Notice

Explanatory memorandum to the Data Protection and Journalism Code of Practice 2023

Published 26 October 2023

1. Introduction

1.1 This explanatory memorandum has been prepared by the Department of Science, Innovation and Technology and is laid before Parliament by Command of His Majesty.

2. Purpose of the instrument

2.1 Under section 124 of the Data Protection Act 2018 (DPA), the Information Commissioner is required to prepare a code of practice which contains practical guidance in regard to processing personal data for the purposes of journalism and such other guidance as the Information Commissioner considers appropriate to promote good practice in the processing of personal data for the purposes of journalism. The code provides support to anyone processing personal data for the purposes of journalism to understand their legal obligations and how to comply effectively.

3. Matters of special interest to Parliament

Matters of special interest to the Joint Committee on Statutory Instruments

3.1 None.  The code is not a statutory instrument, but is subject to the negative resolution procedure set out in section 125(3) and (4) of the DPA.

4. Extent and Territorial Application

4.1 The extent of this code is the United Kingdom.

4.2 The territorial application of this code is the United Kingdom. 

5. European Convention on Human Rights

5.1 As the instrument is subject to negative resolution procedure and does not amend primary legislation, no statement is required.

6. Legislative Context

6.1 Under section 124(1) of the DPA the Information Commissioner is required to produce a data protection and journalism code of practice.  The code must contain practical guidance in relation to the processing of personal data for the purposes of journalism in accordance with the requirements of the data protection legislation and such other guidance as the Information Commissioner considers appropriate to promote good practice in the processing of personal data for the purposes of journalism.

6.2 The journalism code is one of four statutory codes in the DPA that the Information Commissioner is required to prepare (the others being the age appropriate design code, the direct marketing code and the data sharing code) and is the third to be laid in Parliament. The DPA provides that courts and tribunals must take into account the provisions of a statutory code where relevant to the proceedings in question.

6.3 Section 125(1)(a) requires the Information Commissioner to submit the final version of the code to the Secretary of State.  Section 125(1)(b) then requires the Secretary of State to lay the code before Parliament. The code itself is not a statutory instrument but a statutory code and, as stipulated in section 125(3) and (4) of the DPA, follows the negative resolution procedure when the Secretary of State lays it in Parliament.

7. Policy background

What is being done and why?

7.1 Codes of practice issued under section 121 to 124 of the DPA are designed to help organisations comply with data protection legislation in areas where failure to do so   could pose particular risk to individuals. They cover processing activities which the UK Parliament has agreed deserve particular attention via regulatory guidance.

7.2 The journalism code is essential for a number of reasons, primarily to drive compliance with data protection laws when processing personal data for the purposes of journalism. It seeks to address some of the recommendations of the Leveson Inquiry over the intrusion of journalists into the private lives of individuals; it is not concerned with press standards, but aims to strike a balance between freedom of expression and protection of privacy, and is geared towards providing practical guidance on existing data protection requirements.  It is designed to reflect the special importance of the public interest in freedom of expression and information, which is specifically protected in data protection law, while also protecting privacy.  Publication of the code will support the day to day work undertaken by journalists, and help them to build and maintain public trust with practical advice about effective compliance.

7.3 The code sets out the requirements to process data fairly, lawfully and transparently and the need to comply with certain individuals’ rights, like the rights of access and erasure. But it also explains the circumstances when the journalistic exemption applies - i.e. where personal data is being used for journalism provided that: (a) their activity is “with a view to publication”; (b) they reasonably believe that publishing is in the public interest, having regard to relevant codes of practice and guidance (such as the Editors’ Code of Practice); and c) they reasonably believe that complying with a specific part of data protection law is incompatible with journalism.

7.4 The code will reduce the likelihood of harms that could arise during the processing of personal data by journalists in their day to day work and promote confidence in journalists when processing personal data.  

Explanations

What did any law do before the changes to be made by this instrument?

7.5 For the first time, the DPA 2018 has created a statutory requirement for the ICO to produce a data protection and journalism code, which builds on the previous guidance issued by the ICO in 2014 (the data protection and journalism; a guide for the media). The draft being presented to Parliament is the first time this statutory code has been issued.  It does not impose any additional legal obligations upon those working in the journalism sector, but clarifies and helps journalists ensure they are complying with data protection legislation during their day to day activities.

