As the furore around the published photos of Prince Harry continues, the arguments have focused on privacy versus freedom of the press, but is there not another element which needs to be added into the mix? If there is no public interest in the publication of the pictures, then not only is there potentially a breach of Prince Harry’s right to privacy, but there may also be a breach of the Data Protection Act 1998 (“the DPA”) by any newspaper in the UK which publishes the pictures because the “journalistic exemption” within the DPA is not engaged.
The DPA places obligations on organisations when processing personal data¹, as well as giving rights to individuals whose personal data is being processed. The press have argued that the pictures went viral on the internet and are in the public domain and not to be allowed to publish them in the UK impedes the freedom of the press in the UK. While this argument may hold some water, press freedom is not unfettered and when publishing press organisations still need to comply with UK law, including the DPA.
In terms of the DPA, before processing personal data the 8 Data Protection Principles (“the Principles”)² must be complied with, unless an exemption applies. In this instance the press will almost certainly argue that section 32 of the DPA applies in that the publication of the pictures is for the “special purpose” of journalism, art or literature (“the Special Purpose exemption”). If the Special Purpose exemption is met, an organisation may process personal information without having to comply with 7 of the 8 Principles (the 7th Principle regarding security of the data must always be complied with). Additionally, if the exemption is engaged, a press organisation does not need to respond to a request from the individual to stop processing their data as it is causing them damage or distress.
But is the Special Purpose exemption engaged here? To engage the Special Purpose exemption any press organisation needs to jump 3 hurdles set out in the DPA, namely:
- The processing, in this case publication of the pictures, is undertaken with a view to publication;
- The press organisation, having regard to the importance of freedom of expression (in the form of freedom of the press) believes that publication of the personal data is in the public interest; and
- The press organisation reasonably believes that, in all circumstances, compliance with the Principles of the DPA would be incompatible with the special purposes, in this instance journalism.
As mentioned above all 3 hurdles must be jumped for the exemption to apply, if they are not, then the press organisation must comply with the Principles before it can publish the personal data and if it does not, it will breach the DPA and open itself up to enforcement action from the Information Commissioner’s Office (“ICO”) which could include a fine of up to £500,000. Further, if the exemption is not engaged the organisation would be obliged to comply with a request to stop publishing the personal data because of damage or distress which is caused by such publication and finally, the press organisation could face be required to pay compensation for the damage and distress caused by the publication.
Bearing in mind that the DPA only applies to companies in the UK (so could not be used to prevent publication in the US or elsewhere outside the UK), the question has to be does the publication of photos by the UK press meet the requirements of the Special Purpose exemption?
The first hurdle is certainly jumped, the pictures have now been published. It is also probably correct that hurdle 3 would also be jumped, as it is unlikely that if asked Prince Harry would agree to the publication of the photos (consent is one of the ways in which personal data is lawfully processed). Further, it is unlikely that any of the other legal reasons for processing set out in the DPA would apply, especially as the photos might even be argued to comprise sensitive personal data³, (can the pictures give an indication of the Prince’s physical health condition as well as information about his sexual life?) and as such the bar for legal processing is raised higher as sensitive personal data requires that additional legal justification before such data is processed. So yes, hurdle 3 would probably also be jumped by a press organisation.
This leaves only the second hurdle, is it in the public interest to publish the photos? The DPA does not doubt the importance of freedom of the press, but it requires that the press balance that right to expression against public interest in the story being told and as such the right of an individual whose personal data is going to be processed.
So answer this, is it really in the public interest, to see photos of a single, 27 year old off-duty soldier relaxing on holiday in the Las Vegas? Ordinarily the answer would be, no. Does the fact that the soldier is Prince Harry change that answer?
If the answer remains no, that there is no public interest, then before publishing the pictures a press organisation would have to comply with the Principles of the DPA. As advised above, it is unlikely that this would be possible in the current situation. As such, we strongly suspect that publication of the photos without the necessary public interest would be in breach of the DPA. Just food for thought.