The UK Information Commissioner’s Officer (the “ICO”), in a letter to Global Witness (in Steinmetz and others v Global Witness) (the “Letter”), stated that non-media organisations may rely on the special-purposes exemption for journalism in s32 of the Data Protection Act 1998 (the “DPA”), to withhold personal data in response to Data Subject Access Requests. This is the first time s32 of the DPA has been extended to non-media organisations.

In 2012, Global Witness – a non-governmental organisation – reported that four individuals at BSG Resources Ltd (“BSGR”), an international diversified mining company, had been involved in a bribery scandal leading to BSGR being assigned a licence for four blocks at Simandou iron ore mine in Guinea, West Africa (the “Simandou controversy”).

Beny Steinmetz, an Israeli, and three others requested access to the data that Global Witness held about them in an attempt to have Global Witness’ sources disclosed to them. When the data was not disclosed, Steinmetz and the others requested that the ICO determine whether Global Witness was entitled to claim to be protected under the DPA’s journalism exemption.

To rely on exception, Global Witness had to demonstrate that: (1) the personal data was being processed only for journalism, art or literature; (2) the processing took place with a view to publication of some material; (3) Global Witness had a reasonable belief that publication was in the public interest; and (4) such belief extended to access being incompatible with journalism.

The ICO found that Global Witness had met all elements, including the public interest test, because the Simandou controversy purported to involve corruption and a bribe of $2.5 billion of a government in one of the world’s poorest countries.

The ICO’s decision follows its recent ‘Data Protection and journalism: a guide for the media’ guidance, and is the first time use of the journalistic exception has been extended to public-interest reporting by persons other than professional journalists.