Whatever the rights and wrongs of the Leveson proposals for press regulation, the Independent Press Standards Organisation is currently the preferred regulator for most newspapers. Even if you think that IPSO shouldn’t be the regulator for press standards and something more rigorous should be, there is no question that for most of the press, IPSO is the preferred choice. This means that an adverse IPSO decision is something to take seriously.
In January 2015, the Lancashire Evening Post published a story about the use of images of children on a Russian file sharing website, which the paper described as a “Russian pervert website” and a “paedophile website”. Because readers would be unable to understand the story without being reminded what children look like, the paper reproduced images of some of the children. The images were small and pixellated, but they were real children whose images had appeared on the site, and the parents were unaware that the paper was publishing them.
One of the children was recognised by family friends, and the mother was alerted (she had originally posted them on Facebook) and contact her. She complained to the paper and received an apology. The paper’s plan to use the images in a follow-up article were abandoned. Unsatisfied, she complained to IPSO, who upheld her complaint that the newspaper had breached her child’s privacy. There is an argument to be had about how much protection anyone can expect once they have posted images of their children onto the internet. I have moments where I sympathise wholly with the average Facebook user, who has been softened up by big internet companies to share every waking moment with the web, and moments where I think that if you don’t want your kids’ pictures to end up on RussianPaedos.com, you should keep them offline. But the Lancashire Evening Post is not a dodgy file sharing hub, it is a newspaper whose license to use personal data and intrude into privacy is based on the public interest. They can’t simply shout ‘public domain’ and then run and hide like a certain charity I could mention.
There is, of course, an journalist’s exemption in the Data Protection Act which is second only to the national security one in terms of its scope. Section 32 removes the requirement to comply with any of the data protection principles if data is being used for journalistic purposes, as long as the data controller (here, the Lancashire Evening Post) reasonably believes that publication is in the public interest, and complying with the relevant principle is ‘incompatible’ with the public interest in publication.
The exemption isn’t absolute – if it is possible to publish and comply without the two coming into conflict, then the newspaper should do so. Nevertheless, It’s not hard to see why journalists routinely publish information without (for example) informing subjects, without allowing them a right or subject access, or meeting a data protection condition. The exemption is designed to prioritise freedom of expression over privacy, like it or not. However, in this case, I don’t think the exemption could possibly apply.
Most importantly, the Lancashire Evening Post’s failed defence against the mother’s complaint is that the image was not identifiable: “It strongly denied that the child was identifiable from the photographs“. Given that this story starts with the mother’s friends recognising the child from the published image, this is clearly nonsense. If it wants to use a pixellated image of a real child, the onus is on the paper to ensure that the child cannot be identified, and in this they clearly failed.
In this case, S32 doesn’t apply. The Post’s argument isn’t that it was in the public interest to publish the image of an identifiable child. I think that argument is impossible to make, because the public interest would surely count against the identification of a child in these circumstances unless the parents consented (and even then, the interests of the child would be more important than the views of the parent). However, the newspaper’s case is the image wasn’t identifiable, and they have been found to be wrong, firstly by what happened in the real world, and secondly by the independent press regulator.
It won’t happen, and I doubt my call for journalists to be punished for something will generate much support, but this case presents an opportunity for the Information Commissioner to take some action – even if the mother does not complain, there is nothing to stop the ICO from getting involved. The Wilmslow business model is based on a production line of undertakings and (occasionally) civil monetary penalties against public sector bodies who have reported themselves for losing data or sending it to the wrong place. This convinces everybody (most notably, the ICO itself), that this is where the problem lies. That’s not to say that the public sector doesn’t have a problem, it’s just that every sector has the same or a bigger problem and the ICO doesn’t do much about all the others. When newspapers publish inconvenient and embarrassing information about people, data protection isn’t supposed to get in the way. But when newspapers unnecessarily screw up, they should face the same scrutiny as councils and health bodies. The ICO does not have a proud track record of taking on the press when they act unlawfully. The Lancashire Evening Post doesn’t pretend that identification of this child was necessary or relevant, so there is no reason at all why they should not be investigated. This would have two benefits – firstly, it would remind all those who publish data that the public interest in freedom of information does not excuse sloppy data handling, and secondly, it would show that the Commissioner has more imagination than simply chasing another misdialled fax number in the hope of a press release.