The Information Commissioner’s Office (ICO) has unveiled the final version of its much-anticipated Data Protection and Journalism Code of Practice (the Code), following a series of significant revisions to its second draft.

Submitted to the Secretary of State for the Department of Science, Innovation and Technology on 6 July 2023, the Code will come into force following the statutory process laid down by the Data Protection Act 2018. This procedure mandates that the Code is presented to Parliament and approved by both Houses. Once this occurs, the Code will serve as a statutory code that the UK courts and tribunals will be required to take into account when considering data protection issues in legal proceedings. It is intended to complement existing industry codes such as the IPSO Editors' Code of Practice and The Ofcom Broadcasting Code.

The Code is aimed primarily at media organisations and traditional journalists. However, it will also guide data protection officers and ‘citizen journalists’ to understand and meet their legal obligations. Alongside the Code, the ICO has provided practical advice and guidance, which does not form part of the Code but will be of value to those using personal information for journalism.

 What has changed?

After receiving feedback as part of the second consultation from organisations such as Associated Newspapers and the IPSO Editors’ Code of Practice Committee, the ICO made extensive revisions to the Code. Highlights of these amendments include:

  • Streamlining the draft code and cutting it in half to make it more user-friendly;
  • Placing more focus on day to day compliance;
  • Highlighting the journalism exemption and when to apply it in each section;
  • Stressing that the general public interest extends not just to “weightier issues”, but could also cover a wide range of journalistic material including articles focusing on lifestyle, arts, sports and entertainment; 
  • Explaining how the ‘legitimate interests’ lawful basis may be the most appropriate to use for most day-to-day journalism; and
  • Clarifying guidelines on news archives, e.g. that personal information does not become inaccurate if facts emerge after publication.

Did the ICO miss an opportunity?

Unfortunately, due to a lack of consultation responses about its quick guides, including 10 data protection tips for journalists, the ICO decided not to revise and publish these helpful and accessible resources alongside the new Code.

Furthermore, despite receiving feedback from The National Union of Journalists and the Association of Photographers, the ICO did not address the Code’s scant guidance for photographers or videographers, let alone anyone using emerging technologies in the context of journalism.  In some areas, useful guidance such as when photographs may reveal special category data, for example, an individual’s religion or ethnicity, has been removed.

So, where does this leave us?

The ICO’s publication of the Code is undoubtedly a landmark moment for journalism and data protection law. The absence of the quick guides, however, signifies a missed opportunity for presenting this complex information in an accessible format that journalists could use in their day to day work.

Critically, the lack of explicit guidance for photojournalists, videographers and those leveraging emerging technologies indicates a noticeable gap. Looking forward, we hope that the ICO will heed the voices of photographers, videographers and industry innovators to craft more inclusive guidance in future iterations of the Code. By doing so, it will ensure that the Code remains relevant and capable of informing all categories of journalists.