While I applaud the BBC for their reporting of the Paradise Papers, they admit that the personal information was obtained from a leaked source. They also keep reiterating that what these organisations and individuals are doing with their tax is not unlawful. In light of this, I’m trying to figure out what the legal basis is for the BBC to processing that names these individuals. Is it in the public interest that they’ve broken no laws or is it an outright abuse of private personal information in an attempt to sensationalise the story.

The story that the BBC should be reporting is the failure of successive governments to implement laws that prevent organisations and individuals from moving their money offshore. Instead, they’ve focussed on the individuals and for this reason, I’ve submitted a complaint to the ICO and I’ve copied in the BBC.

The ICO has specific guidance for journalists and here’s the BBC Editorial Guideline:

BBC Editorial Guidelines

Section 7: Privacy

Private behaviour, information, correspondence and conversation should not be brought into the public domain unless there is a public interest that outweighs the expectation of privacy. There is no single definition of public interest. It includes but is not confined to:

• exposing or detecting crime;
• exposing significantly anti-social behaviour;
• exposing corruption or injustice;
• disclosing significant incompetence or negligence;
• protecting people’s health and safety;
• preventing people from being misled by some statement or action of an individual or organisation;
• disclosing information that assists people to better comprehend or make decisions on matters of public importance.

Have any of these points been satisfied by naming individuals who have done nothing wrong? The guidance goes on to state:

There is also a public interest in freedom of expression itself. When considering what is in the public interest we also need to take account of information already in the public domain or about to become available to the public. When using the public interest to justify an intrusion, consideration should be given to proportionality; the greater the intrusion, the greater the public interest required to justify it.

Is it in the public interest to process leaked personal information about individuals that have done nothing wrong? Is it in the public interest for BBC reporters to use leaked information to confront women in the street and question them about their finances, when they have done nothing wrong? Or has the BBC processed this leaked information to sensationalise an otherwise boring story. We all know that people take advantage but if doing this is not against the law then the story is all about the government’s failure to bring it into law; it’s not about the individuals that take advantage of the lack of laws. And many of these named individuals will likely have accountants to manage their finances and as such, will likely to be unaware. Yet we had the BBC confronting women on their own in the street… what’s that all about?

I’ve submitted a complaint to the ICO and copied in the BBC. I’ve asked the ICO to seek clarification from the BBC as to what the legal basis is for naming individuals whose personal information was leaked, when these individuals, like Lewis Hamilton, have done nothing wrong. I fail to see how the BBC can rely on it being in the public interest because there is no story with regards to the individuals. The story – which is definitely in the public interested in my view, is that we need new laws. I don’t follow Formula One but Lewis Hamilton seems like a nice bloke. I’m sure he does work for charity and I’m sure that lots of kids see him as a role model, so why? Is it just sensationalism?

Update 15.11.2017

I’ve received a response back from the ICO’s Mary Jervis (ENQ0709951). She said:

Thank you for your interest in potential data protection issues with regards to the Paradise Papers incident. 
 
We are aware of this matter and will liaise with our international counterparts as necessary in order to understand whether UK citizen’s privacy rights have been affected.

With regards to the BBC Panorama programme, as I’m sure you are aware there is an exemption for Journalism, Literature and Art. This exemption protects freedom of expression in journalism, art and literature (which are known as the ‘special purposes’).

The scope of the exemption is very broad and it can exempt from most provisions of the DPA.

Should an individual affected raise a concern with us, we will make an assessment as to whether it was likely or not the DPA has been breached in their circumstances.

Hopefully, you can see why I get frustrated with the ICO. It’s their lack of expertise and professionalism. Ms Jervis knows that I’m well aware of the journalism exemption because I pointed it out to her. What she hasn’t done though, is to explain how the exemption applies in the case of Mr Hamilton and others, who were named when they HAVEN’T DONE ANYTHING WRONG!

The exemption exists so that journalists can investigate crimes, injustice, anti-social behaviour etc., without having to worry about being prosecuted by the ICO. But the BBC has stressed that no crime has been committed by the individuals that they’ve named so does the exemption apply or not?

I’ve submitted a case review because Ms Jervis failed to explain whether or not the journalism exemption applies in this case.

