Select Committee on Culture, Media and Sport Written Evidence


Memorandum submitted by Mr Richard Thomas, the Information Commissioner

  I am grateful for the opportunity to set out briefly the extent to which my role touches upon matters covered by the Committee's enquiry into the treatment of those not generally "in public life" who none the less have found themselves to be the focus of media attention. This submission concentrates upon the relevance of the Data Protection Act 1998—which gives me authority as the Information Commissioner—to the issues which are likely to be considered by the Committee.

  The Data Protection Act 1998 regulates the processing of personal data, that is information relating to identifiable individuals. The Court of Appeal—in the Campbell case—has recently confirmed and clarified various "routine" matters of interpretation relating to the EU Data Protection Directive and the Data Protection Act 1998. In his judgment the Master of the Rolls observed:

    "Foremost among [the Directive's] aims is the protection of individuals against prejudice as a consequence of processing of their personal data, including invasion of their privacy . . .

    . . . Because the Act has in large measure, adopted the wording of the Directive, it is not appropriate to look for precision in the use of language as is usually to be expected from the Parliamentary draftsman. A purposive approach to making sense of the provisions is called for".

  The Court of Appeal also confirmed that the definition of "processing" in the Data Protection Act is "very wide" and that "publication must be treated as part of the operations covered by the requirements of the Act".

  Although the Campbell case reversed the decision of the High Court, in my view it would be quite wrong to characterise the judgement as a denial to any right of privacy. The courts, in my view, are in fact still feeling their way in that direction. There is a tension between Articles eight (privacy) and Article 10 (freedom of expression) of the European Convention on Human Rights. On the central question of where the law stands on this "Article eight vs Article 10" issue, the courts are slowly and carefully moving towards establishing a common law concept of privacy within, alongside or (possibly) outside the realms of the law of confidence. Lord Phillips MR alluded to this paragraph 43 and 61 of his judgment

    "The courts are in the process of identifying, on a case by case basis, the principles by which the law of confidentiality must accommodate the article eight and Article 10 rights . . .

    . . . Protection of privacy by expanding the scope of confidence . . . [is] in the course of development . . .".

  He went on to say:

    "The development of the law of confidentiality since [the Human Rights Act] has come into force has seen information described as "confidential" not where it has been confided by one person to another, but where it relates to an aspect of an individual's private life which he does not choose to make public. We consider that the unjustifiable publication of such information would better be described as a breach of privacy rather than a breach of confidence" (emphasis added).

  I think this comes very close to a recognition by the Court of Appeal that, in an appropriate case, on the particular facts, the courts will almost inevitably find there to be a "breach of privacy" as opposed to "breach of confidence". I predict that the courts are more likely to move further down this road in a case involving a private person, rather than a celebrity or a public figure.

  As and when such cases emerge I—as Information Commissioner—may have a role to play in various ways. This may arise before or during litigation or a complaint to the Press Complaints Commission—most likely in some sort of complementary way. In such circumstances I will need to decide whether the Data Protection Act applies in the particular circumstances. If so, there will be questions as to whether the section 32 exemption applies (see below) or whether there has been a contravention of one of the Data Protection Principles which set rules for the collection, holding and use of personal data.

  My involvement in such matters is likely to manifest itself in a request for me to make an Assessment as to whether there has been compliance with the Data Protection Principles. The Act says that I am required to carry out such Assessment on receiving a valid request. I do have discretion as to the manner in which I carry out such Assessments. I am likely to take into account whether the matter is actually or prospectively before the Courts or the PCC. I will have to be realistic and take into account the rather convoluted enforcement procedures which are available to me, which are particularly convoluted in the so called "special purposes" cases, that is cases involving journalism and artistic expression. I should stress that the Assessment I make is not binding, it is essentially a statutory informed opinion.

  No one knows when, where and how these cases will come forward. We will have to wait and see. But my prediction is that they will come forward and that I will have a role to play.

  I would like to make four further points.

  First, a brief word about section 32 which provides exemptions in relation to data processing for journalism, artistic or literacy purposes—the so called "special purposes". The Court of Appeal adopted a wide approach to this exemption. They made it quite clear that it applies after, as well as before, publication, even though it is quite clear that much of the rationale for this provision is in order to seek to ensure that the Data Protection Act does nor provide a mechanism for prior restraint. The important message, however, is that this does not provide unlimited exemption from the whole Act for the media. This is very clearly not the case. The section 32 exemption only applies in relation to particular provisions of the Act and only applies to the extent that there is a reasonable belief that otherwise journalistic purposes would be prejudiced. Section 32 certainly does not provide carte blanche for the media.

  Second, section 53 of the Act empowers me, on receiving an appropriate request, to provide assistance to an actual or prospective litigant who is involved in proceedings under specified parts of the Act. These proceedings must relate to the "special purposes" and assistance can only be provided where the case "involves a matter of substantial public importance". There has not been a case where assistance has been provided under section 53 yet. However, it is clearly a possibility for the future. To speculate a little it seems to me quite possible that the sort of case where I might consider that assistance is warranted is where there has been a gratuitous disclosure of the identity of a private individual, someone who is not at all in the public eye, in circumstances where revealing the identity of the individual cannot sensibly be held to be a matter of legitimate public interest. In such circumstances I may well decide that it is a matter of "substantial public importance" to clarify the application of the law in this area. I should stress, however, that I do not consider it was Parliament's intention that I should routinely support all those whose cases have merit.

  I should make clear that I have no powers to punish a data controller for a non criminal breach of the Principles. Nor do I have any power to award compensation. However, section 13 of the Act provides that an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of the Act may claim compensation in the courts. Where the contravention involves the processing of personal data for "special purposes" then an individual is entitled to compensation where he or she suffers distress regardless of whether he or she is able to prove that actual damage has occurred.

  For the sake of completeness I ought to also mention the existence of section 55 of the 1998 Act. This creates a criminal offence in relation to the unlawful obtaining and use of personal data. The section 32 exemption has no relevance here at all and the section applies to members of the media in the same way as anyone else. This offence arises where a person knowingly or recklessly obtains or discloses personal data without the consent of the data controller. This may arise, for example, where a journalist—or his agent—impersonates someone to obtain personal information from a bank of from a government department such as the Inland Revenue. There are various defences available but these are narrowly drawn.

  I would like to conclude by stressing several points:

    —  The Court of Appeal decision in Campbell is not the last word on the development of a law of privacy.

    —  As Information Commissioner I do not want, or seek, to be a backdoor regulator of the press.

    —  However the media do not have carte blanche. The special provisions relating to journalism do not take the media outside the Data Protection Act altogether.

    —  My approach will be to promote good information handling practice amongst all data controllers, including the media. This will involve a great deal of persuasion, cajoling and the use of both carrots and sticks.

    —  There are enforcement powers and it may be necessary to take appropriate action in blatant cases—probably cases involving private citizens, where there is no genuine public interest, where their privacy has been invaded as a result of clearly improper conduct in relation to the handling of personal information.

  Finally, I should emphasise that I am not advocating the creation of a statutory right to privacy. That is a matter for Ministers and Parliament. However, I am anxious that the Committee is aware of the extent to which I have a role to play in this area under existing legislation.

February 2003

previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2003
Prepared 16 June 2003