The production
The production in question concerned a programme, Child of Mine (the Programme), which was an observational documentary on stillbirths. The premise was similar to other ‘fly on the wall’ type hospital documentaries, whereby footage would be collected by fixed-rig cameras positioned in various parts of the Maternity Assessment Unit at Addenbrooke’s Hospital in Cambridge (the Hospital). In 2017, TVP installed the cameras with the full permission of the University Hospitals NHS Foundation Trust (the Trust). The aim of the programme was to convey the experience of parents losing a child “from the moment they were given the terrible news that their baby had not survived, through their care and their cycle of grief, and that this would have the most impact in illuminating a difficult and taboo subject which remains something that few people understand or talk about”.
This was therefore always going to involve very sensitive topics and data, and TVP had taken various steps to protect the individuals shown in the footage and had consulted with the Trust on the measures it took.
The initial decision
The ICO issued its monetary penalty notice to TVP in April 2019. Due to the timing of the investigation, the decision was made under the old Data Protection Act 1998 (DPA 1998), now superseded by the General Data Protection Regulation (GDPR) and the UK’s Data Protection Act 2018 (DPA 2018).
There were two key issues in this initial decision: whether the personal data was processed fairly and lawfully, and whether TVP could rely on the journalistic exemption in relation to any of its processing.
1) Fair and lawful processing
The focus for the ICO was the first principle of the DPA 1998: “Personal data shall be processed fairly and lawfully”. The ICO stated that to fulfil this principle, TVP would need to have issued appropriate privacy notices to patients at the Hospital (so they were aware that filming was taking place), and explicit consent should have been collected for the processing of the sensitive data (that is, capturing of the sensitive footage).
TVP explained that footage, although collected automatically (that is, via the CCTV-style camera system mounted in the Hospital rooms being filmed) and without the patient’s initial explicit consent, was not viewed by any member of TVP staff unless and until consent had been provided by the patient concerned. If no consent was provided, the footage would be deleted within days. This meant that, despite lack of consent, there was very little risk to the patient. TVP had deliberately taken this approach since it did not want to cause distress to individuals by asking for consent before they were examined.
The ICO held that this was not fair. It held that there would be no reasonable belief on the part of the patient that there would be fixed cameras in examination rooms, and they would instead expect to have their attention brought to the cameras and notices about filming.
The ICO further held that the only realistic lawful basis for the actual initial filming – including the sensitive data within the footage – was explicit consent, and this had not been obtained. The ICO acknowledged that the filming process had been decided upon following full engagement with the Trust and the Hospital but also pointed out that no records were kept of such discussions, nor were records kept concerning why certain processes were adopted.
Given the ICO’s conclusion that the processing of the personal data was not fair and not lawful, it held that TVP had breached the first data protection principle and issued a fine of £120,000.
2) The journalistic exemption
TVP, in its processing of data captured while producing the Programme, sought to rely on section 32 of the DPA 1998, the so-called ‘journalistic exemption’ – similar but not identical provisions can now be found in the DPA 2018 at schedule 2, paragraph 26. The decisions of the ICO and the Tribunal both centred on whether this exemption was engaged.
The journalistic exemption provides that where personal data is being processed for journalistic purposes, certain parts of data protection law (including the first data protection principle) do not apply. The exemption requires fulfilment of a three-part test:
(a) The processing is undertaken with a view to the publication by any person of any journalistic, literary, or artistic material
(b) The data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest
(c) The data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with [journalistic, artistic, or literary purposes]
If the exemption had been fully engaged, then this would have allowed TVP to exempt itself from providing a privacy notice to subjects of filming and/or filming them without their consent.
The ICO held that the first two parts of the test were engaged for filming, in that the processing was taking place with a view to the publication of journalistic material, and the public interest in the Programme was not disputed. Therefore, the decision focused on the final requirement that the data controller – that is, TVP – reasonably believed that compliance with the first principle of the DPA 1998 was incompatible with journalistic purposes (that is, production of the Programme).
It was TVP’s view that complying with the first principle prior to filming would risk distressing patients, distract staff from their duties, and risk delay in provision of medical treatment.
The ICO held that the journalistic exemption did not apply to the processing because there was no reasonable belief on the part of TVP that certain journalistic processing was incompatible with complying with the first principle of the DPA 1998, so part (c) of the exemption was not engaged. The ICO, referencing NT1 v. Google LLC [2018] EWHC 799 (QB), did accept that TVP had subjective belief under part (c) of the exemption, but stated that this was not objectively reasonable, so the exemption fell away:
“If it would unduly risk distress to patients to inform them that they were being filmed and to ask for their consent, it must also be the case that the fact of filming would be likely to distress patients. It is a tacit recognition that had patients been informed of the filming they would have been likely to be distressed and object to it. The simple fact of asking the question would not be the cause of the distress in most cases; it would be knowledge that filming was taking place of a very sensitive moment. Processing of personal data which is distressing is not lawfully rendered less distressing by the means of not informing the data subject that the processing is occurring”.