Why is it being changed?

7.6 As noted above, this is the first time a statutory code on data protection and journalism has been laid before Parliament.  The DPA has set out the requirement for the ICO to produce the code.  The code itself does not make any changes to journalists’ data protection obligations, but reminds them of their existing responsibilities and clarifies current exemptions set out in the DPA. 

What will it now do?

7.7 Once the code has been laid and completed the parliamentary procedure, it gains its “statutory” status.  As such, it can be relied upon as evidence in legal proceedings and carries more weight than “guidance”.  It aims to provide much needed clarity and guidance to journalists and others on how to comply with data protection legislation.

8. European Union Withdrawal and Future Relationship

8.1 This instrument does not relate to withdrawal from the European Union / trigger the statement requirements under the European Union (Withdrawal) Act.

9. Consolidation

9.1 This is the first time that a data protection and journalism code of practice has been prepared under data protection legislation, although it does build upon the previous non statutory guide “Data protection and Journalism:  a guide for the media” which was published in 2014.

10. Consultation outcome

10.1 Under S.124(3) of the DPA, the ICO is required to consult (where considered appropriate) trade associations, data subjects and persons who appear to the Commissioner to represent the interests of data subjects.

10.2 In terms of consultation, the ICO ran an initial call for views in 2019 to ensure that the code was informed, and shaped directly by stakeholder feedback from the start. This was followed by a 12 week public consultation which ended in January 2022, and supplemented by stakeholder workshops, tailored to large organisations, small organisations and other media experts, such as lawyers, academics, campaign groups and civil society. The workshops were attended by 88 stakeholders.  A summary of this public consultation can be found on the ICO’s website.  The ICO have informed us that the most striking feedback from many respondents was that while the code was       generally well-written and helpful to compliance staff and lawyers, it was too long and should be aimed more directly at journalists.

10.3 The ICO considered responses to the first consultation and produced an updated code, which was subject to a second round of public consultation. This concluded in November 2022, with supplementary engagement taking place with key stakeholders including  media representative groups, and those representing data subjects. Responses to the 2nd consultation were considered and incorporated into a revised version, which led to a final round of engagement with key stakeholders. The ICO have informed us that there are no outstanding issues or concerns on the code. 

11. Guidance

11.1 The draft final code was published on the ICO’s website at the same time as it was presented to the Secretary of State.  Although it does not currently have the “statutory guidance” status, it remains a valuable source of information for journalists.  The code contains key information, but is supplemented by associated reference notes, which provides detailed information and background for users.  The draft code will not achieve its “statutory status” until it has been laid before Parliament for 40 sitting days and no resolution has been made. 

11.2 If no such resolution is made, the Information Commissioner must issue the code which then comes into force 21 days after it is issued. 

12. Impact

12.1 There is no, or no significant, impact on business, charities or voluntary bodies.

12.2 There is no, or no significant, impact on the public sector.

12.3 A full Impact Assessment is submitted with this memorandum and published alongside the Explanatory Memorandum on the legislation.gov.uk website.

13. Regulating small business

13.1 The legislation applies to activities that are undertaken by small businesses.

13.2 The journalism code will help those small organisations that undertake journalistic activities understand what they need to do in order to comply with data protection legislation.

14. Monitoring & review

14.1 The approach to monitoring of this legislation is set out in the DPA. 

14.2 A statutory review clause is included in the legislation.  Under section 126(3) of the DPA the Information Commissioner is required to keep the code under review. Before preparing any amendments to the code, the Information Commissioner must consult the Secretary of State and such other persons as the Commissioner considers appropriate. This includes data subjects, persons who appear to the Commissioner to represent the interests of data subjects, and trade associations.

15. Contact

15.1 Kavita Perry at the Department for Science, Innovation and Technology, email: dpenquires@dsit.gov.uk can be contacted with any queries regarding the instrument.

15.2 Owen Rowland, Deputy Director for Data Protection Policy, at the Department for Science, Innovation and Technology can confirm that this Explanatory Memorandum meets the required standard.

15.3 The Rt Hon John Whittingdale OBE MP, Minister of State in the Department for Science, Innovation and Technology can confirm that this Explanatory Memorandum meets the required standard.