Clause
75
Imprisonment
for unlawfully obtaining etc. personal
data
Question
proposed
, That the clause stand part of the
Bill.
Mr.
Garnier:
I want to discuss an anomaly that arises between
the current civil liability under the Data Protection Act 1998, section
55, and the intended criminal liability that will emerge from clause
75, if and when it becomes the law of the land.
First, I have
an interest, or used to have an interest, in this area of the law. I
want to talk particularly about journalistic endeavour and activity, so
I am speaking as someone who acts for and against newspaper
journalists, publishers of one sort of another and it is right that I
should put that on the record.
Secondly, I
want to clarify a point that the Under-Secretary of State for Justice
and I were discussing last week on the nature of the privilege that
attaches to fair and accurate reports of the proceedings of Parliament.
She was correct to say that in relation to Parliament, even
contemporaneous fair and accurate reports are covered only by qualified
privilege. However—this is where I confess to the
confusion—judicial proceedings, when reported fairly, accurately
and contemporaneously are covered by absolute privilege. Since we last
met to discuss that subject I have yet to find a logical explanation of
that difference; I think that it is one of those historical accidents
where the statute law, which has amended the common law, has not caught
up with itself. There may come a time when it does. I am happy to
correct my earlier mistake.
I approach
this discussion purely from the angle of journalistic activity; I am
not concerned with discussing the fiasco over the data issues relating
to Her Majesty’s Revenue and Customs, which is causing the
Government and the Chancellor of the Exchequer rather a lot of
embarrassment. I am not talking about data theft by malevolent people
who wish to mine other people’s data sources and make improper
use of data and sell it. Other occasions may come when others will want
to talk about the Chancellor, the HMRC fiasco and so on, but today I do
not want to deal with that.
The
Chairman:
As long as they are in order when they do so,
they
may.
Mr.
Garnier:
When I said “on other
occasions”, I meant on other parliamentary occasions. If others
want to talk about it and they are in order today, I am sure that you
would be very pleased to hear what they have to say, Mr.
O’Hara, but I say for the third or fourth time that I am
specifically referring to journalistic activity.
That is not
necessarily a surprising thing to do because the Human Rights Act 1998
makes specific reference to journalistic activity. When we have a
collision, as we frequently do, between competing rights—the
right of free expression and the right of privacy—it is
important that we as law makers get it right when we have the
opportunity. Certainly under the common law, but now under the European
convention where articles 8 and 10 come into play, there is that
dispute between free expression and privacy. Under clause 75 and the
underlying legislation, the Data Protection Act 1998, we have a similar
collision.
4.30
pm
The
Secretary of State for Justice has acknowledged that difficulty.
Recently—I do not know when; I should have checked, but it may
well have been on Second Reading—he said that there were
concerns about the misuse of personal data and that new rules in the
Bill had caused concern because they might impede legitimate
investigative journalism. As far as I can remember, he did not come up
with any solutions for dealing with that difficulty. Relatively
recently—in October—the Prime Minister also acknowledged
it. You will remember, Mr. O’Hara, that the Prime
Minister appointed the editor of the Daily Mail, Paul Dacre to
review the 30-year rule on releasing secret papers. In a speech on
liberty in modern Britain, the Prime Minister also said that a review
of data protection law would be carried out by the Information
Commissioner, Mr. Richard Thomas, who will also seek to
protect legitimate investigative journalists from a planned crackdown
on the trade in personal data, such as bills and health records. The
Prime Minister announced a three-month public consultation on extending
the scope of the Freedom of Information Act 2000, which allows the
public to request confidential information from public
bodies.
Why has
clause 75 been made part of the Bill before the consultation process
that was announced in October by the Prime Minister is completed? The
answer to that may well be, as it so often is, that Bills are not
implemented. Therefore, if this provision is passed into law, it may
not be implemented until after the consultation process is complete. If
it is, I suspect that the Government are putting the cart before the
horse.
What we want,
certainly in relation to journalistic activity, is a proper balance and
sense of proportion. The Bill should allow for vigorous, journalistic
and investigative activity which is in the public interest, and/or
which the investigating journalist considers to be in the public
interest during his investigation, while at the same time affording all
proper protection to the data subject.
