICO as a regulator. The evidence the Inquiry considered29 suggests that this apprehension was almost certainly justified on the basis that the press have a cultural inclination to be defensive and to utilise attack as the best form of defence. It was plainly operative.
¶1.29 The press, in other words, as an object of regulatory contemplation, was seen as trouble.
That is so whether it was actively making operational mischief in response to regulatory attention or impassively declining to address its culture, practices and ethics itself (as Mr Graham memorably developed the metaphor, "if we're talking monkeys, it's see no evil, hear no evil.")30
¶H
- The struggle for a profile: political campaigning and the power of the press
¶2.1 At the beginning of this section of the Report, reference is made to the problematic
1105reputation of the data protection regime. This is a burden with which successive Information Commissioners and their predecessor bodies have struggled constantly. Trying to get the issues surrounding data protection to be better known and understood is a vital precursor to improving compliance and standards. Communication and profile are in turn vital components of raising awareness. The ICO needs publicity for its functions. To a degree, it needs the press, and therefore has a motivation or predisposition to court it, or at least to view it as a potentially ally. To what may be a significantly greater degree, it is also vulnerable
¶Chapter 6 | The relationship: the ICO and the press
to press hostility and suppression or damage to its reputation which can translate directly into weakened operational capability.
¶2.2 Raising the profile of data protection is an important part of the remit of the office and of
the personal remit of its figurehead Commissioner. Both Mr Thomas and Mr Graham have clearly and commendably shown real commitment to, and significant leadership and personal investment in, that very challenging remit. Mr Thomas put it in this way:31
"When I started, data protection had quite a poor reputation. It was seen as a bit nerdy, not taken very seriously across many organisations. I think my office probably had some responsibility. I used to say that, you know, we were seen outside as the temple of data protection and being the high priests of data protection, and I wanted to destroy that sort of approach, and therefore I was trying to make us much less esoteric, much more avoiding the technical language. I mean, a data subject is a man, a woman, a child, not a data subject. So I took a much more practical down to earth approach. Our slogan was that we are here to help organisations who want to get it right, but we'll be tough on those organisations which don't want to get it right…"
¶2.3 Mr Thomas also explained his profile-raising function with particular reference to the wider role he saw for the two What Price Privacy? reports:32
"I was personally involved in this promotional activity to a very considerable extent. The Commissioner – as the personification and leader of the ICO - is obviously expected to be a visible part of all major activity. In this case, I attached particular priority to the issue and also viewed promoting the reports as a tangible way of fulfilling a wider ambition to get data protection taken more seriously."
¶2.4 The potential power of the press as a friend of data protection however, also confronted the
ICO with an awareness of its potential power as an opponent. Mr Thomas was aware of the obvious risk inherent in his strategic response to Motorman by way of the publication of the What Price Privacy? reports and the s55 campaign:33
"We were aware from the outset that the media would probably ignore or show hostility to our reports. This presented two problems: H • The media usually play an important and influential role in any campaign by an independent body to secure legislative and other change. In this case we anticipated hostility through both editorial and proprietorial influence. • We had worked very hard to secure a "good press" for the ICO across a very wide range of other DPA and FOI functions and had been largely successful. There was a real fear that this could be jeopardised."
1106That was a fear which proved to be entirely well-founded. Furthermore, if it was a fear which was clearly present in Mr Thomas mind in relation to his strategic and political response to Operation Motorman, it does not seem a large step to infer that that was a fear understood more generally in the office, not excluding its (more junior) operational staff.
¶PART H | The Press and Data Protection
¶2.5 Although the risk of press hostility to the objectives of the ICO was present from the outset,
it is evident that the sheer scale of the risk and its potential to affect not only the outcome of a particular political campaign but the fundamental nature of the relationship between the press and the regulator was only a gradual revelation over the months and years. Towards the end of his oral evidence to the Inquiry about the course of the s55 campaign, Mr Thomas said this:34
"I think there was a general feeling that people at the head of newspapers were very influential with the politicians and this perhaps was an example of that. And although they rested their case, as I said just now, on the threats to investigative journalism, I was surprised by how hard they were fighting, and it really left me with a message that we were challenging something which went to the heart of much of the - certainly the tabloid press activity. Someone once said to me: "You do realise that you are actually challenging their whole business model?" Maybe that's one reason they were fighting so hard, because on the one hand, they were not publicly accepting this sort of thing went on. On the other hand, they were fighting very hard to avoid the consequences of the law as we saw it."
