The publication of news and other media content often involves the processing of personal data, including names, photographs, opinions and other information relating to identifiable individuals. The Data Protection Act, 2019 (“DPA”) regulates the collection, use, disclosure and other processing of personal data and prescribes the obligations applicable to persons who process such data.
Part VII of the DPA provides exemptions from some of its requirements where personal data is processed for specified purposes. In particular, Section 51 provides an exemption where the processing is undertaken by an individual in the course of a purely personal or household activity, is necessary for national security or public interest, or where disclosure is required by written law or an order of the court. The Data Protection (General) Regulations, 2021 further prescribe the circumstances in which processing may be considered necessary for national security purposes or in the public interest.
In addition, Section 52 of the DPA makes specific provision for the processing of personal data for purposes of journalism, literature and art. In particular, the principles governing the processing of personal data do not apply where the processing is undertaken for the publication of literary or artistic material, the data controller reasonably believes that publication would be in the public interest, and the data controller reasonably believes that, in all the circumstances, compliance with the principles would be incompatible with the purpose of the processing. The public interest exemption applies only where it can be demonstrated that the processing complies with a self-regulatory or issued code of ethics that is in practice and relevant to the publication in question.
Recent determinations of the Data Commissioner considered below, provide important guidance on the application of these exemptions in the context of media publication. In this Alert, we consider three of these determinations and highlight the emerging data protection principles relevant to journalists, media houses and organisations that disclose personal data to the media.
EMERGING PRINCIPLES
1. Journalists and media houses may process personal data without consent where the publication is in the public interest
Section 51(1)(b) of the DPA provides a general exemption from the application of the Act where the processing of personal data is necessary for national security or public interest. Regulations 55 and 56 of the Data Protection (General) Regulations, 2021 further prescribe the circumstances in which processing may be considered necessary in the public interest. In particular, Regulation 56 recognises the processing of personal data for purposes of lessening or preventing a serious threat to the life, health or safety of an individual, or to public health or safety.
The Data Commissioner considered the application of the public-interest exemption in Faith Wavinya v Nation Media Group PLC. The case concerned the publication of the Complainant’s personal data in an article on cigar smoking and the associated health risks. The Data Commissioner found that the publication was in the public interest as it sought to raise awareness of the health risks associated with cigar smoking, particularly among young people.
The public-interest exemption was also considered in Grace Ellah Indoshi & Felistus Khadi Mukami v Hellen Shikanda, Nation Media Group PLC & Board of Management, Sacred Heart Mukumu Girls, In this case, the publication arose from a contamination outbreak at the School which had resulted in student deaths and hospitalisations. The Data Commissioner found that the outbreak presented a serious threat to public health and safety and that reporting on the incident was therefore in the public interest.
These decisions demonstrate that the publication of personal data without consent may be permissible where the processing is necessary in the public interest. In the context of media reporting, this may include reporting on matters involving a serious threat to the life, health or safety of an individual, or to public health or safety.
2. The journalistic exemption is subject to compliance with a relevant code of ethics
Section 52 of the DPA provides an exemption from the principles governing the processing of personal data where the processing is undertaken for publication, the data controller reasonably believes that the publication would be in the public interest and reasonably believes that compliance with the principles would be incompatible with the purpose of the processing. In addition, the exemption on grounds of public interest applies only where the processing complies with a self-regulatory or issued code of ethics that is in practice and relevant to the publication in question.
In Faith Wavinya v Nation Media Group PLC , the Data Commissioner considered Nation Media Group’s Code of Conduct and Ethics, which permitted the use of documents or photographs without consent were justified by the public interest. The Code recognised the protection of public health and safety as one of the circumstances in which the public interest may justify such use. The Data Commissioner found that the Code constituted a relevant self-regulatory code of ethics for purposes of Section 52 of the DPA.
Again, in Grace Ellah Indoshi & Felistus Khadi Mukami v Hellen Shikanda, Nation Media Group PLC & Board of Management, Sacred Heart Mukumu Girls the Data Commissioner considered the application of the same Code in determining whether the processing of personal data by Nation Media Group fell within the journalistic exemption.
