The transcripts of the official inquiry into the culture, practices and ethics of the press. More…

  • MR CHRISTOPHER GRAHAM (sworn).

  • Make yourself comfortable, please, Mr Graham and first of all tell us your full name.

  • Christopher Sydney Matthew Graham.

  • Thank you. You've provided the Inquiry with two witness statements, dated respectively 16 September of last year and 20 January of this year, signed and dated by you. Is this your true evidence to the Inquiry?

  • Thank you very much for the work that's been put into this, and indeed for facilitating during the course of last year the provision of information relevant to the work of your predecessor.

  • It's obviously been work for your office which was not originally planned.

  • Indeed, but the Information Commissioner's office is very glad to help the Inquiry in any way we can.

  • You, Mr Graham, are the current Information Commissioner and have been since late June 2009. Previously you enjoyed a career in journalism, broadcasting and then as Director General of the Advertising Standards Authority; is that right?

  • Unlike Mr Thomas, I don't believe you have a legal background?

  • Can I ask you, please, about the handover from Mr Thomas. Presumably you were advised of the key issues that were concerning the office at that time; is that correct?

  • Indeed. And I had to brief myself on the key issues in my application for the position. It was a long-drawn-out process. Even after being identified by the selection panel, I then had to go before the Justice Committee. So there was plenty of time for me to acquaint myself with the issues and the concerns around the illegal access to personal information, whether by journalists or the much wider problem of information going missing from databases anyway. I think I was questioned about that both at the job interview and the Select Committee, and of course before I took up my position, I had conversations with Richard Thomas.

  • In relation to press and journalism, what were the key issues facing your office in late June 2009, at least as explained to you by Mr Thomas or ascertained by you from your own research and perception?

  • I can't say it was the top of the list, the top priority. I was aware there was an outstanding issue of the commencement or the non-commencement of Section 77 and 78 of the Criminal Justice and Immigration Act, where there was a sword of Damocles hanging over the press. If there was any repetition of the behaviour that Operation Motorman had uncovered that would be accessed pretty quickly. But I have to say that there were many other priorities facing the office. I think the Select Committee questioned me mainly about the backlog in freedom of information cases. It's important to bear in mind that the Information Commissioner is responsible both for the right to privacy and the right to know, and the Freedom of Information Act was I think a higher priority at that point than the Data Protection Act.

    But then I had a wake-up call in week two, because the Guardian front page and Nick Davies' story brought the whole issue to my attention. I was very quickly contacted by the Select Committee and I had to get up to speed on that issue.

  • "That issue" being specifically?

  • At that stage it was briefing myself on what had and hadn't gone on in the period up to 2006 when my predecessor had published "What price privacy?" and "What price privacy now?". But the issue quite quickly became of wider concern, because there was data going missing all over the place. There was the leak of the membership list of the British National Party, which was posted on the Internet, and that I was reminded in September 2009 by the judge in Nottingham Crown Court, who imposed a rather modest fine, as it tends to happen on these occasions for a Section 55 offence, and the judge said it had come as a surprise to him to find that he couldn't impose a custodial penalty.

  • You gave evidence to the Select Committee Culture, Media and Sport on 2 September 2009. We'll come back to that very soon. Your witness statements make it clear that you did not believe that the press was significantly involved in breaches of the Data Protection Act really between 2006 and 2009, true that was before your time, and certainly between 2009 and today's date, and by implication had learnt lessons from the 2006 reports. Is that a fair impression to be gathered from your witness statements, Mr Graham?

  • I can only speak of what's in my own knowledge, and I can only speak of those aspects of press conduct that fall within the responsibilities of my office, and that's primarily Section 55. I know that the Inquiry was triggered by concerns about hacking of phones and hacking of emails, these are criminal offences that don't come under the Information Commissioner's office, but Section 55 certainly does.

    I can't prove a negative. All I can say is I've seen no further evidence beyond what we published in 2006, and that of course was about behaviour before 2003, when Mr Whittamore's office was raided, and much of it related to activity between 1999 and 2003.

    I simply offer a view that this is an issue of such high salience, many investigative journalists working in the area, great rivalry between newspaper groups, lots of campaigners, that if there was evidence of further breaches of Section 55 by the press, it would have been drawn to my attention, and it hasn't been.

    But I must stress that that doesn't mean that Section 55 isn't being breached. It's being breached every day, and my frustration is that I'm faced by the press, who say they ain't misbehaving, but they are flatly opposed or have been opposed to the introduction of a more effective penalty for these offences because they say it will have a chilling effect on investigative journalism.

    As a former journalist, I'm not in favour of something that's going to have a chilling effect on good investigative journalism, but we are facing a problem of not being able to get the courts and society to take seriously this very modern threat of personal information going missing from databases because members of staff are misbehaving, selling information, it's being blagged from them. It isn't just about the press.

    In fact, I went to the Society of Editors conference in 2009 and said it's so not about you. It's about NHS workers, it's about private investigators, it's about bank clerks, and it's frustrating not to be able to deal with that real challenge, which the Information Commissioner's office is concerned to deal with, because we're constantly met by the press saying, "This is terrible, the sky is falling, the sky is falling".

    It really isn't. Section 77 would provide the opportunity for a broader range of deterrent sentences than just a fine, and Section 78 gives the press a stronger public interest defence, because it's based on reasonable belief.

  • How many private inquiry agents have you searched in the last five years?

  • We were investigating -- there are some ongoing investigations, and perhaps I shouldn't say too much about that, but that side of our work is very active.

    What I haven't done is to go back to Mr Whittamore and say, "How's it going on these days?" I don't believe the courts do that. If somebody is sentenced and punished, we move on. I don't think it falls to the Information Commissioner to go and have a look see ten years later to see whether he's a reformed character.

  • I just want to test some of those propositions, not in relation to Section 77 and 78, we hear what you say about that and that is clear, but were you aware that the Express Group were still using JJ Services, Mr Whittamore's alter ego, at least until 2010?

  • I wasn't until I heard it in evidence I think last week.

  • Yes. A number of newspaper groups have given evidence to the Inquiry that they used search agencies, which they're careful to distinguish from private detectives or private investigators, and these search agencies obtain addresses, telephone numbers and similar sorts of personal data. Does your office know the methods these search agencies deploy, in particular whether they're lawful?