¶2.6 Mr Thomas mature reflections on the lessons he learned from the experience of the s55 campaign are worth pondering in this context:35
"Whatever was precisely known about the nature and extent of press misconduct across the industry as a whole, it became increasingly clear that the press were able to assert very substantial influence on public policy and the political processes. I have, throughout my career, been involved in a wide range of activities where it has been essential to attract media attention and, better still, active media support. The ICO press team was very effective at giving strategic, tactical and practical advice and securing favourable media coverage on many occasions. But, in the matters covered by this Statement, the press had a direct interest and a hostile attitude which made it very difficult to achieve our objectives. The history of the campaign over the Criminal Justice and Immigration Bill … left me in no doubt about the power of the press. I can recall saying to my colleagues in 2007 and 2008 that, with hindsight, it may have been a mistake on our part to have highlighted press misconduct in our reports. We
¶H may have made better progress if we had concentrated more on breaches of s55 by other sectors."
- Independent regulation of the press: lessons learned
¶3.1 It is hard to avoid the conclusion that the ICO did indeed consider itself disadvantaged in
1107the task of discharging its functions in relation to the press. That was expressed in a number of dimensions which include insufficiency of legal powers, deference to other authorities, competing operational priorities, practical resourcing and capability issues. Having said that, although each of those dimensions contains important truths, they do not give a full account. Despite the abundant evidence, both patent and latent, of problems in the culture, practices and ethics of the press in handling personal information, the ICO has not been
¶Chapter 6 | The relationship: the ICO and the press
keen to exercise the powers and functions reposed in it by Parliament in the public interest to address the matter. That is not simply a historical matter; it is perceptible in its approach today. In a context in which public concern about press standards and respect for the law has reached sufficiently acute proportions to warrant the commissioning of a judicial inquiry, that must be seen as a regulatory failure within the Terms of Reference of the Inquiry.
¶3.2 It is an understandable failure. The lessons to be learned from the narrative of the ICO and
the press are entirely congruent with the evidence to the Inquiry of the approach of the press more generally. That approach is too often characterised by:
(a) resistance to independent regulation of both law and standards; (b) a confrontational, aggressive and personal approach to its critics; (c) powerful behind the scenes political lobbying in its own interests; and (d) the deployment, through a very loud megaphone, of the rhetoric of the freedom of the press to stifle rational criticism and debate about where the public interest lies.
¶3.3 Although it is a failure to which the ICO may be considered to have contributed by reason of
its own choices, for example by engaging in the political arena on contested policy matters to a degree beyond what was likely to be constructive and productive, and in relation to operational decision making, I do not attribute it wholly or mainly to the individual leadership of the ICO. If, however, there is a perception of inequality of arms in the relationship between the ICO and the press, and if it is one which for understandable reasons the ICO has been reluctant to articulate or seek to remedy itself, then Mr Owens' rhetorical question takes on certain urgency for the Inquiry:36
"It's our job to take them or indeed anyone else on, that's what we are paid to do. If we do not do it then who does?"
¶3.4 The ICO has to be capable of performing its function in relation to the press, however balanced
and light touch the exercise of that function should be. It keeps wicket in this respect, on behalf of the public and at public expense. It does not have an option simply to leave the field open. As was observed in recent High Court proceedings, which also took a wider view of the ICO's functions in relation to journalism than it was minded to take itself:37
"there is a need for someone to protect the public." H
¶3.5 The final part of this part of the Report therefore briefly identifies the structural and
1108governance issues which are likely to need to be addressed to put the ICO in a position in which it is capable of discharging its functions in relation to the press. This is at the margins of the Terms of Reference but, in the light of the analysis to which the ICO has been subject, I have no doubt that it is appropriate to identify the parameters of a solution before leaving the matter to the more detailed consideration both of the Ministry of Justice and the ICO itself.
¶PART H | The Press and Data Protection
- Powers, governance and capability of the ICO:
¶reflections for the future
¶4.1 The legal structure of the ICO is such that the entirety of the functions of the office is devolved
through the office and the person of the Information Commissioner. The organisation of the office (that is to say, the division of functions, decision-making processes, accountabilities, staff mix and so on) are matters within the personal discretion of the Commissioner.
