skip to content
 

Data Protection Laws and Freedom of Expression: United Kingdom A flag featuring both cross and saltire in red, white and blue

 

Constitutional/Primary Law Background - see also ECHR

Uniquely amongst European liberal democracies, the United Kingdom lacks a written constitution as such and, focusing generally on specific fact scenarios and remedies, has also avoided “those declarations or definitions of rights so dear to foreign constitutionalists” (Dicey, Introduction to the Study of the Law of the Constitution, [1885] (1959), p. 197).  Nevertheless, the Human Rights Act 1998 did grant formal domestic status to those rights set out in the European Convention on Human Rights (ECHR).  From being unique to the UK, granting of formal (and generally high) domestic legal status to the ECHR now extremely common not only amongst monist but also dualist Council of Europe States (for a now somewhat dated overview see Blackburn and Polakiewicz, Fundamental Rights in Europe: the European Convention on Human Rights and its member states, 1950-2000 (2001)).  Nevertheless, in the general absence of a purely internal instrument enumerating a set of rights guarantees, the Human Rights Act has assumed in the UK.  Indeed, the UK Supreme Court has recognised it as one of a number of “constitutional instruments” which are inter alia protected against various forms of implied repeal (HS2 v Secretary of State for Transport and Ors [2014] UKSC 3 at [207]-[208]).

Schedule 1 of the Human Rights Act 1998 protects all substantive ECHR rights including freedom of expression (art. 10) and the right to respect for private and family life (as well as home and correspondence) (art. 8).   Subject to requirements stemming from overriding primary law, section 6 of the Act prohibits public authorities acting in a way incompatible with these rights and section 3 requires all legislation (including primary legislation) “[s]o far as it is possible to do so” to be “read and given effect” in a way compatible with these rights.  Where that is not possible, Section 4 empowers the higher courts to issue a formal Declaration of Incompatibility which does not change the law but under Section 10 does empower the Government to introduce secondar legislation to remedy the inconsistency (a power also available where the European Court of Human Rights likewise rules against the UK).  Finally, Section 12 grants additional protection to freedom of expression especially as regards the granting of relief such injunctions.  It requires that no relief shall be granted unless granted unless a court (including a tribunal) is satisfied that the applicant has taken all practical steps to notify the respondent or there are compelling reasons why there should be no notification.  It also prohibits relief prior to trial unless the court is satisfied that the applicant “is likely to establish that publication should not be allowed”.  Finally, it requires courts to have “particular regard” to the importance of this right and, where the respondent claims or it appears to be the case that the material is journalistic, literary or artistic (or is connected to such material), (i) the extent to which the material either is, or is about to, become available to the public or it is, or would be, in the public interest for the material to be published and (ii) any relevant privacy code.

 

First-Generation Statutory Law

The UK adopted its first Data Protection Act in 1984.
 
Special Expression Derogation
The Act did not contain a derogation in favour of journalism or any other type of special expression.However, a carve-out was established for any “operation performed solely for the purpose of preparing the text of documents” (s. 1(7)) which, in turn, was related to a broader requirement that any in-scope processing be through an operation on data “by reference to the data subject” (s. 1(8)).
 
Broad Expression Derogation
No specific provision adopted. However, an exclusion was provided for any “operation performed solely for the purpose of preparing the text of documents” (s. 1(8)).
 
Personal Exemption
Processing of personal data kept by an individual and concerned only with the management of his personal, family or household affairs or kept by an individual only for recreational purposes were exempted from registration and supervision by the Data Protection Authority (DPA) and also from all data subject rights (s. 33(1)).This effectively amounted to a full exemption.
 
