If you meet the criteria to apply the journalism exemption, you no longer have to comply with the specific rights people can exercise relating to their personal information, except for rights about automated uses of personal information. This section of the code sets out what the legislation says and how to comply when you are not applying the journalism exemption (See Apply the journalism exemption).
What does the legislation say?
12.1 People have specific rights they can exercise relating to their personal information. This code focuses on rights most likely to be relevant to journalism (See also Use personal information transparently and our separate guidance about automated use of personal information).
12.2 People can make requests in writing or verbally to use their rights. If someone makes a request, you must comply with it without undue delay and within one month. However, you can extend the time to respond in certain circumstances (see 12.2 in Reference notes).
12.3 You must be able to justify any decision you take to refuse someone’s request. You can refuse to respond to a request if:
- an exemption applies (eg see Apply the journalism exemption); or
- it is manifestly unfounded or manifestly excessive.
12.4 If you refuse to comply with a request, you must tell the requester why and that there is a right to complain to us and the court.
Right of access
12.5 People have the right to ask you to:
- confirm you are using their information;
- give them access to it; and
- provide other supplementary information.
12.6 You must not give someone personal information about another person in response to an access request, unless:
- the other person has consented (see Use personal information lawfully); or
- it is reasonable to disclose it without their consent. There is very strong legal protection for a journalist’s sources.
Right to restriction
12.7 People have the right to ask you to restrict the use of their personal information in certain circumstances (see 12.7 in Reference notes).
12.8 You must be able to restrict personal information, if required. For example:
- by temporarily moving it to another system;
- making it unavailable to users; or
- temporarily removing published personal information from a website.
12.9 You must tell each recipient of the personal information that you have restricted it unless this proves impossible or involves disproportionate effort. If the person concerned wants to know who these recipients are, you must tell them.
12.10 In many cases, the restriction is only temporary. You must tell the person concerned before you lift the restriction.
Right to correct or complete personal information
12.11 People have a right to ask you to correct their personal information if it is inaccurate, or to complete it if it is incomplete. If necessary, you must correct or complete personal information.
12.12 You must tell recipients about any correction or completion unless this proves impossible or involves disproportionate effort. If the person concerned wants to know who these recipients are, you must tell them.
Right to object
12.13 People have the right to object to the use of their personal information in certain circumstances (see 12.13 in Reference notes).
12.14 You must clearly tell people about their right to object when you first communicate with them at the latest.
12.15 If you have no reason to refuse the objection, you must stop using the personal information (see 12.15 in Reference notes).
Right to erasure
12.16 People have the right to have their personal information erased without undue delay in certain circumstances (see 12.16 in Reference notes).
12.17 Crucially, the right to erasure does not apply if it is necessary for you to use the information to exercise the right to freedom of expression and information.
12.18 If personal information is made public and you are required to erase it, you must take reasonable steps to inform other parties with legal responsibility for using it that the requester has asked them to erase any links to, or copies of, the personal information.
12.19 You must tell recipients about any erasure unless this proves impossible or involves disproportionate effort. If the person concerned wants to know who these recipients are, you must tell them.
How do we comply?
Right of access
12.20 If you are considering the right of access, you should make reasonable efforts to find relevant information.
Right to correct or complete personal information
12.21 Personal information, such as that contained in news archives, does not become inaccurate because of new facts that did not exist at the time when it is part of a news archive (see Use accurate personal information).
12.22 However, if a person exercising this right brings to your attention that their personal information in the news archive was inaccurate when you used it, you must correct or complete it, where necessary.
12.23 As long as it is clear that someone is expressing an opinion, you are unlikely to need to correct or complete it. Opinions are subjective by their nature. The courts have developed well-established principles to distinguish between fact and opinion (see 12.23 in Reference notes).
Right to erasure
12.24 There is a strong, general public interest in the preservation of news archives and protecting the integrity of records, which contributes significantly to people’s access to information about the past and contemporary history. This is a strong factor in favour of not erasing personal information from news archives if someone asks you to.
