With the rise in popularity of reality TV, production companies are going to great lengths to get the next big story. The most recent example of this involves TV Chef Jamie Oliver and his production company Fresh. Fresh provided children with small cameras to secretly film incidents of themselves being bullied while at school. The fact that they did not obtain the school’s consent or the consent of any of the individuals that were filmed gave rise to a number of concerns and led many to ask whether such practices were lawful.

The images and sounds captured of those individuals on film are likely to be within the definition of “personal data” for the purposes of the Data Protection Act 1998 (the “DPA”). Personal data includes any information that can identify a living individual. One of the key facets of the DPA is that the collection, retention, publication and other processing of personal data must be fair and lawful. To be fair, the legal entity responsible for the data processing will usually provide information to inform the reasonable expectations of the affected individuals. This is why we commonly come to expect to be told about all data processing which affects us on a day to day basis.

There are, however, exemptions to these requirements. One of the available exemptions applies to the requirement to provide fair notice to affected individuals where, in summary, personal data is being processed for a journalistic purpose and when there is a reasonable belief that that processing is in the public interest. It can, therefore, be lawful under the DPA to covertly record operations within an institution where it is for a journalistic purpose and in the greater public interest.

Issues arise when those who are undertaking the covert filming are not journalists, for example, the pupil who had the camera attached to her backpack. It is more difficult to show the exemption applies for a purely journalistic purpose when other individuals (who are not journalists) are undertaking the recording (or using the data recorded at a later date). Any personal use or wider sharing of those recordings would be likely to fall outside of the journalistic exemption. It is here that individuals can get caught out and (in many cases, accidentally) find themselves personally in breach of the DPA.

In addition, if such recordings are shared on an institution’s IT systems, the institution itself will be deemed to have collected and retained the personal data contained in the recordings (and again would risk being in breach of the DPA itself by doing so). It is important IT acceptable use policies are in place to help guard against such system misuse.