Knowledge Facilitation Framework
It was established that, so long as ‘no damage or distress is, or is likely to be, caused to any data subject’, personal data held for historical statistical and research purposes would not be regarded as having been ‘obtained unfairly by reason only’ that such purpose was ‘not disclosed when it was obtained’ and could be kept indefinitely (Sch. 1, Pt. 2, para. 7).An exemption from reactive transparency (subject access) for data kept for the purpose of preparing statistics or carrying out research was provided but only where the data were not used or disclosed for any other purpose and the results not made available in a form that identified any of the data subjects (s. 33(6)).An exemption from registration and supervision by the DPA for payroll and accounts allow disclosure of information on persons in any employment or office for use in occupational medical research (s. 32(3)(c)).
Parliamentary Debates
Background
The background to the Data Protection Act can be traced back to backbench proposals starting with the Data Surveillance Bill 1969, the work of the Younger Committee on Privacy (1970-72) and the Lindop Committee on Data Protection (1976-78).  In April 1982 a Government White Paper Data Protection: The Government’s Proposals for Legislation (HMSO, 1982) set out two main reasons to legislate – (i) “the threat to privacy posed by the rapid growth in the use of computers, with their ability to process and link at high speed information about individuals” and (ii) that without the law firms operating in the UK could be disadvantaged since when the Council of Europe Data Protection Convention came into force “it will confirm that right of countries with data protection legislation to refuse to allow personal information to be sent to other countries which do not have comparable safeguards”.  It was stated the “[t]he legislation will be designed to impose no greater burden on our resources than is necessary” (p. 1).  The Data Protection Bill (82-83) was introduced into the House of Lords on 21 December 1982 by the Conservative Government and completed its various stages there on 24 March 1983.  Second reading of the Bill took place in the Commons on 11 April 1983 and proceeded as far as Committee stage when the 1983 General Election was called, thereby brining proceedings relating to the Bill to an end.  Shortly into the new Parliament, the Conservative Government introduced a new Data Protection Bill (83-84) in the Lords on 5 July 1983 from where it was sent to the Commons on 3 November 1983.  Second Reading of the Bill took place in the Commons on 30 January 1984 and all stages of the Bill were completed there on 26 April 1984.  The Bill was then sent back to the Lords for consideration of Commons amendments which took place between 6 June and 29 June 1984.  The Royal Assent was given on 12 July 1984.
 
Special Expression Derogation
Notwithstanding that ultimately no special provisions were adopted in this area, issues concerning at least journalists and media organisations were raised a number of times especially in the House of Lords.  During the Commons Committee stage of first Data Protection Bill (82-83) Mr Snape MP on behalf of the Opposition raised fears that a journalist writing copy on a word processor would need to register with the DPA (then styled the Data Protection Registrar).  This was linked to a broader concern that what was called “universal registration” would result in the registrar finding themselves bogged down in day-to-day administration” (HC Standing Committee H, 26 April 1983 at col 70).  David Waddington on behalf of the Government rejected this stating in particular that a journalist would not be so caught, especially as a result of a government amendment making clear that processing merely for preparing documents was excluded (Ibid at col 77).  During the subsequent committee stage in the Lords, Lord Wigoder of the Liberal Party proposed ensuring that subject access replies specified the precise source of personal data (HL Debates, 15 March 1983 vol 440 at col 620).  The Lord Chancellor opposed this for the Government on the basis inter alia that it would require the disclosure of sources held by newspapers within computerised files on individuals (Ibid at col 621).  The Lords committee stage of the Data Protection Bill (83-84) prompted a much more extensive debate.  Prompted by discussions with the British Broadcasting Corporation (BBC), Lord Winstanley of the Liberal Party proposed stating that “data collected from published sources and held in connection with the purpose of publishing by organisations whose primary function is publishing” should be deemed to have been obtained not unfairly and could be kept indefinitely (HL Debates, 21 July 1983 vol 443 at col 1078-79).  Lord Elton on behalf of the Government stated that publishers would be exempt in this way when holding/processing personal data for bona fide “historical, statistical and research purposes”, that insofar another publishing purposes were at issue he could “scarcely image” it would be deemed unfair but that as regards only retaining data as necessary he was “not sure … why publishers should not be subject to [this] principle like everyone else” (Ibid, col 1079-80).  Lord Avebury, also of the Liberal Party, additional raised concerns about application of the accuracy principle stating that it would be absurd if every owner of a “press cutting library” would be required to make corrections in the electronic version so that what was held “is not a verbatim record of what was originally in the newspaper but a bowdlerised version” (Ibid, col 1082-83).  Lord Elton in reply stated that “[t]he broad answer is that [the data] must be as accurate as the purposes for which it is held make appropriate” (Ibid, col 1083).  Lord Winstanley later proposed exempting from subject access “information which is confidential to journalists’ sources” (Ibid at col 1307-08).  Baroness Trumpington for the Government argued an general derogation anyway would mean that journalists would not have to “reveal who has given them the information” but that, even if the disclosable information might make identification deductible, a wider exemption from subject access was unwarranted since (it was argued) “the whole point of the journalist holding the information must be to publish it eventually, when the fear of deduction must be even greater” (Ibid at col 1038-39).
 
