Exclusive: Information Commissioner’s Office kisses source protection goodbye
While the Information Commissioner’s Office has already been criticised over its handling and obtaining of a search warrant in the context of its investigation into the disclosure of images of CCTV footage of then Secretary of State for Health and Social Care canoodling with a colleague, we can exclusively reveal the failings in its approach and deficiencies in the information placed before the court when obtaining the search warrant targeting individuals involved in whistleblowing in a political controversy in the context of the most pressing societal challenge of a generation. The Information Commissioner’s Office has admitted that it failed to give consideration at any time during the course of its investigation to the public interest in the protection of journalistic sources, contrary to its obligations.
In light of this and previous failings, we call on the Government to take the opportunity presented by its forthcoming Data Reform Bill to enhance the protections for processing for the special purposes, in particular to ensure that appropriate restrictions are imposed on the Information Commissioner’s enforcement powers when exercised in the context of processing for the special purposes and that the Information Commissioner is not the sole arbiter of when those protections apply.
We implore the Government and Parliament not to approve any statutory Journalism Code which fails to accurately reflect the law and scope of protection for processing for the special purposes or to balance data protection rights against the fundamental right to freedom of expression.
We also call on the Information Commissioner to reflect on the approach taken to this case, to ensure that the right to freedom of expression is understood and applied when exercising his powers.
Background
On 25 June 2021, The Sun published the article ‘IS IT ALL LEGOVER?’ containing images taken from CCTV footage dating from 6 May 2021 inside the Department of Health and Social Care. The images depicted the then Secretary of State for Health and Social Care, Matt Hancock, canoodling with his aide, a personal friend he had appointed to the taxpayer funded role, in his office. It was suggested that the relationship and his conduct appeared to be contrary to the requirements of the Ministerial Code and breached the COVID rules his department was responsible for. At the time, Stage 2 COVID restrictions were applicable in England, which stated that "No person may participate in a gathering... which consists of two or more people and takes place indoors” and while there was an exception for work purposes, this only applied where reasonably necessary. Hugging was banned. Just a week previously, Mr Hancock had cautioned the public against complacency in relation to the rules and shortly after the events emphasised that the public needed to exercise personal responsibility. Mr Hancock had also made clear that he had felt it necessary for a government adviser who had failed to comply with social distancing guidelines to cease their role.
The same day as The Sun’s exposé, Mr Hancock published the following statement: “I accept that I breached the social distancing guidance in these circumstances”. The incident led to widespread opprobrium including from the opposition, with Labour Leader Sir Keir Starmer calling for his resignation, and the matter was discussed in Parliament. Days later Hancock resigned. On 02 June 2021, the Department responded to an urgent Parliamentary question confirming that it had launched an investigation.
The images constituted the personal data of Mr Hancock and his aide.
Information Commissioner's Investigation
On 15 July 2021, the Information Commissioner’s Office published a statement confirming that it was investigating a data breach reported, unusually, by the provider of CCTV and facilities management services to the Department of Health and Social Care, EMCOR Group (UK) plc, a data processor on behalf of the Department. It has subsequently been confirmed to us that the Information Commissioner’s Office was not focused on any specific offence(s), and was investigating whether any offence had been committed under s.170 Data Protection Act 2018 (DPA 2018).
It is a criminal offence, contrary to s170(1)(a) DPA 2018 to disclose personal data without the consent of the data controller, and a further offence to offer to sell (s.170(5)(a) DPA 2018), or to in fact sell (s.170(4) DPA 2018), such data. These are offences triable either way but are punishable only by a fine (s196(2) DPA 2018) and an order for the forfeiture, destruction or erasure of documents or other material (s196(4) DPA 2018).
However, it is a defence to disclosure to prove that the disclosure was “in the particular circumstances… justified as being in the public interest” (s.170(2)(c) DPA 2018), or if the discloser reasonably believed that they had the lawful right to disclose (s.170(3)(a) DPA 2018), or if the person acted for the special purposes of journalism, with a view to the publication by any person of journalistic material and reasonably believed that disclosure was justified as being in the public interest (s.170(3)(c) DPA 2018). Unless the consent of the Director of Public Prosecutions is obtained, criminal proceedings may only be instituted by the Information Commissioner (s.197 DPA 2018).
