PART L SUMMARY OF RECOMMENDATIONS

Summary of recommendations Regulatory Models for the Future Establishing an independent self-regulatory regime Independence: appointments

An independent self regulatory body should be governed by an independent Board. In

order to ensure the independence of the body, the Chair and members of the Board must be appointed in a genuinely open, transparent and independent way, without any influence from industry or Government.1

The appointment of the Chair of the Board should be made by an appointment panel. The

selection of that panel must itself be conducted in an appropriately independent way and must, itself, be independent of the industry and of Government.2

The appointment panel:

(a) should be appointed in an independent, fair and open way; (b) should contain a substantial majority of members who are demonstrably independent of the press; (c) should include at least one person with a current understanding and experience of the press; (d) should include no more than one current editor of a publication that could be a member of the body.3

The appointment of the Board should also be an independent process, and the composition of

the Board should include people with relevant expertise. The requirement for independence means that there should be no serving editors on the Board.4

The members of the Board should be appointed by the same appointment panel that appoints the Chair, together with the Chair (once appointed), and should:

(a) be appointed by a fair and open process; (b) comprise a majority of people who are independent of the press; (c) include a sufficient number of people with experience of the industry who may include former editors and senior or academic journalists; (d) not include any serving editor; and (e) not include any serving member of the House of Commons or any member of the Government.5

¶PART L | Summary of Recommendations

¶Independence: funding

Funding for the system should be settled in agreement between the industry and the Board,

taking into account the cost of fulfilling the obligations of the regulator and the commercial pressures on the industry. There should be an indicative budget which the Board certifies is adequate for the purpose. Funding settlements should cover a four or five year period and should be negotiated well in advance.6

Functions Standards Code and Governance Requirements

The standards code must ultimately be the responsibility of, and adopted by, the Board,

advised by a Code Committee which may comprise both independent members of the Board and serving editors.7

The code must take into account the importance of freedom of speech, the interests of the

public (including the public interest in detecting or exposing crime or serous impropriety, protecting public health and safety and preventing the public from being seriously misled) and the rights of individuals. Specifically, it must cover standards of:

(a) conduct, especially in relation to the treatment of other people in the process of obtaining material; (b) appropriate respect for privacy where there is no sufficient public interest justification for breach and (c) accuracy, and the need to avoid misrepresentation.8

The Board should require, of those who subscribe, appropriate internal governance processes,

transparency on what governance processes they have in place, and notice of any failures in compliance, together with details of steps taken to deal with failures in compliance.9

¶Complaints

The Board should require all those who subscribe to have an adequate and speedy complaint

handling mechanism; it should encourage those who wish to complain to do so through that mechanism and should not receive complaints directly unless or until the internal complaints system has been engaged without the complaint being resolved in an appropriate time.10

The Board should have the power to hear and decide on complaints about breach of the

standards code by those who subscribe. The Board should have the power (but not necessarily in all cases depending on the circumstances the duty) to hear complaints whoever they come from, whether personally and directly affected by the alleged breach, or a representative group affected by the alleged breach, or a third party seeking to ensure accuracy of published information. In the case of third party complaints the views of the party most closely involved should be taken into account.11

¶Summary of Recommendations

Decisions on complaints should be the ultimate responsibility of the Board, advised by complaints handling officials to whom appropriate delegations may be made.12
Serving editors should not be members of any Committee advising the Board on complaints

and any such Committee should have a composition broadly reflecting that of the main Board, with a majority of people who are independent of the press.13

It should continue to be the case that complainants are able to bring complaints free of charge.14

¶Powers, Remedies and Sanctions 15. In relation to complaints, the Board should have the power to direct appropriate remedial

action for breach of standards and the publication of corrections and apologies. Although remedies are essentially about correcting the record for individuals, the power to require a correction and an apology must apply equally in relation to individual standards breaches (which the Board has accepted) and to groups of people (or matters of fact) where there is no single identifiable individual who has been affected.15

The power to direct the nature, extent and placement of apologies should lie with the Board.16
The Board should not have the power to prevent publication of any material, by anyone, at

any time although (in its discretion) it should be able to offer a service of advice to editors of subscribing publications relating to code compliance which editors, in their discretion, can deploy in civil proceedings arising out of publication.17

The Board, being an independent self-regulatory body, should have authority to examine

issues on its own initiative and have sufficient powers to carry out investigations both into suspected serious or systemic breaches of the code and failures to comply with directions of the Board. Those who subscribe must be required to cooperate with any such investigation.18

