Last month, the UK Court of Appeal upheld the High Court’s ruling in favor of Duchess Meghan Markle in her case against the British newspaper, Mail on Sunday, following the publication in the newspaper of excerpts from a letter she had sent to her ex-father. In its judgment, the high court found that the content of the Duchess’s letter was private and related to personal matters which were not matters of legitimate public interest, in which she enjoyed a reasonable expectation of confidentiality. The court also held that the limitation of Mail on Sunday freedom of expression was a necessary and proportionate way to protect the Duchess’s privacy.

This is not the first time that the British royal family has sued the media to protect their right to privacy. In 2017, a French magazine was ordered by a French court to pay Prince William and Kate Middleton £92,000 for invasion of privacy after they published topless photos of Middleton while she was on vacation.

Perhaps more interesting, however, was Prince Harry’s trial in Britain in 2019 against Splash News, an international photo agency that used a helicopter to take pictures inside his home. While his wife and sister-in-law won their respective claims on ‘traditional’ privacy grounds, Prince Harry’s complaint against Splash News was not only for breach of privacy, but also for breach of European Union data protection law, the General Data Protection Regulation (GDPR). The case was eventually settled before going to trial, with Splash News apologizing to the prince.

We are likely to see more lawsuits, like Prince Harry’s, against media and other publishers over data protection concerns. And with South Africa’s data protection legislation, the Protection of Personal Information (Popia) Act 2013 coming into force in 2021, it’s only a matter of time before complainants wonder if they can use Popia against the media.

Popia helps the media in this regard. Section 7(1) states that the law “does not apply to the processing of personal information solely for the purposes of journalistic, literary or artistic expression to the extent that such exclusion is necessary to reconcile, in the public interest , right to privacy with the right to freedom of expression”.

Article 7(2) specifies that “where a controller who processes personal information for exclusively journalistic purposes is, by virtue of his duties, employment or profession, subject to a code of ethics which offers guarantees adequate safeguards for the protection of personal information, this Code will apply to the relevant processing to the exclusion of this Act and any alleged interference with the protection of a data subject’s personal information which may result from such processing shall be adjudged in accordance with the provisions of this code”.

As can be seen from the above, processing for the purposes of literary and artistic expression is in fact given greater leeway than journalistic expression – Article 7(1) excludes literary expression entirely and artistic scope of Popia, that a separate code of ethics applies to those who engage in literary or artistic expression. Article 7(2), however, states that Popia will not apply to the processing of personal information for the purposes of journalistic expression if those who engage in such expression are bound by a code which provides “adequate safeguards ” for the protection of personal information.

The precise scope of the terms “journalistic expression”, “literary expression” and “artistic expression” is unclear – the terms are not defined under Popia and neither our courts nor the news regulator have yet ruled on the meaning of these expressions.

It is useful in this regard to consult the GDPR for guidance. Like Popia, the GDPR also recognizes that the processing of personal information for artistic, literary and journalistic purposes should be exempted from ordinary data protection regulations governing other entities that process personal information – so long as these exemptions are necessary to reconcile the right to the protection of personal information with the right to freedom of expression. While the GDPR does not define the terms “journalistic”, “artistic” or “literary” expression, recital 153 specifies that “in order to take into account the importance of the right to freedom of expression in any democratic society, it is necessary to interpret in a broad sense the notions relating to this freedom, such as journalism”.

In addition, the UK Information Commissioner’s Office recently published a Code of Ethics for Journalism which states that “journalism is not limited to professional journalists and organisations. It may also involve other people and members of the public posting information. This can cover citizen journalism, for example, when individuals post journalistic material, usually online” and “generally, the more an individual’s activity resembles activities traditionally carried out by print and broadcast media or other clear sources of journalism, the more likely it is to be journalism. For example, if an individual films an event of public interest, such as a protest or the aftermath of a natural disaster, and posts the footage online, they may be doing journalism.

It therefore appears that if the three terms (“artistic”, “literary” and “journalistic”) are to be interpreted broadly, the expression will be more likely to be considered “journalistic expression” (and will therefore require a code separate ethics code that deals with the processing of personal information to qualify for a Popia exemption) if it resembles the activities carried out by traditional forms of journalism.

The bottom line is that in all cases, care should be taken when personal information is handled and published by the media and other publishers. And in order to ensure that the necessary level of care is taken, there should be an appropriate code of ethics, which sets out safeguards for the protection of personal information. Popia provides useful guidance in this regard – Section 7(3) lists certain factors that will be taken into account in determining whether or not a code of ethics provides adequate safeguards for the handling of personal information by journalists. These factors include the importance of freedom of expression and the need to balance the public interest in allowing the free flow of information while safeguarding the protection of personal information, as well as standards of professional integrity for journalists. .

What these factors indicate is that the implementation of an appropriate data protection code that governs only journalistic activities will guarantee the protection of the freedom of expression of the media, while ensuring that this freedom is reconciled and balanced appropriately with the right of data subjects to the protection of their personal information. It will also exempt the media from the onerous obligations imposed by Popia, which often conflict with the media’s rights to freedom of expression.

Moreover, while such a code will not protect the media against common law claims, it will provide a level of protection against the type of claim launched by Prince Harry for data protection reasons and against potentially exorbitant fines. for breach of data imposed under Popia. DM

Lavanya Pillay is a senior partner at the law firm Webber Wentzel.

Related Articles