As I
understand it, since 2004 there have been 26 prosecutions under section
55 of the Data Protection Act 1998, brought by the Information
Commissioner. Of those prosecutions, only four have been in the Crown
court—the others have all been in the magistrates
courts—and only two have resulted in fines of more than
£5,000. Where is the pressing social need to introduce, on
summary conviction, a term of imprisonment “not exceeding 12
months”, or
“a
fine not exceeding the statutory maximum,
or...both”
but,
“on conviction on indictment”— in the Crown
court—
“imprisonment for a term not
exceeding two years”,
or
an unlimited fine? We must ask whether this measure is necessary and
proportionate when we are dealing with legitimate investigative
journalism, and when there is a difference between the civil and the
criminal regimes—the civil regime as it currently is, and the
criminal regime as it is intended to be under the Bill.
In making
these remarks, I am relying upon assistance from the Newspaper
Publishers Association, the Newspaper Society, the Periodical
Publishers Association, the Scottish Newspaper Publishers Association
and the Society of Editors. They have responded to the consultation
paper, “Increasing penalties for deliberate and wilful misuse of
personal data”, issued by the Government and the Information
Commissioner. My concern, which is both informed by my own practical
experience as a newspaper lawyer and based upon the advice of those
groups, is that to introduce without justification a disproportionate
sanction capable of discouraging the press from investigating matters
of legitimate public concern, could have chilling effect on press
freedom in this country.
Maria
Eagle:
Does the hon. and learned Gentleman not believe
that the defences already available under section 55 of the Data
Protection Act are adequate? Is he just making the point about a
chilling effect, or is he saying that the defences available are not
sufficient to enable journalists to pursue legitimate matters of public
interest?
Mr.
Garnier:
As I hope to explain as I develop my case, there
is a distinction between the defences available at criminal law and at
civil law. It seems to us that there should be no higher test in
defending a criminal prosecution than in resisting liability under a
claim for civil compensation. The Minister will know that a charge can
be defended under section 55(2)(d) of the Data Protection Act when it
can be shown
“that in the
particular circumstances the obtaining, disclosing or procuring was
justified as being in the public
interest.”
That language
is to be contrasted with the language in section 32(1) of that Act,
which states that the requirement for exemption from civil liability
depends upon a journalist showing that he reasonably believed that
publication would be in the public interest.
The difference
in statutory language between those two sections produces the bizarre
result that if a journalist investigating accusations of improper
conduct, for example by a business man or a senior politician,
proceeded in the honest and reasonable but mistaken belief that
publication would be in the public interest, he would be able to
establish an exemption from civil liability but not a defence against a
criminal charge arising from the same facts. That anomaly, to which I
referred at the outset, is a matter of serious concern. It will be
significantly more serious if clause 75 is accepted and increases the
penalty for offences under section 55 of the Data Protection Act from a
fine to a sentence of
imprisonment.
To
return to the Minister’s points, every newspaper or magazine
publisher is a data controller for the purposes of the Data Protection
Act. Many journalists, particularly those operating on a freelance
basis, are also data controllers for the purposes of that Act. The
courts have held that the operations involved in producing a printed
newspaper using electronic equipment inevitably amount to processing of
data for the purposes of the Act and that that processing will include
the acquisition, recording and use of information by journalists. Under
the provisions of the Act, such processing may potentially give rise to
both civil and criminal liability.
Civil
liability may arise if the publisher or journalist breaches the
statutory duty imposed by section 4(4) of the Act, which requires
compliance with the data protection principle set out in part I of
schedule 1. The Court of Appeal has recognised that in the operations
required for the production and publication of a
newspaper,
“it will be
impractical to comply with many of the data processing
principles.”
It
follows that publishers and journalists are likely to incur civil
liability for breaches of the Data Protection Act unless the exemption
relating to journalism provided by section 32 can be
invoked.
