A key ruling by the Information Commissioner’s Office spells good news for journalists in all their guises. The decision is the latest twist in the on-going saga of Steinmetz and others v Global Witness, a case involving allegations of corruption in Guinea; cash for mines and bribes to presidential wives. The Information Commissioner’s Office (“ICO”) decided in December 2014 that the campaigning non-governmental organisation (“NGO”), Global Witness, can rely on the “journalism” exemption under s 32 of the Data Protection Act 1998 (“DPA”).
Global Witness is a Nobel-prize nominated NGO which investigates and reports on natural-resource related conflict and corruption around the world. Since 2012, it has reported allegations that the international mining company, BSG Resources, run by Israeli diamond magnate, Beny Steinmetz, obtained a mining licence in Guinea by corruption.
Specifically, it is alleged that BSG Resources promised millions of U.S. dollars in bribes to the wife of former president of Guinea, Lansana Conté, for her help in securing the rights to mine at Simandou, a mountain in the remote interior of Guinea which has one of the world’s largest known deposits of untapped iron ore. Critics claim that BSG Resources acquired the rights by pledging to invest U.S.$165 million in Guinea. Shortly afterwards, the company sold half its stake in Simandou for U.S. $2.5 billion, valuing the mining rights at U.S.$10 billion. African telecoms billionaire Mo Ibrahim asked publicly “Are the Guineans who did the deal idiots, or criminals, or both?” BSG Resources has denied any corruption and says it has always acted “to the highest standards of corporate governance”.
On 6 December 2012, Mr Steinmetz submitted a subject access request to Global Witness pursuant to s.7 of the DPA, seeking details of the personal information and data held by Global Witness concerning him, including information as to the source of that data. Global Witness refused the request, firstly on the grounds that it held no “personal data” on Mr Steinmetz: It stated that it held data only relating to BSG Resources or to Mr Steinmetz interchangeably with BSG Resources (i.e. not personal data). Secondly, Global Witness relied on the exemption conferred by s 32 of the DPA for processing data “with a view to journalistic publication”; one of the so-called “Special Purposes” afforded special protection under the DPA.
In December 2013, Mr Steinmetz, together with three others, filed a claim with the High Court, claiming that Global Witness had failed to comply with the requirements of the DPA by not releasing the personal data it held on the individuals further to their Section 7 subject access requests. Significantly, Mr Steinmetz alleged that because he was personally so connected to BSG Resources, any data on it amounted to data on him. The claimants sought damages under Section 13 DPA for loss and distress and orders under Section 7(4), Section 10 and Section 14 DPA requiring Global Witness to cease all processing of personal data it held and to rectify, block, erase or destroy such data as the court held was inaccurate – all claims to which Section 32 DPA would provide a defence, if found applicable to Global Witness.
Global Witness successfully obtained a stay of the claims against it, under Section 32(4) DPA, which requires proceedings involving claims that personal data is being processed for a special purpose to be stayed until that issue is determined by the ICO. The matter was accordingly then passed to the ICO for a possible determination under Section 45 DPA.
Decision under Section 45 DPA
The ICO declined to make a determination under Section 45 DPA. Since a determination is made where the ICO considers that personal data is not being processed only for the special purposes, this effectively means that ICO accepted Global Witness’ submissions that it was processing the data subjects’ personal data only for the special purpose. That means the stay under Section 34(2) of the High Court proceedings remains in place.
The ICO went on to give its assessment under Section 42 DPA regarding Global Witness’ compliance with the DPA when processing the claimants’ personal data. If a data controller is contravening any of the Data Protection Principles, the ICO can issue an enforcement notice under the DPA regime which could still have curtailed Global Witness’ investigation of BSG Resources. The issue for the ICO was to determine whether, under the sixth data protection principle, the claimants’ personal information had been processed by Global Witness in accordance with a data subject’s rights under the DPA. The Claimants had made Subject Access Requests under Section 7 DPA which had been refused by Global Witness, who claimed the exemption under Section 32 DPA.
Assessment under Section 42 DPA
On the basis of all the information provided by the claimants and Global Witness, the ICO decided that it was likely that Global Witness had complied with the requirements of the DPA in these cases. This was because the ICO was satisfied that Global Witness could rely on the exemption under Section 32 DPA.
Four elements needed to be considered:
(i) whether the personal data is processed only for journalism, art or literature (i.e. “the special purposes”);
(ii) whether that processing is taking place with a view to publication of some material;
(iii) whether the data controller has a reasonable belief that publication is in the public interest; and
(iv) whether the data controller has a reasonable belief that compliance is incompatible with journalism.
(i) Whether the personal data is processed only for journalism, art or literature (Section 32(1))
Here, Global Witness had to show that it was only processing personal data requested for the special purposes, i.e. journalism. In other words, the ICO explained, if Global Witness was processing the data for any other purposes as well then the exemption would not apply.