Personal Exemption
The original 1982-83 Bill included an exemption from registering personal data held by an individual and when this was concerned only with the management of his personal, family or household affairs.  During the House of Lords Committee stage, Lord Teviot (Liberal Party) expressed unease that this would not exempt individuals and family history societies who store data “not only in relation to themselves and their immediate families but even to remoter members of their families and even to people of the same name” (HL Debates 22 February 1983 vol 439 at col 722).  Lord Elton stated that even if carried out by individuals such activities would indeed not be excluded since the proposed statutory terms “carry with them the very definite sense of administering or controlling functions relevant to the person concerned” (Ibid at 723), whether these be tangible (e.g. sending out birthday cards of time) or intangible (e.g. preserving the cohesion of the family unit).  Nevertheless, he indicated a willingness on behalf of the Government to explore the possibility of some exemption (Ibid at 724).  During the proceedings on the Data Protection Bill (83-84) in the Lords similar concerns were raised including at Third Reading by Lord Mishcon from the Labour Party, the example here being of an individual schoolboy “put[ting] through the school computer the names of the first eleven and the second eleven, and the runs that they had managed to take during the season” (HL Debates 3 November 1983 vol 444 at col 639-40).  Similar concerns were raised during Second Reading in the House of Commons by Peter Lloyd MP, with the example raised being a hypothetical “enthusiastic football captain” who “wrote into the school computer the qualities and attributes of his potential players for his private guidance” (HC Deb 11 April 1983 vol 40 at col. 615).  During the Commons committee stage of the Data Protection Bill 83-84 David Waddington introduced a Government amendment exempting individuals holding data for recreational purposes from the oversight of the registrar.  In doing so he stressed that “with recreational purposes or hobbies the risk of harm is so minimal that it can safety be disregarded” (HC Standing Committee H, 3 April 1984 at col 555-66).  Denis Howell accepted this on behalf of the Opposition Labour Party (Ibid, col 556).  However, later on he raised a different concern (based on advice received from Professor James Fawcett), namely, that the exemption as whole could enable disclosure contrary to the data principles and also a refusal of subject access such as to be contrary to Article 17 of the International Covenant on Civil and Political Rights which safeguarded privacy, reputation and related rights (HC Standing Committee H, 12 April 1984 col 812).  Waddington rejected this stating that exemption was limited to “uses of data for private and family purposes” and that a failure to include it would have led to a greater risk of criticism for “intrusion on personal privacy and the home” (Ibid at col 817).  The Lords subsequently accepted the amendment regarding recreational purposes without dissent (HL Deb 29 June 1984 vol 453 col 1179-80).
 
Knowledge Facilitation Framework
All the main exemptions in this area were included even in the original Data Protection Bill (82-83).  During this Bill’s Lords Committee stage Lord Mishcon of the Labour Party raised concerns that the reference to “research” without qualification might be too wide and tentatively suggested adding “bona fide historical or scientific”.  This was opposed by Lord Elton on behalf of the Government (HL Deb 22 February 1983 vol 439 col 733-34).  As has already been explored above, during the subsequent Bill’s (83-84) Lords Committee passage, Lord Elton suggested that publishers such as the BBC could legitimately make use of these derogations in their activities (HL Debates, 21 July 1983 vol 443 at col 1079-80).  During the Commons Committee stage, Robert Kilroy-Silk (also from the Labour Party) suggested adding “archival” to these purposes noting concerns raised by the Library Association and others who wish to “retain what they regard as the raw material for future academic research or for the writing of history, especially social history” (HC Standing Committee H 23 February 1984 col 180-81).  Responding for the Government, David Waddington argued that the Bill’s current wording “would cover original data that might in the future be of historical interest” but that the concept of archival would be “much more difficult to interpret” (Ibid, col. 181-2).  Later, Kilroy-Silk also tabled a probing amending to exclude “data held solely for bibliographical purposes” (HC Standing Committee H, 3 April 1984, col. 597).  However, giving the example of potentially inaccurate data processed for payments under the public lending right scheme, Waddington also rejected this amendment.
 