¶4.2 In looking at the issues raised in this section of the Report, some issues of governance
appeared to be raised by the narrative. In particular, the importance of the connection between the strategic leadership and the operational activities of the office, and the question of the circumspection that the ICO evidently felt and feels about fulfilling its functions in relation to the press raised questions about its organisational capability to act effectively in this area.
¶4.3 The data protection regime has specific application to journalism, as indeed it does to other
sectors for which special provision is made in the law. To operate successfully in specialist areas, a regulator needs to have access to two forms of specialist knowledge. This includes legal expertise in the operation of the relevant statutory provisions, and business knowledge of the sector concerned. In the person of Mr Graham, of course, the ICO is currently led by a Commissioner with direct experience in the sector, but it is essential that the relevant expertise is also accessible at operational levels. The historic lack of direct engagement between the ICO and the industry may not only be a symptom of the ICO's lack of operational familiarity with the press, but also a cause of it. I recommend that the opportunity should be taken by the ICO to review the availability of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it.
¶4.4 A fruitful exchange of knowledge, experience and perspective between the strategic and
operational levels of a regulator such as the ICO is fundamental to the success of both. In the history of its engagement on matters relating to the press, I have some questions about whether the organisation and decision-making processes of the ICO have been such as to support the necessary exchange and that its success in discharging its functions has suffered as a result. I therefore recommend that the opportunity should be taken by the ICO to review
¶H its organisation and decision-making processes to ensure that large-scale issues, with both
strategic and operational dimensions, such as the intersection between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other, can be satisfactorily considered and addressed in the round.
¶4.5 The model of a single post holder is not one which is generally encountered in modern
1109regulatory regimes, especially those whose responsibilities extend to powerful business sectors. There has in recent years been a fairly general trend away from individual decision- makers to boards. The Director-General for Fair Trading was replaced several years ago by a Chairman, Chief Executive and Board. The DG for electricity and gas regulation was replaced in the late 1990s by the Gas and Electricity Markets Authority (a board in which non-executives form the majority), and subsequently the executive role was divided between Chairman and Chief Executive. With the creation of Ofcom, the DG for telecommunications was replaced with a full board (which spanned other areas); Ofwat made the same transition in the mid- 2000s; and the health regulator, Monitor, recently moved from a combined executive role (with board oversight) to separate chairman/CEO roles.
¶Chapter 6 | The relationship: the ICO and the press
¶4.6 There are a number of reasons why the single model has drawbacks:
(a) It can render an organisation particularly vulnerable to pressure as its profile and reputation are focused on an individual personality. (b) The absence of an effective senior executive board with non-executive input can expose the office to a presidential style of leadership, with insufficient internal checks and balances to ensure that its overall priorities remain congruent with its statutory functions. (c) The absence of an effective senior executive board can also, as a simple matter of business management, mean that priorities, business risks, resources and performance are not managed and monitored coherently.
¶4.7 The merits by contrast of a formal Board constitution potentially include the following:
(a) The benefits of collective decision making. This includes being able to bring a range of different expertise, experience and mindset to issues of strategy, priority and direction, and an enrichment of analysis, debate and perspective as a result. (b) Firmer discipline can be maintained in decision-making, including the need to proceed by means of structured agendas, formal papers and recorded minutes. This is of particular importance in relation to decisions not to take action; when such decisions are taken individually or informally they are much more likely not to have been made from a structured position of strength. (c) There are formal and precisely defined delegations and it is beyond doubt where decisions are to be delegated to the executive as not requiring Board approval.
All of these have a potential to promote collective decision-making as much more transparent and accountable. Each decision will thus both be more considered in itself and more susceptible to structured follow-through to specific outcomes.
