Criminal Justice and Immigration Bill

[back to previous text]

Clause 75

Imprisonment for unlawfully obtaining etc. personal data
Question proposed , That the clause stand part of the Bill.
Mr. Garnier: I want to discuss an anomaly that arises between the current civil liability under the Data Protection Act 1998, section 55, and the intended criminal liability that will emerge from clause 75, if and when it becomes the law of the land.
First, I have an interest, or used to have an interest, in this area of the law. I want to talk particularly about journalistic endeavour and activity, so I am speaking as someone who acts for and against newspaper journalists, publishers of one sort of another and it is right that I should put that on the record.
Secondly, I want to clarify a point that the Under-Secretary of State for Justice and I were discussing last week on the nature of the privilege that attaches to fair and accurate reports of the proceedings of Parliament. She was correct to say that in relation to Parliament, even contemporaneous fair and accurate reports are covered only by qualified privilege. However—this is where I confess to the confusion—judicial proceedings, when reported fairly, accurately and contemporaneously are covered by absolute privilege. Since we last met to discuss that subject I have yet to find a logical explanation of that difference; I think that it is one of those historical accidents where the statute law, which has amended the common law, has not caught up with itself. There may come a time when it does. I am happy to correct my earlier mistake.
I approach this discussion purely from the angle of journalistic activity; I am not concerned with discussing the fiasco over the data issues relating to Her Majesty’s Revenue and Customs, which is causing the Government and the Chancellor of the Exchequer rather a lot of embarrassment. I am not talking about data theft by malevolent people who wish to mine other people’s data sources and make improper use of data and sell it. Other occasions may come when others will want to talk about the Chancellor, the HMRC fiasco and so on, but today I do not want to deal with that.
The Chairman: As long as they are in order when they do so, they may.
Mr. Garnier: When I said “on other occasions”, I meant on other parliamentary occasions. If others want to talk about it and they are in order today, I am sure that you would be very pleased to hear what they have to say, Mr. O’Hara, but I say for the third or fourth time that I am specifically referring to journalistic activity.
That is not necessarily a surprising thing to do because the Human Rights Act 1998 makes specific reference to journalistic activity. When we have a collision, as we frequently do, between competing rights—the right of free expression and the right of privacy—it is important that we as law makers get it right when we have the opportunity. Certainly under the common law, but now under the European convention where articles 8 and 10 come into play, there is that dispute between free expression and privacy. Under clause 75 and the underlying legislation, the Data Protection Act 1998, we have a similar collision.
4.30 pm
The Secretary of State for Justice has acknowledged that difficulty. Recently—I do not know when; I should have checked, but it may well have been on Second Reading—he said that there were concerns about the misuse of personal data and that new rules in the Bill had caused concern because they might impede legitimate investigative journalism. As far as I can remember, he did not come up with any solutions for dealing with that difficulty. Relatively recently—in October—the Prime Minister also acknowledged it. You will remember, Mr. O’Hara, that the Prime Minister appointed the editor of the Daily Mail, Paul Dacre to review the 30-year rule on releasing secret papers. In a speech on liberty in modern Britain, the Prime Minister also said that a review of data protection law would be carried out by the Information Commissioner, Mr. Richard Thomas, who will also seek to protect legitimate investigative journalists from a planned crackdown on the trade in personal data, such as bills and health records. The Prime Minister announced a three-month public consultation on extending the scope of the Freedom of Information Act 2000, which allows the public to request confidential information from public bodies.
Why has clause 75 been made part of the Bill before the consultation process that was announced in October by the Prime Minister is completed? The answer to that may well be, as it so often is, that Bills are not implemented. Therefore, if this provision is passed into law, it may not be implemented until after the consultation process is complete. If it is, I suspect that the Government are putting the cart before the horse.
What we want, certainly in relation to journalistic activity, is a proper balance and sense of proportion. The Bill should allow for vigorous, journalistic and investigative activity which is in the public interest, and/or which the investigating journalist considers to be in the public interest during his investigation, while at the same time affording all proper protection to the data subject.
As I understand it, since 2004 there have been 26 prosecutions under section 55 of the Data Protection Act 1998, brought by the Information Commissioner. Of those prosecutions, only four have been in the Crown court—the others have all been in the magistrates courts—and only two have resulted in fines of more than £5,000. Where is the pressing social need to introduce, on summary conviction, a term of imprisonment “not exceeding 12 months”, or
“a fine not exceeding the statutory maximum, or...both”
but, “on conviction on indictment”— in the Crown court—
“imprisonment for a term not exceeding two years”,
or an unlimited fine? We must ask whether this measure is necessary and proportionate when we are dealing with legitimate investigative journalism, and when there is a difference between the civil and the criminal regimes—the civil regime as it currently is, and the criminal regime as it is intended to be under the Bill.
