Popia and the delicate balance between press freedom, freedom of expression and data protection

Last month, the Court of Appeal in the UK upheld the High Court of Justice’s ruling in favour of Duchess Meghan Markle in her claim against British newspaper, Mail on Sunday, following the publication in the newspaper of excerpts from a letter she had sent to her estranged father. In its judgment, the high court found that the content of the duchess’s letter was private and concerned personal matters that were not matters of legitimate public interest, in which she enjoyed a reasonable expectation of privacy. The court also held that the limitation of Mail on Sunday’s freedom of expression was a necessary and proportionate means of protecting the duchess’s privacy.

This is not the first time the British royal family has sued the media to protect their privacy rights. In 2017, a French magazine was ordered by a French court to pay £92,000 to Prince William and Kate Middleton for invasion of privacy after it published topless photographs of Middleton while she was on holiday.

Possibly more interesting, however, was Prince Harry’s lawsuit in Britain in 2019 against Splash News, an international photo agency which used a helicopter to take pictures inside his home. While his wife and sister-in-law succeeded in their respective claims on “traditional” privacy grounds, Prince Harry’s claim against Splash News was not just for breach of privacy but also for a breach of the European Union’s data protection law, the General Data Protection Regulation (GDPR). The matter was ultimately settled before going to trial, with Splash News issuing an apology to the prince.

It is likely that we will see more lawsuits, such as Prince Harry’s, against the media and other publishers on data protection grounds. And with South Africa’s data protection legislation, the Protection of Personal Information Act, 2013 (Popia) coming into force in 2021, it is only a matter of time before plaintiffs consider whether they can use Popia against the media.

Popia assists the media in this regard. Section 7(1) states that the act “does not apply to the processing of personal information solely for the purpose of journalistic, literary or artistic expression to the extent that such an exclusion is necessary to reconcile, as a matter of public interest, the right to privacy with the right to freedom of expression”.

Section 7(2) goes on to state that “where a responsible party who processes personal information for exclusively journalistic purposes is, by virtue of office, employment or profession, subject to a code of ethics that provides adequate safeguards for the protection of personal information, such code will apply to the processing concerned to the exclusion of this Act and any alleged interference with the protection of the personal information of a data subject that may arise as a result of such processing must be adjudicated as provided for in terms of that code”.

As can be seen from the above, processing for the purpose of literary and artistic expression is actually given more leeway than journalistic expression – Section 7(1) excludes literary and artistic expression entirely from the ambit of Popia regardless of whether a separate code of ethics applies to those engaging in literary or artistic expression. Section 7(2), however, states that Popia will not apply to the processing of personal information for the purposes of journalistic expression if those engaging in such expression are bound by a code which provides “adequate safeguards” for the protection of personal information.

The precise ambit of the terms “journalistic expression”, “literary expression” and “artistic expression” is unclear – the terms are not defined under Popia and neither our courts nor the Information Regulator have yet pronounced on the meanings of these phrases.

It is useful in this regard to look to the GDPR for guidance. Like Popia, the GDPR also recognises that the processing of personal information for artistic, literary and journalistic purposes ought to be exempt from the ordinary data protection regulations governing other entities which process personal information – so long as such exemptions are necessary to reconcile the right to the protection of personal information with the right to freedom of expression. While the GDPR does not define the terms “journalistic”, “artistic” or “literary” expression, recital 153 does state that “in order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly”.

In addition, the UK’s Information Commissioner’s Office recently published a journalism code of practice which states that “journalism is not limited to professional journalists and organisations. It may also involve other individuals and members of the public publishing information. This can cover citizen journalism, for example, when individuals publish journalistic material, typically online” and “as a rule of thumb, the more closely an individual’s activity resembles activities traditionally carried out by the print and broadcast media or other clear sources of journalism, the more likely it is to be journalism. For example, if a private individual films an event of public interest, such as a demonstration or the aftermath of a natural disaster, and places the footage online, they may be engaging in journalism.”

It thus appears that while all three terms (“artistic”, “literary” and “journalistic”) ought to be interpreted broadly, expression will be more likely to be considered “journalistic expression” (and thus require a separate code of ethics which deals with the processing of personal information to qualify for a Popia exemption) if it resembles the activities carried out by traditional forms of journalism.

The bottom line is that in all instances, care must be taken when personal information is processed and published by the media and other publishers.  And in order to ensure that the necessary level of care is taken, there should be an appropriate code of ethics, which sets out the safeguards for the protection of personal information. Popia provides useful guidance in this respect – Section 7(3) lists certain factors which will be considered when determining whether a code of ethics provides adequate safeguards for the processing of personal information by journalists or not. These factors include the importance of freedom of expression and the need to balance the public interest in allowing the free flow of information while also safeguarding the protection of personal information, as well as standards of professional integrity for journalists.

What these factors indicate is that the implementation of an appropriate data protection code which governs solely journalistic activities will ensure that the media’s freedom of expression is protected, while also ensuring that this freedom is reconciled and appropriately balanced with the right of data subjects to the protection of their personal information. It will also exempt the media from the onerous obligations under Popia which often conflict with the media’s rights to freedom of expression.

In addition, while such a code will not protect the media against common law privacy claims, it will provide a level of protection against the type of claim launched by Prince Harry on data protection grounds and from the potentially exorbitant data breach fines imposed under Popia. DM

Lavanya Pillay is a senior associate at law firm Webber Wentzel.