Refusing requests
12.25 An exemption may exempt you in whole or only in part. You should avoid taking a blanket approach.
12.26 If you are deciding whether to refuse a request because it is manifestly unfounded or manifestly excessive, you should consider objectively whether the request would clearly have a disproportionate or unjustifiable impact.
Reference notes
These reference notes support the Data protection and journalism code of practice (the code) but are not part of the statutory code itself.
12.1 Individual rights
People have the following rights relating to their personal information:
- right to be informed;
- right of access;
- right to rectification;
- right to erasure;
- right to object;
- right to data portability; and
- rights related to automated decision-making, including profiling.
12.2 Extending the time to respond
12.6 Protection of a journalist’s confidential sources
There is strong legal protection for a journalist’s sources beyond data protection law. For example, sources are protected under the Contempt of Court Act 1981.
12.7 Right to restriction in certain circumstances
People have a right to restriction in the following circumstances:
- you have processed their personal information unlawfully and they have requested restriction rather than erasure (see Use personal information lawfully);
- they contest the accuracy of their personal information and you are verifying it (see Use accurate personal information);
- they object to your use of their information and you are considering whether your legitimate reasons override theirs (see Right to object); or
- you no longer need the information but the person concerned needs you to keep it for a legal claim.
12.13 Right to object in certain circumstances
People can object to the use of their personal information in the following circumstances:
- the information is being used for direct marketing;
- you are relying on the public task or legitimate interests lawful basis; or
- you are using information for scientific or historical research or statistic purposes.
12.15 Refusing the right to object
12.16 Right to erasure in certain circumstances
People have the right to have their personal information erased in the following circumstances:
- you do not need to keep the personal information for the purpose you originally collected or used it for;
- you are relying on the consent lawful reason, consent is withdrawn and there are no other legal reasons for using the information;
- a person objects to your use of the information and there are no overriding legitimate reasons for using it;
- you have used personal information unlawfully;
- you collected the information to offer online services to a child; or
- you need to erase the information to comply with a legal obligation.
12.17 Right to erasure
To help you determine whether you need to use the personal information to exercise the right to freedom of expression, you may find the factors used by the European Court of Human Rights helpful.
These factors are a guide and some may have more or less relevance, depending on the circumstances, including:
- how much the information contributes to a debate of public interest;
- how well known the person concerned is and the subject of the article;
- the prior conduct of the person (eg have they actively invited media attention?);
- how you obtained and verified the information;
- the content, form and impact of the publication; and
To help you determine whether you need to use the personal information to exercise the right to freedom of expression, you may find the factors used by the European Court of Human Rights (EctHR) helpful.
These factors are a guide and some may have more or less relevance, depending on the circumstances, including:
- how much the information contributes to a debate of public interest;
- how well known the person concerned is and the subject of the article;
- the prior conduct of the person (eg have they actively invited media attention?);
- how you obtained and verified the information;
- the content, form and impact of the publication; and
- whether the interference with the person’s right to privacy is proportionate and justified in light of the above factors.
12.23 Right to correct or complete personal information
12.26 Refusing manifestly unreasonable or excessive requests
To help you decide whether to refuse a request because it is manifestly unreasonable or excessive, you may find it helpful to consider:
- whether the request has any serious purpose or value;
- what is the requester’s motive;
- whether the request would impose an unreasonable burden on your resources; and
- if it involves any harassment of your staff.
Case example 8
Right of access and protection of journalistic sources (paragraph 12.6 of the code)
EctHR
Goodwin v United Kingdom (1996) 22 EHRR 123
The ECtHR said in this case:
“Protection of journalistic sources is one of the basic conditions for press freedom…Without such protection, sources may be deterred from assisting the press in informing the public on matters of public interest. As a result the vital public watchdog role of the press may be undermined and the ability of the press to provide accurate and reliable information may be adversely affected.
Having regard to the importance of the protection of journalistic sources for press freedom in a democratic society and the potentially chilling effect of an order of source disclosure has on the exercise of that freedom, such a measure cannot be compatible with Article 10 of the Convention unless it is justified by an overriding requirement in the public interest”. (39)
Case example 9
DPA 1998 - Fact and opinion (paragraph 12.23 of the code)
High Court
Aven and Others v Orbis Business Intelligence Limited [2020] EWHC 1812 (QB)
In this case, which concerned a claim brought under the DPA 2018, the judge used principles from defamation law to consider a dispute about accuracy.
