The Information Commissioner’s Office (ICO) has published a code of practice about using personal information for journalism (the code), and formally submitted it to the Secretary of State at the Department for Science, Innovation and Technology.
The code provides practical guidance on how to comply with data protection law and good practice when personal information is used for journalism. We also published reference notes to support the code, containing more information about the legislation and case law examples.
The code is limited to the ICO’s regulatory remit for data protection law and does not concern media standards in general. The code is also generally well-aligned with, and is intended to complement, existing industry codes.
Constructive feedback from media organisations, industry representatives, civil society and others has helped shape the code at each stage of the consultation process.
“A free media is at the heart of any healthy democracy – keeping us informed, encouraging debate and opinion, and entertaining us. It is a crucial part of the fundamental right to freedom of expression and information.
“The crucial public interest role served by the media is the reason journalism is covered by data protection law. The law includes important provisions that enable journalism, whilst also protecting people by ensuring that personal information is used lawfully.
“Our code strikes the right balance between supporting journalists’ work and protecting people’s personal information by providing clear and practical guidance on how to comply with data protection law.”
– John Edwards, UK Information Commissioner
Statutory process
The ICO was required by Parliament to produce the code, which builds upon guidance for the media published in 2014 following a recommendation from the Levenson Inquiry.
It is a statutory code under section 124 of the Data Protection Act 2018 (DPA 2018). The ICO formally submitted the code to the Secretary of State for the Department of Science, Innovation and Technology on 6 July 2023.
For the code to come into force, it needs to complete the statutory process set out in section 125 of the DPA 2018 and be laid before Parliament by the Secretary of State. In the meantime, the code will help journalists to understand what data protection law says and how to comply if when using personal information for journalism.
Notes to editors
About the Data protection and journalism code of practice
The second consultation closed in November 2022, following the first consultation in January 2022, and an earlier call for views.
About the ICO
- The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the DPA 2018, the United Kingdom General Data Protection Regulation (UK GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five acts and regulations.
- The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
- To report a concern to the ICO telephone call our helpline on 0303 123 1113, or go to ico.org.uk/concerns.
