Data protection and you
THE INFORMATION Commissioner's Office (ICO) is consulting on guidelines for the application of data protection law to journalists and journalism. This was one of the recommendations of the Leveson Inquiry into the culture, practice, and ethics of the press.
The deadline for responses is 22 April 2014. The NUJ's Freelance Industrial Council is drafting a response. This notes that the draft guidance does not adequately deal with the increasing proportion of journalists who are freelance and work from home.
It addresses, among other things, the difficulties raised for journalists by the requirement to "delete any details which you no longer need" - how can that be determined? For example, if you have cleared use of someone else's image or text, the correspondence may unpredictably become relevant information under the Act - but you (and your heirs) need to retain it for 70 years after the death of the authors (including illustrators and photographers). It also suggests that the NUJ Code of Conduct be explicitly recognists in the advice alongside the Society of Editors' Code.
Nevertheless, we would appreciate it if members pointed out their own concerns to the ICO, and copied their response to the Freelance editors.
Things you should know now
Almost certainly all freelance journalists need to register with the Information Commissioner's Office (ICO) as a holder of personal data. This currently costs £35 a year.
When registering, you must provide the ICO with your address. You must also provide an address at which a "data subject" can serve notice, for example asking what information you hold on them. And who better than the ICO to keep your home address confidential?
You must also:
- be open and honest wherever possible: in general, people should know if you are collecting information about them, and what for, the exception being when that would prevent a story that is in the public interest;
- ensure that information you hold about others is secure - for example by having a strong password on your computer and on your backups (and keep the latter under lock and key);
- protect the identities of your confidential sources;
- reply within 21 days to requests to stop using someone's personal data - either agreeing to stop, or explaining why you think their objection is unjustified;
- collect information about someone's health, sex life or criminal behaviour only if you are very confident the public interest overrides their right to privacy;
- obtain information by deception ("blagging"), hacking or exploiting poor security only if you can convince a court that this was absolutely necessary in the public interest.
The NUJ aims to issue further advice, including notes on responding to "subject access requests" when the ICO's guidance is finalised. We would appreciate information in confidence from members who have had to deal, as freelances, with subject access requests.