The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Case Study 6

News of the World: Limits of the Media Exemption

Breaches of data protection rights of individuals by publication of material in the media, as described in last year's annual report, remained an issue during 2006. I made two separate decisions in the course of the year that newspapers had breached their obligations under the Data Protection Acts. One such case involved the Sunday World. The other, described below, involved the Irish edition of the News of the World. Both cases involved the publication of information about children of well-known individuals.

I received a complaint on behalf of a data subject, a well-known individual, arising from material published in the News of the World (Irish edition) in 2005. The complaint related to the subject matter of the material published and the manner in which it was obtained. The material published consisted of a photograph of the data subject and child while shopping, together with related text expressly identifying the data subject's child by name and age, and referring to a third party's perception as to how parent and child were getting along. The complainant alleged that consent was neither sought nor obtained prior to the taking of the photograph. The complainant further alleged that consent was not sought nor obtained prior to the publication of the material subsequently in the News of the World newspaper. In particular, the complainant alleged that the publication contravened Sections 2(1), 2A (1) and 22 of the Data Protection Acts. The complainant considered that their right to privacy outweighed any purported journalistic purpose or public interest in the publication of their photograph and accompanying text which was the subject of the complaint.

My Office commenced an investigation and wrote to the data controller, News of the World (Ireland). We sought its observations on the alleged contravention of the Acts, in particular in relation to the journalistic exemption contained in Section 22A. This Section provides a "public interest" exemption in respect of the processing of personal data for journalistic purposes. In response the newspaper highlighted that the data subject was a well-known personality who had been the subject of extensive media attention. It claimed that the data subject had, in the past, courted such attention. Given this background, it concluded that there was a public interest in revealing information about the data subject and the parent - child relationship, as illustrated by the photograph and accompanying text. It stated that the information revealed did not constitute sensitive personal data and that, therefore, the conclusion reached by the UK Courts in the case of Naomi Campbell V. MGN Limited - cited as the only authority to date dealing with this particular issue - was not relevant to the present case. It concluded that, in the circumstances, "the article amounted to a publication of journalistic material in the public interest?.that?fall(s) squarely within the exemption provided by Section 22A of the 1988 and 2003 Acts".

The primary issue to be decided in this case was whether the public interest exemption under section 22A of the Acts in respect of processing of personal data for journalistic etc. purposes applied in respect of the publication of the photograph and text relating to the data subject and child. If the public interest in publication exemption applied, then there would be no breach of the provisions of the Data Protection Acts in this case.

I am obliged by Section 3 of the European Convention on Human Rights Act, 2003, to perform my functions in a manner compatible with the State's obligations under the Convention's provisions. Accordingly, in arriving at my conclusion on the applicability of the Section 22A exemption to the facts of the case, I had regard to the provisions of Articles 8 and 10 of the European Convention on Human Rights and any guidance that the EuropeanCourt of Human Rights (ECtHR) had provided on how the rights to privacy and freedom of expression should be balanced - the same balance that was at issue in relation to the applicability of Section 22A of the Acts.

In this regard, I noted the Decision of the ECtHR in the case of Von Hannover v. Germany (Application No. 59320/00) - the Princess Caroline case. The Court held that the German courts, in refusing to grant Princess Caroline of Monaco injunctions against newspapers taking and publishing photographs of her, had infringed her rights under Article 8 of the Convention. The photographs in question had shown Princess Caroline engaged in various activities such as shopping, playing sport and at the beach. The Court, noting that the material related exclusively to details of the applicant's private life, considered that "the publication of the photos and articles in question, of which the sole purpose was to satisfy the curiosity  of a particular readership regarding the details of the applicant's private life, cannot be deemed to contribute to any debate of general interest to society despite the applicant being known to the public." In that case, the Court considered that "anyone, even if they are known to the general public, must be able to enjoy a "legitimate expectation" of protection and of respect for their private life."

While data protection law is not specifically dealt with in the Von Hannover Decision, this case was of assistance in helping me to come to a decision as to the appropriate balance between the public interest in freedom of expression and the individual's right to protection of their personal data, as required by Section 22A of the Acts.

Section 22A(3) of the Acts provides that, in evaluating whether a publication would be in the public interest, regard may be had to codes of practice approved by the Data Protection Commissioner pursuant to the Acts. While no such code has been approved, it seemed appropriate, in reaching a determination, to take note of the newspapers' own codes of practice. In making my assessment, I therefore took account of the National Newspapers of Ireland Code of Practice. In relation to children, the Code provides that they should not be identified unless there is a clear public interest in doing so. Relevant factors are identified as the age of the child, whether there is parental permission, and whether there are circumstances that make the story one of public interest, "or, if the person is a public figure or child of a public figure, whether or how the matter relates to his/her public person or office." I also noted that the UK Press Complaints Commission Code of Practice provides that editors must not use the fam e of a parent as sole justification for publishing details of a child's private life and that "in cases involving children under 16, editors must demonstrate an exceptional public interest to over-ride the normally paramount interest of the child". I was of the view that these provisions  represent a fair expression of how the principles of data protection legislation ought to be applied in relation to children and minors.

In coming to my decision, I also noted the allegation, which was not refuted by the data controller, that the photograph was taken without the consent of the data subject. I issued a Decision on this case under Section 10(1) (b) (ii) of the Acts. Among other things, I found that it did not appear to me that the public interest claimed by the data controller in publication of the material in question could be such as to justify setting aside the right to respect for a person's private and family life.

I was of the view that the publication of the photograph and text relating to the data subject and child, and the manner of their interaction, could not be justified in terms of the public interest under section 22A. I considered that the material published breached the entitlements of a child to interact with its parent in a normal way without their relationship being made the subject of public comment through publication in a newspaper.

Having therefore concluded that the journalistic exemptions under section 22A did not apply in this case, I considered whether the processing of personal data involved in the obtaining and publication of the material complied with the other provisions of the Acts, especially sections 2 and 2A thereof. On the basis of my examination, my decision was that the personal data relating to the data subject and child was not obtained or processed fairly, as required under section 2(1) (a) and 2A of the Acts.

This case demonstrates that data protection applies even in relation to the publication of material in the media. However, in such cases, the issue to be considered in the first instance is whether a general public interest could be deemed to apply to the publication of the material. If it does then the general requirements of data protection are set aside. However, if no public interest could legitimately be claimed, then the media must have due regard to their data protection obligations.