This is one of a series of responses to the publication of the report of the Leveson Inquiry. For an introduction, and links to other posts, see here.
The extent of the recommendations on amending the provisions for journalism in the Data Protection Act came as a surprise to me, and of course the Government will have to be aware of the context of EU law if it does implement these proposals. It would change the nature of the journalistic exemption under the Directive as implemented in the UK through the Data Protection Act. (This is an unusual formulation in the Directive – member states *shall* provide a derogation but only when it is *necessary*; implementation is therefore of interest to the EU; and not forgetting the interaction between data protection and (other?) fundamental rights.
Although this is a field of law that is complex, and the recommendations may seem on the legalistic side, I do believe that this has the potential to be quite far-reaching. It’s not a surprise that it has come up in the House of Commons debate (although more heat than light so far). Some of the objections may be fairly categorised as symbolic, that is to say, it is the idea of having an exemption (or special treatment, if you will) that is important rather than every aspect of compliance. However I would anticipate particular tensions in respect of subject access requests (i.e. Mary Murphy contacts a newspaper asking for all the data it holds on her), and the proposed shift in the burden for those areas that are covered by an exemption might have an impact.
The recommendations on the structure of the ICO are also particularly detailed – there may be a need to consider the consequences of such changes for other areas under the DPA supervised by the ICO (which were well beyond Leveson’s remit or indeed interest). There is, quite fairly, a reminder that some of the recommendations can be implemented soon and should not be delayed until longer-term structural changes are considered. Nonetheless the role of the ICO is surely up for discussion now, and not just in respect of its relationship with the media. Data protection watchers (of which I am not really one) will be interested in this process. (Time for a focused review of the ICO in the context of these recommendations but with wider participation from IT lawyers?).
It’s less of a surprise, but still important, to see it recommended that the stronger sentencing powers for the criminal provision in the Data Protection Act (s 55) be (finally) brought into force.