Annex D: Informal meeting with the Information
Commissioner
Background
The Information Commissioner submitted a memorandum
to the inquiry which set out in summary the extent to which his
role touched on matters covered by the Committee's inquiry. The
Committee also heard reference to his role from witnesses. Mr
Michael Tugendhat QC told the Committee on 25 February 2003: "You
do have a privacy commissioner. He is not called that, he is called
an information commissioner, but under section 53 of the Data
Protection Act 1998 he can support people who do not have legal
advice and representation." The Committee held an informal
meeting with the Commissioner in the course of the inquiry.
Meeting
The Commissioner said that the Data Protection Act
1998 was a complex piece of legislation that replaced the previous
1984 Act to implement the provisions of the EU Data Protection
Directive (95/46/EC). The Act did not contain the term "privacy"
but the Directive did - not least in Article 1 setting out its
aims—and many of the Commissioner's European colleagues
had privacy in their titles or job descriptions. The concept is
embraced by the Act in many of its provisions.
The Commissioner was not there to regulate the media.
However, his duties covered their performance as controllers and
processors of data, and their activity in respect of other data
controllers, just as much as anyone else except insofar as Section
32 of the Act applied. Section 32 exempted personal data processed
for the "special purposes" (journalistic, literary or
artistic) from certain provisions of the Act if the processing
was undertaken with a view to publication provided that the data
controller reasonably believed that, having regard to the importance
of the public interest in freedom of expression, publication would
be in the public interest. In considering this "reasonable
belief" Section 32 required account to be taken of the compliance
of the data controller with any relevant or designated code of
practice - e.g. the Press Code of Conduct.
The Court of Appeal adopted a wide approach to this
exemption, making it clear that it applied after, as well as before,
publication, even though it was equally clear that the principal
rationale was in order to ensure that the Act does not create
an oppressive means of prior restraint. During the passage of
the Bill quite the reverse impression had been given and the exemption's
application to processing "prior to publication" stressed
by Lord Williams. It was for the Law Lords to finally settle this
matter should a relevant case ever get to come before it - and
Naomi Campbell had been given leave to appeal to the House of
Lords in her case against the Daily Mirror (Campbell
v MGN Ltd 2002) which involved the Data Protection Act..
Section 32 was certainly not, therefore, a huge get-out
clause for the media; it applied to certain provisions of the
Act to the extent that there was a reasonable belief, in conjunction
with compliance with the PCC Code as interpreted by the courts,
that compliance with any of those provisions was incompatible
with journalistic purposes.
Section 55 of the 1998 Act created a criminal offence
in relation to the unlawful obtaining or disclosuere of personal
data. The section 32 exemption had no relevance here and the section
applied to everyone. The offence would arise where someone knowingly
or recklessly obtained or disclosed (or procured the disclosure
of) personal information without the consent of the data controller.
This might arise, for example, where a journalist - or an intermediary
- impersonated someone to obtain personal information from a bank
or from a government department such as the Inland Revenue. The
sale of personal information obtained in this way is also an offence,
as is offering to sell such information. There are various defences
available but these are narrowly drawn. Under the analogous provisions
of the previous Act (Section 5(6)-(8) of the Data Protection Act
1984) there was at least one prosecution in 1997 of a private
detective who was convicted of extracting personal data from BT
on behalf of various newspapers. A "Blaggers' video"
had recently been made by the Commissioner to warn people with
access to personal data of the common ruses used to extract personal
and private information from data controllers.
Section 53 of the Act empowered the Commissioner
to provide assistance to individuals to take forward actions under
specified parts of the Act relating to the 'special purposes'
and in a case involving, in his view, a matter of substantial
public importance (i.e. where important clarification of
the law was likely to result). The Commissioner had yet to use
these powers.
The Commissioner raised the issue of co-regulation;
effectively the system recommended by the National Heritage Committee
in 1993 in respect of the press and raised in evidence to this
Committee. He pointed to the example of the Advertising Standards
Authority where Regulations in 1987 had created a back-stop role
for the Office of Fair Trading. The Commissioner's impression
was that, while this had been initially resisted as a threat to
self-regulation, in the event the ASA had found the capacity to
refer very difficult or complex cases to the OFT quite useful.
The Commissioner said he had no wish to be given further responsibilities
in addition to the two very considerably complex pieces of legislation
under which he already had duties. However, he felt duty-bound
to point out the significant contiguity of some of his responsibilities
with some of the matters under consideration by the Committee
and to offer the observation that a wholly new regulator, with
an over-lapping remit, could add further confusion to an already
uncertain legal environment.
The issue of the definition of a "public authority"
under the Human Rights Act (HRA) was discussed. Clearly the Information
Commissioner was such an authority as were the statutory regulators.
With regard to the PCC it was at least arguable that it was such
an authority (and it was believed that the PCC itself accepted
this - not least by expressly adopting procedures as if it were
subject to the jurisdiction of the Administrative Court). Government
policy, however, since the days of the "last chance saloon"
made applying the usual rule of thumb - would the state perform
the function if the self-regulatory body did not exist? - less
than straightforward. In the final analysis it was the role of
the courts to decide the issue in the light of the HRA.
The Commissioner pointed to some legal developments
related to privacy. He felt that the courts were cautiously moving
towards a common law concept of privacy in the same neighbourhood
at least as the law of confidence. In his opinion the Court of
Appeal had come very close to recognising that, in an appropriate
case and on particular facts, a "breach of privacy"
would be found as opposed to a "breach of confidence".
| 
