Data protection and you
ALMOST CERTAINLY all freelance journalists need to register with the Information Commissioner's Office (ICO) as a holder of personal data. This currently costs £35 a year. Back in 2004 we warned against companies that contact you, giving the impression that they are the ICO, but in fact offering to fill out forms for you, for a hefty fee.
Use only ico.org.uk/for_organisations/data_protection/registration
When registering, you must provide the ICO with your address. You must also provide an address at which a "data subject" can serve notice, for example asking what information you hold on them. And who better than the ICO to keep your home address confidential?
You must also:
- be open and honest wherever possible: in general, people should know if you are collecting information about them, and what for, the exception being when that would prevent a story that is in the public interest;
- ensure that information you hold about others is secure - for example by having a strong password on your computer and on your backups;
protect the identities of your confidential sources;
- reply within 21 days to requests to stop using someone's personal data - either agreeing to stop, or explaining why you think their objection is unjustified;
- collect information about someone's health, sex life or criminal behaviour only if you are very confident the public interest overrides their right to privacy;
- obtain information by deception ("blagging") hacking or exploiting poor security only if you can convince a court that this was absolutely necessary in the public interest.
The NUJ aims to issue further advice, including notes on responding to "subject access requests" when the ICO has finished consulting on guidelines for the application of data protection law to journalists and journalism.
We would appreciate information in confidence from members who have had to deal, as freelances, with subject access requests..