The rest of the deliberations focused almost exclusively on medical/health research.  During the initial Bill’s Commons Committee stage Harriet Harman of the Labour Party sought to ensure that data could not be repurposed without data subject consent or statutory authorisation.  She raised concerns that the current Bill would enable health data to be collected for “health” purposes and then “used later for research – with the person identified – but be quite contrary to what the subject is prepared to accept” (HC Standing Committee H 5 May 1983 at col 153).  During the subsequent Bill’s Second Reading in the Commons Dr John Marek (also of the Labour Party) similarly argued that disclosure of medical records should “follow the recommendations in the British Medical Association’s handbook of medical ethics” which according to him provided that absent consent “[a]n individual should be identifiable from data supplied for statistical or research purposes” (HC Debates 30 January 1984 vol 53 at col 78-80).  These proposals were not accepted by the Government, with David Waddington stressing that whilst it was “legitimate to criticise the exemptions as being too wide” the Opposition Members gave the impression that “we were taking away the rights of the individual, when, in fact, we are providing new rights” (Ibid at col 101).  This issue was returned to during the Bill’s Commons Committee stage but without any more success.  During these same proceedings, David Waddington also introduced a Government amendment enabling the payroll and accounts exemption also to be relied upon when limited data was disclosed for the purposes of occupational health research.  The Opposition rejected this, with Kilroy-Silk arguing that such data “should not be disclosed without the knowledge and consent of the person about whom the information is to be disclosed” (HC Standing Committee H 3 April 1984 at col. 551).  However, the amendment was subsequently voted on and carried (Ibid at col 558)
 
 

Second-Generation Statutory Law

The UK adopted a second-generation data protection Data Protection Act 1998 which inter alia transposed Directive 95/46.
 
Special Expression Derogation
The UK Act set out a broadly applicable substantive derogation based on the permissive public interest regarding publication of any journalistic, literary or artistic material, which—pursuant to the controller’s reasonable belief—would be in the public interest (having regard in particular the special importance of the public interest in freedom of expression) and further that compliance would be incompatible with these journalistic, literary or artistic purposes (s. 31(1)). Regarding the public interest, account could be taken of any relevant designated code of practice (s. 32(3)).This substantive test allowed for a derogation from the data quality principles, the proactive direct and indirect as well as retroactive transparency rules, the sensitive information rules, legitimating ground condition and the international data transfer rules but not duty to register processing with the DPA or the criminal prohibition on procuring or obtaining of personal data without authorization of the data controller which remained subject only to a general public interest defence (s. 55). In addition, a complex remedial shield administered through the DPA itself and the tribunal system prohibited both civil and regulatory investigatory or injunctive powers here prior the publication of material (s. 32(4)-(5)).On the other hand, the Act enabled individual claimants to seek compensation for pure distress (s. 13(2)(b)) and for the DPA to provide claimants with assistance where they considered the case to involve a matter of substantial public importance (s. 53).
 
Broad Expression Derogation
No special provision was adopted.
 
Personal Exemption
A full substantive exemption was set out for “[p]ersonal data processed by an individual only for the purposes of that individual’s personal family or household affairs (including recreational purposes) (s. 36)
 
Knowledge Facilitation Provisions
The law provided a qualified exemption for “research purposes” including statistical or historical purposes from the incompatibility, time limits and sensitive data restrictions as well as subject access.This was subject to general condition that processing not cause or be likely to cause substantial damage or substantial distress and that it not be processing to support measures or decisions in respect of particular individuals.The subject access exemption was additionally subject to a requirement that the any results not identify any data subjects and the sensitive data restrictions exemption to a requirement that processing be in a substantial public interest.See section 33 and the Data Protection (Processing of Sensitive Personal Data) Order 2000, paragraph 9. Subject to the general conditions only, data processed for historical purposes manually or even automatically so long as this was not by reference to the data subject were exempt from most of the data protection principles and sensitive data restrictions (Sch. 8, Pt. IV). A further provision separately lifted the sensitive data restrictions for medical purposes including medical research so long as this was subject to health professional or equivalent duties of confidentiality (Sch. 3, para. 8).
 