  • I'm certainly aware of the information which I think was in the witness statement from News International, which referred to a service where you could access ex-directory numbers on the web. We were certainly aware about that. One of the services, I think the GB Group, got going about 2002, so after many of the Whittamore offences, if there were offences, were committed.

    This is simply a phenomenon of the online world. If I'm ex-directory, I probably don't think too much about giving out my number when I am booking a flight or buying something online, and I really ought to read the privacy notice rather more carefully than most of us do, because that information may be shared and it will be claimed that I've given my consent. Consequently, a database of many millions of numbers may arise. So just being ex-directory to British Telecom doesn't get you very far.

    Is it lawful? The information should be processed fairly, and if you make a subject access request or you apply to the company and say, "I don't want you to go on providing my number", our evidence is where these cases have been raised with us that the companies are quite good about withdrawing that information and making changes. So on the face of it, not unlawful.

  • There are two points there. The first point, as you say, if you're booking up a flight or obtaining any sort of service these days on the Internet, you have often to tick specifically a box which makes it clear that you don't want your private information to be shared with others. That's the position.

  • And that box may be quite hidden away, or certainly not patent on the web page you're looking at. Is that also correct?

  • That is correct, and it's one of the priorities of the Information Commissioner's office to help consumers understand how the world works and to get data controllers to treat their consumers as adults, and to give them the information. I mean, this is the next phase of data protection.

  • Yes, but just speaking back for the personal interest in this and speaking for the wider public, why doesn't it work the other way round? Why don't you have to tick a box that makes it clear you are happy that your personal data is shared? Why do you have to tick a box to say that you're not happy? It doesn't seem right Mr Graham.

  • No, the opt-in, opt-out debate is raging all the time. We've had proposals from the European Commission yesterday about a completely new regime for data protection. In many cases you do have to tick to opt in.

    All I would say is the information that websites provide is typically deeply obscure. I mean Google, for example, have changed their privacy policy. I noticed on the search engine yesterday, it said, "Do you want to know more about our privacy policy?" and at that moment I didn't particularly want to do that, but it turns out that it's a huge change which aggregates all the various Google search engines and any information that you give to one can be shared with everybody. Big issue, which my office is now engaging with. So this is --

  • Could I ask you just to slow down a bit, because what you're saying is being recorded and we want to make sure we get it accurately.

  • The second point is why assume that a search agency has obtained this information because consumer X, such as me, has failed to tick the relevant box, the information, the personal data has been transmitted to the search agency and the search agency is therefore processing it lawfully? It may be that the search agency has obtained the information unlawfully in the first place. How do we know?

  • It wouldn't be fair processing if you were -- if you hadn't got the consumer's consent. I say the consent is very often claimed because of something deep in a privacy policy.

    I absolutely recognise the problem that you describe, but it's a different order to the sort of thing that we were dealing with with Section 55. I wasn't very convinced by the evidence from some other newspaper groups, who seemed to say that because they could, in 2011 or 2012, get the information that they were seeking from Mr Whittamore from some online source which they believe was lawful, it couldn't be an offence, it couldn't be a Section 55 offence, could it, to get Mr Whittamore to use the dark arts to provide the information from an earlier age.

    I say in my second witness statement that that's rather akin to saying that because second-hand cars are available for sale, it's therefore not an offence to take and drive someone's motor. It's just a non sequitur.

  • I understand that point, Mr Graham, and it's a very fair point, but to go back to Mr Whittamore, who is probably still trading as JJ Services, is this the position: you don't know one way or the other whether he's using lawful means or unlawful means; is that right?

  • I don't know anything about Mr Whittamore's business except what I heard last week in relation to the Express.

    If one was dealing with -- if at the time one was dealing with newspapers who are saying, "Well, in good faith we had bought a product from this person, so we can't be blameworthy, can we?" I would simply observe that if you are dealing with a receiver of stolen goods, you shouldn't be surprised if the goods that you purchase are stolen. But I don't know whether that's happening now and I'm not sure that it's the job of the Information Commissioner, faced by all the other things we're being asked to do, to go back and check on something that was happening ten years ago.

  • No, I'm not asking you to check what happened between the late 1990s and 8 March, I think it is, 2003. The question relates to what Mr Whittamore may have been doing since then. You do have power under the Act, Section 43, simply to ask him, in the first instance, what methods he's using, don't you?

  • But surely a regulator should act on the basis of current prima facie evidence?

  • I'm not quite understanding your answer. Are you saying you don't have power or are you saying you do have power but you don't wish to exercise it?

  • I'm saying that if evidence is brought to my attention of continued misbehaviour, particularly in the light of a suspended sentence, it would be my responsibility to go back and enquire, but it's not my responsibility -- I think it would be quite wrong -- if I started probing when I have no reason to believe that anything's wrong.

  • We'll come back to that when we look at the relevant section. The same point relates to the search agencies, there are presumably quite a large number. One of them was mentioned in evidence when Mr Thomas answered questioned posed by News International. I think it's a company called GB Group, but there are others who carry out similar activities. You could ask them, could you not, of the methods they use to gather their data? Do you accept that?

  • We do this all the time, but there's no reason to believe that in that particular case they're doing anything wrong. The evidence we've had is that companies like GB Group are very ready to respond to subject access requests and to amend the record. If you say, "That's a mistake, I didn't intend you to have that information", they take it down.

  • But that suggests that you're leaving this to the consumer primarily to sort this out, rather than you as regulator to take a proactive line with these search agencies, and more specifically JJ Services, who, after all, have quite intrusive powers and may not be exercising them fairly and properly in all cases. Do you accept that?

  • There are two jobs. One is to arm the consumer, to educate and empower the consumer to exercise their information rights and to help them to assert them.

    The other responsibility is to educate the industry and to help online providers to understand that we are living in a world where all our information is online, and the Information Commissioner expects them to respect people's privacy and stick to the law, but a regulator has to intervene on the basis of evidence, and if we simply set off on a whole series of fishing expeditions, we couldn't cover the territory and I think it would be a misapplication of resources.

    If I'm presented with the evidence, Mr Jay, I will send in the troops.

  • You're not like a journalist going on a fishing expedition. You're a regulator with proactive powers and obligations the font of which starts off with Section 51 of the Act and you have a range of specific powers ranging from Section 40 to Section 50. You could deploy those, couldn't you?