In
the Naomi Campbell case against Mirror Group Newspapers—I do not
know whether the Minister remembers it—the Court of Appeal held
that the provisions of section 32 of the Act
provide
“widespread
exemption from the duty to comply with the provisions that impose
substantive obligations upon the data
controller”,
and that
that widespread exemption applied both before and after publication. In
practical terms the effect of section 32, as interpreted by the Court
of Appeal in the case of Campbell, is to make available an exemption
from civil liability for publishers and journalists, subject only to
the following simple conditions set out in section 32(1)(b) and (c):
first, that
“the data
controller reasonably believes that, having regard in particular to the
special importance of the public interest in freedom of expression,
publication would be in the public interest”;
and secondly,
that
“the data controller
reasonably believes that, in all the circumstances,
compliance”
with the data
protection principles is incompatible with the purposes of journalism.
The vital words contained in those conditions
are
“the data controller
reasonably
believes”.
The
effect of those words is that to invoke the exemption, the data
controller does not have to prove that the publication to which the
process relates would be in the public interest, only that he
“reasonably believes” that it would be in the public
interest.
That
acknowledges the reality of deadline journalism. In the early stages of
investigating a story, there may be reasonable grounds to believe that
publication would be in the public interest, although it may ultimately
transpire after full investigation that that is not so. It also avoids
the imposition of civil liability on the journalist who honestly and
reasonably, but mistakenly, believes that publication would be in the
public interest.
The
importance of that approach and the latitude that it allows to
responsible journalists was expressly recognised by the then
Under-Secretary of State for the Home Office Department, the right hon.
Member for Knowsley, North and Sefton, East (Mr. Howarth),
in the Standing Committee that scrutinised the Data Protection Bill. He
said:
“Given
the high importance of freedom of inquiry and expression to our
society, we must, on balance, favour publication, subject to reasonable
restraint on the journalist's actions. The present test has been
designed with some care to do that. Of course journalists might get it
wrong that is in the nature of things. But they need to get it
significantly wrong before the law should intervene...We should
maintain a proper emphasis on freedom of expression—[Official
Report, Standing Committee D, 21 May 1998; c.
213.]
That is what the then
Minister said when dealing with the civil regime under the 1998
Act.
As
it is obvious that potential criminal liability might have more serious
consequences for a journalist than potential civil liability, one would
expect the same or a greater degree of latitude to be offered to a
journalist in the provisions of the Act relating to criminal liability,
but that is not the case, as we know. Section 55(1) of the Data
Protection Act makes it a criminal offence for a person
to
“knowingly or
recklessly, without the consent of the data
controller—
(a) obtain or
disclose personal data or the information contained in personal data,
or
(b)
procure the disclosure to another person of the information contained
in personal
data”.
Clearly,
investigative journalists may often obtain information directly or
through a source without seeking the consent of the data controller
holding the data containing that information. One has only to
take the common example of an investigation into allegations of
improper or unethical practices within a business organisation. Such a
story could not be investigated effectively, particularly if a source
within the business organisation was involved, without risking criminal
liability under section 55 of the 1998 Act. Obtaining the information
will almost certainly also give rise to potential civil liability, as
it will be impracticable to comply with the data protection principles.
The journalist will be able to invoke the provisions of section 32 to
secure exemption from civil liability on the grounds that he reasonably
believes that publication would be in the public interest, so why
should he not also have at least the same level of protection from
potential criminal liability arising from the same
facts?
That
anomaly is a matter of serious concern as the Act stands, and it will
be exacerbated by implementation of clause 75. I have informed the
Committee of the genesis or origin of those concerns, which I share,
both as a newspaper lawyer and as a citizen. As I understand it, we
have yet to see—certainly the people advising me on the issue
have yet to receive—a rational response to
their concerns, which they have passed to the Government. I shall leave
it to the Minister to explain the Government’s response to my
points, although I am sure that I know what it
is. First,
the imprisonment sanction will have the chilling effect that the
Minister mentioned in her intervention. To introduce imprisonment for
investigative journalists who obtain information without the consent of
the data controller who holds the data containing that information in
circumstances when the journalist may be unable to establish that the
obtaining was justified in the public interest is self-evidently
capable of discouraging the press from actively pursuing the
investigation of allegations raising matters of legitimate public
interest, and accordingly is capable of having a chilling effect on
press freedom.
4.45
pm
Those
concerns have not just been dreamt up in the bars of Fleet street or in
the offices of lawyers who benefit from work from media
companies.
