Data Protection Act 2018

Journalistic, academic, artistic and literary purposes

26 (1) In this paragraph, “the special purposes” means one or more of the following—

(a) the purposes of journalism;

(b) academic purposes;

(c) artistic purposes;

(d) literary purposes.

(2) Sub-paragraph (3) applies to the processing of personal data carried out for the special purposes if—

(a) the processing is being carried out with a view to the publication by a person of journalistic, academic, artistic or literary material, and

(b) the controller reasonably believes that the publication of the material would be in the public interest.

(3) The listed GDPR provisions do not apply to the extent that the controller reasonably believes that the application of those provisions would be incompatible with the special purposes.

(4) In determining whether publication would be in the public interest the controller must take into account the special importance of the public interest in the freedom of expression and information.

(5) In determining whether it is reasonable to believe that publication would be in the public interest, the controller must have regard to any of the codes of practice or guidelines listed in sub-paragraph (6) that is relevant to the publication in question.

(6) The codes of practice and guidelines are—

(a) BBC Editorial Guidelines;

(b) Ofcom Broadcasting Code;

(c) Editors’ Code of Practice.

(7) The Secretary of State may by regulations amend the list in sub-paragraph (6).

(8) Regulations under sub-paragraph (7) are subject to the affirmative resolution procedure.

(9) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the GDPR (which may be exempted or derogated from by virtue of Article 85(2) of the GDPR)—

(a) in Chapter II of the GDPR (principles)—

(i) Article 5(1)(a) to (e) (principles relating to processing);

(ii) Article 6 (lawfulness);

(iii) Article 7 (conditions for consent);

(iv) Article 8(1) and (2) (child’s consent);

(v) Article 9 (processing of special categories of data);

(vi) Article 10 (data relating to criminal convictions etc);

(vii) Article 11(2) (processing not requiring identification);

(b) in Chapter III of the GDPR (rights of the data subject)—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(iv) Article 16 (right to rectification);

(v) Article 17(1) and (2) (right to erasure);

(vi) Article 18(1)(a), (b) and (d) (restriction of processing);

(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);

(viii) Article 20(1) and (2) (right to data portability);

(ix) Article 21(1) (objections to processing);

(c) in Chapter IV of the GDPR (controller and processor)—

(i) Article 34(1) and (4) (communication of personal data breach to the data subject);

(ii) Article 36 (requirement for controller to consult Commissioner prior to high risk processing);

(d) in Chapter V of the GDPR (transfers of data to third countries etc), Article 44 (general principles for transfers);

(e) in Chapter VII of the GDPR (co-operation and consistency)—

(i) Articles 60 to 62 (co-operation);

(ii) Articles 63 to 67 (consistency).