The statement further confirmed that the ICO had that day conducted searches of 2 residential properties and had seized personal computer equipment and electronic devices. Justifying the action, the Information Commissioner’s Director of Investigations stated “It’s vital that all people, which includes the employees of government departments and members of the public who interact with them, have trust and confidence in the protection of their personal data. In these circumstances, the ICO aims to react swiftly and effectively to investigate where there is a risk that other people may have unlawfully obtained personal data. We have an ongoing investigation and will not be commenting further until it is concluded”.
The then Information Commissioner subsequently emphasised that her office was not “investigating The Sun or journalists” but that in her view “whistleblowers and the public interest turns on us establishing the facts in this case, so it’s important that we go in and we look at the facts and only then will we make a determination as to whether this data breach was in the public interest.”
The Prime Minister Boris Johnson’s Official Spokesman confirmed in the days following the Information Commissioner’s Office’s announcement that the Prime Minister considered The Sun’s publication to be in the public interest. Other politicians followed suit. The Sun went on to win ‘Scoop of the Year’ for its expose at the British Journalism Awards.
At some point on or prior to 06 April 2022, the Information Commissioner’s Office determined that a prosecution could not be pursued. It was not until 13 April 2022, however, the day after the Metropolitan Police confirmed the COVID fines it had issued in respect of the so-called Partygate probe, that the Information Commissioner’s Office issued a statement to the effect that, despite having seized 6 mobile phones in the course of its investigation, it had concluded that there was insufficient evidence to pursue a prosecution against 2 individuals suspected of unlawfully obtaining and disclosing the Department of Health and Social Care CCTV footage and had closed its investigation. The statement went on “Given the seriousness of the report and the wider implications it potentially had for the security of information across government, the ICO had a legal duty to carry out an impartial assessment of the evidence available to determine if there had been a breach of the law”.
In response to the statement the Editor of The Sun, Victoria Newton, commented that “We welcome the closure of this investigation. It should never have been opened, it was an outrageous abuse of state power which risked having a chilling impact on a free press”.
The Information Commissioner’s Office published a further statement on 19 April, supplementing its previous explanation by stating that its investigation was “The investigation was never about a newspaper’s decision to publish the pictures”.
The Information Commissioner's Powers
Schedule 15, paragraph 1 DPA 2018 grants judges the power to issue a warrant to the Information Commissioner if the judge is satisfied by information on oath supplied by the Commissioner that there are reasonable grounds for suspecting an offence has been or is being committed and there are reasonable grounds for suspecting that evidence of the commission of the offence is to be found on specified premises.
On any application for a warrant, being made on an ex parte basis, the applicant has a duty of candour and must make full and frank disclosure and any material non-disclosure will vitiate the warrant (In re Stanford International Bank Ltd [2010] EWCA Civ 137, [2011] Ch 33), with material non-disclosure being determined by considering “whether the information that it is alleged should have been given to the magistrate might reasonably have led him to refuse to issue the warrant” or “might the information that should have been given to the magistrate reasonably have led him or her to refuse to issue the warrant?”
However, paragraph 3 of Schedule 15 DPA 2018 provides that a warrant must not be issued in respect of personal data processed for the special purposes unless a determination under s.174 DPA 2018 has taken effect. The special purposes are defined as “one or more of the following… the purposes of journalism… academic purposes… artistic purposes… literary purposes”. A determination under s.174 DPA 2018 requires the Information Commissioner to determine, and provide written notice of its determination and rights of appeal, that personal data is not being processed only for the special purposes, or is not being processed with a view to the publication of journalistic material which has not previously been published by the controller.
While what constitutes a journalistic purpose is not defined in the Act, the definition is intentionally broad, and (contrary to the impression given by the Information Commissioner in her statement) is not restricted to certain entities or individuals or where the controller of the personal data is the intended publisher to the public. The courts have, however, considered the same phrase in the context of the Freedom of Information Act 2000. In relation to the BBC, the Supreme Court opined that the purposes of journalism incorporated activities including “the collecting, writing and verifying of material for publication”, “the editing of the material, including its selection and arrangement, the provision of context for it and the determination of when and how it should be broadcast”, “the maintenance and enhancement of the standards of the output by reviews of its quality, in terms in particular of accuracy, balance and completeness, and the supervision and training of journalists”, “the actual exercise of broadcasting or publishing the material”, and the maintenance of a library of material “for current reference” (Sugar v BBC [2012] UKSC 4).
The purpose of extending protection to journalism is to protect the fundamental right to freedom of expression, which includes the right to “receive and impart information and ideas without interference by public authority”. The right may be restricted where and to the extent “prescribed by law”, provided this is “necessary in a democratic society in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary”. Any interference must be proportionate to the legitimate aim pursued and the reasons for the interference must be relevant and sufficient. Section 6(1) Human Rights Act 1998 makes it unlawful for a public authority to act in a way which is incompatible with a Convention right.