Update 26.12.2017

I’ve received a response to the case review. The ICO’s Rob Cole has told me (RCC0712553):

My understanding is that you are clearly concerned that a breach of the DPA has occurred as you don’t think an exemption (namely the journalistic exemption) would apply in the ‘Paradise Papers’ situation. It would seem that you would like us to look into it and give a view whether we think it is likely or unlikely that the BBC has complied. You have raised a number of questions/points about the situation in your service complaint form.

The difficulty is that as far as I’m aware, you were not directly affected by the disclosure and therefore you don’t appear to have any specific evidence other than that which has been in the media and conclusions/deductions that you have made yourself. Ms Jervis responded to the questions you asked, she didn’t conduct an assessment of the processing in question.

As this is a fairly complex situation, to answer the points raised in your service complaint form would necessitate us doing a detailed investigation and assessment of the situation on your behalf. But as you were not directly affected it is difficult to see how this would be an appropriate use of our resources.

In addition I’ve decided not to respond to your questions with general advice on the DPA, as Ms Jervis has already done this and so it’s difficult to see how this would be helpful to you. Also, it’s clear from your service complaint form that you want us to look into this situation in detail rather than be provided with general advice.

As you know section 42 of the DPA allows anyone to ask us to make an assessment of an organisations processing of personal data. Usually this right is exercised by the people directly affected by such processing and so we have detailed information and evidence to make our decision on.

You could ask us to make an assessment about this matter on behalf of those affected, however, for the reasons mentioned above, it would seem unlikely that we’d have enough detailed and direct information to make an informed decision if you did.

That said, in cases such as this, any of the individuals directly affected could ask us to make an assessment and we would look into the matter and give them our conclusion. Or regardless of whether a formal complaint was brought to us, we could also investigate the situation if we felt that there may be DPA compliance issues.

If we found that there were any DPA issues and if we were of the opinion it would promote compliance and fit with our Regulatory Action Procedure, we would also take the action.

Given the above, I don’t accept that we’ve provided you with a poor service or given incorrect advice and am therefore I’m unable to uphold you complaint.

I disagree with Mr Cole that this is a complex situation. The question here, is simple… was it in the public interest to name the individuals whose information was obtained from a leaked source – bearing in mind that these individuals haven’t done anything wrong, or were they named by the BBC as a way of sensationalising the story? If it’s the latter then we’re looking at a very serious abuse in my view. Yet, see how Mr Cole opts to deflect my concerns by informing me that I have to submit a formal complaint under Section 42 DPA. I disagree.

The ICO’s Data Protection Regulatory Action Policy can be viewed here:https://ico.org.uk/media/about-the-ico/policies-and-procedures/1853/data-protection-regulatory-action-policy.pdf. Under the Initiation of regulatory action heading, the ICO’s drivers for initiating and pursuing regulatory action will usually be:

• issues of general public concern (including those raised in the media);
• concerns that arise because of the novel or intrusive nature of particular activities;
• concerns raised with us in complaints that we receive [Section 42 complaint];
• concerns that become apparent through our other activities.

This is a very serious issue and I’ve informed the ICO about this – as a concerned member of the public. I’ve asked Mr Cole to clarify the ICO’s legal basis for refusing to investigate my complaint. Is the Information Commissioner of the view that this is not a serious issue?

Can you see how the ICO manipulates the process? The ICO will say anything to avoid having to deal with this very serious issue.

Update 14.01.2018

The ICO’s Rob Cole has now agreed to pass my complaint to the team that deals with intelligence information (RCC0712553). Why was that so difficult?

The thing is, this case has similarities with Gulati v MGN Ltd – the phone hacking scandal, because it’s about the disclosure of “private” information to the public. To ensure that lessons have been learned, the ICO reasonably needs to determine whether the BBC published private information to the public – purely as a means of sensationalising the story. To make this determination, the ICO will need to satisfy themselves that it was in the public interest for the BBC to disclose private information about individuals who were going about their lawful business.

This is serious stuff and it’s frustrating that the ICO is so reluctant to investigate. All I want the ICO to do is to tell me whether, in their view, it was in the public interest for the BBC to disclose leaked, private, personal data in this case.

Added: 08.11.2017