In making these remarks, I am relying upon assistance from the Newspaper Publishers Association, the Newspaper Society, the Periodical Publishers Association, the Scottish Newspaper Publishers Association and the Society of Editors. They have responded to the consultation paper, “Increasing penalties for deliberate and wilful misuse of personal data”, issued by the Government and the Information Commissioner. My concern, which is both informed by my own practical experience as a newspaper lawyer and based upon the advice of those groups, is that to introduce without justification a disproportionate sanction capable of discouraging the press from investigating matters of legitimate public concern, could have chilling effect on press freedom in this country.
Maria Eagle: Does the hon. and learned Gentleman not believe that the defences already available under section 55 of the Data Protection Act are adequate? Is he just making the point about a chilling effect, or is he saying that the defences available are not sufficient to enable journalists to pursue legitimate matters of public interest?
Mr. Garnier: As I hope to explain as I develop my case, there is a distinction between the defences available at criminal law and at civil law. It seems to us that there should be no higher test in defending a criminal prosecution than in resisting liability under a claim for civil compensation. The Minister will know that a charge can be defended under section 55(2)(d) of the Data Protection Act when it can be shown
“that in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest.”
That language is to be contrasted with the language in section 32(1) of that Act, which states that the requirement for exemption from civil liability depends upon a journalist showing that he reasonably believed that publication would be in the public interest.
The difference in statutory language between those two sections produces the bizarre result that if a journalist investigating accusations of improper conduct, for example by a business man or a senior politician, proceeded in the honest and reasonable but mistaken belief that publication would be in the public interest, he would be able to establish an exemption from civil liability but not a defence against a criminal charge arising from the same facts. That anomaly, to which I referred at the outset, is a matter of serious concern. It will be significantly more serious if clause 75 is accepted and increases the penalty for offences under section 55 of the Data Protection Act from a fine to a sentence of imprisonment.
To return to the Minister’s points, every newspaper or magazine publisher is a data controller for the purposes of the Data Protection Act. Many journalists, particularly those operating on a freelance basis, are also data controllers for the purposes of that Act. The courts have held that the operations involved in producing a printed newspaper using electronic equipment inevitably amount to processing of data for the purposes of the Act and that that processing will include the acquisition, recording and use of information by journalists. Under the provisions of the Act, such processing may potentially give rise to both civil and criminal liability.
Civil liability may arise if the publisher or journalist breaches the statutory duty imposed by section 4(4) of the Act, which requires compliance with the data protection principle set out in part I of schedule 1. The Court of Appeal has recognised that in the operations required for the production and publication of a newspaper,
“it will be impractical to comply with many of the data processing principles.”
It follows that publishers and journalists are likely to incur civil liability for breaches of the Data Protection Act unless the exemption relating to journalism provided by section 32 can be invoked.
In the Naomi Campbell case against Mirror Group Newspapers—I do not know whether the Minister remembers it—the Court of Appeal held that the provisions of section 32 of the Act provide
“widespread exemption from the duty to comply with the provisions that impose substantive obligations upon the data controller”,
and that that widespread exemption applied both before and after publication. In practical terms the effect of section 32, as interpreted by the Court of Appeal in the case of Campbell, is to make available an exemption from civil liability for publishers and journalists, subject only to the following simple conditions set out in section 32(1)(b) and (c): first, that
“the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest”;
and secondly, that
“the data controller reasonably believes that, in all the circumstances, compliance”
with the data protection principles is incompatible with the purposes of journalism. The vital words contained in those conditions are
“the data controller reasonably believes”.
The effect of those words is that to invoke the exemption, the data controller does not have to prove that the publication to which the process relates would be in the public interest, only that he “reasonably believes” that it would be in the public interest.
That acknowledges the reality of deadline journalism. In the early stages of investigating a story, there may be reasonable grounds to believe that publication would be in the public interest, although it may ultimately transpire after full investigation that that is not so. It also avoids the imposition of civil liability on the journalist who honestly and reasonably, but mistakenly, believes that publication would be in the public interest.