The focus of the test was on the specific data requested and whether it was being processed for the purposes of journalism or some other purpose. Global Witness explained that the personal data requested by the claimants was being processed only for the purpose of reporting on the Simandou controversy, as part of its wider campaign to raise public awareness about issues concerning natural-resources-related corruption around the world.
The ICO referred to its guidance for the media “Data Protection and journalism: a quick guide for the media” in which it was accepted that it was quite possible for non-media organisations to invoke the Section 32 exemption if the purpose of the processing of personal data was to publish “information, opinions or ideas for general public consumption”. This, the ICO said, “constitutes a journalistic purpose even if they are not professional journalists and the publication forms part of a wider campaign to promote a particular cause”.
Therefore, the ICO was satisfied that Global Witness was processing the personal data in question only for the purpose of journalism.
(ii) Whether that processing is taking place with a view to publication of some material (Section 32(1)(a)
The ICO noted that, here, it was not necessary to intend to publish the actual personal data in question. However, Global Witness had to demonstrate that its aim was to publish a story and that the personal data was being processed in connection with that story.
Global Witness said that the personal data was indeed being processed with a view to publication of journalistic material and that this position was supported by the articles that it had already published. Global Witness also said that the Simandou story was ongoing and that it intended to publish further reports as the story unfolded.
The ICO accepted this explanation and was satisfied that the personal data was being processed in order to publish reports about the Simandou controversy.
(iii) whether the data controller has a reasonable belief that publication is in the public interest (Section 32(1)(b)
The ICO emphasised that the onus was on data controllers to make their own independent decisions on whether publication is in the public interest. The test is subjective, rather than objective, subject to an overall requirement that the decision taken by data controllers is reasonable.
Global Witness explained that the personal data had been, and continued to be, processed as part of its journalistic campaign to raise awareness about the Simandou Controversy, which it considered to be “a major corruption scandal and very high profile matter”. Global Witness therefore believed that publication would be in the public interest and that the public interest outweighed the privacy rights of the affected data subjects.
Further, Global Witness said that it did not reveal the intimate details of the data subjects’ private lives; the reports related solely to the data subjects’ professional lives in connection with BSG Resources’ involvement in the Simandou controversy. In Global Witness’s view, the data subjects could have no reasonable expectation of privacy in respect of their professional activities as those activities were directly or indirectly related to the Simandou deal. Global Witness also said that it was “vital” to raise public awareness of the Simandou deal because of its value and because it had been made with the Government of one of the poorest countries in the world.
The ICO’s role was not to decide whether Global Witness’s allegations were true or not. It only had to consider whether Global Witness’s view that publication was in the public interest was reasonable (or not) having regard to the special importance of the public interest in freedom of expression, as well as the individual circumstances of the case.
The ICO found that Global Witness’ belief was not unreasonable. Further, it said, although individuals did not lose their right to privacy when acting in a professional capacity, they should reasonably expect a lower level of privacy than they would expect in relation to their private lives where the issues involved were “relatively high profile”.
(iv) whether the data controller has a reasonable belief that compliance is incompatible with journalism (Section 32(1)(c))
Here again, the test is subjective rather than objective, being predicated on Global Witness’ reasonable belief. Global Witness argued that complying with the data subjects’ rights under Section 7 would have an effect on Global Witness’ journalistic activities because it would give the data subjects details of the nature and direction of its investigation and the data subjects would use this as a strategy to try to thwart Global Witness’ further journalistic activities.
In addition, Global Witness said that compliance would have an impact on Global Witness’ sources or potential sources who would lose confidence in Global Witness’ ability to protect their identities.
The ICO accepted these arguments, finding that Global Witness’s concerns were not unreasonable.
Accordingly, the ICO decided that it was liklely that Global Witness had met all four elements of Section 32 and could therefore rely on the special purposes exemption to decline to comply with the subject access requests.
The decision is good news for journalists whether they operate in a traditional newsrooms or from their bedrooms, since it confirms that the Section 32 exemption for journalism applies to anyone engaged in public-interest reporting, not just the conventional media.
Leigh Baldwin, one of Global Witness’ investigative journalists said:
“It is a victory for press freedom because it defines journalists by what they do, not whom they work for. With non-traditional media playing a growing role in exposing corruption and human rights abuses, all journalists – and their sources – need to know they can rely on the same protections available to the mainstream press.”
According to The Guardian newspaper (22 December 2014), a spokesman for those associated with BSG Resources said: “The ICO has not applied the law correctly and we will be asking the courts to review its decision.”
The ICO’s refusal to make a determination under Section 45 DPA effectively brings to an end Mr Steinmetz and his co-claimants’ High Court claim under the DPA, since the stay will not be lifted. Section 48 DPA does not appear to provide an avenue of appeal against a Section 45 determination, or lack thereof.
If the claimants wish to appeal the ICO’s assessment under s 42 they will have to go to the First Tier Tribunal. The next stage would be to go to the Upper Tribunal and then on to the Court of Appeal.
The ICO’s letter to Global Witness outlining its determination is available on the Global Witness website at http://bit.ly/1CkWsZh