ICO second consultation on the draft Data protection and journalism code of practice

Original consultation text from 23 November 2022

We would like further feedback on the draft Data protection and journalism code of practice about using personal data for journalism. This is a statutory code under section 124 of the Data Protection Act 2018 (DPA 2018).

The code provides practical guidance about how to comply with data protection legal requirements and good practice when using personal data for journalism. It does not concern press conduct or standards in general.

We have now updated the code following the first consultation in January 2022, taking your feedback into account. This has shaped the draft at every stage so thank you. It is vital that we continue to hear your views so that our code works practically for you.

You can read a full summary of the work we have already done to respond to your feedback. We have significantly reduced the length and overall complexity of the code by:

focusing more on the code’s key points and moving background information to supporting reference notes;
distinguishing clearly between legal requirements and good practice by explaining what must, should or could be done to comply;
developing quick reference guides to use – 10 tips for journalists and the code ‘at a glance’;
making the code more user-friendly with plainer language and explanations so it’s helpful to a broader audience; and
providing greater clarity on the practical application of various areas of data protection where sought.

Although the focus of this consultation is the code, we also welcome views on the associated documents below:

We encourage interested parties to get in touch, including anyone involved in the media industry or using personal data for journalism, such as media organisations, journalists, photographers and private investigators. We are keen to hear a wide range of views, including those of regulators, civil society, campaign groups, lawyers, academics, and members of the public.

Please submit responses by 23 November 2022. We may not consider responses submitted after the deadline.

We have also started to review how personal data has been used for journalism since the UK GDPR came into force. We are required to do this under section 178 of the DPA 2018. Insight gained from the review will help us continue to develop the code in the future.

Responding to the consultation

You can respond to this consultation in different ways as set out below. However, we ask that you respond directly to the questions we ask in this consultation paper.

1. Reply to us directly online via Snap Survey:

Macro alias: FurtherReading

2. Download this document and email to: [email protected].

Macro alias: FurtherReading

3. Print off the above document and post to:

Data protection and journalism code of practice
Regulatory Assurance
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
If you have any general queries about the consultation, please email us at [email protected].

Privacy statement

For this consultation, we will publish all responses except for those where respondents are acting in a private capacity (eg a member of the public). We will remove email address and telephone numbers from all responses.

For more information about what we do with personal data, please see our privacy notice.

We have developed the Data protection and journalism code of practice as required by section 124 of the Data Protection Act 2018 (DPA 2018).

The code provides practical guidance about what the legislation says and how to comply with it when using personal information for journalism.

The second consultation closed in November 2022, following the first consultation in January 2022, and an earlier call for views. We have now published the code and reference notes, along with a consultation summary explaining how we responded to the feedback.

We formally submitted the code to the Secretary of State for the Department of Science, Innovation and Technology on 6 July 2023. For the code to come into force, it needs to complete the statutory process set out in section 125 of the DPA 2018 and be laid before Parliament by the Secretary of State.

List of responses

Responses summary

This is a short summary of the second public consultation on the draft Data protection and journalism code of practice (the code). It focuses on key themes and changes made in response to feedback.

The second consultation ran for eight weeks and closed in November 2022. We consulted on:

a revised draft code;
supporting Reference notes (not part of the code itself);
a revised impact assessment; and
two quick reference guides to support the code.

This consultation follows the first public consultation on the code and an earlier call for views. In the first consultation we consulted on a draft code and impact assessment.

Feedback from the first consultation showed respondents thought the code is generally well written and helpful for compliance staff at media organisations. Respondents also said it is too long and should be more practical.

In response, we revised the draft substantially and agreed to undertake a second, shorter public consultation. As a result of this feedback, changes we made include:

shortening the code to make it more focused;
highlighting the journalism exemption;
focusing on day to day compliance and the general legitimate interest in journalism, which often applies in a straight-forward way;
making it clear demonstrating how you comply is a requirement of data protection law that is flexible, leaving significant room to judge how best to look after people’s personal information;
explaining the nature of UK GDPR consent, and why legitimate interests is often likely to be the most appropriate lawful basis;
being more explicit that not all personal information is private;
clarifying details about the right to correct or complete personal information.

Who we heard from

We received 20 written responses to the code’s second public consultation from:

Media representative organisations - 4
Media organisations - 6
Media standards body – 1
Journalist - 1
Academics - 3
Consultant -1
Union -1
Law firm – 2
Member of public – 1

We are grateful for the time and valuable, constructive insights we received from stakeholders. This included those representing perspectives beyond mainstream media including civil society, campaign group Hacked Off, IMPRESS, lawyers and academics.