The importance of that approach and the latitude that it allows to responsible journalists was expressly recognised by the then Under-Secretary of State for the Home Office Department, the right hon. Member for Knowsley, North and Sefton, East (Mr. Howarth), in the Standing Committee that scrutinised the Data Protection Bill. He said:
“Given the high importance of freedom of inquiry and expression to our society, we must, on balance, favour publication, subject to reasonable restraint on the journalist's actions. The present test has been designed with some care to do that. Of course journalists might get it wrong that is in the nature of things. But they need to get it significantly wrong before the law should intervene...We should maintain a proper emphasis on freedom of expression—[Official Report, Standing Committee D, 21 May 1998; c. 213.]
That is what the then Minister said when dealing with the civil regime under the 1998 Act.
As it is obvious that potential criminal liability might have more serious consequences for a journalist than potential civil liability, one would expect the same or a greater degree of latitude to be offered to a journalist in the provisions of the Act relating to criminal liability, but that is not the case, as we know. Section 55(1) of the Data Protection Act makes it a criminal offence for a person to
“knowingly or recklessly, without the consent of the data controller—
(a) obtain or disclose personal data or the information contained in personal data, or
(b) procure the disclosure to another person of the information contained in personal data”.
Clearly, investigative journalists may often obtain information directly or through a source without seeking the consent of the data controller holding the data containing that information. One has only to take the common example of an investigation into allegations of improper or unethical practices within a business organisation. Such a story could not be investigated effectively, particularly if a source within the business organisation was involved, without risking criminal liability under section 55 of the 1998 Act. Obtaining the information will almost certainly also give rise to potential civil liability, as it will be impracticable to comply with the data protection principles. The journalist will be able to invoke the provisions of section 32 to secure exemption from civil liability on the grounds that he reasonably believes that publication would be in the public interest, so why should he not also have at least the same level of protection from potential criminal liability arising from the same facts?
That anomaly is a matter of serious concern as the Act stands, and it will be exacerbated by implementation of clause 75. I have informed the Committee of the genesis or origin of those concerns, which I share, both as a newspaper lawyer and as a citizen. As I understand it, we have yet to see—certainly the people advising me on the issue have yet to receive—a rational response to their concerns, which they have passed to the Government. I shall leave it to the Minister to explain the Government’s response to my points, although I am sure that I know what it is.
First, the imprisonment sanction will have the chilling effect that the Minister mentioned in her intervention. To introduce imprisonment for investigative journalists who obtain information without the consent of the data controller who holds the data containing that information in circumstances when the journalist may be unable to establish that the obtaining was justified in the public interest is self-evidently capable of discouraging the press from actively pursuing the investigation of allegations raising matters of legitimate public interest, and accordingly is capable of having a chilling effect on press freedom.
4.45 pm
Those concerns have not just been dreamt up in the bars of Fleet street or in the offices of lawyers who benefit from work from media companies.
In a judgment made by the European Court of Human Rights, on 17 December 2004, on the case of Cumpana v. Romania, a grand chamber of 17 judges, in the course of finding that the imprisonment of a journalist had infringed his article 10 rights on freedom of expression, stated:
“Although the Contracting States are permitted, or even obliged, by their positive obligations under Article 8 of the Convention”,
which deals with the protection of privacy, family life and so forth,
“to regulate the exercise of freedom of expression so as to ensure adequate protection by law of individuals’ reputations, they must not do so in a manner that unduly deters the media from fulfilling their role of alerting the public to apparent or suspected misuse of public power... Investigative journalists are liable to be inhibited from reporting on matters of general public interest—such as suspected irregularities in the award of public contracts to commercial entities—if they run the risk, as one of the standard sanctions imposable for unjustified attacks on the reputation of private individuals, of being sentenced to imprisonment or to a prohibition on the exercise of their profession.”
It continued:
“The chilling effect that the fear of such sanctions has on the exercise of journalistic freedom of expression is evident”.
A little while later, it said:
“Such a sanction, by its very nature, will inevitably have a chilling effect.”
In my view—I was going to say “and in the view of those who instruct me in this matter”, but hon. Members know what I mean.
Maria Eagle: They are not paying you are they?
Mr. Garnier: No they are not. This is a public duty, which I enjoy.
In my view, it follows that the introduction of custodial sentences for section 55 offences committed by journalists is capable of interfering with their article 10 rights. Accordingly, under the consistent jurisprudence of the European Court of Human Rights, the introduction of those sanctions cannot be justified, unless there is a pressing social need and the interference is proportionate to the legitimate aim pursued. Furthermore, the reasons for introducing those sanctions must be relevant and sufficient.
The inclusion of a penalty of imprisonment within the civil liability deterrent regime has not been shown to be a necessary response to any pressing social need, or to be proportionate or otherwise justified. I said at the beginning of my remarks that there have been only 26 prosecutions under section 55 of the 1998 Act and that only two of those resulted in fines of more than £5,000. If that is correct, and on the facts as we know them, there does not seem to be a need to ratchet up the criminal regime so dramatically.