These decisions demonstrate that reliance on the journalistic exemption requires more than merely establishing that the subject matter of a publication is in the public interest. A journalist or media house seeking to rely on the exemption must also demonstrate that the processing complies with a relevant self-regulatory or issued code of ethics applicable to the publication.
3. A data controller must establish a lawful basis before disclosing personal data to a media house
The disclosure of personal data to a journalist or media house constitutes processing under the DPA. A data controller proposing to make such a disclosure must therefore establish an appropriate lawful basis for the disclosure.
In Grace Ellah Indoshi & Felistus Khadi Mukami v Hellen Shikanda, Nation Media Group PLC & Board of Management, Sacred Heart Mukumu Girls , the School had collected the student’s photograph for admission and administrative purposes and subsequently disclosed it to Nation Media Group for publication. The Data Commissioner found that the disclosure of the photograph to the media constituted further processing for a purpose that was distinct from the purpose for which the photograph had originally been collected.
In particular, the Data Commissioner found that, since the student was a minor, the School should have obtained parental consent before processing the photograph for the new purpose. The School therefore had no lawful basis for the disclosure. By contrast, the Data Commissioner found that Nation Media Group had lawfully published the photograph in the public interest.
Consequently, the Data Commissioner found the School liable and awarded the Complainants Kes. 300,000/- as compensation for the unlawful processing and disclosure of the student’s personal data.
The decision therefore demonstrates that the lawfulness of the publication by a journalist or media house is distinct from the lawfulness of the disclosure by the data controller from whom the personal data is obtained. A data controller must independently establish a lawful basis before disclosing personal data to the media.
4. A data controller must obtain consent before using personal data for advertising or promotional purposes in media houses
Section 37 of the DPA regulates the commercial use of personal data and requires a data subject’s express consent where personal data is used for commercial purposes. The Data Protection (General) Regulations, 2021 provide further guidance on the use of personal data to advance commercial or economic interests as a commercial purpose.
In Julian Rowa (suing on behalf of a minor, AJR) v The Nairobi Academy the School disclosed a student’s name and examination results to Nation Media Group for publication in an Advertising Feature in the Daily Nation. The School maintained that it did not intend to use the information for commercial gain. The Data Commissioner, however, found that the publication was promotional in nature and that it advanced the School’s commercial and economic interests.
In the circumstances, the Data Commissioner found the School liable and awarded the Complainant KES 637,500 in compensation for the unlawful processing of the student’s personal data. The decision demonstrates that the use of personal data in advertising or promotional content may constitute commercial use for purposes of the DPA. A data controller must therefore obtain the required consent before using personal data to advertise or promote its products, services or activities.
5. A data controller must honour a data subject’s right to object to processing before sharing personal data for publications by media houses
The DPA gives a data subject the right to object to the processing of their personal data. Where a data subject exercises this right, the data controller must stop the processing unless it demonstrates compelling legitimate grounds that override the data subject’s interests, rights and freedoms.
In Julian Rowa (suing on behalf of a minor, AJR) v The Nairobi Academy, the parent objected to the disclosure and publication of the student’s personal data and requested the School not to disclose the data without his consent. The School acknowledged the objection and confirmed that it would not make any further disclosures without the parent’s consent. However, the School went ahead to disclose the student’s name and examination results to Nation Media Group for publication.
The Data Commissioner found that, upon receiving the objection, the school should have implemented appropriate internal controls to prevent any further disclosure of the student’s personal data. In addition, the school did not demonstrate any compelling legitimate grounds that justified the subsequent processing. Therefore, Data Commissioner found that the school had violated the data subject’s right to object.
The decision demonstrates that a data controller must take practical steps to give effect to an objection to processing. This includes implementing appropriate internal controls to ensure that the personal data is not subsequently processed in a manner that is inconsistent with the objection.
Conclusion
The decisions discussed in this alert demonstrate the need to balance the protection of personal data with the role of the media in reporting on matters of public interest. They also demonstrate that the applicable data protection obligations will depend on the purpose and context of the processing. Journalists and media houses should therefore carefully consider the basis on which they process and publish personal data, while organisations that disclose personal data to the media should independently assess the lawfulness of the disclosure and ensure that they comply with applicable data protection requirements.