Parliamentary Debates
Special Expression Derogation
The new provisions in this area were by far most the most contested within the parliamentary process and prompted very extensive discussion during numerous parts of the Bill’s passage.  The formulation included in the initial Bill was broadly equivalent to that finally written in to law and the Labour Government made clear on second reading in the Lords that they were the outcome of extensive discussions with the media “throughout the summer and autumn of last year [1997]” (HL Deb 2 February 1998 vol 585 col 441).  This claim was backed up by the warm support given to the provisions by the chairman of the self-regulatory Press Complaints Commission Lord Wakeham (in contrast to Human Rights Bill which also included provisions on privacy and free speech) (Ibid at col 464).  However, concerns were raised by the Conservative spokesperson Viscount Astor that “every freelance journalist might have to register with the data protection commissioner and that it will be an offence not to do so” (Ibid at col 447) and by Baroness Nicholson of Winterbourne on behalf of the Liberal Democrats that it was vital that there be robust protections for accuracy and for the privacy of private citizens (Ibid at col. 453).  Whilst the first issue was then apparently forgotten, matters related to the other aspects came back periodically during the proceedings but were repeatedly rejected.  During the Lords Committee stage, Lord Williams of Mostyn on behalf of the Government did acknowledge that “simply because the public is interested does not necessarily qualify a story, an article or a comment piece as being in the public interest” (HL Debates 23 February vol 586 col 96) and also indicated that there was the potential for any partial incorporation of self-regulatory codes of practice to be withdrawn through the Secretary of State not providing designation for the code (Ibid col 99).  At Report stage a Government amendment was moved clarifying that, even if such a claim was not raised by the relevant party, the remedial stay on pre-publication proceedings must be applied by a court whenever its conditions appeared present (HL Debates 16 March 1998 vol 587 at col 513-14).   The Government also accepted a Liberal Democrat amendment to make designation of special expression codes of practice subject to affirmative resolution in Parliament (Ibid at col 538-39).  However, more significant Liberal Democrats attempts to strengthen the privacy and accuracy provisions of the Bill which were opposed by the Government (with general Conservative support) (HL Debates 24 March 1998 vol 587 col 1109-1122).   During the Committee stage in the Commons, concerns were raised especially by John Greenway on behalf of the Conservatives with support from Richard Allen from the Liberal Democrats as to the potential over-breath of literary and artistic expression in the absence of either a merits or an explicit necessary to reconcile rights threshold and, in particular, in light of the global and instant nature of electronic publication.  Greenway also raised concerns (evidently shared by the DPA itself) that both its and the tribunal’s mandatory involvement in the pre-publication shields operation was open to abuse and was liable to lead to very lengthy and drawn out processes.  It was therefore suggested that the ordinary courts should be empowered to act in appropriate cases.  However, all these concerns and suggestions were rejected, it being argued that the tribunal would be able to fast-track actions and to empower the ordinary courts could open the door to pre-publication relief (see HC Select Committee D, 12 May 1998 at cols 53-55 and 21 May 1998 at cols 211-229).  George Howarth on behalf of the Government did however stress that even in journalism cases (and in contrast to the special expression shield to civil and purely regulatory action) the defense to criminal prohibition on procuring or obtaining of personal data without authorization depended on a strict demonstration that it “be justified as being in the public interest in all the circumstances of the case” (HC Select Committee D 2 June 1998).
 
Broad Expression Derogation
Except insofar as this was touched on in relation to the scope of artistic and literary expression in an online context, there was no explicit discussion of these issues.
 
Personal Exemption
There was no significant discussion of this provision.
 
Knowledge Facilitation Framework
With the exception of the general provisions on “research purposes” and sensitive data which were came into law via statutory instrument (in 2000), the final provisions in this area were as they were in the Bill originally introduced.  Debate was not extensive.  During the Committee stage in the Lords, Lord Teviot (Conservative) raised the need for those holding “archives or records to which the public have access” to be able to continue “keeping and accepting on deposit ʻsensitiveʼ personal data, albeit under strict conditions”. Lord Williams of Mostyn on behalf of the Government acknowledged that that there would “undoubtedly” be circumstances beyond those enumerated were the substantial public interest required such data to the processed and indicated the “strong preference” of the Government to address these by means of secondary legislation (HL Debates 23 February 1998 vol 586 col 34-5).   During the Report stage, Lord Teviot also suggested an amendment under which any controller would be empowered to “deposit records containing personal data” in an archive open to the public so long the latter “agree[d] to comply with a code of practice approved by the Secretary of State” which, it was indicated, would “doubtless” contain long closure periods.  Teviot indicated the type of records in mind as “membership registers of trade unions or co-operative societies, lists of employees and their wages among business records, and records of the recipients of charities”.  However, Lord Williams of Mostyn on behalf of the Government indicated that the breath of the proposal meant that it was not “capable of being accepted within the terms of the [data protection] directive” (HL Debates 16 March 1998 vol 587 at col 514-17).  During the Committee proceedings in the Commons, doubts were raised by John Greenway supported by Ian Taylor (both Conservative) as to whether in the absence of a clear definition of research the derogations might be misused (rather strangely, Taylor illustrated his point by arguing that “[s]ome things masquerade as history but are in fact investigative journalism”, without apparently being aware the legal provisions for journalism were far more lenient – see above).  It was tentatively suggested that use of the derogation might be subject to individuals having their research credentials or qualifications approved by the DPA.  George Howarth on behalf of the Government rejected this suggestion as being both “bureaucratic and burdensome” and it was withdrawn (HC Standing Committee D, 21 May 1998, col 230).
 
 

Third-Generation Statutory Law

The UK adopted third generation data protection law through the Data Protection Act 2018 and the GDPR. The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019/419 made relevant amendments to UK law in order to implement Brexit.  However, the substance of both instruments has been retained as the Keeling Schedule for the Data Protection Act and for the UK GDPR indicate.
 
