Update statement on journalism etc. exemption on privacy page

[RichardTaylor]

Current:

"In almost all cases our processing of personal information will be lawful under Article 6 of the GDPR but we may also rely on the "special purposes" derogations in the Data Protection Act 2018, especially those applying to academic and journalistic purposes. Often use of our service is academic or journalistic in nature, and the provision of our service as a whole may be considered a journalistic endeavour."

Proposed:

"In almost all cases our processing of personal information will be lawful under Article 6 of the GDPR but we may also rely on exemptions in the Data Protection Act 2018, especially those applying to academic and journalistic purposes (see Schedule 2 Part 5 and Sections 174-9). Often use of our service is academic or journalistic in nature, and the provision of our service as a whole may be considered a journalistic endeavour."

Derogations from the GDPR apply where publication of the material would be in the public interest. In determining whether it is reasonable to believe that publication would be in the public interest regard must be given to: the BBC Editorial Guidelines, the Ofcom Broadcasting Code and the Editors’ Code of Practice.

The exemptions for journalistic and academic purposes relate to circumstances where "processing is being carried out with a view to the publication". This phrase has been interpreted broadly by the Information Commissioner in published guidance to potentially encompass any information collected, created or retained in connection with journalistic activities.

Reasons for the proposed changes:

• We weren't linking to the most relevant elements of the Data Protection Act 2018
• As these help pages also act as our policies explicitly referencing the codes/guidelines to which regard must be given in cases where publication is justified on journalistic or academic grounds appears sensible.

Significant weight should be given to brevity but the proposed additional paragraphs may assist readers' understanding of the position and so be of value.

[RichardTaylor]

The proposed changes are now out of date as they don't link to the UK GDPR.

I realised again that we could do with improving this section while working on https://github.com/mysociety/whatdotheyknow-private/issues/90

I now propose a more concise change from:

In almost all cases our processing of personal information will be lawful under Article 6 of the UK GDPR but we may also rely on the "special purposes" derogations in the Data Protection Act 2018, especially those applying to academic and journalistic purposes. Often use of our service is academic or journalistic in nature, and the provision of our service as a whole may be considered a journalistic endeavour.

to

In almost all cases our processing of personal information will be lawful under Article 6 of the UK GDPR but we may also rely on the "special purposes" derogations and exemptions in the Data Protection Act 2018, especially those applying to academic and journalistic purposes. Often use of our service is academic or journalistic in nature, and the provision of our service as a whole may be considered a journalistic endeavour.

I do still quite like paragraphs 2 and 3 from my previously proposed text. I'm tempted to move them to the wiki, as they're just guidance/interpretation, however I'm mindful that we want to be as open and transparent as possible and we prefer published policies etc., to private material on the wiki.