By contrast, more severe restrictions are imposed on the powers of other law enforcement bodies. Section 8 Police and Criminal Evidence Act 1984 grants magistrates the power to grant search warrants to the police where there are reasonable grounds for believing that an indictable offence has been committed and there is material likely to be of substantial value on the premises which is likely to be relevant evidence and other means of accessing the premises are not appropriate. In relation to journalistic material, which is defined as “material acquired or created for the purposes of journalism” in the possession of someone who acquired or created it for the purposes of journalism, additional protection is in place, and this falls within the “special procedure” at Schedule 1 PACE 1984, which requires that in addition there be no other way of securing the relevant evidence and the public interest in the benefit to the investigation outweighs the public interest in maintaining the integrity of journalism. Journalistic material held in confidence, is defined as “excluded material” and can therefore only be subject to a search warrant in the most serious offences, such as terrorism.
While the Information Commissioner has been granted the right to exercise invasive powers to enter and search premises, they must also be exercised in accordance with public law obligations, the Information Commissioner’s Regulatory Action Policy, Prosecution Policy Statement and the Crown Prosecution Service’s Legal Guidance on ‘Assessing the Public Interest in Cases Affecting the Media’.
The Information Commissioner’s Regulatory Action Policy recognises that its powers must be used “predictably, consistently and judiciously”, and that the objectives of regulatory action include “responding swiftly and effectively to breaches of legislation… focussing on (i) those involving highly sensitive information”, “to be effective, proportionate, dissuasive and consistent, targeting our most significant powers (i) for organisations and individuals suspected of repeated or wilful misconduct or serious failures to take proper steps to protect personal data, and (ii) where formal regulatory action serves as an important deterrent to those who risk non-compliance with the law”. Accordingly, the Policy commits to taking “action proportionately, we will exercise discretion as to when, in what manner, and to what extent enforcement is required”. The Policy contains a non-exhaustive list of criteria to be taken into account when determining whether and how to respond to breaches of information rights obligations. No specific reference is made to whether the processing involved whistleblowing or processing for the special purposes, but does require consideration of the public interest in regulatory action being taken.
The Prosecution Policy Statement provides that “The prosecuting lawyer will provide guidance to investigators throughout the investigation and prosecution stage, to advise on the strength of the evidence and to identify potential deficiencies at an early stage”.
The CPS’ guidance is specifically stated to be relevant to cases involving individuals whose interactions with journalists may have involved the commission of a criminal offence. The Guidance states that Prosecutors are required to take into account the right to freedom of expression and the right to receive and impart information when making decisions which affect the exercise of those rights. It goes on to state that “there will be cases where it is clear, prior to the collection and consideration of all the likely evidence, that the public interest does not require a prosecution. In these cases, prosecutors may decide that the case should not proceed further”. Where an offence provides for an express defence, as s.170 Data Protection Act 2018 does, the guidance requires that “prosecutors must consider what any public interest defence may be, and how it is likely to affect the prospects of conviction”. The Guidance further stipulates that “Prosecutors should take special care in cases which involve the disclosure of journalists' sources”, reflecting the dictum in Goodwin v UK (1996) 22 EHRR 123 paragraph 39 that otherwise “sources may be deterred from assisting the press in informing the public on matters of public interest”.
Failings in the Information Commissioner’s investigation
At Handley Gill, our consultants have significant expertise in the application of data protection legislation and guidance to the processing of personal data for the special purposes of journalism, art and literature. We were concerned by the invasive action taken against multiple individuals who appeared to have been suspected of participating in whistleblowing in the public interest, with a view to bringing criminal proceedings against them for their role as journalistic sources in a political controversy in the context of the most pressing societal challenge of a generation.
To try and understand what justification could exist for such action, we submitted a request for information under the Freedom of Information Act 2000 to the Information Commissioner’s Office. We can exclusively reveal that the response, recently provided to us, demonstrates:
The Information Commissioner’s Office failed to conduct a determination under s.174 Data Protection Act 2018 prior to applying for a search warrant, and therefore either wrongly considered that the personal data was not being processed for the special purposes (adopting an overly narrow interpretation of the law) or failed to comply with its statutory obligations and obtained an order to which it was not entitled.
