The former might have suggested that the existing regime had not been wholly unable to bring the press to account. Whatever the need for the latter, at least it deflected attention from issues of competence and willingness on the part of the enforcing agencies.

The impetus for the royal charter came from the need to appear to be doing something with the recommendations of Lord Justice Leveson in his The Report into the Culture, Practices and Ethics of the Press.

Published a little under one year earlier, the first 47 of the Report’s recommendations concerned a self-regulatory regime for the press.  The next 18 recommendations concerned “the Press and Data Protection.”  The latter have been largely forgotten about in the excitement surrounding the royal charter.  In any event, data protection does little to fire the imagination.  The 18 recommendations would have seen modest changes to the Data Protection Act 1998, essentially putting the press on the same footing as everyone else in requiring them to respect personal information.  This would have restored effective redress for individuals whose personal information had been abused by the press.  The immediate and near universal press reaction was that implementation of Lord Justice Leveson’s data protection recommendations would destroy investigative journalism – which variety of investigative journalism, none of the critics was prepared to say.  The Ministry of Justice also fought the press’s corner, having nothing positive to say about the proposed changes.

Though unfortunate, this reaction carries on a tradition. Described in Campbell v MGN [2003] QB 633 at [72] as “a thicket” and as “certainly a cumbersome and inelegant piece of legislation”, the Data Protection Act 1998 is the ugly relation in the law of privacy. While the Human Rights Act 1998 alchemized the law of confidentiality to protect personal privacy, the Data Protection Act 1998 has been relegated to a backup role: at most, the coda to human right actions of symphonic complexity.  Its occasional appearances in the law reports tell of maverick claims and scornful damages awards.

The Act was born to this. Hansard records an exodus from the House of Lords as Lord Williams of Mostyn commenced his second reading speech for the Data Protection Bill. One must, of course, want to understand in order to understand. For many, data protection is a dark hole, its strange concepts miring previously unhindered activities with needless complexities. That the source of these complexities is thought to be a European Directive only deepens the instinctive hostility. That in fact its origins lie elsewhere – in guidelines on the protection of privacy from the Organisation for Economic Co-operation and Development (OECD), a sober body of economists and technocrats not normally associated with spearheading human rights sentiments – passes unnoticed.

Until recently, personal privacy had not enjoyed much favour in English law. In October 2003, the House of Lords, declaring the law, proclaimed that there was no tort of invasion of privacy. It is true that in Prince Albert v Strange (1849) 2 De G & Sm 652 a court had felt able to protect the plaintiff’s personal privacy without requiring the infringement of any property right. But whether on that occasion the Lady of Justice had a peep at the parties or thought one of them sounded odd, after that she pushed her seat into the fully reclined position. There she remained for 150 years.

When awoken, it was the law of confidentiality that was pressed into serving to protect personal information. With only the name “confidentiality” to unite two distinct causes, it was not long before “privacy” wriggled free from the taxon out of which it had been fashioned and became recognised in its own right. Meanwhile, the Data Protection Act 1998, with its sophisticated treatment of personal information and its carefully thought-out exemptions, was crippled by a series of judgments. After professing all the right things, these judgments variously restricted key rights, enlarged exemptions – most notably that for the press – and denied compensation for anything but pecuniary loss. Conscious that the direction of travel was presenting its own risks, actionability under the Act was equated with actionability under the ECHR. The prosthetic of Article 8 was bolted onto the Act: just enough to enable it to hobble to Convention compliance. The Act did not need this. Its language is naturally Convention compliant. Its structure and the considerations placed within that structure are an embodiment of Convention principles. It is only when dismembered that devices are needed to make it compliant.

Not surprisingly, standard practitioner works treat the Act as adding little practical advantage to the status quo and devote the bulk of their writing to deriving principles from the uncertainties of judge-made law. So it was that most of those whose evidence of press intrusion was heard by Lord Justice Leveson had been without a practical remedy from the very Act designed to protect against the abuse of personal information.