  • Yes but you're asking me to do a mystery shopping expedition on the basis of no smoke.

  • We are -- if I could just finish the point -- engaged in a series of investigations at the moment of abuse of personal information. That's what my office does all the time. This Inquiry is particularly concerned about what may have happened to Mr Whittamore. This Inquiry is particularly interested, because it's been put in evidence, into the activities of some of these identification management businesses. Well, fine, but that isn't very high up my priority list of regulatory action.

    But if any information came my way suggesting there was abuse, then we would go into action.

  • Could I just ask this, and it's to understand it rather than anything else: how will a consumer know if his or her personal data is being bandied about? I'm not targeting Mr Whittamore at all, I simply don't know, as you say, but absent that search, which was generated for different reasons, none of this material would ever have come to light. So because of a concern, I think it was through DVLA, I can't quite remember, so the search was organised, and then a veritable Aladdin's cave of material was revealed.

  • And it just concerns me that I simply do not know whether somebody has got hold of my personal data, and I don't know how I would ever find out, and therefore, if I never find out, I don't know to make the complaint.

  • We have very frequent applications, sir, from citizens and consumers who have reason to believe that information they believed was secret has got out into the public domain, and sometimes that relates to the sort of activity that was highlighted in the Motorman files and sometimes it's much more sort of day-to-day and current, and we're able to assist consumers and citizens to make subject access requests under the Data Protection Act to find out what information people have and to get it corrected.

    The second thing is that since April of 2010, we've had the power to impose a civil monetary penalty of up to £500,000 for serious breaches of the data protection principles and this is beginning to have a very salutary effect, both on public authorities and on commercial companies. They realise that the Information Commissioner has teeth.

    I don't think we're going to get very far if we invite the Information Commissioner to apply a scattergun approach and just go around checking different websites and different inquiry agents on the off-chance they might be breaching the law, when we have quite enough work following up on leads with some suggestion that people have been breaking the law.

  • I'm not sure it would take that long, though --

  • -- to formulate a letter which went out to all these search agencies to ask them a series of specific questions in relation to their modus operandi and invited responses. Depending on the quality of the response, you would then be able to determine whether or not further investigation was necessary. Do you accept that possibility?

  • Well, I certainly hear what you say, and our list of regulatory priorities at the moment, our information rights strategy has listed the priorities that we have, and it really starts off with the health sector and with the financial services and credit and so on. I do have to pick my targets, so I would be inclined to wait until I saw more evidence of current abuse than I have at the moment.

  • This was a point which the Select Committee brought up with you on 2 September. In the further bundle of documents you supplied, under cover of your second witness statement, you'll see the transcript of evidence to the CMS Committee.

  • I think it's in the other bundle, 14.

  • I'm sorry to interrupt, but the reference to a second witness statement of Mr Graham is a surprise to us.

  • Because I'm afraid we have never received such a statement.

  • It is a statement dated 20 January of this year and it responds effectively to some of the evidence that has been given.

  • I can understand why it had been prepared, but unfortunately I don't believe it's reached us, and we've done such checks as we can within the last ten minutes without eliciting any reference to or knowledge of it.

  • Well, hm. Can we do a check from this room as to whether it's on the system? We're doing it now.

  • Mr Graham, under tab 14, if you look at the pagination at the top right, it's EV353, please.

  • The question on the bottom right, question 1869 from Mr Hall, are you with me?

  • "In previous questions from various members of the Committee you then try to establish the scale of the abuse that journalists carry out in this field, and the evidence you have submitted to the Committee is that there is no evidence you can see about whether this is an ongoing practice."

    And then you answer:

    "There is no evidence that we hold beyond the evidence which contributed to ..." the 2006 reports.

    "Question: I just want to be clear that that is what you said.

    "Answer: I have not got anything else, so I cannot help you further.

    "Question: So your evidence to the Committee is that the practice of private investigators continuing in some illegal activity is ongoing and is a serious problem?

    "Answer: Yes."

    Who are the private investigators in general that you are referring to there, Mr Graham?

  • I was referring to the recent cases of concern. I don't remember the specific example. But just before I went before the Select Committee, we'd had the BNP case, which was Section 59, and we had given evidence previously, I mean my predecessor, Richard Thomas, had been before an earlier stage of the inquiry and we had prosecuted under Section 55 various inquiry agents. I'm sorry I don't have the detail to hand.

    The point I was trying to make to the committee was that they were -- you will see earlier on, they were constantly talking about hacking and I was explaining that that wasn't what we did. I was concerned -- because it's a breach of the Regulation of Investigatory Powers Act and is prosecuted by the police. But we had been concerned about Section 55 in relation to the press in Operation Motorman.

    I should say in passing, I've reread "What price privacy?", and it is about much more than the behaviour of the press. There are only five pages of the 41 pages that deal with the press --

  • We know that, the question was --

  • It's relevant. That was the point I was making to the committee.

  • Then Mr Hall carries on:

    "But we do not know who the clients are any more?

    "Answer: Well, we know some of the clients because of the example we have given.

    "Question: But they are not journalists?

    "Answer: We have not got any further evidence of journalistic involvement beyond 2006.

    "Question: Does that strike you as the news industry having actually cleaned up its act or as confirming the evidence that we have been given in this Committee that the government case was a one-off, rogue journalist acting ultra vires without the knowledge of his editor?"

    That, if I could just say, that related to a different case. It's possible that the question could have been framed in these terms, that the newspaper industry was saying in relation to phone hacking it's cleaned up its act; that was untrue. The newspaper industry is saying it's cleaned up its act post 2006. How do we know whether that's true, given that we do know it didn't clean up its act in relation to phone hacking? Do you see, if you put the point in those precise terms, what's your answer?

  • We were talking at cross purposes at the committee because they were talking about the hacking case and I was talking about the blagging case and we'd be in danger of talking at cross purposes here if we confused the two.

    All I'm saying is I don't have evidence beyond what we published in 2006. That evidence was itself historic. But I was surprised to hear the evidence from the Express, and the Express saying, "We had no reason to believe that a supplier was going to behave in a reprehensible way". I would simply comment to this extent: Richard Thomas in his evidence referred to the counsel in the Operation Glade trial and said that the journalists who had been questioned were tricky, well-armed and well-briefed, effectively a barrel of monkeys.