The Board should have the power to impose appropriate and proportionate sanctions,

(including financial sanctions up to 1% of turnover with a maximum of £1m), on any subscriber found to be responsible for serious or systemic breaches of the standards code or governance requirements of the body. The sanctions that should be available should include power to require publication of corrections, if the breaches relate to accuracy, or apologies if the breaches relate to other provisions of the code.19

The Board should have both the power and a duty to ensure that all breaches of the standards

code that it considers are recorded as such and that proper data is kept that records the extent to which complaints have been made and their outcome; this information should be made available to the public in a way that allows understanding of the compliance record of each title.20

¶PART L | Summary of Recommendations

¶Reporting

The Board should publish an Annual Report identifying:

(a) the body's subscribers, identifying any significant changes in subscriber numbers; (b) the number of complaints it has handled and the outcomes reached, both in aggregate for the all subscribers and individually in relation to each subscriber; (c) a summary of any investigations carried out and the result of them; (d) a report on the adequacy and effectiveness of compliance processes and procedures adopted by subscribers; and (e) information about the extent to which the arbitration service had been used.21

¶Arbitration Service

The Board should provide an arbitral process in relation to civil legal claims against subscribers,

drawing on independent legal experts of high reputation and ability on a cost-only basis to the subscribing member. The process should be fair, quick and inexpensive, inquisitorial and free for complainants to use (save for a power to make an adverse order for the costs of the arbitrator if proceedings are frivolous or vexatious). The arbitrator must have the power to hold hearings where necessary but, equally, to dispense with them where it is not necessary. The process must have a system to allow frivolous or vexatious claims to be struck out at an early stage.22

¶Encouraging membership

A new system of regulation should not be considered sufficiently effective if it does not cover all significant news publishers.23
The membership of a regulatory body should be open to all publishers on fair, reasonable and

non-discriminatory terms, including making membership potentially available on different terms for different types of publisher.24

In any reconsideration of the powers of the Information Commissioner (or replacement

body), power should be given to that body to determine that membership of a satisfactory regulatory body, which required appropriate governance and transparency standards from its members in relation to compliance with data protection legislation and good practice, should be taken into account when considering whether it is necessary or proportionate to take any steps in relation to a subscriber to that body.25

It should be open any subscriber to a recognised regulatory body to rely on the fact of

such membership and on the opportunity it provides for the claimant to use a fair, fast and inexpensive arbitration service. It could request the court to encourage the use of that system of arbitration and, equally, to have regard to the availability of the arbitration system when considering claims for costs incurred by a claimant who could have used the arbitration service. On the issue of costs, it should equally be open to a claimant to rely on failure by a newspaper to subscribe to the regulator thereby depriving him or her of access to a fair, fast

¶Summary of Recommendations

and inexpensive arbitration service. Where that is the case, in the exercise of its discretion, the court could take the view that, even where the defendant is successful, absent unreasonable or vexatious conduct on the part of the claimant, it would be inappropriate for the claimant to be expected to pay the costs incurred in defending the action.26

¶Recognition 27. In order to meet the public concern that the organisation by the press of its regulation is by a

body which is independent of the press, independent of Parliament and independent of the Government, that fulfils the legitimate requirements of such a body and can provide, by way of benefit to its subscribers, recognition of involvement in the maintenance of high standards of journalism, the law must identify those legitimate requirements and provide a mechanism to recognise and certify that a new body meets them.27

The responsibility for recognition and certification of a regulator shall rest with a recognition

body. In its capacity as the recognition body, it will not be involved in regulation of any subscriber.28

The requirements for recognition should be those set out the recommendations set out

above numbered 1 to 24 inclusive and more fully described in Part K, Chapter 7, Section 4 of the Report.29

The operation of any certified body should be reviewed by the recognition body after two years and thereafter at three yearly intervals.30
The role of recognition body, that is to say, to recognise and certify that any particular body

satisfies (and, on review, continues to satisfy) the requirements set out in law should fall on Ofcom. A less attractive alternative (on the basis that any individual will not have the requisite authority or experience and will only be occasionally be required to fulfil these functions) is for the appointment of an independent Recognition Commissioner supported by officials at Ofcom.31

It should be possible for the recognition body to recognise more than one regulatory body,

should more than one seek recognition and meet the criteria, although this is not an outcome to be advocated and, should it be necessary for that step to be taken, would represent a failure on the part of the industry.32