Special Expression Derogation
The Act continues with broadly applicable substantive derogations where —pursuant to the controller’s reasonable belief— special expression publication would be in the public interest (having regard in particular the special importance of the public interest in freedom of expression and now also information) and in addition where compliance would be incompatible with the relevant purposes.The definition of special expression is expanded to also include “academic purposes” and the explicit need for processing to be “only” for such purposes is dropped (although it is retained in some of the remedial shields below).In determining the public interest part of the test, controllers are required to take into account any relevant designated codes of practice and guidelines such as the Editors’ Code of Practice (Sch. 1, Pt. 5, para. 26).The Information Commissioner is also charged with drawing up journalism code of practice (s. 124) which, following approval by Parliament (s. 125), must be taken into account by both it and all courts and tribunals whenever they consider it appears relevant (s. 127).A permissive public interest test is also extended to provide a defence to the Act’s main criminal provisions (see s. 170(3)(c), s. 171(4)(c)).The Act continues with a complex remedial shield prohibiting both private civil and regulatory investigatory or injunctive powers here prior the publication of material (s. 176 and 174) and the DPA remains empowered to assist claimants in private civil action where they consider their case involves a matter of substantial public importance (s. 175).In a new departure, a cognate test and the leave of the court is required before an DPA administrative fine can be issued (s. 156(1)-(2)) although otherwise their scope and especially quantum are more far-reaching.New provisions are included requiring the DPA to publish guidance for the public within one year on how to seek redress against media organizations (s. 177), for a government coordinated review every three years on the effectiveness of the media’s alternative dispute resolution procedures (s. 179) and for an ICO review every five years (four in the first instance) into legal and good practice compliance when processing personal data for the purposes of journalism (s. 178).The DPA is additional granted wide-ranging information and audit/assessment powers when carrying out these reviews (the latter being completely unavailable within this area in any other context) (Sch. 17).The scope of the special expression shield does not extend to most of the data integrity provisions including requirements for an impact assessment (although DPA prior consultation is included) or the obligation to pay a fee (or charge) to the DPA as a controller (s. 137) and does not explicit establish priority over the knowledge facilitation framework.However, the Secretary of State is granted a secondary legislative power to expand or retract the list of exempted provisions, subject to an affirmative resolution of both Parliamentary chambers (Sch. 1, Pt. 5, para. 26(7)-(8)).
 
Broad Expression Derogation
No special provision was adopted.
 
Personal Exemption – see GDPR (now UK GDPR), art. 2(2)(c)
Alongside the above, section 142(b)(ii) of the Act grants the DPA powers to demand information which it reasonably requires for determining whether processing is carried out for these limited purposes.
 
Knowledge Facilitation Framework – see also GPDR (now UK GDPR), art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
The Act sets out derogations from all the provisions set out article 89 of the GDPR in relation to scientific or historical research purposes, statistical purposes and archiving purposes in the public interest to the extent that the application of those provisions would prevent or seriously impair the achievement of these purposes. Other than for archiving purposes, the subject access derogation is subject to any results not being in a form which identifies a data subject (see Sch. 2, Pt. 6, para. 27).  A legal basis for processing special and criminal-related data is also established so long as processing is necessary and in the public interest (Sch. 1, Pt 1, para. 4).  In addition, section 19 sets out general safeguards for knowledge facilitation processing, namely, that it must not be likely to cause substantial damage or substantive distress to a data subject and, other than when pursuing medical research approved by a recognised research ethics committee or equivalent, is not carried out for the purposes of measures or decisions with respect to a particular data subject (s. 19).  Finally, a special defence to the Act’s new general criminalisation of reidentifying deidentified data is include for effectiveness testing so long as this not done with the intention to cause, or threaten to cause, damage or distress to a person, is grounded in a reasonable belief in the public interest of the activity and where the person responsible notifies either the DPA or a controller responsible for the (original) de-identification of personal data of the reidentification without undue delay and, where feasible, within 72 hours of being aware of this (s. 172).
Parliamentary Debates
Special Expression Derogation
Although the core substantive and procedural aspects of this derogation remained as originally introduced in the Bill and indeed as in the DPA 1998, there were substantial proceedings on this topic throughout its parliamentary passage.  Drawing on the Leveson Public Inquiry into the Culture, Practices and Ethics of the Press which reported in 2012, these proceedings became increasingly critical of journalistic practices and this spawned some potentially significant changes during the final ʻping pongʼ between the two chambers.  Although this was lamented (see e.g. Lord Black, HL Debates 22 November 2017 at 17.15), there was almost no specific discussion of other areas of special expression.  A partial exception is found in Labour spokesperson’s Liam Byrne MP suggestion during the Commons Committee stage to explicitly establish the priority over the special expression derogation over the knowledge facilitation regime.  This was particularly motivated by a desire to ensure that archives were shielding including not only news archives but also those held within museums and other similar institutions.   The Government’s rejection of this returned to a media focus, arguing that news archives were protected by their referencing in recital 153 of the GDPR and suggesting that further prioritization would risk information such as subscriber data archived by a media organization also falling within the derogation (HC Public Bill Committee, 13 March 2018 col 79).
 
