data-protection-and-journalism-a-guide-for-the-media-draft

Data protection and journalism
Data protection basics
Other key terms
In this guide we have tried to avoid using legal jargon as far as possible.
However, in some circumstances you will need to understand the
technical meaning of a term defined in the DPA. The key terms are:
Data controller – the person who decides why and how personal
data is processed. This is usually an organisation, but can be an
individual if they are acting on their own initiative – for example, a
blogger or freelance journalist. It is the data controller who is
responsible for complying with the DPA. If two data controllers work
together, they can be jointly responsible.
Data processor – someone the data controller instructs to process
data on their behalf. In other words, a subcontractor. (Employees are
part of the data controller rather than separate data processors.)
Data subject – the person the personal data is about.
Third party – someone who’s not a data controller, its employee, a
data processor, or a data subject.
Inaccurate – incorrect or misleading as to any matter of fact. This
means someone’s opinion cannot be ‘inaccurate personal data’ as
long as it is marked as opinion and was correctly recorded.
Special purposes – journalism, art or literature.
See The Guide to Data Protection – (A)(3) Key definitions for more
information and exact definitions as they appear in the DPA.
The duty to notify
Most organisations processing personal data will need to notify with the
Information Commissioner, who keeps a public register. There is a fee.
Failure to notify is a criminal offence.
Private individuals and some organisations (generally very small
businesses or not-for-profits) are exempt from notification, but the media
are not generally exempt. The exemption for journalism does not apply to
the obligation to notify.
DRAFT 15