We were contacted by an individual that had been subject of an article in the press a number of years ago. 

The information contained within the article was out of date. It also revealed certain personal details that the individual no longer wished to be available online. 

Challenge

Under the UK GDPR, individuals (data subjects) who have their personal data processed by an organisation for that organisation’s purposes (data controllers) are given certain rights over that personal data. 

When personal data is being published online and the data subject wishes to have that personal data removed or corrected, data subjects have certain rights to potentially make that happen. For example: 

1. The right to have inaccurate data rectified 

2. The right to erasure (the so-called “right to be forgotten”) 

3. The right to restrict processing

4. The right to object to the processing 

    These rights are not absolute. Data controllers are able to resist these rights, primarily on the basis that they have an overriding interest in continuing the processing and/or because that processing is necessary for some other legitimate reason (e.g. defending legal claims). 

    Furthermore, the press is able to rely on what is commonly known as the “journalism exemption.” 

    This exemption allows journalists to process personal data in order to report on matters in the public interest, without having to comply with the key aspects of the UK GDPR (including most data subject rights). 

    As well as this, newspapers can also rely on the “archiving” exemption that relates to the maintenance of databases of historical news articles. If the press can demonstrate that it is archiving the personal data, and that archiving is in the public interest, then it will be exempt from most of the main UK GDPR data subject rights. 

    Process and insight

    We started by discussing with the client the impact that the article was having on them. Importantly, the personal details in the article could be used by others to identify the client, as it contained an image of the client as well as information about their home address. In the client’s circumstances, this posed a risk to their physical safety. Balanced against this was the fact that the client previously provided most of the information contained in the article to the press themselves. This makes it more difficult to justify why the processing of the personal data needed to stop. 

    In discussing this with the client, it became apparent that the image of the client was their intellectual property. Accordingly, we also needed to cater for the revocation of the copyright licence in the image. This was an alternate way in achieving at least part of the client’s objectives in removing her personal data from the article. 

    Solution

    We crafted a lengthy data subject rights complaint, which also contained a notice that the copyright in the image was revoked by the client. 

    We focused on the relative harm that the publication of the article could to do to our client, against the unimportant subject matter of the article in question. 

    In doing so, we sought to demonstrate that (1) the newspaper could not have any interest in continuing to publish the article and (2) the public has no interest whatsoever in the risk of someone being harmed when the content of the article was so benign. 

    This proved convincing. The newspaper agreed to remove our client’s personal data from the article. We reviewed the changes on behalf of our client and confirmed a settlement on the basis of what the newspaper agreed to remove. 

    If you need any help enforcing or responding to a data subject rights complaint – we can help. Please do not hesitate to contact us here if you have any questions.