In passing legislation to identify the legitimate requirements to be met by an independent

regulator organised by the press, and to provide for a process of recognition and review of whether those requirements are and continue to be met, the law should also place an explicit duty on the Government to uphold and protect the freedom of the press.33

¶PART L | Summary of Recommendations

Recommendations for a self-regulatory body Internal Governance

In addition to Recommendation 10 above, a new regulatory body should consider requiring:

(a) that newspapers publish compliance reports in their own pages to ensure that their readers have easy access to the information;34 and (b) as proposed by Lord Black, that a named senior individual within each title should have responsibility for compliance and standards.35

¶Incentives to membership

A new regulatory body should consider establishing a kite mark for use by members to establish a recognised brand of trusted journalism.36

¶The Code

A regulatory body should consider engaging in an early thorough review of the Code (on

which the public should be engaged and consulted) with the aim of developing a clearer statement of the standards expected of editors and journalists.37

¶Powers and sanctions

A regulatory body should be prepared to allow a complaint to be brought prior to commencing

legal proceedings if so advised. Challenges to that approach (and applications to stay) can be decided on the merits.38

In conjunction with Recommendation 11 above, consideration should also be given to Code

amendments which, while fully protecting freedom of speech and the freedom of the press, would equip that body with the power to intervene in cases of allegedly discriminatory reporting, and in so doing reflect the spirit of equalities legislation.39

A new regulatory body should establish a ring-fenced enforcement fund, into which receipts from fines could be paid, for the purpose of funding investigations.40

¶Protecting the public

A new regulatory body should continue to provide advice to the public in relation to issues

concerning the press and the Code along with a service to warn the press, and other relevant parties such as broadcasters and press photographers, when an individual has made it clear that they do not welcome press intrusion.41

¶Summary of Recommendations

A new regulatory body should make it clear that newspapers will be held strictly accountable,

under their standards code, for any material that they publish, including photographs (however sourced).42

¶The public interest 42. A regulatory body should provide guidance on the interpretation of the public interest that

justifies what would otherwise constitute a breach of the Code. This must be framed in the context of the different provisions of the Code relating to the public interest, so as to make it easier to justify what might otherwise be considered as contrary to standards of propriety.43

A new regulatory body should consider being explicit that where a public interest justification

is to be relied upon, a record should be available of the factors weighing against and in favour of publication, along with a record of the reasons for the conclusion reached.44

A new regulatory body should consider whether it might provide an advisory service to editors in relation to consideration of the public interest in taking particular actions.45

¶Access to information 45. A new regulatory body should consider encouraging the press to be as transparent as possible

in relation to the sources used for stories, including providing any information that would help readers to assess the reliability of information from a source and providing easy access, such as web links, to publicly available sources of information such as scientific studies or poll results. This should include putting the names of photographers alongside images. This is not in any way intended to undermine the existing provisions on protecting journalists' sources, only to encourage transparency where it is both possible and appropriate to do so.46

¶Protecting journalists 46. A regulatory body should establish a whistleblowing hotline for those who feel that they are being asked to do things which are contrary to the code.47

The industry generally and a regulatory body in particular should consider requiring its

members to include in the employment or service contracts with journalists a clause to the effect that no disciplinary action would be taken against a journalist as a result of a refusal to act in a manner which is contrary to the code of practice.48

¶PART L | Summary of Recommendations

The Press and Data Protection Recommendations to the Ministry of Justice

The exemption in section 32 of the Data Protection Act 1998 should be amended so as to make it available only where:49

(a) the processing of data is necessary for publication, rather than simply being in fact undertaken with a view to publication; (b) the data controller reasonably believes that the relevant publication would be or is in the public interest, with no special weighting of the balance between the public interest in freedom of expression and in privacy; and (c) objectively, that the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication.

The exemption in section 32 of the Data Protection Act 1998 should be narrowed in scope, so that it no longer allows, by itself, for exemption from:50

(a) the requirement of the first data protection principle to process personal data fairly (except in relation to the provision of information to the data subject under paragraph 2(1)(a) of Part II Schedule 1 to the 1998 Act) and in accordance with statute law; (b) the second data protection principle (personal data to be obtained only for specific purposes and not processed incompatibly with those purposes); (c) the fourth data protection principle (personal data to be accurate and kept up to date); (d) the sixth data protection principle (personal data to be processed in accordance with the rights of individuals under the Act); (e) the eighth data protection principle (restrictions on exporting personal data); and (f) the right of subject access.