¶4.8 The evidence before the Inquiry suggested that the constitution of the ICO as a corporation
sole may, in at least some of these dimensions, have risked its ability to discharge effectively its functions in relation to the press. Unresolved questions must remain, for example, as to whether:
(a) the informal approach adopted by the ICO to its regulatory functions (partly a matter, H perhaps, of presiding over a regime struggling for a profile, also possibly a matter of personal leadership style) has contributed to a reluctance to bring issues to a head through the use of regulatory powers, and has allowed inaction to be an unremarked default within its own structure; (b) the tendencies of Information Commissioners to see themselves as having a major, even dominant, outward-facing role with a political or campaigning dimension has been at the expense of their ability to provide clear, engaged, understood and accountable leadership in the decisions made within their office, to the detriment of the quality of those decisions, and has posed some risk to the regulatory reputation of the ICO, including in relation to its quasi-judicial functions; and (c) its current constitution leaves the ICO with insufficient strength to match major business sectors with power and influence, such as the press.
¶4.9 I recommend therefore that the opportunity be taken by the Ministry of Justice to consider
1110amending the DPA formally to reconstitute the ICO as an Information Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public
¶PART H | The Press and Data Protection
administration, law and business, and that active consideration be given in that context to the desirability of including on the Board a Commissioner from the media sector. In making this recommendation I do not, however, consider that the recommendations directed to reflecting on the governance of the ICO as currently constituted should be delayed in the meantime.
¶H
1111Chapter 7 Summary of recommendations
¶1.1 I am conscious of both the length and complexity of this Part of the Report. For ease of
reference, I have decided to place all my recommendations in summary form at the conclusion of this Part rather than to follow the approach I have pursued elsewhere.
1112I recommend to the Ministry of Justice that: The exemption in section 32 of the Data Protection Act 1998 should be amended so as to make it available only where:1 (a) the processing of data is necessary for publication, rather than simply being in fact undertaken with a view to publication; (b) the data controller reasonably believes that the relevant publication would be or is in the public interest, with no special weighting of the balance between the public interest in freedom of expression and in privacy; and (c) objectively, that the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication. The exemption in section 32 of the Data Protection Act 1998 should be narrowed in scope, so that it no longer allows, by itself, for exemption from:2 (a) the requirement of the first data protection principle to process personal data fairly (except in relation to the provision of information to the data subject under paragraph 2(1)(a) of Part II Schedule 1 to the 1998 Act) and in accordance with statute law; (b) the second data protection principle (personal data to be obtained only for specific purposes and not processed incompatibly with those purposes); (c) the fourth data protection principle (personal data to be accurate and kept up to date); (d) the sixth data protection principle (personal data to be processed in accordance with the rights of individuals under the Act); H (e) the eighth data protection principle (restrictions on exporting personal data); and (f) the right of subject access. The recommendation on the removal of the right of subject access from the scope of section 32 is subject to any necessary clarification that the law relating to the protection of journalists' sources is not affected by the Act. It should be made clear that the right to compensation for distress conferred by section 13 of the Data Protection Act 1998 is not restricted to cases of pecuniary loss, but should include compensation for pure distress.3
¶PART H | The Press and Data Protection
The procedural provisions of the Data Protection Act 1998 with special application to journalism in: (a) section 32(4) and (5) (b) sections 44 to 46 inclusive should be repealed.4 In conjunction with the repeal of those procedural provisions, consideration should be given to the desirability of including in the Data Protection Act 1998 a provision to the effect that, in considering the exercise of any powers in relation to the media or other publishers, the Information Commissioner's Office should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime.5 Specific provision should be made to the effect that, in considering the exercise of any of its powers in relation to the media or other publishers, the Information Commissioner's Office must have regard to the application to a data controller of any relevant system of regulation or standards enforcement which is contained in or recognised by statute.6 The necessary steps should be taken to bring into force the amendments made to section 55 of the Data Protection Act 1998 by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism).7 The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.8 A new duty should be introduced (whether formal or informal) for the Information Commissioner's Office to consult with the Crown Prosecution Service in relation to the exercise of its powers to undertake criminal proceedings.9 The opportunity should be taken to consider amending the Data Protection Act 1998 formally to reconstitute the Information Commissioner's Office as an Information
¶H Commission, led by a Board of Commissioners with suitable expertise drawn
1113from the worlds of regulation, public administration, law and business, and active consideration should be given in that context to the desirability of including on the Board a Commissioner from the media sector.10
¶Chapter 7 | Summary of recommendations
