Fairness in publishing personal data

Until recently editors’ (and night lawyers’) main pre-publication legal concerns were defamation, privacy and contempt of court.  However, the recent Court of Appeal judgment in Vince v Associated Newspapers [2026] EWCA Civ 899 has, applying the fair processing principle in UK GDPR, added fairness.

Background

Late on 8 June 2023, the night editor of the Daily Mail and Mail+ decided to combine two stories about prominent Labour party donors, Davide Serra and Dale Vince into one article, with the headline “Labour repays £100,000 to ‘sex harassment’ donor”, above two photos of Dale Vince at a Just Stop Oil protest. The headline was not intended to refer to Mr Vince, but one had to read the full text for that to become clear. The photos of Mr Vince were replaced with photos of Mr Serra in Mail+ within 48 minutes, but the original Daily Mail article remained available on PressReader for several months.

Mr Vince complained that the article portrayed him as accused of sexual harassment. The Independent Press Standards Organisation (IPSO) declined to investigate on the basis that the article, read as a whole, was not in breach of the accuracy provision of the Editor’s Code. Then the High Court, applying the House of Lords judgment in Charleston v News Group Newspapers Ltd [1995] 2 AC 65, held that a reader would read the article as a whole rather than the headline or image in isolation. The Court rejected Vince’s claims both in defamation and for unfair processing of his personal data contrary to Article 5(1)(a) of UK GDPR.

Publishing personal data – the special purposes exemption

Article 5(1) UK GDPR sets out the principles relating to personal data, including that “Personal data shall be (a) processed lawfully, fairly and in a transparent manner in relation to the data subject ….”, and “(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ….”.   

Publishers have hitherto relied on the “special purposes” exemption from Article 5(1)(a) and (d) for “processing …. carried out with a view to the publication by a person of journalistic, academic, artistic or literary material” (Data Protection Act 2018 Schedule 2 Part 5 para 26). However, as the ICO has long noted, the exemption is not open-ended. It requires that the data controller (here the publisher) must reasonably believe that publication of the material would be in the public interest and that application of the Article 5 principles would be incompatible with the special purposes. In reaching that view publisher must consider not only the significance of public interest in the freedom of expression and information, but also specified codes of practice and guidelines where applicable, currently the BBC Editorial Guidelines, the Ofcom Broadcasting Code and the Editors’ Code of Practice applied by IPSO. The Human Rights Act 2000 section 12(4) also requires the court to have regard to any relevant privacy code when considering whether to grant any relief which, if granted, might affect the exercise of the right to freedom of expression. 

Unlike the Ofcom Code and BBC Guidelines, the Editors’ Code does not have a specific provision on fairness, but it does distinguish between information that is inaccurate and information that is misleading, stating “The Press must take care not to publish inaccurate, misleading or distorted information or images, including headlines not supported by the text”.

If the special purposes exemption does not apply then regard should be had to the ICO’s 2024 Data protection and journalism code of practice, a statutory code under section 124 DPA, but not in force at the time of publication of the Mail articles.

The Court of Appeal judgment

The Court of Appeal took “judicial notice of the fact that many readers do not read further than headlines and pictures”. It found that whilst the Charleston rule had been held to apply to a claim for inaccurate data processing under Article 5(1)(d) UK GDPR, there was no automatic read across to a claim for unfair processing. Having regard to the Editors’ Code, the information in the headline juxtaposed next to the images of Mr Vince would have misled many casual readers into thinking that Mr Vince was the “sex harassment donor” referred to in the headline, and the night editor’s evidence for the juxtaposition did not show that compliance with the fairness principle would be incompatible with the purposes of journalism or that the Mail had taken any adequate care as required by the Code. The publication was misleading, and unfair.

Damages

In addition to the special purposes exemption, publishers have also had a degree of reassurance from the fact that damages in data protection cases (for “material or non-material damage as a result of an infringement”, per UK GDPR Article 82) have hitherto been low, lower than in defamation. Associated wisely settled Mr Vince’s claim, and we do not know on what terms. The Supreme Court judgment in the Farley case concerning how damages are to be assessed under Article 82 is currently awaited (see our earlier blog here).

What next?

The non-application of Charleston in misleadingness/unfairness claims reflects the reality of how people read material, particularly online where they may not read beyond snippets or click-bait. It also better aligns with consumer law, where the notional “average consumer” may read copy in different ways, and may be misled even if the (for example) advertisement is, read as a whole, factually accurate. But there are difficulties for publishers in that the protections in defamation law (with the requirements of the Defamation Act 2013 for claimants to show serious harm to reputation, and a limitation period of one year from first publication) are not reflected in UK GDPR for an unfairness claim (with no apparent de-minimis threshold, and a six year limitation period). Other outstanding issues include whether the single meaning rule applies in GDPR publication claims (it does not in malicious falsehood claims), County Court jurisdiction in such claims (it has none in defamation claims, unless agreed by the parties), how the special purposes exemption applies to publishers who are not subject to one of the three codes/guidances currently listed under the special purposes exemption, and whether the Charleston rule should still apply at all in defamation or GDPR cases – much for the courts to grapple with.

In the meantime, the Court of Appeal resisted the temptation to set any general fairness test (e.g. based on reasonable expectations of the data subject) for media publications. The existence of the special purposes exemption makes clear that freedom of expression allows for a publication to be “unfair” to its subjects. There is no general legal duty of care imposed on media in relation to readers and data subjects (publishers are exempt from the duty of care imposed on platforms by the Online Safety Act 2023). Each case will depend on its facts. But publishers should consider pre-publication whether what is proposed is likely unfairly to mislead in relation to an identifiable data subject, including in particular when editing a publication to save space, or to add pictures or headlines, or to tempt the reader. No doubt the editors of Mr Vince’s newly acquired local newspapers will be particularly attentive.