According to the Government’s response to the consultation process, or at least to the remarks from the groups that I mentioned before—the editors and so forth—they do not expect the number of prosecutions to increase if custodial sentences are made available. It must follow, therefore, that the prosecution of offences has not been discouraged by the lack of custodial sentences. Furthermore, in view of the few prosecutions that have taken place, the penalties imposed have tended to be modest fines—some in the low hundreds—even though a conviction on indictment makes an unlimited fine available.
The facts and arguments that I have presented to the Committee suggest that existing penalties are more than sufficient to deal with offences under section 55. On that basis, I urge the Government to rethink clause 75 and to consider whether their proposals are necessary and justified.
Maria Eagle: I have been listening intently and shall try to deal with the points that the hon. and learned Member for Harborough made. However, it might be helpful if first I set out what we are doing in clause 75 and why.
The clause amends section 60 of the Data Protection Act 1998 to increase the penalties for offences under section 55 of the Act to allow for a period of imprisonment of six months in a magistrates court up to two years on indictment. It increases the current penalty, as the hon. and learned Gentleman said, which is limited at present to fines in either a magistrates or Crown court.
Section 55(1) and (3) of the Act provide that a person is guilty of an offence if they knowingly or recklessly, without the consent of the data controller, obtain or disclose or procure the disclosure of personal data to another person. Section 55(4) and (5) provide that a person is guilty of an offence if they sell or offer to sell personal data obtained in breach of section 55(1).
I wish to make it absolutely clear that the origin of the clause has nothing to do with trying to create a chilling effect on the legitimate activity of investigative journalism. It has nothing to do with that at all. The Information Commissioner’s report “What price privacy? The unlawful trade in confidential personal information”, which was laid before Parliament on 10 May 2006, highlighted the extent of the illegal trade in personal data and recommended custodial sentences for offences relating to its misuse, as the existing financial penalties were not sufficiently protecting individuals’ rights.
That is the origin of clause 75. I reiterate that the intention is not to try to undermine or chill in any way legitimate investigative journalism, nor do we wish inadvertently to cause problems in that regard. As the Committee will be aware, the clause does not create any new criminal offences. The hon. and learned Gentleman did not say that it did—I am not suggesting that he said that.
Mr. Garnier: You are reading the wrong paragraph.
Maria Eagle: I am making it up. I am not reading any paragraph. I do sometimes read out paragraphs, but I am not doing so at present. The hon. and learned Gentleman was doing a fair amount of reading himself. I am sure that it was stuff that he had prepared earlier.
We are not creating a new criminal offence. [ Interruption. ] Everyone is chuntering this afternoon, Mr. O’Hara. It must be something to do with the time. In any event, I shall try to deal with some of the points that the hon. and learned Gentleman made.
We are not creating a new criminal offence. As a result of the process, we are increasing the penalty because we have been convinced that we need to do so. I do not want us to have too arcane an argument, but the hon. and learned Gentleman suggested that the defence for the civil offence under section 32 of the 1998 Act was of a higher threshold than the defence for the criminal offence under section 55. I am not convinced of that. We could debate exactly where the threshold is, but the point of much of what he was saying was bound up in that. If there are civil and criminal penalties for similar offences, one can understand why the threshold for the civil offence ought to be lower than for the criminal offence. That is common sense under our system of law.
However, sections 32 and 55 of the 1998 Act are different in numerous respects. Section 32 gives media organisations exemption from some parts of the Act that apply to them as data controllers. It exempts them from most of the data protection principles and certain other provisions of the 1998 Act if, after due regard to the public interest and freedom of expression and publication, they reasonably believe that publication is in the public interest.
Section 55, however, is not about the normal business of being a newspaper in the same way. It concerns a wilful obtaining, disclosing or procuring of information without the data controllers’ consent. The prohibitions in this section apply equally to everyone, as do the defences listed in 55(2). Section 55(2)(D) requires that the knowing or reckless obtaining, disclosing or procuring of information without the consent of the data controller to be justified in the public interest.
I accept that not everyone will agree with that. The hon. and learned Gentleman set out in great detail the reasons why he does not. Let me assure him that there is no intention to create a chilling effect, and to inhibit in any way responsible investigative journalism. Not everyone accepts that there would be a chilling effect. When the Committee on Culture, Media and Sport was considering self-regulation for the press, it looked at this provision and suggested that the penalty did not have a chilling effect, and it welcomed the amendment. There are other reasons of public policy for signalling very strongly that the obtaining and selling of public or private data is not only a breach of human rights, but a matter that causes a great deal of damage and it ought to be treated as seriously as the provision suggests.