In a judgment made by the European Court
of Human Rights, on 17 December 2004, on the case of Cumpana v.
Romania, a grand chamber of 17 judges, in the course of finding
that the imprisonment of a journalist had infringed his article 10
rights on freedom of expression,
stated:
“Although
the Contracting States are permitted, or even obliged, by their
positive obligations under Article 8 of the
Convention”,
which deals
with the protection of privacy, family life and so forth,
“to regulate the exercise of
freedom of expression so as to ensure adequate protection by law of
individuals’ reputations, they must not do so in a manner that
unduly deters the media from fulfilling their role of alerting the
public to apparent or suspected misuse of public power... Investigative
journalists are liable to be inhibited from reporting on matters of
general public interest—such as suspected irregularities in the
award of public contracts to commercial entities—if they run the
risk, as one of the standard sanctions imposable for unjustified
attacks on the reputation of private individuals, of being sentenced to
imprisonment or to a prohibition on the exercise of their
profession.”
It
continued:
“The
chilling effect that the fear of such sanctions has on the exercise of
journalistic freedom of expression is
evident”.
A little while
later, it
said:
“Such
a sanction, by its very nature, will inevitably have a chilling
effect.”
In
my view—I was going to say “and in the view of those who
instruct me in this matter”, but hon. Members know what I
mean.
Maria
Eagle:
They are not paying you are
they?
Mr.
Garnier:
No they are not. This is a public duty, which I
enjoy.
In my view,
it follows that the introduction of custodial sentences for section 55
offences committed by journalists is capable of interfering with their
article 10 rights. Accordingly, under the consistent jurisprudence of
the European Court of Human Rights, the introduction of those sanctions
cannot be justified, unless there is a pressing social need and the
interference is proportionate to the legitimate aim pursued.
Furthermore, the reasons for introducing those sanctions must be
relevant and sufficient.
The inclusion
of a penalty of imprisonment within the civil liability deterrent
regime has not been shown to be a necessary response to any pressing
social need, or to be proportionate or otherwise justified. I said at
the beginning of my remarks that there have been only 26 prosecutions
under section 55 of the 1998 Act and that only two of those resulted in
fines of more than £5,000. If that is correct, and on the facts
as we know them, there does not seem to be a need to ratchet up the
criminal regime so
dramatically.
According
to the Government’s response to the consultation process, or at
least to the remarks from the groups that I mentioned before—the
editors and so forth—they do not expect the number of
prosecutions to increase if custodial sentences are made available. It
must follow, therefore, that the prosecution of offences has not been
discouraged by the lack of custodial sentences. Furthermore, in view of
the few prosecutions that have taken place, the penalties imposed have
tended to be modest fines—some in the low hundreds—even
though a conviction on indictment makes an unlimited fine
available.
The facts and
arguments that I have presented to the Committee suggest that existing
penalties are more than sufficient to deal with offences under section
55. On that basis, I urge the Government to rethink clause
75 and to consider whether their proposals are necessary and
justified.
Maria
Eagle:
I have been listening intently and shall try to
deal with the points that the hon. and learned Member for Harborough
made. However, it might be helpful if first I set out what we are doing
in clause 75 and
why.
The
clause amends section 60 of the Data Protection Act 1998 to increase
the penalties for offences under section 55 of the Act to allow for a
period of imprisonment of six months in a magistrates court up to two
years on indictment. It increases the current penalty, as the hon. and
learned Gentleman said, which is limited at present to fines in either
a magistrates or Crown
court.
Section
55(1) and (3) of the Act provide that a person is guilty of an offence
if they knowingly or recklessly, without the consent of the data
controller, obtain or disclose or procure the disclosure of personal
data to another person. Section 55(4) and (5) provide that a person is
guilty of an offence if they sell or offer to sell personal data
obtained in breach of section
55(1).
I
wish to make it absolutely clear that the origin of the clause has
nothing to do with trying to create a chilling effect on the legitimate
activity of investigative journalism. It has nothing to do with that at
all. The Information Commissioner’s report “What price
privacy? The unlawful trade in confidential personal
information”, which was laid before Parliament on 10 May 2006,
highlighted the extent of the illegal trade in personal data and
recommended custodial sentences for offences relating to its misuse, as
the existing financial penalties were not sufficiently protecting
individuals’
rights.
