The media, press or journalists process lots of personal information when they gather, report on, and publish the news. They have a responsibility to protect it. For example, a journalist might know information relating to the education or the medical, financial, criminal or employment history of a person. They might also know the HIV status of a person. Often this personal information is private and not publicly known. Sometimes personal information is used to get to the bottom of a story only for the story to be published without the personal information itself being published.
What does the law require from the media?
Journalists need to have access to personal information to do their jobs. But what are their responsibilities when it comes to that personal information? The main responsibility is to ensure that the personal information does not fall into the wrong hands and get used to cause harm to the data subject. The Press Code published by the Press Council is very important in this regard. Many publications (like the Business Day and the Daily Maverick) subscribe to it. It requires their journalists to strive to always avoid unnecessary harm.
With the emergence of the Protection of Personal Information Act (the POPI Act), however, a new twist was added to the tale. The focus shifted to whether journalists must comply with both POPIA or just the Press Code. In fact, the discussion did not end there. Another question which lawyers and journalists alike, began asking was: If both apply, what happens if there is a conflict between the two?
The journalistic exclusion in the POPI Act
POPIA does not apply when someone processes personal information solely for the purpose of journalistic, literary or artistic expression. But this is not an automatic blanket exclusion – there are limits on it. If you intend relying on this exclusion, you must be careful. You need to balance the right to privacy and the right to freedom of expression. The public interest is also important. It means that the information must be of a legitimate interest or importance to citizens.
This is not your get out of jail free card
There is also another exclusion. POPIA does not apply when someone processes personal information:
- for exclusively journalistic purposes, and
- is bound by a code of ethics that adequately protects personal information.
In this case, the code of ethics applies to the exclusion of POPIA and POPIA is not relevant.
Questions that arise?
But there are many questions:
- What is the difference between the two exclusions?
- Is there a difference between the “purpose of journalistic expression” and “journalistic purposes”?
- Is the Press Code a code of ethics that adequately protects personal information? Is it a code of conduct as envisaged by POPIA.
- What does the Press Code require a media house to do to protect personal information?
- When does a media house process for a purpose other than journalism? For example, employing their employees, marketing their publications and sending newsletters.
- What does POPIA require a media house to do to protect personal information when its activity is for a purpose other than journalism.
- Who is someone? Does it include citizen bloggers, or non-media organisations?
How we can help?
- Find answers to these questions by asking Michalsons to give you their opinion or interpretation.
- Define your understanding of public interest with the protection of personal information in mind by asking Michalsons to workshop it with you.
- Comply with privacy and data protection laws by joining a programme.
- Train journalists and other writers on what the law, codes, and policies require them to do by asking Michalsons to run private workshops for you.
- Have up-to-date policies by asking Michalsons to review or draft them for you.
- Map your activities so you know whether POPIA or the Press Code applies by asking Michalsons to do it for you?
- Ensure the Press Code adequately protects personal information by asking Michalsons to review it.