I recommend to the Information Commissioner's Office that: The Information Commissioner's Office should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime.11 In discharge of its functions and duties to promote good practice in areas of public concern, the Information Commissioner's Office should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. This should be prepared and implemented within six months from the date of this Report.12 The Information Commissioner's Office should take steps to prepare and issue guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights.13 In particular, the Information Commissioner's Office should take immediate steps to publish advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice.14 The Information Commissioner's Office, in the Annual Report to Parliament which it is required to make by virtue of section 52(1) of the Act, should include regular updates on the effectiveness of the foregoing measures, and on the culture, practices and ethics of the press in relation to the processing of personal data.15 The Information Commissioner's Office should immediately adopt the Guidelines for Prosecutors on assessing the public interest in cases affecting the media, issued by the Director of Public Prosecutions in September 2012.16 The Information Commissioner's Office should take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to ensuring that the Office is well placed to fulfil any necessary role in this respect in the future, and in particular in the aftermath of Operations Weeting, Tuleta and Elveden.17 The Information Commissioner's Office should take the opportunity to review the H availability to it of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it.18 The Information Commissioner's Office should take the opportunity to review its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions (including the relationship between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other) can be satisfactorily considered and addressed in the round.19
¶parT I The Press and politicians
¶I
1117Chapter 1 Introduction
¶1.1 In addition to addressing other concerns, the Terms of Reference require the Inquiry to
examine the relationship between national newspapers and politicians and the conduct of each. That this issue should have been considered relevant to an Inquiry into the culture, practices and ethics of the press is a matter of considerable significance. It implies the existence of legitimate questions of public concern about the nature of that relationship and conduct, and about the connection between that relationship and the current state of press standards and accountabilities. It asks, in other words, whether anything about the relationship between the press and the politicians has amounted to 'part of the problem' of press standards.
¶1.2 In doing so, and in putting these questions before a judge-led inquiry, the Terms of Reference
required reflection on the relationship between press and politicians in a way which was relevant to and directed towards the issue of press culture, practices and ethics, and of course to do so in an objective, evidenced, analytical and politically neutral way. That too is significant. If there have been failures of public interest in the relationship between press and politicians, then our democracy provides ways in which politicians can account for that directly to the public. However, if there were failures of what might be called generic political culture (a pattern across time and across parties) and if there were failures in the democratic mechanisms for accountability, then the ordinary political means of challenging and investigating such matters might not have been effective. The politicians would themselves have been, or at least appeared, too close to the problem itself to address it in a way which would leave no doubts in the mind of the public.
¶1.3 An issue of closeness is at the heart of this part of the Terms of Reference. More specifically,
the issue is whether that relationship between politicians and the press had become too close in respects which might not have best served the public interest. The Prime Minister himself said that he believed that to be the case, first in July 2011 and subsequently when interviewed by Andrew Marr on 29 April 2012 when he said this:
"Have we all got too close? Yes. Do we spend too much time on this short-term news management agenda? Yes, we do. Should we try and have a better relationship where we fight the daily fire fight with the media, but we focus on the long-term change our economy needs, our society needs? Yes. And if that comes out of Leveson, great."
¶1.4 To put the matter in context from the outset, however, it is essential first to reflect the
overwhelming evidence that relations between politicians and the press on a day to day I basis are in robust good health and performing the vital public interest functions of a free press in a vigorous democracy, providing an open forum for public debate, enabling a free flow of information and challenge and holding power to account. If there were any doubts about that they would have been dispelled by the perceptive insights of both politicians and political journalists and commentators among the Inquiry's witnesses, and by the remarkable quantity and quality of contemporary coverage of this module of the Inquiry's work.
¶1.5 Political journalism is one of the most highly-prized aspects of a free press operating in a
1118developed democracy. It has often been referred to as the 'lifeblood of democracy', invigorating the body politic and supporting the effectiveness of democratic accountabilities. It is in this area (although not just in this area) that the press performs some of the most essential public
¶PART I | The Press and Politicians
interest functions on which we all depend. Some excellent examples were seen first-hand during the course of the Inquiry's deliberations. I make very clear at the outset therefore that political journalism is not the focus of this Part of the Report, and indeed the Inquiry has had clearly in mind throughout the importance of ensuring that political journalism is fostered and encouraged to the greatest degree possible for the future.