    The impression I get, from statements like the one we heard from the Express, is that if we're talking monkeys, it's see no evil, hear no evil.

  • But I have to say that I see no evidence, so I can't -- I can't comment.

  • There's a recurring theme here, might it be said, that in relation to the whole issue of phone hacking, the argument was: it's one rogue reporter, it's not systemic. That argument, subject to the view of this Inquiry, may not be correct, putting it at its absolute lowest.

    When we look at the position the press have adopted in this Inquiry, they're saying precisely that: see no evil, hear no evil, et cetera. We don't know one way or another whether these search agencies are acting lawfully or unlawfully, but we're not going to find out.

    The question really I have for you is: why don't you find out, as the regulator?

  • Right, so the Information Commissioner started this whole thing off in 2006 and called for action to deal with the unlawful trade in personal information, part of which involved the press. We now have a judicial Inquiry, which is charged with investigating the whole area and the Prime Minister in the Commons on 13 July, if I can quote, because this struck me:

    "We should have made more of these reports [he's referring to the Information Commissioner's reports] which included some very important detail about what was going wrong in data handling, data theft and the rest of it. We must ensure that the Inquiry asks the question: why were they ignored, and what are we going to do now?"

    We seem to be in a completely circular debate, where the absence of evidence of wrongdoing is puzzling, but in the absence of evidence of wrongdoing, somebody ought to go and find some wrongdoing, and it had probably better be the Information Commissioner.

  • I don't think it's fair to characterise what I'm trying to do in that way, Mr Graham, with great respect. I would put it rather differently. I do not know whether the sort of search that produced the Whittamore material, if conducted today, would or would not produce any similar material. It is said, and I've heard much evidence to this effect, that it would not. But with great respect, neither do you.

    Now, I appreciate your point that absence of evidence does not mean that there is something going on, but equally, absence of evidence does not mean that something isn't going on. We simply don't know what we don't know. Is that fair?

  • Indeed. This is Donald Rumsfeld territory, I suppose.

    But, sir, the terms of reference as I read them published on 20 July include the Inquiry being charged with finding the extent to which there was a failure to act on previous warnings about media misconduct, and we do seem to be in an Alice in Wonderland world where -- or Alice in Wonderland meets catch 22, where the Information Commissioner having sounded the alarm, the Inquiry, among the difficult tasks that it has, has been asked to establish why there was a failure to act on the previous warnings, the government says it can't implement Section 77 because there's a judicial inquiry, and Mr Jay is putting to me that it's somehow up to Information Commissioner to find out what's going on. I find that puzzling.

  • The question does not relate to historical excavation of what might have happened or what did happen between the late 1990s and 2003. The question is directed to the present.

  • It's really Lord Justice Leveson's question. He put my question in a slightly different way, probably more clearly: we don't know one way or the other. We do know that the press have come up with arguments, rogue reporter defence. They themselves accept they don't know one way or the other. You are the regulator. You have power to find out. Do you accept that?

  • Yes, but I repeat that I do think that given the many responsibilities that the regulator has, particularly at the moment with the revision of the European Directive, with concerns about privacy on the O2 system, on the Google system, with the post legislative scrutiny of the Freedom of Information Act, I can list any number of tasks that my office should be spending its time on.

    Here is an Inquiry. What about the Press Complaints Commission? There are lots of ways of establishing the truth, but I come back to the point I made earlier that there's been so much feverish activity over the past two years in relation to this with the various newspaper groups, with the journalists, with the books written on the subject, with the campaigning groups. If the best that critics can do is to turn up further evidence of what was going on between 1999 and 2003, it doesn't amount to much.

  • Please leave that issue to one side, okay? We're not looking, at the moment, at what I've called archeology.

  • We're looking at the present. Can I just direct your attention to your powers under the Data Protection Act and suggest to you that this could all be done quite straightforwardly? Your general power -- this is in your first witness statement, tab 62 of the bundle we've prepared, where you've included the whole of the Data Protection Act. It's page 08046 on the unique numbering system we're using. Your general duties are under section 51, aren't they, Mr Graham?

  • Could you just repeat that reference? I'm at tab 3 of the first bundle. Is this right?

  • It's the whole of the Data Protection Act.

  • It's under 62 of mine but it may be tab 3 of yours. Do you have that section?

  • I have the Act in front of me.

  • If you look at the pagination at the bottom right --

  • Yes. You should be looking at the last five numbers, 08046.

  • Okay. 08046. Yes, "General Duties of the Commissioner", yes.

  • "It shall be the duty of the Commissioner to promote the following of good practice by data controllers and in particular so to perform his functions under this Act as to promote the observance of the requirements of this act by data controllers."

    So that is your main function --

  • Absolutely. And of course in order to do that you have to be fairly selective of the targets that you tackle.

  • Section 55 is the criminal section, as we know. Section 32 might be an important section. It's 08029, which creates a special exemption for journalism, literature and art; is that correct?

  • Yes. And this is what I describe as the significant carve-out for the media from many of the provisions of the Data Protection Act.

  • That's the proposition I was going to test with you, Mr Graham. Can we establish first of all that Section 32 is completely irrelevant to the criminal offence under Section 55 --

  • Absolutely. A journalist charged with involvement in a Section 55 offence might like to pray in aid Section 32. It wouldn't get him anywhere. Section 32 concerns the civil offences. Section 55 is about the criminal offences.

  • Absolutely. If you look at the language of section 32, and I tried this one out with Mr Thomas, but I'm going to have another go with you:

    "Personal data which are processed only for the special purposes are exempt from any provision to which this subsection relates ..."

    Those are the provisions listed in Section 32(2).

  • "... if (a) the processing is undertaken with a view to the publication by any person of any journalistic material."

  • The point I put to you is this: if you imagine the proposition, which the newspaper organisations have advanced, that they need to obtain ex-directory numbers in order to contact the subject of an article before it is published in order to obtain comment on the proposed publication --

  • -- that cannot, as a matter of language or logic, be within Section 32(1)(a) because the processing of the relevant personal data, namely the obtaining of the ex-directory number and then storing it, is not with a view to publication of that data in any journalistic material. Do you see that?