The recommendations of Lord Justice Leveson would restore the Data Protection Act 1998 to Directive compliance and would provide a ready, fair and predictable facility for preventing and compensating press mishandling of personal information.

The focus of those recommendations was the section 32 press exemption. As the section presently reads, it gives the press greater exemption from the protective provisions of the Act (ie the data protection principles) than that enjoyed by law enforcement agencies. That the press believe they need anything of the sort hints at what they feel they must be free to do. The predecessor Act – the Data Protection Act 1984, which was not the product of a European Directive – had no equivalent exemption. Investigative journalism appears to have survived. The provenance of s 32 was Art 9 of the Directive, which requires a balance to be struck between the right to privacy and the right to freedom of expression. But the Directive does not dictate how the balance is to be struck. Lord Wakeham, one-time Chairman of the Press Complaints Commission and a captain of a household name company, was instrumental in its drafting, “steering a sensible path” (he said) “which avoids the perils of privacy law.”  So it does. Section 32 gives a wide berth indeed from the great majority of controls on the handling of personal information imposed by the Act. For good measure, the Act also saves the press from the perils of court claims, with special obstructing provisions that draw any complainant into a procedural labyrinth that leads nowhere.

Lord Justice Leveson recommended trimming the s 32 exemption back into shape. He suggested that it be amended so as to make it available only where the processing of the personal information is necessary for publication of journalistic material, rather than simply being undertaken with a view to publication of journalistic material. The Court of Appeal had stretched the latter phrase as far as the elasticity of language permitted. He also recommended that the exemption should require the organisation to reasonably believe that the publication would be in the public interest. That the press should not self-assess where the public interest lies is, after the evidence given to the Inquiry, unexceptionable. And he recommended that the exemption require that the likely interference with privacy from the handling of a person’s information be outweighed by the public interest in publication.

So amended, the Act would have given those who had appeared before Lord Justice Leveson some chance in bringing a successful claim. It is notable that critics of his data protection recommendations have not pointed to any example of responsible journalism which would have been muffled. It is true that the changes would imperil the activities about which Lord Justice Leveson heard evidence. But given the house cleaning now universally said to have been carried out by those ultimately responsible, one might have expected the press to be pleased for the legislation to be changed so as to keep pace with them.

Lord Justice Leveson also recommended that s 32 not disapply all the protective principles, but be directed to those principles from which exemption is necessary for responsible press freedom.

Importantly, Lord Justice Leveson’s recommendations would rectify the Court of Appeal’s inability to open its eyes to anything other than pecuniary loss. They would enable the Court to see that misuse of personal information can be distressing and, having seen that, to do something about it. Similarly, the procedural obstructions to claims against the press for breach of data protection principles would be removed, putting the press in the same position as everyone else. Lord Justice Leveson recommended far greater involvement by the Information Commissioner, including additional scope to prosecute for breaches of the Act and the laying down of good practice guidelines.

If implemented, the upshot of these recommendations would be to allow those whose personal information has been abused by the press to claim for the distress caused and to do so in a straightforward way. If the Information Commissioner were to issue guidelines on the measure of compensation, the lottery of judicial idiosyncrasy would be reduced. In all, this would give control and certainty to those who have suffered.

The approval of the royal charter does not remove the need to implement the Inquiry’s data protection recommendations. Lord Justice Leveson did not present these as an alternative to those for press regulation. It is not satisfactory to await finding out the shortcomings of having taken half measures. Ignoring the second half betrays the real thoughts of those professing concern. It justifies the European Commission’s proposal to replace the Directive with a directly applicable regulation and a new directive. When these take effect – to predictable outcries – we will do well to remember our domestic inability to engage with the issues.

Philip Coppel QC

Philip practises in commercial, regulatory and public law. The author of Information Rights, 4th ed, Hart, he has a long-standing interest in the law relating to information.  His recommendations to the Leveson Inquiry on data protection were adopted in the Final Report and thereafter roundly rejected by Government and the Press alike: an acknowledgment of their likely efficacy, he says.