On
24 July 2006, the Government published a consultation paper
“Increasing penalties for deliberate and wilful misuse of
personal data”. They invited comments on proposals to increase
the penalties available to include
custodial sentences. The consultation closed on 30 October 2006. The
majority of responses—not all of them—welcomed the
introduction of custodial penalties to provide a greater deterrent to
potential offenders and public reassurance that offenders would receive
the appropriate sentence, and to achieve parity with several disparate
pieces of legislation that deal with similar types of
offence. That
is the origin of clause 75. I reiterate that the intention is not to
try to undermine or chill in any way legitimate investigative
journalism, nor do we wish inadvertently to cause problems in that
regard. As the Committee will be aware, the clause does not create any
new criminal offences. The hon. and learned Gentleman did not say that
it did—I am not suggesting that he said
that.
Mr.
Garnier:
You are reading the wrong
paragraph.
Maria
Eagle:
I am making it up. I am not reading any paragraph.
I do sometimes read out paragraphs, but I am not doing so at present.
The hon. and learned Gentleman was doing a fair amount of reading
himself. I am sure that it was stuff that he had prepared
earlier.
We
are not creating a new criminal offence.
[
Interruption.
] Everyone is chuntering this
afternoon, Mr. O’Hara. It must be something to do
with the time. In any event, I shall try to deal with some of the
points that the hon. and learned Gentleman
made.
We
are not creating a new criminal offence. As a result of the process, we
are increasing the penalty because we have been convinced that we need
to do so. I do not want us to have too arcane an argument, but the hon.
and learned Gentleman suggested that the defence for the civil offence
under section 32 of the 1998 Act was of a higher threshold than the
defence for the criminal offence under section 55. I am not convinced
of that. We could debate exactly where the threshold is, but the point
of much of what he was saying was bound up in that. If there are civil
and criminal penalties for similar offences, one can understand why the
threshold for the civil offence ought to be lower than for the criminal
offence. That is common sense under our system of
law.
However,
sections 32 and 55 of the 1998 Act are different in numerous respects.
Section 32 gives media organisations exemption from some parts of the
Act that apply to them as data controllers. It exempts them from most
of the data protection principles and certain other provisions of the
1998 Act if, after due regard to the public interest and freedom of
expression and publication, they reasonably believe that publication is
in the public interest.
Section 55,
however, is not about the normal business of being a newspaper in the
same way. It concerns a wilful obtaining, disclosing or procuring of
information without the data controllers’ consent. The
prohibitions in this section apply equally to everyone, as do the
defences listed in 55(2). Section 55(2)(D) requires that the knowing or
reckless obtaining, disclosing or procuring of information without the
consent of the data controller to be justified in the public
interest.
The
purposes of those two provisions are very different. Section 32 ensures
that the data protection principles do not prevent or inhibit
responsible journalism, while
section 55 ensures that the prohibition on the misuse of personal data
does not prevent disclosures that are in the public interest. The
Government do not believe that it is necessary to amend section 55 and
to extend the exemption in section 32. We are not proposing to
criminalise any behaviour that is not currently against the law. The
section 55 offence with its public interest and other defences is a
proportionate measure to deal with the risk to people’s
privacy. I
accept that not everyone will agree with that. The hon. and learned
Gentleman set out in great detail the reasons why he does not. Let me
assure him that there is no intention to create a chilling effect, and
to inhibit in any way responsible investigative journalism. Not
everyone accepts that there would be a chilling effect. When the
Committee on Culture, Media and Sport was considering self-regulation
for the press, it looked at this provision and suggested that the
penalty did not have a chilling effect, and it welcomed the amendment.
There are other reasons of public policy for signalling very strongly
that the obtaining and selling of public or private data is not only a
breach of human rights, but a matter that causes a great deal of damage
and it ought to be treated as seriously as the provision
suggests.