The initial Conservative Government Bill did not contain any exemptions from notification of rectification, erasure etc. (GDPR, art 19), DPA prior consultation (art 36) or data export (art. 44), any specific special expression defences from its core criminal provision and also explicitly limited the scope of the substantive exemptions to situations were processing was only for the special purposes and sought to grant the DPA a new power to determine that “carrying out processing in compliance with a [specified] provision” was “not incompatible with the special purposes” (cl. 164(3)(c)).  Led by Lord Black (executive director of the Telegraph Media Group) these provisions faced criticism as did other clauses including the incompatibility test for derogation (which it was proposed to replace with a reasonable belief that ordinary compliance would be “impractical or inappropriate”), the absence of a reference to news archives and the absence (unlike in the Defamation Act 2013) of a rebuttable single publication rule and one year limitation period (see HL Debates, 13 November 2017 at 22:00).  Whilst the Government continued to defend these other clauses, the Government reversed course on the former provisions proposing changes principally at Report Stage in the Lords (HL Debates, 13 December 2017 at 18:30) but as regards the notification obligation and also requirements to notify data subjects of data breaches (not given emphasis in the debates themselves) at Committee stage the Commons (HC Public Bill Committee, 13 March 2018, col 77).  At the same time, others including notably Baroness Hollins suggested amendments to address what was seen as an undue weight given to freedom of expression in contradiction to the Leveson Inquiry outcome.  In particular, at Lords’ Report stage amendments were moved to ensure that codes approved by the Press Recognition Panel (PRP) (a body established in the wake of Leveson) were recognized in the Bill (by Lord Low in the name of Baroness O’Neill), to establish clear necessity and proportionality tests to the exemption (by Baroness Hollins), to establish (as had been promised as part of a Second Stage Leveson Inquiry) a public inquiry into allegations of breaches of data protection law by or on behalf of news publishers (also by Hollins) and a provision to enable (unless unjust or inequitable) for the costs of court actions in data protection to be assigned to a relevant news publisher where they reasonably could but had not joined a regulator approved by the Press Recognition Panel and the claim could otherwise have been resolved using this regulator’s arbitration scheme (by Lord Attlee).  The amendments for a public inquiry passed 238-209 (HL Debates, 13 December 2017 at 18:50) and for cost apportionment 217-200 (Ibid at 19:10).   These amendments were removed by a single vote on strict party lines (10-9) at Commons’ committee stage (HC Public Bill Committee, 20 March 2018 at col 215).  Modified versions of both amendments were reintroduced at Commons’ Report stage alongside Government proposals for a DPA one-off legal review of journalistic processing and a DPA-coordinated data protection and journalism code of practice.  An attempt was also made to ensure that the Code of IMPRESS (the only newspaper self-regulator recognised by the PRP) was included in the Bill.  A number of Conservatives spoke in favour of the non-government amendments including Dr Andrew Murrison MP who noted that the proposed arbitration scheme of the Independent Press Standards Organisation (the most popular newspaper self-regulator but not approved by the PRP) had only been introduced during the Bill’s passage and Peter Bone MP who noted that it still enabled the exclusion of linked online publications such as MailOnline (HC Debates, 9 May 2018 at 13:49).  However, in contrast to the committee stage, Brendan O’Hara MP stated on behalf on the Scottish National Party that it was unable to support the proposals on costs due to devolution concerns (Ibid at 15:45), and only the non-government amendment for a public inquiry was voted on where it was defeated 295-304 (Ibid at 16:01).  The Government amendments carried without a division.  During the Lords’ consideration of this, Lord Attlee agreed to abandon his provisions on costs but Baroness Hollins pushed forward with an amendment for a public inquiry which carried 252-213 (HL Debates, 15 May 2018 at 18:20).  During further Commons’ consideration, the Government introduced further amendments to give the ICO specific powers when carrying out its journalism review which was made periodic rather than one-off, to introduce a government coordinated periodic review of media alternative dispute resolution and to widen the journalism data protection code to cover not just bare legal compliance but also good practice.  These proposals carried without a division and a proposal to provide for an adjusted version of the public inquiry into past press behaviour was defeated 301-289 (HC Debates, 15 May 2018 at 15:21).  Proceedings then returned to the Lords where, following a short debate (including advocacy for the public inquiry), the Commons version of the Bill was accepted without a division (HL Debates, 21 May 2018 at 16:00).
 