The recommendation on the removal of the right of subject access from the scope of section 32 is subject to any necessary clarification that the law relating to the protection of journalists' sources is not affected by the Act.

It should be made clear that the right to compensation for distress conferred by section 13 of

the Data Protection Act 1998 is not restricted to cases of pecuniary loss, but should include compensation for pure distress.51

The procedural provisions of the Data Protection Act 1998 with special application to journalism in:

(a) section 32(4) and (5) (b) sections 44 to 46 inclusive

¶should be repealed.52

¶Summary of Recommendations

In conjunction with the repeal of those procedural provisions, consideration should be given

to the desirability of including in the Data Protection Act 1998 a provision to the effect that, in considering the exercise of any powers in relation to the media or other publishers, the Information Commissioner's Office should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime.53

Specific provision should be made to the effect that, in considering the exercise of any of its

powers in relation to the media or other publishers, the Information Commissioner's Office must have regard to the application to a data controller of any relevant system of regulation or standards enforcement which is contained in or recognised by statute.54

The necessary steps should be taken to bring into force the amendments made to section

55 of the Data Protection Act 1998 by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism).55

The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.56
A new duty should be introduced (whether formal or informal) for the Information

Commissioner's Office to consult with the Crown Prosecution Service in relation to the exercise of its powers to undertake criminal proceedings.57

The opportunity should be taken to consider amending the Data Protection Act 1998 formally

to reconstitute the Information Commissioner's Office as an Information Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public administration, law and business, and active consideration should be given in that context to the desirability of including on the Board a Commissioner from the media sector.58

¶Recommendations to the Information Commissioner 58. The Information Commissioner's Office should take immediate steps to prepare, adopt and

publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime.59

In discharge of its functions and duties to promote good practice in areas of public concern,

the Information Commissioner's Office should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. This should be prepared and implemented within six months from the date of this Report.60

¶PART L | Summary of Recommendations

The Information Commissioner's Office should take steps to prepare and issue guidance to

the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights.61

In particular, the Information Commissioner's Office should take immediate steps to publish

advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice.62

The Information Commissioner's Office, in the Annual Report to Parliament which it is

required to make by virtue of section 52(1) of the Act, should include regular updates on the effectiveness of the foregoing measures, and on the culture, practices and ethics of the press in relation to the processing of personal data.63

The Information Commissioner's Office should immediately adopt the Guidelines for

Prosecutors on assessing the public interest in cases affecting the media, issued by the Director of Public Prosecutions in September 2012.64

The Information Commissioner's Office should take immediate steps to engage with the

Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to ensuring that the Office is well placed to fulfil any necessary role in this respect in the future, and in particular in the aftermath of Operations Weeting, Tuleta and Elveden.65

The Information Commissioner's Office should take the opportunity to review the availability

to it of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it.66

The Information Commissioner's Office should take the opportunity to review its organisation

and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions (including the relationship between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other) can be satisfactorily considered and addressed in the round.67

Regulation by Law The Criminal Law

On the basis that the provisions of s77-78 of the Criminal Justice and Immigration Act 2008

are brought into effect, so that increased sentencing powers are available for breaches of s55 of the Data Protection Act 1998,68 the Secretary of State for Justice should use the power vested in him by s124(1)(a)(i) of the Coroners and Justice Act 2009 to invite the Sentencing Council of England and Wales to prepare guidelines in relation to data protection offences (including computer misuse).69

¶Summary of Recommendations

The Home Office should consider and, if necessary, consult upon:70

(a) whether paragraph 2(b) of Schedule 1 to the Police and Criminal Evidence Act 1984 (PACE) should be repealed; (b) whether PACE should be amended to provide a definition of the phrase "for the purposes of journalism" in s13(2); and (c) whether s11(3) of PACE should be amended by providing that journalistic material is only held in confidence for the PACE provisions if it is held or has continuously been held since it was first acquired or created subject to an enforceable or lawful undertaking, restriction or obligation.

The Civil Law Damages

There should be a review of damages generally available for breach of data protection,

privacy, breach of confidence or any other media-related torts, to ensure proportionate compensation including for non-pecuniary loss (all referable to the duration, extent and gravity of the contravention).71

The Civil Justice Council should consider the level of damages in privacy, breach of

confidence and data protection cases, being prepared to take evidence (from the Information Commissioner, the media and others) and thereafter to make recommendations on the appropriate level of damages for distress in such cases. How the matter is then taken forward will ultimately be for the courts to consider.72