¶1.6 This Part of the Report is not therefore directed at the relationships of everyday political
journalism other than by way of background, nor particularly to the issue of press standards as they might apply to such journalism. Nor did the Inquiry pursue as a separate issue the status of individual politicians as actual or potential victims of media misconduct (although in the course of evidence there have been a number of accounts of the impact of personal attacks upon politicians by the press and concern about the potential for such attacks).
¶1.7 The narrative of this Part of the Report explores instead a very different aspect of the closeness
of the relationship between press and politicians, the one that is in my view most directly relevant to the public interest concerns that prompted the setting up of this Inquiry in the first place. That is the question of a closeness which may have, or appear to have, impacted on the willingness or ability of the politicians to decide matters of public policy about the media, and specifically of policy on press standards, fairly and impartially in the public interest.
¶1.8 As I have already said,1 this Inquiry takes its place in responding to the latest in a long sequence
of spikes in public concern about press standards; this time it is phone hacking. That history is also a history of what has been described as failures by the politicians to make appropriate responses to those spikes in public concern. The Inquiry has taken a brief but informative look at what has happened in the past, with the invaluable privilege of access to the perspectives of many of those directly involved. In doing so, it has considered whether there was any discernible pattern in that history, and if so whether it was a pattern which could be related to a relationship that was 'too close'. The historical approach, which is reflected in this Part of the Report, is not therefore academic (and certainly does not pretend to any degree of historical discipline or originality); but is, as should be expected of an Inquiry of this nature, thematic and inquisitorial.
¶1.9 Module Three of the Inquiry has focused on the more recent manifestations of this issue, but
it is an issue which I recognise (as has been pointed out) goes back in time very much further than that. The fact that I have not heard oral evidence about relations between the national press and politicians at a period any earlier than the middle of the last century certainly does not mean that I am blind to the very considerable influence which the press barons of the late nineteenth and early twentieth centuries are generally agreed to have had on politicians. I am well aware from written evidence and other material in the public domain of
¶I the role in public life which Lords Northcliffe, Beaverbrook and Rothermere had in their day.
The power wielded in the past by these proprietors, and their influential relationships with the politicians of their time, demonstrates that the issues which the Inquiry is now addressing are far from new. However, these earlier events are not sufficiently proximate to the current culture to merit detailed examination: the primary focus of the Inquiry has been on what should happen in the future in the light of what has happened more recently.
¶1.10 Chronologically, the Inquiry began its focus on the relationship with evidence about the
acquisition in 1981 by Rupert Murdoch of The Times and The Sunday Times and it has reflected on events from then to the present. To have gone back further would have demanded too much of any witness and was highly unlikely to have added to the understanding which emerged from the oral evidence which itself spanned a period of 31 years. That oral evidence
¶Part D Chapter 1
1119¶Chapter 1 | Introduction
is, of course, supplemented by documentary evidence some of which goes back considerably before 1981.
¶1.11 From this, a clear pattern has in my view emerged about the relationship between the press
and the politicians in recent years at the most senior levels of influence. There is of course no evidence at all of explicit, covert deals between senior politicians and newspaper proprietors or editors; no-one should seriously have expected that there would be. These very powerful relationships are more subtle than that, the extent to which interests coincide or diverge is more complicated, and the dialogue more sophisticated. But there can be no doubt that within these relationships, some of them having the quality of personal friendships (and some of active hostility), there have been exchanges of influence on matters of public policy which have given rise to legitimate questions about the trust and confidence the public can have that they have been conducted scrupulously in the public interest.
¶1.12 Care has to be taken in talking about 'influence'. It is the prerogative of a free and partisan
press in a democracy to campaign, lobby and seek to influence both public opinion and public policy. Where the issues arise is in the nature, visibility and accountability of the politicians' response. Nor is the existence of personal relationships and friendships at senior levels between press and politicians anything other than entirely natural and to be expected. The issues arise here in relation to the conduct of public affairs in the context of such relationships, and in the boundaries between public and private, accountable and unaccountable.
¶1.13 The pattern which emerges is one in which senior press/political relationships have been too
close to give sufficient grounds for confidence that fear or favour have not been operative factors in the determination and implementation of media policy. That has been the position for some years at least. It is not a state of affairs confined to any one political party.
