The UK's data protection regulator the Information Commissioner (ICO), has published a revised draft Journalism Code, which is now open for consultation. It sets out recommendations and expectations of those conducting 'journalism' (which has a very broad meaning) and the associated processing of personal data associated.

It has been a very long road to get to this point. The existing Code was published in 2014, which means it pre-dates the General Data Protection Regulation and all the fundamental changes in that legislation, including how the "journalism" exemption can be applied. The ICO prepared a first draft of the new Code which closed for consultation in January of this year. This received widespread criticism (more details can be found in our update here) and so now, unsurprisingly, we have a second draft version. Key points to note are as follows:

• Generally, those in the media and arts will be relieved since the revised Code is better written, clearer and more focused. It is also shorter (down to 60 pages from 93 pages) which is always helpful! The previous version focused too heavily on citizen journalist provisions which were not relevant to most.
• It sets out clear distinctions between what are legal obligations or just recommendations, making it easier to concentrate on the key requirements - described as "must do", "should do" and "could do".
• It generally contains more realistic obligations. For example, a key concern for many companies has been the level of "accountability" required to successfully apply the journalism exemption. The draft Code explains that there could be various means of demonstrating reliance including through policies or written decisions which could even be conducted "at a later stage if more appropriate", which amounts to retrospective compliance. Similarly, it is mentioned that impact assessments can cover general activities and do not have to be done each time personal data is processed. These measures aim to address both accountability (which the GDPR is so heavy on) and practicality (which is key in many fast-paced journalistic scenarios) and the existing tension between the two.
• A negative is that some of the more specific and common industry processing scenarios have been removed and the ICO has resisted calls to address these up front. There is still general language around consent not being appropriate for use in journalism with no explanation as to why (for example, the practical issues faced where consent is withdrawn with respect to a programme that is already broadcasting, and the common myth that consent for data processing can be obtained via a contractual release form). It also leaves a lot still to the discretion of companies which may cause uncertainty. Additionally, the concept of what is "manifestly made public" is a hot topic for the media but the draft Code does not much more than tell organisations to consider matters themselves here (such as the expectations of an offender to privacy some time after a court hearing which is public) and to do what is fair "in the circumstances". This is all rather vague and it was hoped the Code would give more of a steer.
• It is not all good news in terms of documentation either. For example, the draft states that records should be kept regarding journalistic sources for the purposes of accuracy and it arguably strays into content rules by stating that reports should differentiate between fact and opinion when reporting personal data.

Overall, it is an improvement but it will still leave organisations with a lot to consider and digest. The updated draft is testament to the fact that the ICO does take the views of respondents into account, so do submit your feedback to help shape the Code further.

The consultation remains open until 16 November 2022.