14.1 People have the right to complain to you, us, and the courts about how you have used their personal information.
14.2 We publish statutory guidance for the public to help them complain about the media and decide the most appropriate organisation to make their complaint to.
14.3 Our role is about data protection, not general press standards. However, where there is overlap, we will work with other authorities to resolve issues effectively and efficiently.
14.4 People can also enforce their data protection rights or claim compensation for damages in court, or both. When the case concerns journalism, the person who is a party, or a prospective party, to the proceedings can ask us to assist if the case is of substantial public importance.
14.5 Courts must stay (or in Scotland, sist) some legal proceedings if certain criteria are met, which protects publication.
14.6 We can take formal enforcement action. However, there are specific and strong protections for journalism and various restrictions and safeguards built into the law.
14.7 Any action we take is targeted and proportionate, with our strongest measures reserved for the most serious incidents. We also carefully consider the potential impact on freedom of expression and information, and a free media, in any action we may take.
14.8 We can also investigate and prosecute criminal offences when we consider it is in the public interest. There are some defences relating to the public interest and journalism set out in the DPA 2018 that can apply in specific circumstances (see key legal provisions in Reference notes).
Reference notes
These reference notes support the Data protection and journalism code of practice (the code) but are not part of the statutory code itself.
Key legal provisions
DPA 2018 section 167 – compliance orders
DPA 2018 section 168 – compensation for contravention of the GDPR
DPA 2018 section 143 – information notices: restrictions
DPA 2018 section 152 – enforcement notices: restrictions
DPA 2018 section 156 – penalty notices: restrictions
DPA 2018 section 170 -173 – criminal offences
DPA 2018 section 174 – the special purposes
DPA 2018 section 175 – provision of assistance in special purposes proceedings
DPA 2018 section 176 – staying special purposes proceedings
DPA 2018 section 177 – guidance about how to seek redress against media organisations
DPA 2018 section 178 – review of processing of personal data for the purposes of journalism
DPA 2018 Schedule 15 – powers of entry and inspection DPA 2018 Schedule 17 – review of processing of personal data for the purposes of journalism
Further reading
What to expect from the ICO when making a data protection complaint contains information about our data protection complaints process.
Data protection and journalism: how to complain about media organisations has more information about how to make complaints about media organisations, including details about court action.
ICO Regulatory action policy and statutory guidance on our regulatory action (currently in draft form following a public consultation).