Managing data protection risks in the context of sensitive documentaries can be extremely challenging for the media sector, and, to date, there has been little industry guidance or precedent from the Information Commissioner’s Office (ICO) to help companies navigate these issues.
The ICO’s large 2019 fine against production company True Visions Productions (TVP) was a key development, but it also caused surprise and alarm to many in the production business since it seemed unduly harsh. TVP appealed the decision in November 2020 to the First-tier Tribunal (the Tribunal), and, although the fine was not reversed, it was significantly reduced to £20,000 as a result.
In this article, we explain the two decisions and provide some key takeaways for similar productions.
The production in question concerned a programme, Child of Mine (the Programme), which was an observational documentary on stillbirths. The premise was similar to other ‘fly on the wall’ type hospital documentaries, whereby footage would be collected by fixed-rig cameras positioned in various parts of the Maternity Assessment Unit at Addenbrooke’s Hospital in Cambridge (the Hospital). In 2017, TVP installed the cameras with the full permission of the University Hospitals NHS Foundation Trust (the Trust). The aim of the programme was to convey the experience of parents losing a child “from the moment they were given the terrible news that their baby had not survived, through their care and their cycle of grief, and that this would have the most impact in illuminating a difficult and taboo subject which remains something that few people understand or talk about”.
This was therefore always going to involve very sensitive topics and data, and TVP had taken various steps to protect the individuals shown in the footage and had consulted with the Trust on the measures it took.
The initial decision
The ICO issued its monetary penalty notice to TVP in April 2019. Due to the timing of the investigation, the decision was made under the old Data Protection Act 1998 (DPA 1998), now superseded by the General Data Protection Regulation (GDPR) and the UK’s Data Protection Act 2018 (DPA 2018).
There were two key issues in this initial decision: whether the personal data was processed fairly and lawfully, and whether TVP could rely on the journalistic exemption in relation to any of its processing.
1) Fair and lawful processing
The focus for the ICO was the first principle of the DPA 1998: “Personal data shall be processed fairly and lawfully”. The ICO stated that to fulfil this principle, TVP would need to have issued appropriate privacy notices to patients at the Hospital (so they were aware that filming was taking place), and explicit consent should have been collected for the processing of the sensitive data (that is, capturing of the sensitive footage).
TVP explained that footage, although collected automatically (that is, via the CCTV-style camera system mounted in the Hospital rooms being filmed) and without the patient’s initial explicit consent, was not viewed by any member of TVP staff unless and until consent had been provided by the patient concerned. If no consent was provided, the footage would be deleted within days. This meant that, despite lack of consent, there was very little risk to the patient. TVP had deliberately taken this approach since it did not want to cause distress to individuals by asking for consent before they were examined.
The ICO held that this was not fair. It held that there would be no reasonable belief on the part of the patient that there would be fixed cameras in examination rooms, and they would instead expect to have their attention brought to the cameras and notices about filming.
The ICO further held that the only realistic lawful basis for the actual initial filming – including the sensitive data within the footage – was explicit consent, and this had not been obtained. The ICO acknowledged that the filming process had been decided upon following full engagement with the Trust and the Hospital but also pointed out that no records were kept of such discussions, nor were records kept concerning why certain processes were adopted.
Given the ICO’s conclusion that the processing of the personal data was not fair and not lawful, it held that TVP had breached the first data protection principle and issued a fine of £120,000.