We have published the written responses to the code’s second public consultation as appropriate in line with our privacy notice.

Key themes and changes - code and reference notes

Length and structure

We made the following changes in response to feedback about the length and detail of the code:

We shortened the code and made it more practical.
We divided each section of the code into two parts detailing:
- What the legislation says.
- How organisations should comply.
The code is supported by associated Reference notes that are not part of the code itself. These contain extra detail and background for people who need more information. The notes contain:
- further details about the legislative provisions;
- examples of good practice to help people consider different ways to comply;
- links to our wider guidance and resources; and
- case law examples where relevant and helpful to parts of the code.

Presentation of the journalism exemption

We made the following changes in response to feedback that it was important to emphasise day-to-day compliance rather than the journalism exemption:

The journalism exemption is highlighted and introduced at the start of the code.
We refer to the application of the exemption at the top of each section.
We moved substantive detail about how to apply the exemption to the end of the code.
We focused more on day-to-day compliance when the journalism exemption is not needed.

Criteria to apply the journalism exemption

We made the following changes in response to feedback about the different parts of the exemption:

We moved examples of the general public interest to the reference notes as some respondents said it might imply the public interest was limited to ‘weightier’ issues.
We added further detail about the fundamental public interest in freedom of expression and information, and a free press. We made it clearer this can cover a wide range of journalistic material.
The code contains guidance about approaching the part of the exemption concerned with incompatibility in a way that is appropriately flexible and as straight-forward as possible.

Requirement to demonstrate compliance

We made the following changes in response to feedback that guidance in this section of the code was impractical for the media:

We shortened this section to make it more focused.
We highlighted the flexible nature of data protection law, the significant discretion available and how you can comply.

Lawful bases – legitimate interests and consent

We made the following changes in response to feedback about two of the lawful bases for using personal information:

We explained more clearly when using personal information for day-to-day journalism, the legitimate interests lawful basis is often the most straight-forward to use when there is a clear legitimate interest in journalism that is not outweighed by the legitimate interests of the person concerned.
We are clearer that the legitimate interests lawful basis is not restricted to ‘low impact’ stories.
We are clearer about the specific legal definition of UK GDPR consent.
We also explain a person can withdraw consent at any time therefore relying on UK GDPR consent in the context of journalism may be difficult. The legitimate interests lawful basis is likely to be most appropriate in many cases.

Privacy, especially in the context of the fairness principle

We made the following changes in response to feedback that the distinction between different privacy laws was not always clear in the code and the Reference notes:

We are clearer that not all personal information is private.
We are clearer about why we refer to privacy in parts of the code, and the type of privacy issues that are likely to occur in a journalistic context.
We are clearer about the purpose and content of the supporting reference notes.
We explain why the notes refer to privacy law beyond data protection-specific cases.
We indicate at the start of each case which privacy law it involves.
We also cross-reference each case to the relevant part of the code.

Individual rights

We made the following changes in response to feedback that some respondents thought parts of the code suggest it is necessary to correct factual personal information or opinions based on subsequent developments.

We clarify that personal information contained in a news archive does not become inaccurate if facts that did not exist at the time subsequently emerge.
We also explain if a person exercising the right to rectification brings to your attention their personal information in a news archive was inaccurate when it was used, you must correct or complete it where necessary.
We also clarify that as long it is clear that someone is expressing an opinion, you are unlikely to need to correct or complete it because opinions are subjective by their nature.

ICO and media regulators

Some respondents said our role as a complaints handler risks unnecessary regulatory burden and duplication of effort. We were urged to say explicitly in the code that we would pass complaints about the media directly to the Independent Press Standards Organisation in the first instance.

We have already published separate guidance to help the public consider the different routes available to make complaints about the media as required by the DPA 2018.

We do not consider it would be possible or appropriate to include this suggestion in the code, particularly in view of our specific legal duties. We are, however, open to considering other ways to increase our cooperation and engagement with industry generally and welcome further contact to explore potential options.

Quick reference guides

Very few consultation responses referred in any detail to the guides, other than to say their purpose and the distinction between them was not clear. We therefore decided not to revise and publish these documents.

Impact assessment

Despite no substantive feedback, we updated the impact assessment to reflect recent changes

Next steps

We published the draft code and submitted it to the Department of Science, Innovation and Technology on 6 July 2023.

The code will help you understand what data protection law says and how to comply if you use personal information for journalism. For the code to come into force formally, it needs to complete the statutory process set out in section 125 of the DPA 2018. The legal effect of statutory codes once they are in force is set out in section 127 of the DPA 2018. A court or tribunal must take the code into account where relevant to proceedings.