  • It's not with a view to the publication of the data, but it is with a view to publication, and as an ex-journalist, I must say that I think the process of approaching subjects for checking out a story is absolutely essential, and I would be very concerned if newspapers weren't trying to contact people. The question is: do they contact people lawfully?

  • If you look at Section 32(1)(a), what is being published, Mr Graham?

  • The activity is for the purpose of the preparation of an article for publication, and some may make it into the paper and some may not. And indeed when the journalist has made the phone call, it may be there's a perfectly satisfactory explanation for the thing he's checking out and that kills the story. That's called journalism.

  • Yes, but what may happen is that the journalist contacts the subject, the subject gives his or her version of events, and it's that version of events which finds its way into the journalistic material. Are we agreed?

  • Yes, it's the version of events rather than the ex-directory number.

  • That's right, and that's why the ex-directory number and the processing of that number has nothing to do with the publication of journalistic material. Isn't that the correct analysis?

  • I appreciate that it's your view. It's not something that I've given great consideration to.

  • I'm not expressing a view; I'm just making --

  • You're putting a proposition which I don't immediately recognise.

  • I wouldn't put the argument if I thought it was completely wrong, obviously, Mr Graham, but I'm just putting it out for consideration and seeing your response to it. Have you obtained leading counsel's advice on Section 32?

  • Certainly I haven't and I'm not aware that the office did before my time. But isn't this angels dancing on the head of a pin? Parliament clearly intended, and it's in my first witness statement, that there should be a significant carve-out for press activity, which indeed is in line with the recitals to the directive which the Act implements. So if the point is put to me that Section 32 covers the writing of this piece, but it doesn't cover the obtaining of the evidence, I find that, well, a challenging distinction about which I would need to think further.

  • It may spring from the language of Section 32(1)(a) before we even get to Section 32(1)(b). It is a simple linguistic approach, which may or may not be consonant with the policy and objects of the Data Protection Act.

    But it's relevant to section 43. If you look forward to 08039.

  • "(1) If the Commissioner --

    "(a) has received a request ..." but that doesn't apply here, so park that one.

    "(b) reasonably requires any information for the purpose of determining whether the data controller has complied or is complying with the data protection principles ..."

    Then I paraphrase: you may serve a notice on the data controller requiring the data controller to provide you with specified information relating to the request or to compliance with the principles.

    So that means that if we fall outside Section 32, because Section 32 disapplies virtually all --

  • -- of the data protection principles save the seventh principle, if we don't fall within Section 32 and you have some basis, or you reasonably require, in fact it says, any information, you can serve a notice for example on JJ Services, or on any search agency, asking them to provide any information relating to the request or to explain whether or not they are complying with the principles. That's very straightforward, isn't it?

  • Why haven't you done that?

  • We're talking current rather than historic.

  • We're also talking hypothetical, but nevertheless --

  • We're not talking hypothetical because we know Express were using JJ Services until at least 2010. We also know that newspaper organisation, and they're in good company, because others do as well, are using search agencies systematically. You could fire off, under Section 43, a number of information notices in like terms to all these people to find out how they're comporting themselves.

  • Do you accept that?

  • I'm interested in the point you're putting to me. I wonder where "reasonably requires" comes in.

  • It's not reasonably believed that any contravention has occurred. "Reasonably requires any information" would include inquiring whether or not there is compliance with the data protection principles, wouldn't it?

  • So it's a spot check, if you like?

  • Mr Jay, I simply say Parliament has given the Information Commissioner all sorts of responsibilities, and I'm applying my resources in those areas where I have reason to believe there may be misconduct, and what you've described to me doesn't compel me to start scattering around Section 43 notices.

  • It doesn't compel you, no, but there's certainly a power for you to do it, isn't there, Mr Graham?

  • Yes, there is. I accept that.

  • And you also knew that Parliament, speaking as it were as the mouthpiece of the nation in September 2009, was specifically concerned with this issue, weren't they?

  • Yes, indeed, and I put the -- I gave evidence to that committee, but I also reminded them that there was the outstanding matter of acting on the 2006 report, because the Information Commissioner's office had taken the view that there should be action against the suppliers and the dealers, rather than acting against the users.

  • But hasn't the focus of the office been far too much on the issue of activating Section 77 and Section 78, which involves political ramifications, rather than the straightforward activation of your powers under the Act? Wouldn't you accept that?

  • No, because the problem that I've been looking at since 2009 is the problem of information going missing from databases. It's a general problem. And the courts are imposing such modest sentences that it's not a disincentive. We have had in the past seven months four prosecutions in the magistrate's court and the going rate is about £100 an offence. So my focus has been on trying to get through this log jam of a stand-off between -- and I think this does concern the Inquiry -- the politicians and the newspapers over something that the newspapers say they're not doing anyway.

    So I think it's absolutely right that I've been spending my time on that, but I assure you, my investigators are deeply into all sorts of investigations and abuses, but I haven't asked them to drop everything and go and see how Mr Whittamore is getting on.

  • Can I suggest this, Mr Graham, that your difficulty, possibly, with persuading Parliament, or indeed the executive, is that in the absence of evidence that offences are being committed, people are saying, "Why do we need to impose a custodial sentence?" It might be --

  • Let me just complete the thought. It might be said that the better way to proceed is to get the evidence, or at least to go down the line of inquiry. You start with Section 43. It takes you half a day to formulate your pro forma request of the search agencies, Mr Whittamore, and if necessary the newspaper groups. You wait and see what evidence comes back. Some of the evidence may be unclear, or incomplete, so you serve a further notice. If something untoward is there, then you can activate your other powers, including your enforcement powers. If the evidence is not there, then you publish that fact. But isn't this fairly basic, Mr Graham?

  • With respect, the pressure that I've been applying is very much evidence-based. You say there are no offences being committed. There are many, many offences being committed. It just doesn't happen to include newspapers at the moment, so far as I can see. I don't think it's going to strengthen my case if I add further cases. The previous government accepted the need to respond to the T-Mobile loss of customer data, and had a consultation in the autumn of 2009 about activating Section 77 and 78 of the Criminal Justice and Immigration Act, and then it all went quiet. Why did it go quiet? Because the press went into full defence mode again saying this is an absolute outrage, it would chill investigative journalism, and by the way, we don't do that sort of thing.

