Leveson on Data Protection in the UK: What Do Allegations of Phone Hacking Have to Do With Data Protection?

by BakerHostetler

Editor’s Note: This post is a joint submission to BakerHostetler’s Media Law Bytes & Pieces blog.

The much-anticipated Leveson Inquiry on the Culture, Practices and Ethics of the Press (“Leveson Report” or “Report”) was released on November 29, 2012. The inquiry leading to the Report was initiated as a response to ongoing reports and allegations of systemic phone hacking by the English media.

The 16-month inquiry by Lord Justice Brian Leveson sought evidence from many, including victims and law makers, current and former prime ministers, all leading to the recommendations in the Report. The leviathan tome – nearly 2,000 pages in length – censures the culture of the media in the United Kingdom for faults including its “tendency . . . vigorously to resist or dismiss complainants,” difficulties in securing an appropriate apology or correction, disregard for accuracy, failure of compliance, and—not least of which—an environment that allowed phone hacking to exist. Its calls for the end of the current state of self-regulation of the print media by the Press Complaints Commission (PCC) and for independent oversight is a top-level take-away from its findings. As of December 11th, it is being reported that the replacement to the PCC’s commissioner will be in place in early 2013.

Soon after the issuance of the Report, another story has emerged and seen increased attention, the Report’s potential effect on data protection laws. Lawyers as well as politicians and journalists alike share concerns that the proposed reforms could chill investigative journalism. In addition, some of the proposed reforms would have broader effects beyond the media’s gathering and use of personal data. Overall, the changes seek to significantly strengthen the power of the Information Commissioner’s Office (ICO), particularly in its relation to the press, while narrowing exceptions for the press. In fuller detail, there are at least five significant changes affecting data protection laws called for in the Leveson Report, and a host of recommendations to the ICO. The report seeks to:

  • Narrow an exemption to the UK’s Data Protection Act 1998 (DPA) specific to journalistic use from one where data processing is allowed with a “view to” publication, to one where processing is “necessary” for publication. It would remove language granting special weight to freedom of expression when a data controller considers whether the publication is in the public interest, and it would change the consideration whether compliance with the DPA is incompatible with the purpose of journalism from a subjective belief (the reasonable belief of the data controller) to an objective belief that the likely interference with privacy is outweighed by the public interest in publication.

It also seeks to narrow the set of requirements from which the use is exempted. For example, the data subject’s “right of access” would not be part of the exemption. The Leveson Report is careful to clarify that the proposal to remove the right of subject access from the exemption is not meant to affect the protection of journalists’ sources. However, there does not appear to be any attempt to provide a mechanism to discern when data that is subject to an access request relates to the source, which may present a challenge. The further concern is that such requests could be used to disrupt a journalist’s investigation or obtain information before publication.

  • Clarify that the DPA Provides Compensation for ‘Pure Distress’ In Addition to Pecuniary Loss.
  • Repeal Certain Procedures That Relate to Journalism and Instead Grant More Power to the Information Commissioner. The Report hints that the DPA could be amended to give the power to the Information Commissioner (IC) to decide whether publication is acceptable when there are challenges under the DPA.
  • Permit Imprisonment for Up to Two Years. The Report calls for allowing terms of imprisonment of up to two years for offenses of unlawful obtaining of personal data. The amendment would be applicable generally and not simply to the press. Leveson sees this amendment as a response to the thriving black market in personal data. This amendment was initially halted by lobbying by the press arguing that it would hamstring their ability to conduct investigations. Leveson stresses that a high regard for public interest defenses to this kind of offense should alleviate the concerns of journalists. The Report seeks to bring into force another amendment for such an enhanced defense for public interest journalism.
  • Extend the Prosecution Power of the Information Commissioner’s Office. The Report recommends extending the prosecution powers of the IC to include any breach of the data protection principles outlined in the DPA. It advocates for a new duty for the ICO to consult with prosecutors and reconstituting the ICO with a board of commissioners rather than one IC. The concern here relates to the increased power in the hands of an entire board, which could have an effect on efficiency and independence, particularly where required to consult with prosecutors.

The Report also makes recommendations to the Information Commissioner in its Executive Summary. Among these recommendations, the Report suggests that the ICO take immediate steps to publish policies on its functions as well as guidelines and advice for the press to observe in the process of personal data and for individuals on their rights in relation to the use by the press of their data. It also suggests that the ICO update Parliament on the effectiveness of new measures in its annual report to Parliament, adopt guidelines published in September 2012 for prosecutors on assessing the ‘public interest’ in cases affecting the media, and engage with the police to prepare a long-term strategy in relation to alleged media crime with a view to inclusion of the ICO where appropriate.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© BakerHostetler | Attorney Advertising

Written by:


BakerHostetler on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.