The appeal
In November 2020, TVP’s appeal was heard in the Tribunal and focused on the extent to which the journalistic exemption was engaged, to allow TVP to dis-apply the first data protection principle, but it also raised some other interesting points and departed from the ICO’s decision in several respects:
TVP had clearly considered the rights and interests of the data subjects
The Tribunal acknowledged the reputation of TVP for producing highly regarded programmes about difficult subjects and for doing so sensitively, and that TVP “was concerned about the mothers, their privacy and their welfare”. TVP accepted clinicians’ advice that alerting a mother to the possibility that her baby might have died was detrimental to her welfare. The Tribunal further noted that TVP “was concerned to make, and did make, a sensitive quality programme that took account of the mother’s interests and did not involve anything that would be detrimental to the mothers or their babies or unethical in terms of his profession of journalism”. Taking this into account, the Tribunal stated that TVP relied on the Hospital’s clinical team to lay down the limits of what was permissible from a medical point of view, always accepting their advice. The Tribunal was satisfied that TVP believed there was nothing more it could do to draw patients’ attention to the filming, while at the same time complying with the directions of clinical staff.
Formal privacy notices were not essential
The judge found that, given the levels of anxiety and concern which expectant parents would be feeling, “the thought that would be uppermost in their minds would be the safety of their unborn child”, and “It is unlikely that they would want to take the time to read notices, even if they registered their presence”. This was an interesting departure from the decision of the ICO, which focussed more closely on the content of the notices. The Tribunal here suggests that the content of the notices was irrelevant as the patients are unlikely to have read them, so other measures would need to be taken to draw attention to the filming.
The journalistic exemption was engaged but only for some of the processing
The Tribunal found that the journalistic exemption was fully engaged for the purposes of collecting consent. This conclusion was based on the fact that TVP always had the protecting of individuals in mind, and took into account various important factors when deciding how the Programme should be produced. This included not viewing recordings without consent and not interfering with clinical judgment on what is in an expectant parent’s best interests (as mentioned above).
The Tribunal found that TVP’s beliefs were reasonable for the purposes of part (c) of the journalistic exemption test, especially because clinicians would not allow TVP to collect explicit consent, as “it was impossible to provide a mother with the necessary information for her to give [explicit consent] without alerting her to the possibility of a stillbirth”, and this was an insuperable problem. This can be contrasted with the ICO’s view that it was not the informing of filming that would be distressing, but the knowledge of filming itself, and that this was not an objectively reasonable belief as to why the first data protection principle could not be complied with.
Looking to the way in which the Programme was produced, the Tribunal stated that “it was not reasonable to believe that collecting the data required could only be achieved in a way that was incompatible with the principle of fairness”, and that TVP should have considered the use of handheld cameras to make expectant parents aware they were being filmed and having their voices recorded, which would have made the data subject aware of the processing of their (potentially sensitive) personal data. Therefore, the journalistic exemption was not engaged for the purposes of fair processing.
Consequently, TVP’s fine was lowered to £20,000 on the basis that the ICO was incorrect in concluding that collection of explicit consent by TVP was compatible with journalistic purposes. The Tribunal did, however, affirm the ICO’s decision that there were other ways to inform patients of the processing to ensure it was fair.
Analysis and key takeaways
On the basis of this decision, we recommend considering the following in relation to similar productions:
1. Transparency and general ‘fairness’
This was a key part of the judgments. The Tribunal suggested using handheld cameras to improve fairness and transparency. However, we do not think this should be taken as meaning such cameras are always needed. There have been many other successful hospital-based programmes produced in recent years using solely fixed rig camera equipment, for example. The Tribunal did not address this or any other industry standards set by such programming, so practical guidance is quite limited in this respect. They key takeaways that can be extracted, however, are:
- Consider whether it is ‘obvious’ enough that filming is taking place, or whether filming may go unnoticed if individuals did not happen to read the filming notices provided. If you are not producing your programme with handheld cameras, are there other ways to achieve ‘fairness’ (for example, very clear filming notices and visible production staff)?
- Are you producing in accordance with established industry standards for similar programming? Have you considered how programming of this type is produced generally, and the ways in which such programming complies with data protection requirements?
2. Accountability and documentation
The Tribunal made clear that prior to production, consideration and assessment of the implications of data protection laws is important. TVP was hampered in its defence by the fact that there was little evidence of such decision-making and the considerations they had taken into account. It is important to note that the previous data protection regime placed less emphasis on accountability compared to the GDPR today. Under the DPA 1998, there was no explicit principle of accountability. However, in the new world of data protection, there is an explicit requirement under GDPR that controllers are able to demonstrate compliance with their obligations. Therefore, we would expect this issue of documentation and evidence to be even more critical moving forward. Specifically:
- Always document your decisions as to why a certain approach has been taken, including the ways in which the risk to data subjects has been mitigated. This includes considering alternative means of producing the programming (such as handheld cameras) and, if they are not viable, an explanation of why they are not. Typically, this would involve completing a data protection impact assessment, where required by Article 35 GDPR.
- If you wish to rely upon the journalistic exemption, ensure not only that the test set out in the DPA 2018 has been considered and engaged but also that you have documented this analysis. Be careful to analyse incompatibility against each GDPR requirement seeking to exempt. The ICO has yet to publish a journalism code of practice under the GDPR, however existing guidance under the previous regime remains a helpful resource.
Although helpful in many respects, it is always worth remembering that decisions of the First-tier Tribunal do not bind the Tribunal or the ICO, and are binding only on the parties to a particular case. They are also subject to appeal. Therefore it cannot be said that the ICO will necessarily make further decisions in line with the outcome of the Tribunal’s judgment.
In-depth 2021-043