    We just can't seem to get past -- I'm hoping very much this Inquiry will do that -- we can't get past the government saying "Love to help you, but Lord Justice Leveson is looking at all of this".

  • Is it your position that notwithstanding what I've attempted to do, show that there is a basic way through this, get the evidence base by using Section 43, that you're still not going to do it, Mr Graham? Is that the position?

  • I think I've made my point to the government and to Parliament. I've been supported by the Justice Select Committee. It's simply a question of the orders being placed for commencement. When the political will is there --

  • I'm not interested in the statutory instruments, I'm interested in your powers. When I said you're still not going to do it, I mean you're still not going to serve or consider the serving of information notices under Section 43; is that right?

  • I'm saying that the regulatory priorities of the Information Commissioner's office must be concerned about the current problems where there is evidence of abuse. We're absolutely flat out on a whole range of issues, whether it's car insurance or these cases of information security in the health service, in local government, issuing civil monetary penalties, dealing with freedom of information requests and so on. You're not dealing with a complacent regulator who can't be bothered to exercise his powers. I'm just saying --

  • I think the answer to my question is no, you're not going to do it?

  • I think we can take a pause here and let me see if I've understood the position.

    First, your office has many statutory responsibilities which engage you, you have a very great deal to do in connection with those statutory responsibilities, and much material which you believe properly should lead to enforcement or other action?

  • You have, along with many other government bodies, limited resources within which to do it, so you deploy your resources as effectively as you feel is right?

  • If I could just say, I'm not pleading poverty. Every organisation has limited resources. We're actually quite well resourced on the data protection side. But every regulator has to make choices and to focus on the areas of greatest concern and abuse, and it usually begins with some evidence of things going wrong or else a programme of checking sector by sector. I'm not going to get the massive expansion of resources that would allow me to do everything that the various parties who have an interest in this Inquiry would like.

    I had a letter last night, and no doubt this will be coming up later in the evidence, saying why have I not made contact with every individual whose name is mentioned in the Motorman file? And part of the answer to that is going to be I would have to take on a veritable army of extra people. I'm also going to say I don't think it's necessary, but this isn't practical. All regulators have to pick their battles, prioritise their resources, and I just need some evidence of there being a problem before I divert resources to do it.

  • And in relation to the penalty point, there are two aspects to it. First of all, you believe that for the real cowboys who are misusing data, there ought to be the potential in the courts to pass a custodial sentence?

  • Not just a fine, and for the real cowboys it might well be a custodial penalty, but I'm really concerned to access the full range of penalties available to the courts to make the punishment fit the crime.

  • And you're concerned about the size of fines, and the problem with that, of course, is that bodies that could recommend or talk about the size of fines, such as the Sentencing Council, are concerned that if the legislation is about to change, there's no point in doing a lot of work on that, if suddenly the whole thing is going to be altered, and therefore what you're trying to do is to break the Gordian Knot?

  • To break into it. I understand.

    And to Mr Jay's proposition that it would involve no great exercise of your powers to monitor what has happened in the ten years since Motorman, you identify the other competing demands upon your time and the need to deploy your team most effectively?

  • Indeed. But I hasten to say, sir, that if a recommendation of your Inquiry was that I should consider deploying my resources that way, of course I'd have to take it very seriously.

  • I understand that. I understand that.

    Now, the position in relation to Mr Rhodri Davies' point is, I am told, that the statement which we've got and which I've seen was received on Friday and was not circulated, in error. But it was received on Friday.

    I don't know whether you've seen it, Mr Caplan?

  • We haven't had it either.

  • What I would like to do is I'm going to take the break early and just pause so that you can read it. If you need further time, then I will interrupt Mr Graham's evidence, with due apologies to him, and move on to something else, so that you can read it rather more leisurely than ten minutes would give you.

    I don't think you will find anything that is of sufficient concern to you. It addresses some of the concerns that have been raised about access to material, it deals with Ms Hartley's evidence on access. It contains an explanation, and I think it's not fair to say regret, so I don't think it will cause trouble, but I think if we just take five minutes for you to see it, then you can look through it and see whether you need any more time.

  • May I just mention one other matter, it's really a correction. Mr Graham, I think it was a slip of the tongue, said that he was unaware that Associated Newspapers had continued to use Mr Whittamore until 2010.

  • I meant the Express. I apologise.

  • All right. Very good. Right, we'll just have the break now, so that that can be done. Thank you very much.

  • (A short break)

  • Mr Davies, Mr Caplan and those others concerned, I am sorry that you did not have this statement in advance. If you are in difficulty, then I shall cope with it.

  • Mr Graham, may I move on to some different topics, one is related.

    At the Select Committee hearing on 2 September 2009 you extended an offer to newspaper organisations, if so advised, to come and look at the Operation Motorman material. That's clear from EV353. We needn't --

  • -- dig it up. It's clearly stated there. Your evidence is as well that that was repeated at a Society of Editors conference at Stansted in November 2009; is that correct?

  • And your second statement makes it clear that the offer was taken up somewhat belatedly by the Guardian Media Group, first of all in February 2011; is that correct?

  • And then it wasn't until the announcement of the Inquiry that there was a rash of approaches to your office; is that correct?

  • As part of the wave of approaches, Associated, I think Express and News International contacted your offices; is that right?

  • Yes, and also the public -- the publishers at one of the magazines, the magazine Closer, I think, Bauer.

  • Whether or not that's a coincidence may be open for consideration. But can I deal with the issue which I know Hacked Off have raised with you and are keen that I put, which is in effect the individuals in the Whittamore notebook should be written to and advised that their data has been unlawfully accessed, that the nature of the data should be given to those individuals and if not the journalists, then the newspaper organisation who procured that information should be named to the victims. What is your response to that, Mr Graham?

  • I did deal with this in my evidence to the Select Committee back in September 2009, and of course a fair number of individuals have had access to the Motorman material, either through subject access requests, "I think I may be in the file, I want to check, I want to see, I want to get it corrected", or indeed as a result of court orders, where litigants in various civil actions have persuaded the court that they ought to see the material.

    When I went before the Select Committee in 2009, it was apparent to me that a number of members of the committee had a very good understanding of what was in the Motorman files. I suspected at the time that that might have come from some of the material which had been released under court order. Members seemed to be particularly well briefed. And at that point, I formed the view that the Section 59 position where we had not been making available information in -- to the newspaper groups certainly needed to change.