Reflecting on whether a statement is a fact or an opinion, the judge said:
“The DPA contains no guidance on this topic. But this is an issue that arises frequently in defamation cases. The principles are very well established and familiar to this court”. He also said “I caution myself that this is not a libel action. But these principles are not technical matters, of relevance only to a niche area of the law. They reflect the experience of generations in analysing speech and striking a fair balance between the right to remedies for false factual statements, and the need to safeguard freedom of opinion”.
He summarised the “core points” as follows:
- A key question is how the words would strike the ordinary reasonable reader.
- A comment is a deduction, inference, conclusion, criticism, remark, observation etc.
- Words must be looked at in their context along with the subject matter.
Other important factors may be whether the statement is capable of verification, and whether the words stand by themselves or accompany others.
Case example 10
Data Protection Directive 95/46/EC - right to erasure (or right to be forgotten) and distinction between search engines and publication of data by other websites (paragraph 12.24 of the code)
European Court of Justice (ECJ)
Google Spain C-131/12
This ECJ considered a person seeking to exercise their privacy rights about a search engine.
Although this case was about a search engine, it is important because it distinguished between use of personal information by the search engine and use of personal information carried out by publishers of other websites.
Working party guidance has further information about this judgment and the flexible criteria the court set out to help search engines decide whether “de-listing” of search results is appropriate.
Case example 11
European Convention on human rights (ECHR) - right to erasure (or right to be forgotten) and strong public interest in news archives (paragraph 12.24 of the code)
ECtHR
ML and WW v Germany [2018] ECHR 554
This case concerned someone who sought to exercise their “right to be forgotten” under human rights law about their murder conviction.
The ECtHR decided that it was not proportionate to require anonymisation of media reports.
The court recognised the strong public interest in the media and news archives. It also recognised the potential chilling effect of right to be forgotten requests.
Factors affecting this outcome included:
- There was considerable interest in the crime at the time. The applicants had also subsequently sought to reopen the case and had not even been granted parole when they commenced legal proceedings.
- The applicants had lodged every possible judicial appeal and had also directly contacted the press.
- The reports were fair and accurate.
- The dissemination of the reports was limited in scope because they were no longer available on the news pages of the websites and subject to restrictions such as paid access or subscription.
- The applicants had not attempted to contact search engine operators to further limit the availability of the information.
Case example 12
ECHR - Right to erasure (or right to be forgotten) and anonymisation of digital archive record (paragraph 12.24 of the code)
ECtHR
Hurbain v Belgium [2021] ECHR 544
A person was named as causing a fatal car accident. The person was convicted, served their sentence, and received a pardon. They subsequently sought to exercise their “right to be forgotten” under human rights law.
Given the facts of this specific case, the ECtHR decided that it was proportionate to ask the newspaper to anonymise only the digital archive record that was freely accessible through an online search, not the original article.
The court recognised the strong value of archives “…for teaching and historical research, as well as for contextualising current events”. It also recognised that anonymising archives undermines their integrity. It urged domestic courts to be “particularly vigilant” about people seeking to anonymise or modify electronic archives.
Factors affecting the outcome in this case included:
- The information was of no topical value 20 years after the event and the person concerned had no public profile.
- The public interest in the rehabilitation of offenders.
- The person had not sought media attention.
- Online publication is much more likely to undermine the right to privacy than paper publication.
Key legal provisions
UK GDPR article 12 – requirements about providing information to people
UK GDPR article 15 – right of access
UK GDPR article 16 – right to rectification
UK GDPR article 17 – right to erasure (or right to be forgotten)
UK GDPR article 18 – right to restrict processing
UK GDPR article 19 – requirement for controllers to notify recipients of personal data when personal data is rectified, erased or restricted
UK GDPR article 21 – right to object
Contempt of Court Act 1981 Section 10 Sources of information