¶1.14 This section examines in particular the decision to permit Mr Murdoch's News Corporation
to acquire The Times and The Sunday Times; the terms of the Broadcasting Act 1990 (insofar as they concerned foreign and cross media ownership) which were such as to permit Sky TV to continue in the ownership of News Corporation; the passage of the Communications Act 2003, in particular the development of its provisions on foreign and cross media ownership, which in their final form would not have prevented News Corporation from acquiring Channel 5; and finally, the bid by News Corporation for the remaining shares in BSkyB which came to an end shortly before the Inquiry was set up (and for connected reasons). Evidence on the last of these matters brought into sharp focus the pressures, from more than one direction, on governing politicians charged with making a decision of great importance to the media. In particular, it exposed a formidable and relentless lobbying operation which gave rise to serious legal and ethical issues.
¶1.15 On more than one occasion during the period under consideration, concerns about the culture,
1120I practices and ethics of the press surfaced in public debate. However, on each occasion the political reaction was not such as to bring about a lasting solution to the problem. As outlined earlier in this Report, concern during the late 1980s reached such a level that the then Home Secretary commissioned Sir David Calcutt QC to lead a committee which inquired into and reported on press standards, highlighting significant areas of legitimate public concern. The political response to the first Calcutt Report purported to give the press a final chance to put its own house in order before addressing the matter further. The press failed by some margin to meet the challenge, but the establishment of the 'self-regulatory' PCC was the chief exception to a prevalent "do nothing" response from the Government. How and why that was so is examined.
¶PART I | The Press and Politicians
¶1.16 The PCC was (or at least could have been) a step forward from its predecessor, the Press
Council. However, it was never endowed by the industry with the full range of powers and resources advocated by the politicians by whom it was presented as a credible response to public concern. In practice, as is discussed more fully elsewhere in this Report2 irrespective of how it described itself or the powers (however limited) that it actually had, it functioned principally as a handler of complaints and latterly an advisory body. When concerns about press behaviour, and of paparazzi photographers in particular, resurfaced in 1997 with the tragic death of Diana, Princess of Wales, there was some tightening of the Editors' Code but, as the then Prime Minister candidly accepted, he took a conscious decision to manage rather than to confront the media, taking the view that to have confronted the press would have been an all consuming task.
¶1.17 There was a further missed opportunity to address press misconduct when the Information
Commissioner published his findings about the ways in which private investigators had, in his view, unlawfully obtained confidential data which was then provided to the press in circumstances (including the extent of payments made for the data) which provided ample grounds for profound public concern.3 The Information Commissioner recommended amendments to the Data Protection Act 1998. In the result, the political response was a further compromise and no effective action. How that came about is also illuminating.
¶1.18 This Part of the Report therefore begins by considering some relevant aspects of the
relationships between our last five Prime Ministers (including the present holder of that office) and the press. Political leaders have their own approaches to and experiences of the press at a personal level. Personality and individual approach greatly influence the dynamic between a Prime Minister and the opinion-makers of the press. This Part reflects on these relationships for the insights they offer into what they might nevertheless have in common, and into whether any patterns can be said to emerge.
¶1.19 This search for patterns is an exercise which was fundamental to the work of the Inquiry
in this module. It would, however, be a mistake to think that the Inquiry can or should try to solve all of the unresolved questions about the relationship between the press and the politicians at the highest levels over the past 35 years. What follows, therefore, attempts simply and briefly to set out some of the narrative history which seemed to be particularly relevant to the Terms of Reference; there is no ambition to be comprehensive or to sit in judgment on political history whether past or contemporary, but only to identify the extent of the issues relevant to the Inquiry and to reflect on any pointers for the future. If the most recent past is considered in the greatest detail, that is, first, because some of these issues were prominent features of the context in which the Inquiry was set up and, second, because contemporary concerns are inevitably uppermost in the public mind, and have had the least
¶I benefit of the longer perspective.
¶1.20 This Part then canvasses some wider contemporary political perspectives. My overall conclusions and recommendations follow.
¶1.21 The Report addresses one final matter in this Part. The public concern which led to this
Inquiry stands at the end of a long line of surges in public concern. Each has been followed by a political response which has not adequately addressed that concern. This all has to be viewed in the context of press/political relationships which themselves appear to have had problematic dimensions. Thus, the approach to this Inquiry also deserves consideration.
¶Part D, Chapter 1
¶Part H
1121Chapter 2 The Conservative Years