    So far as the individuals are concerned, I'm still very ready for subject access requests by those who may be concerned. The difficulty about simply contacting everybody lies in the nature of the dossiers themselves. Mr Jay, you've seen them. I don't know whether all the core participants are in that position, but these are notebooks, and sometimes the information contained in them is deeply obscure. I said in my witness statement that the individual who made the notes must have had a perfect understanding of what he was intending, but it isn't always clear. That partly explains why there's sometimes a discrepancy between the spreadsheets that we've compiled and the notebooks.

    If you said to me, "You ought to notify everybody whose name appears in the Motorman files", I'd be hard pressed to do that. It isn't just a question of resources, it's it isn't immediately clear who is being referred to, because it isn't just celebrities, it's all sorts of people who may or may not be part of a story concerning a celebrity or whatever it is; it's just a name. Sometimes it's just a surname.

    I think Richard Thomas put the point very well in his response to you on this matter, when he said: if, having established the identity of the individual and their address, we wrote to them to say simply, "Your details appear in the Motorman file, we can't tell you why", that might be an even greater breach of privacy than the original offence, because there would be a suggestion that there's no smoke without fire. Other members of the family might see the letter and say, "Hey, what's going on?" and I couldn't tell them any more than a name appears in a file.

    It would be a phenomenal undertaking. Just because there's a name, John Smith, I would then have to work out which John Smith. The example I gave to the Select Committee was Ziggy Stardust, that's a bit easier to do, but there are an awful lot of very anonymous names and it simply isn't practical.

    However, if Hacked Off and their lawyers are representing particular individuals, then that's what we're here for: subject access requests, off we go.

  • Some miscellaneous questions now, Mr Graham. I think you told one of the seminars that your understanding of the position in relation to the statutory instrument which might activate Section 77 and Section 78 is it's the position of the government that they're awaiting the outcome of this Inquiry; is that right?

  • The -- I mean, yes. The situation basically is that there was a consultation, there has to be a consultation under the Act, in the autumn of 2009, and we've never had a response to that consultation. And the new government wasn't particularly keen to proceed.

    When I started drawing to their attention the cases involving NHS workers and bank workers, I was told that nothing could be done about it because this was a matter now before the Leveson Inquiry.

    The learned judge has -- the Chairman has said it's finding a way of cutting through the Gordian Knot, and the suggestion to me was that I could use my audit powers to cut through the Gordian Knot and provide an even better evidence base. I'm not sure it's really about evidence.

    Another way of cutting through the Gordian Knot is for this Inquiry to conclude that that particular proposal, commencing a provision in an Act of Parliament which has been properly debated, is a matter for government and that the Inquiry wouldn't wish to be seen to be holding things up. There seems to be a dialogue with the deaf at the moment.

  • The penultimate question --

  • Would I have to conclude, or reach some conclusion, to the effect that I did not accept the proposition that implementing these provisions would have the chilling effect that is contended?

  • If you took the view, sir, that Section 78, which applies a reasonable belief test to the public interest, was strengthening the position of the press, then that's good to go. But the dilemma we are in is that our press friends say that they're not doing this anyway, so why should concerns about press freedom, which are in any case misguided -- and I say this as a proud former journalist -- in any case misguided, those considerations shouldn't be seen to be holding up something which I need to deal with the many breaches of Section 55 which are going on all the time.

  • That's a different point, because it's unlikely that I am going to be able to assert or that I would want to feel it's necessary to assert this is not happening, or to the contrary, that this is happening. I am looking at the culture, practices and ethics of the press, and I'm not looking at specifics.

  • The specifics are, to some extent, prohibited from me because of the distinction between parts one and two of my Inquiry, and the ongoing criminal investigation. Now, that might bite specifically on RIPA-type offences, but doesn't necessarily exclude any offences that arise from a police investigation.

    That's one issue, but if I am going to have to be able to say that I don't think this -- ignoring the fact whether they're doing it or not -- I don't think it in any sense chills the freedom of the press, then that probably is a conclusion that is going to have to wait for the Inquiry, isn't it?

  • I'm merely thinking about what I could do and when, depending upon the view that I have formed.

  • Indeed. I understand the difficult position that the Inquiry is placed in.

    Another way of tackling the Gordian Knot is for the press, who are so convinced of their rectitude, to get together with the Ministry of Justice and say, "Okay, we accept that Section 77 and Section 78 should now be activated because we're not doing it anyway and the 78 defence is okay by us."

  • Well, I'm not going to enter into the debate that the press might have with the government. I have enough difficulties with the debate that the press are having with me, without entering into another debate. But that's the issue, in any event. All right.

  • Your ideas for future press regulation, Mr Graham, in particular having regard to your experience with the ASA. Are there any ideas that you'd like to share with the Inquiry?

  • It's obviously a personal view born of experience, but I was for eight or nine years the Director General of the Advertising Standards Authority, which is an effective self-regulatory body. Of course, I can't speak for the ASA these days, I'm two and a half years out of it and there have been all sorts of changes in structure and so on. But I simply offer the view that I gave at the seminar, which preceded this stage of the Inquiry, and that is for self-regulation to be credible, it has to be effective, and it has to be so structured that the public can have confidence that those who are being regulated are not just looking after their own interests.

    The difference between the Advertising Standards Authority and the Press Complaints Commission in my day was that there was a much greater separation of function between the investigatory and adjudicatory side, the Advertising Standards Authority, and the code writing side, the Committee of Advertising Practice and latterly the Broadcast Committee of Advertising Practice. A lay majority on the ASA council with the minority of experienced industry people not being the equivalent of serving editors.

    I don't know whether it had always been that way with the ASA. When I came in in 2000, a number of the newspaper trade associations, who of course are part of the tripartite advertisers, agencies and media, were very concerned to explain to the new boy that I shouldn't be seeking to adjudicate all the time, it should be a word in the ear. The industry would follow the lead that the regulator gave; it didn't need to be done so publicly and so formally. And I disagreed. But I was told that I should look at the way that Lord Wakeham runs the Press Complaints Commission, and I think there may have been a bit of a parting of the ways there.