As
the hon. and learned Gentleman knows, because of his close interest in
this matter, there have been meetings between newspapers and various
interests who believe very strongly what he, the former Lord
Chancellor, former Ministers and the Department for Constitutional
Affairs put forward in respect of this. I am not saying that we will
all agree, but we have considered the matter very carefully. We believe
that the current clause is correct. While I am not promising to make
any changes, I am perfectly happy to look very closely at what has been
said today. I do not feel convinced that the hon. and learned Gentleman
is right, but I will look very closely at what he has said and talk to
him and the Newspaper Society further about it. However, we believe
that clause 75 is the right provision. I have heard what the hon. and
learned Gentleman has had to say, but I commend the clause to the
Committee.
Mr.
Garnier:
I am grateful to the Minister for her explanation
of her Department’s policy. May I say that the chuntering was an
unnecessary intervention, and that the further chuntering was my
attempt to apologise for that from a sedentary
position?
There
are a number of illogicalities and inconsistencies in the
Government’s approach. It may be that in the rush to make laws
and so forth, No. 10 is not talking to the Ministry of Justice and vice
versa. [Interruption.] I interpret what the Minister of State is
saying and that is not in the least bit unusual. It is interesting that
the Prime Minister has said that he wants a further consultation period
and an investigation or inquiry into the way in which the Freedom of
Information Act and its provisions work and has asked Paul Dacre, the
editor-in-chief of the Daily Mail to chair that
investigation.
5
pm
The
Secretary of State for Justice said that the Bill raises concerns that
it
“might impede
legitimate investigative journalism”.—[Official
Report, 25 October 2007; Vol. 465, c.
409.]
However, the clause will
ratchet the penalty up. I am not talking about data thieves or
blackmailers, even if part of the Minister’s response
concentrated on that. I am not seeking to defend reckless, negligent or
deliberately ill-motivated conduct by data processors—I would
call it Her Majesty’s Revenue and Customs’ story and the
Minister will doubtless hear more of it in due course because the
Chancellor of the Exchequer will tell her. I want to ask her
about what is in the journalist’s mind at two different times.
If we look at the civil regime, we will see that it is anticipatory
because the defence applies
if
“the data controller
reasonably believes that, having regard in particular to the special
importance of the public interest in freedom of expression, publication
would”—
in
future—
“be in the
public interest”
or,
secondly, if
he
“reasonably believes
that, in all the circumstances, compliance
with”
data protection
principles
“is
incompatible with
the...purposes”
of
journalism. We are therefore looking ahead when it comes to the civil
liability regime, which allows the journalist to have some form of
subjective input to his defence whereas, under the criminal regime, he
has to show
“that in the
particular circumstances the obtaining, disclosing or procuring was
justified”—
that
measure uses the imperfect
tense—
“as being
in the public
interest”.
A proper
construction of the expression
“was justified as being in the
public interest”
is an
object test, which the court, jury or magistrate will assess for
themselves on the basis of the evidence before them and the advice they
receive on the meaning of the expression “the public
interest”.
Having
said all that, I am grateful to the Minister for indicating that she
would be prepared to read carefully the report of our discussions with
her officials and the Department’s lawyers, and also for
offering me the opportunity to have further meetings with the Fleet
Street Lawyers’ Society. I mentioned Alastair Brett, who is the
secretary of that group; he is also legal manager of The Times
newspaper group, so I am talking about major media operators, not
irresponsible, dodgy, fly-by-night members of the yellow press. Such
people have a legitimate and responsible attitude toward both the need
to protect people’s privacy and the need to take a proper
interest in maintaining, and fighting hard for, the fundamental right
of freedom of
expression.
I
shall take up the Minister’s offer and get back to those who
have been in touch with me to see whether they would like to meet the
Minister. Perhaps meetings can take place between now and Report, or at
least before the Bill leaves this House and goes to the other place. I
am reasonably sure that the clause will receive close attention in the
other place, whose Members will not be under the same time constraints
as us. I suspect that that will be the case because Lord Lester of
Herne Hill was very busy during the deliberations on the Human Rights
Act 1998 when discussing journalistic endeavour, as was my noble Friend
Lord Fowler, who is both an ex-journalist and a newspaper executive.
There
will be plenty of interest in the clause in the other place, so it would
be useful if the Minister would hold those meetings before the Bill
goes there. Given those offers, which I accept with alacrity, I
withdraw my resistance.
Question
put and agreed
to.
Clause 75
ordered to stand part of the
Bill.
| 