As the hon. and learned Gentleman knows, because of his close interest in this matter, there have been meetings between newspapers and various interests who believe very strongly what he, the former Lord Chancellor, former Ministers and the Department for Constitutional Affairs put forward in respect of this. I am not saying that we will all agree, but we have considered the matter very carefully. We believe that the current clause is correct. While I am not promising to make any changes, I am perfectly happy to look very closely at what has been said today. I do not feel convinced that the hon. and learned Gentleman is right, but I will look very closely at what he has said and talk to him and the Newspaper Society further about it. However, we believe that clause 75 is the right provision. I have heard what the hon. and learned Gentleman has had to say, but I commend the clause to the Committee.
Mr. Garnier: I am grateful to the Minister for her explanation of her Department’s policy. May I say that the chuntering was an unnecessary intervention, and that the further chuntering was my attempt to apologise for that from a sedentary position?
There are a number of illogicalities and inconsistencies in the Government’s approach. It may be that in the rush to make laws and so forth, No. 10 is not talking to the Ministry of Justice and vice versa. [Interruption.] I interpret what the Minister of State is saying and that is not in the least bit unusual. It is interesting that the Prime Minister has said that he wants a further consultation period and an investigation or inquiry into the way in which the Freedom of Information Act and its provisions work and has asked Paul Dacre, the editor-in-chief of the Daily Mail to chair that investigation.
5 pm
The Secretary of State for Justice said that the Bill raises concerns that it
“might impede legitimate investigative journalism”.—[Official Report, 25 October 2007; Vol. 465, c. 409.]
However, the clause will ratchet the penalty up. I am not talking about data thieves or blackmailers, even if part of the Minister’s response concentrated on that. I am not seeking to defend reckless, negligent or deliberately ill-motivated conduct by data processors—I would call it Her Majesty’s Revenue and Customs’ story and the Minister will doubtless hear more of it in due course because the Chancellor of the Exchequer will tell her. I want to ask her about what is in the journalist’s mind at two different times. If we look at the civil regime, we will see that it is anticipatory because the defence applies if
“the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would”—
in future—
“be in the public interest”
or, secondly, if he
“reasonably believes that, in all the circumstances, compliance with”
data protection principles
“is incompatible with the...purposes”
of journalism. We are therefore looking ahead when it comes to the civil liability regime, which allows the journalist to have some form of subjective input to his defence whereas, under the criminal regime, he has to show
“that in the particular circumstances the obtaining, disclosing or procuring was justified”—
that measure uses the imperfect tense—
“as being in the public interest”.
A proper construction of the expression
“was justified as being in the public interest”
is an object test, which the court, jury or magistrate will assess for themselves on the basis of the evidence before them and the advice they receive on the meaning of the expression “the public interest”.
Having said all that, I am grateful to the Minister for indicating that she would be prepared to read carefully the report of our discussions with her officials and the Department’s lawyers, and also for offering me the opportunity to have further meetings with the Fleet Street Lawyers’ Society. I mentioned Alastair Brett, who is the secretary of that group; he is also legal manager of The Times newspaper group, so I am talking about major media operators, not irresponsible, dodgy, fly-by-night members of the yellow press. Such people have a legitimate and responsible attitude toward both the need to protect people’s privacy and the need to take a proper interest in maintaining, and fighting hard for, the fundamental right of freedom of expression.
I shall take up the Minister’s offer and get back to those who have been in touch with me to see whether they would like to meet the Minister. Perhaps meetings can take place between now and Report, or at least before the Bill leaves this House and goes to the other place. I am reasonably sure that the clause will receive close attention in the other place, whose Members will not be under the same time constraints as us. I suspect that that will be the case because Lord Lester of Herne Hill was very busy during the deliberations on the Human Rights Act 1998 when discussing journalistic endeavour, as was my noble Friend Lord Fowler, who is both an ex-journalist and a newspaper executive. There will be plenty of interest in the clause in the other place, so it would be useful if the Minister would hold those meetings before the Bill goes there. Given those offers, which I accept with alacrity, I withdraw my resistance.
Question put and agreed to.
Clause 75 ordered to stand part of the Bill.
Previous Contents Continue
House of Commons 
home page Parliament home page House of 
Lords home page search page enquiries ordering index

©Parliamentary copyright 2007
Prepared 28 November 2007