Broad Expression Derogation
Parliamentary debate in this area was only sporadic, piecemeal, generally tangential and somewhat confused.  Thus, during the Lords’ Committee stage, Lord Black argued with specific reference to journalistic and other special expression publishers that they were not informed when an article was delisted within Google or other searches following a data subjects’ appeal to the DPA or given the opportunity to put a case for continued listing.  He suggested an amendment to allow the DPA to consult with the original publisher and to publicise any determination (HL Debates, 22 November 2017 at 15:45).   Meanwhile, when attempting to move his Commons’ Committee amendment to explicitly establish the priority of the special expression derogation over the knowledge facilitation framework (see above), Liam Byrne MP stressed that Labour “wanted to offer an amendment worded hopefully in such a way that, frankly, it excludes Google, Facebook and others from enjoying the exemptions sought here” (HC Public Bill Committee, 13 March 2018 at col 78).  When at Commons’ Report stage Peter Bone MP noted that news publications such as the MailOnline fell outside of self-regulatory alternative dispute proposals, Matt Hancock MP on behalf of the Government stated that “MailOnline is, of course, an online publication, and we are looking at that as part of our internet safety strategy” (HC Debates, 9 May 2018 at 13:49).
 
Personal Exemption
This exemption hardly featured in the parliamentary proceedings.  During the Commons’ committee stage Margot James MP did move amendments to enable the DPA to check whether or not processing was being carried out within the scope of the exemption through requiring information via an information notice.  These were accepted without debate (HC Public Bill Committee, 20 March 2018 at cols 215-17).
 
Knowledge Facilitation Framework
The Bill was little amended in this area and most of the debate here occurred during the initial Lords’ proceedings and focused especially but not only on medical research.   Second Reading concerns included that the GDPR’s definition of consent might be too stringent in the medical research context (Baroness Neville-Jones (Conservative), HL Debates, 30 October 2017 at 17:06) and that the legal grounds for knowledge facilitation activities may be unclear(given that public authorities were denied the opportunity to rely on “legitimate interests” when pursuing their tasks (Lord Patel (Crossbencher), Ibid at 17:18).  Concerns were also raised that the limitation of research to that which was historical or scientific risked (according to the trade body techUK) such research as computer science engineering research (Lord Clement Jones (Liberal Democrats) at HL Debates, 13 November 2017 at 20:45) and that the new criminal provisions on reidentifying deidentified data would stop information security researchers “doing their work” (Lord Stevenson (Labour) at HL Debates, 22 November 2017 at 17:45).  At Lords’ Report stage the Government argued that “research carried out for the benefit of society” will “almost always be seen as a public interest task” (Baroness Chisholm of Owlpen, HL Debates 11 December 2017 at 16:15) and stressed by reference to recital 149 of the GDPR that scientific research was to be interpreted in a broad manner (Lord Ashton of Hyde, HL Debates, 11 December 2017 at 19:30).  Government amendments also clarified that the damage or distress test applied to data subjects rather than individuals per se and established an exemption for approved medical research from the condition that this not be for the purposes of measures or decisions regarding particular data subjects (Lord Ashton of Hyde, HC Debates 11 December 2017 at 21:45).   A later Government amendment introduced a special safeguarded defence for effectiveness testing of deidentification (Lord Ashton HC Debates 13 December 2017 at 20:49).  All these amendments carried without division.  Turning to the Commons, of specific note is the attempt by Liam Byrne to explicitly establish the priority of the special expression derogations over the knowledge facilitation framework which was discussed above.  Finally, it should be recognised that although most of the contributions in both the Lords and Commons were in favour of a more liberal framework for knowledge facilitation, this was not invariably the case.  For example, during the Common Report Stage Dr Sarah Wollaston (Conservative) specifically emphasised concerns regarding medical confidentiality in the context of data sharing including for research arguing that “NHS Digital has the specific duty to robustly stand up for the interests of patients and for the principles of confidentiality” (HC Debates, 9 May 2018 at 17:15).