Dear All,

You may have seen the headlines where Dan Evans a former reporter for the News of the World (NOTW) gave sworn testimony that alleges the NOTW held personal information in a safe as leverage in the future. http://www.theguardian.com/uk-news/2014/jan/30/news-of-the-world-safe-stories-hacking

 

My questions are these.

1.     Does the data controller need to destroy this information if the story is no longer viable i.e. the special purposes exemption no longer applies?

2.     Does the data subject have a right to request, under a SAR, a copy of that information? If the special purposes exemption no longer applies?

3.     Does such storage breach, at some point, principle 5? If the special purposes exemption no longer applies?

 

If the claims are true and the material is held in the interest of the news organisation rather than in the public interest, because, obviously, the news organisation cannot by default be the sole guardian or determinant of the public interest, then does it lose its privilege under the special purposes exemption s.32 ?  (It is exempt from all DP principles except 7.)

 

In this court case, would a data subject have to make a claim under s.13 so that the ICO will have to make a ruling under s.45 to declare the special exemption no longer applies. Is anyone aware of that ever being used?  Furthermore, does this raise the question that the press could have material in their “safe” (again this is the sworn allegation in court) that could be used to deter any regulator or any politician from acting?

 

Or would the find it difficult to show damage and distress from the material so a s.13 appeal would be difficult to uphold? If they cannot put in a SAR as section 7 does not apply, is there any way to find out what is held. Or does the organisation have to respond by saying that subject to your SAR the personal data we hold is exempt under s.32 exemption which would follow the ICO’s good guidance.

 

For example, if someone submitted an SAR to a newspaper they would, I would imagine, hold personal data of data subjects that was not covered by s.32. For example, just holding the name of a famous actress or even a member of the public would not itself be covered by s.32? Or am I missing something here? In other words, is s.32 as powerful as national security?

 

Best,

 

Lawrence

 

Principal Information Management Officer

Durham County Council

Room 4/143-148

County Hall

County Durham

DH1 5UF

 

03000 268038