The Information Commissioner’s Office failed to refer to the public interest in the disclosure of the images and/or any reasonable belief in the public interest in the disclosure of the images in its application for the search warrant, in breach of the duty of candour.
The Information Commissioner’s Office failed to refer to the CPS’ Guidance in its application for the search warrant, in breach of the duty of candour.
The Information Commissioner’s Office has admitted that at no time during the course of its investigation did it give any consideration to the public interest in the protection of journalistic sources, in breach of its obligations under the Crown Prosecution Service’s Legal Guidance on ‘Assessing the Public Interest in Cases Affecting the Media’ and its duty to have regard to and act consistently with the human rights of affected individuals/entities.
We asked the Information Commissioner’s Office for its response to these allegations. It told us that “the ICO has a duty to investigate potential offences within our remit and consider all possible motives for illegally obtaining the personal data of Government employees… An application was made for search warrants, supported by full information. The application was, in our view, properly granted… The Full Code Test, outlined in the Code for Crown Prosecutors, was followed… The public interest stage only has to be considered once the evidential test has been passed; that is, where there is sufficient evidence to justify a prosecution”.
The need for reform
The Information Commissioner’s Office has informed us that “the ICO did not, and would not have considered investigating journalists in relation to this matter. We accept that such individuals would have been processing for the ‘special purposes’, as described in section 174 Data Protection Act 2018 (“DPA 18”) and would have had a defence to a charge under section 170 DPA 18 by virtue of section 170(3)(c)”. The protection of the fundamental right to freedom of expression does not, however, merely apply to journalists and media organisations, and the repeated assertion that journalists were not being investigated in defence of the position fails to address the fact that Article 10 and the protection of journalistic sources relates “not only to the journalist, but also and in particular to the source who volunteers to assist the press in informing the public about matters of public interest” (Nordisk Film & TV A/S v Denmark Application no. 40485/02).
Despite admitting to spending thousands of pounds of public money on external costs relating to this case, the Information Commissioner’s Office has repeatedly demonstrated that it either misunderstands or is unwilling to apply the law and to appropriately balance privacy rights against the right to freedom of expression. In 2013, in the context of a complaint against the NGO Global Witness by Beny Steinmetz regarding its compliance with a subject access request, the Information Commissioner’s Office found that Global Witness was unlikely to have complied with its obligations under the Data Protection Act 1998, effectively finding that Global Witness was not entitled to rely on the exemption for processing for the special purposes of journalism. This position was subsequently corrected but only after proceedings were issued against Global Witness and subject to automatic stay which could only be lifted in the event that the Information Commissioner determined that personal data was not being processed only for the special purposes and had not yet been published. In the appeal against the imposition of a monetary penalty notice in the sum of £120,000 (reduced to £96,000 if paid within a month) by the Information Commissioner against an independent television production company, the Information Commissioner sought to argue that the production company and its staff did not reasonably believe that publication would be in the public interest for the purposes of the legislation. That was rejected, and the penalty reduced to £20,000. More recently, the draft statutory Journalism Code produced by the Information Commissioner’s Office “mis-states the law in certain respects, often in a manner which diminishes the right to freedom of expression and information”, as stated in our response to the consultation.
The Information Commissioner’s attempts to justify the exercise enforcement powers by suggesting there was an obligation to act give further cause for concern since its Regulatory Action Policy says it will focus on cases where regulatory action serves as an “important deterrent”. By its own admission, its actions were intended to have a chilling effect on freedom of expression. The personal data disclosed did not raise issues of national security or breaches of the Official Secrets Act, and the justification for exercise of enforcement powers does not withstand scrutiny.
During Parliamentary debate during the passage of what became the Data Protection Act 2018, Lord Black of Brentwood warned against “the Information Commissioner becoming a statutory regulator of the media” and assurances were given that this would not be the case, but it is the inevitable consequence of the application of its powers.
To ensure that the right to freedom of expression and information is protected, we call on the Government to:
utilise the Data Reform Bill to ensure that the restrictions on the enforcement powers available to the Information Commissioner in the context of processing for the special purposes are no less restrictive than those available to the police;
utilise the Data Reform Bill to reform the gateway to obtaining protection against enforcement in the context of processing for the special purposes so that it is not reliant on the Information Commissioner’s untrammelled assessment, which has been demonstrated to be incongruous; and,
decline to approve any statutory Journalism Code proposed by the Information Commissioner that fails to reflect the law and full scope of legal protections for journalism (including for sources) and appropriately balances these against data protection rights.