Most people know that UK data protection law gives individuals rights over their personal information. Fewer know that the same law contains a carve-out for journalism, which lets publishers set many of those rights aside when the conditions are met. This article explains how that exemption is built, what a publisher has to be able to show, and what stays in force regardless.
Why data protection law touches the news
Anything written about a named person involves personal data: a name, a job, a photograph, a quotation, a decision about what to include. Gathering and storing that material, before any story is published, is “processing” in the legal sense. If every principle and individual right applied in full, a journalist could be asked to reveal an investigation’s contents to the person under scrutiny, or to delete material because its subject objected.
The law’s answer is a group of “special purposes”: journalism, academic work, art and literature. According to the Information Commissioner’s Office (ICO), processing for those purposes can be relieved of a long list of obligations. The relevant provisions sit in Part 5 of Schedule 2 to the Data Protection Act 2018, at paragraph 26, which is the text the ICO’s guidance explains.
The exemption is not specific to well-known people. It applies to anyone’s data. It matters in the celebrity context because that is where the tension between public curiosity and individual control is most visible.
The three conditions
The ICO’s guide to the exemptions sets out the conditions, and they must all be met “to the extent” the exemption is relied on. In plain terms:
- The processing is done with a view to publication. It must be carried out with a view to the publication of some journalistic, academic, artistic or literary material.
- The publisher reasonably believes publication is in the public interest. In weighing that, the ICO says the controller considers freedom of expression, the specific public interest in the subject, and the potential for harm to individuals. The statute itself refers to the “special importance” of freedom of expression and information.
- The publisher reasonably believes compliance would be incompatible with the special purpose. The ICO says this must be “more than just an inconvenience”.
The word “reasonably” appears twice, and it matters. The ICO states that it does not have to agree with a publisher’s view, but it must be satisfied that the belief was a reasonable one. A belief that was never actually formed, or that no sensible person in the publisher’s position could have held, would not qualify.
Which codes inform the public interest judgement?
When a publisher decides whether publication is in the public interest, the legislation directs it to have regard to any relevant code or guideline from a short list. Paragraph 26 names three: the BBC Editorial Guidelines, the Ofcom Broadcasting Code and the Editors’ Code of Practice. The ICO’s guide repeats the point.
That linkage is significant. Data protection law does not invent its own free-standing definition of journalism’s public interest. It points to the standards that broadcasters and press publishers already work to. Those standards are covered elsewhere on this site: what the Editors’ Code says about privacy explains the press side, and where to take a complaint about media coverage sets out the routes available to readers and viewers.
The Secretary of State has the power to amend the list of codes by regulations, which the legislation says are subject to the affirmative resolution procedure, meaning Parliament must approve them.
What the exemption can switch off
The ICO describes the exemption as capable of relieving a controller of most UK GDPR obligations. According to the ICO, these include:
- most of the data protection principles, with the exceptions below;
- the rules on lawful bases and on consent, including children’s consent;
- the conditions for processing special category data and criminal offence data;
- the right to be informed and most other individual rights;
- breach notification to individuals, prior consultation with the ICO for high-risk processing, and rules on international transfers.
The statute lists the provisions by article number. They include several of the principles in Article 5, the lawful bases in Article 6, the rules on special category and criminal offence data in Articles 9 and 10, the information rights in Articles 13 and 14, the right of access in Article 15, rectification and erasure in Articles 16 and 17, and the right to object in Article 21.
In practice this means that, where the conditions are met, a person generally cannot use a subject access request to find out what a newsroom holds on them while a story is being prepared, and cannot demand erasure of material that is being investigated. That is the point of the exemption: it protects the ability to report before the subject is told.
What it never removes
An exemption this broad would be alarming without limits. Two are worth noting.
The security and accountability principles stay in force. The ICO says these are not disapplied. A newsroom holding sensitive material must still keep it secure and must still be able to show how it complies.
The exemption is not a blanket. It applies only “to the extent” that the conditions are met, and the ICO says a publisher should be able to explain why the exemption was needed in each case, and how and by whom the question was considered at the time. A general policy of relying on it for everything would not meet that standard.
The ICO also notes that rights relating to automated individual decision-making, including profiling, are not among those it lists as disapplied.
Is a famous person treated differently?
The statutory conditions do not mention fame. There is no separate, weaker set of rights for people in the public eye. What changes is the public interest assessment. A person’s role, their own public statements, and the connection between the information and that role all bear on whether publishing is justified, which is the same logic the press code applies to privacy.
The reverse is equally true. Being well known does not remove a person’s data protection rights. It changes how a publisher is likely to weigh the factors, but the publisher still has to hold a reasonable belief and be able to explain it.
A worked example in outline
Consider a hypothetical case with no real people in it. A magazine is preparing a feature about a public body’s spending, and a named official appears in internal documents. The official makes a subject access request while the work is under way.
| Question | How the exemption analysis runs |
|---|---|
| Is the data processed for journalism and with a view to publication? | Yes, if the documents are being gathered for the feature. |
| Is publication reasonably believed to be in the public interest? | Depends on the subject, the official’s role and the potential harm, weighed against freedom of expression. |
| Would complying with the request be incompatible with journalism? | Possibly, if disclosure would undermine the investigation. Mere inconvenience is not enough. |
| What still applies? | Security and accountability obligations. |
If any one answer is no, the exemption does not apply to that item of data. The analysis is done afresh for each case and, according to the ICO, should be recorded.
What readers and subjects can do
Anyone who thinks their data has been mishandled can raise it with the organisation first, using its complaints process and any published data protection contact. The ICO is the UK regulator for data protection and can be approached if the matter is not resolved. Complaints about accuracy or intrusion in published stories run through a different set of routes, the press and broadcast regulators, as set out in the article linked above.
Readers who want a feel for how coverage is assembled may also find it useful to read how to read a celebrity profile, which looks at sourcing and framing from the audience’s side.
Why the design makes sense
The journalism exemption is a trade-off, and it can be defended and criticised. Defenders point out that reporting often depends on confidentiality until publication, and that a right to see or erase everything held would let those under scrutiny stop stories. Critics argue that a broad exemption, applied on a publisher’s own judgement, needs strong checks. The statute’s response is to make the exemption conditional on reasonable belief, tie the public interest test to established editorial codes, and leave a regulator able to ask whether the belief was reasonable.
For a reader, the useful takeaway is simple. Publishers can lawfully do things with personal data that other organisations cannot, but only on stated conditions, and the burden of explaining those conditions rests with the publisher, not the person written about.
This article is general information based on published guidance and is not legal advice. For the current text of the law and the regulator’s guidance, see legislation.gov.uk and the ICO.
Sources: ICO (A guide to the data protection exemptions); legislation.gov.uk (Data Protection Act 2018, Schedule 2, Part 5)
