Complaints, enforcement, and investigations

14.1 People have the right to complain to you, us, and the courts about how you have used their personal information.

14.2 We publish statutory guidance for the public to help them complain about the media and decide the most appropriate organisation to make their complaint to.

14.3 Our role is about data protection, not general press standards. However, where there is overlap, we will work with other authorities to resolve issues effectively and efficiently.

14.4 People can also enforce their data protection rights or claim compensation for damages in court, or both. When the case concerns journalism, the person who is a party, or a prospective party, to the proceedings can ask us to assist if the case is of substantial public importance.

14.5 Courts must stay (or in Scotland, sist) some legal proceedings if certain criteria are met, which protects publication.

14.6 We can take formal enforcement action. However, there are specific and strong protections for journalism and various restrictions and safeguards built into the law.

14.7 Any action we take is targeted and proportionate, with our strongest measures reserved for the most serious incidents. We also carefully consider the potential impact on freedom of expression and information, and a free media, in any action we may take.

14.8 We can also investigate and prosecute criminal offences when we consider it is in the public interest. There are some defences relating to the public interest and journalism set out in the DPA 2018 that can apply in specific circumstances (see key legal provisions in Reference notes).

Reference notes

These reference notes support the Data protection and journalism code of practice (the code) but are not part of the statutory code itself.