    As an observer, and a friendly observer, I think it's a huge mistake to have serving editors serving on the Press Complaints Commission. I think the editors should write the code, and be prepared to be judged on the titles' observance of it, and then it's up to a demonstrably independent and effective Press Complaints Commission to apply that code. That was the model in the advertising standards business, that is widely respected, and it's something to which the media, the non-broadcast media, of course are involved in through their membership of the Committee of Advertising Practice, so I don't see why it's such a difficulty when it comes to the PCC.

  • Thank you very much, Mr Graham.

  • You don't have a problem, though, Mr Graham, or you didn't have a problem when you were the Director General of the ASA, in relation to non-participation?

  • Well, no, because that was -- I don't know how I could apply this point to press content regulation. The beauty of the advertising system was that the three legs of the stool, the advertisers, the agencies and the media, had a mutual interest in the credibility of commercial communication. They were all in it together. And so if an advertiser said, "Well, two fingers to the ASA, I'm taking no notice of you", they simply didn't get space in the papers.

    I've been searching for what is the equivalent principle that binds all the participants in the newspaper business together. You would hope that it would be about a search for truth, and an editorial independence, and all those good things. It seems to be about being allowed to continue drinking in the last-chance saloon and the politicians wouldn't dare to do anything else.

    I'm not in favour of statutory regulation of the press, and I'm speaking purely personally here, but self-regulation will only survive if it's credible. If it's lost the confidence of the public, then something has to give, and different arrangements have to be put in place. But if you don't have credibility, you can make all the speeches you like about self-regulation, and you get back to the observation of the LSE professor who said, being a sceptic, that self-regulation in some circumstances had as much relationship to regulation as self-righteousness does to righteousness.

  • Thank you. There may be some more questions.

  • I wonder if I could just raise two points with Mr Graham?

  • Mr Graham, my name is Rhodri Davies. I appear for News International. I wanted to ask you about two things. The first is custodial sentences in Section 55, which you've talked about a lot. As I understand the problem, the problem that you want to attack at the moment is what you've called the modern scourge of data theft, and as far as you know at the moment that's not a problem with the press, it's the banks, the NHS and so on?

  • We were always, I think, at the ICO looking at it from the point of view of the suppliers and the dealers rather than the users. As I've said ad nauseam, I have no evidence as to use, but I am concerned that I don't have effective powers to deal with what is a modern scourge just because we do everything online. We're all very vulnerable.

  • So the practical target you want to hit at the moment is the people who leak data from NHS databases, banking records and so on?

  • Yes. I would also say the sort of people Mr Whittamore and his friends were ringing up.

  • It can't be limited to that, can it? Because if there was no market, then there would be no worth doing it.

  • Indeed, sir, but the fundamental principle that we were dealing with in this report all those years ago was that those who were in a position of trust in the health service or the phone companies or the DVLA didn't see passing on information for sums of money as being particularly serious. Certainly the penalties that were imposed were not enough to disincentivise it, even if you got caught, and the whole attitude of society and the courts to this modern phenomenon, because we're now in the information age, was that it was no worse than pinching the office stationery.

    So I'm not looking to jail lots of people. I can't imagine that a journalist going about his or her business with a proper story and a good public interest reason for doing it would be in any trouble with the ICO or with the courts, but I want to deal with the problem of the courts being limited to fines and then dealing with people who are of limited means and can only be fined about £100, and the court doesn't have the option of doing anything about a community sentence or tagging or curfew or whatever else might be involved. It's just the going rate is £100. It happened again the week before last. It's nothing.

  • The political problem, if I can call it that, that you have in getting the existing legislation into force is what we might call the perceived effect on the press. It's not the bank clerks who are campaigning against this; it's the perceived effect on the press which is your problem?

  • My problem is the press. It's not the perceived effect on the press, it's the behaviour of the press, worrying away at a penalty designed to deal with a problem which they say doesn't apply to them, and I say, "If it doesn't apply to you, get out of the way."

  • Isn't the way through this, which might perhaps satisfy both parties, simply to exempt from the threat of a prison sentence anyone who is acting for the special purposes of journalism, artistic or literary matters, using the phraseology in Section 32?

  • How much of a good deal do you guys want? Excuse me, sir, for being heated about this, but you fought everyone to a standstill back in 2006/7. You did it again in 2009/10. You've got so many privileges and exemptions. It's perfectly possible for a journalist to do a decent job legally. There is Section 78 on the statute book, applying the reasonable belief of the journalist that what they were doing for publication was in the public interest. It's going to be very difficult for anyone to strike that down, but there are some people who believe that that's more generous to the press than really should have been the case, but that was the deal.

    Now, if I understand it, you're sort of coming back for more -- on behalf of your clients.

  • What I'm trying to do, Mr Graham, is to point out a route through the problem, or one that bypasses the Gordian Knot, and I'm not quite understanding why this solution is not acceptable to you.

  • Well, this isn't a negotiation about these things, but it sounds to me as if the representatives of the press want to be somehow above the law. Surely a free press operates within a framework of law, and a vibrant and healthy press, challenging those in authority and doing the job that it should be doing and the job that I joined the profession to do, operates within the law. Yes, okay, you sometimes have to apply the dark arts to get the story, and then you're accountable for it. And if you're really in trouble, that's the mitigation that you put to the court. But we can't keep having more and more carve-outs and reductions and special cases, surely.

  • The point is, Mr Graham, that prison sentences do have a more chilling effect than the lesser sanctions available to the court --

  • Is that right, Mr Rhodri Davies? I'd be very interested to see evidence about that, because one thing is for rock solid certain: interception of communications did have a custodial sentence attached to it, and it didn't seem to have stopped a great deal of activity.

  • Well, that certainly was true-up to 2006/7, I entirely understand that.

  • I'm not, I think, trying to make a cheap point. I'm not doing that at all. But I am concerned about the evidence base for the assertion. I'm not stopping you, I understand the point, and of course you can pursue it.

  • Well, I think -- really, what I'm putting to you, Mr Graham, is your own assumption, which is that if the sentences available for breach of Section 55 are increased and the range of sanctions available to the court is widened, then you think that that will have a beneficially chilling effect on people who would otherwise contemplate a breach of Section 55?

  • It would have a beneficially chilling effect on DVLC workers handing out car numbers and addresses based on those car numbers in exchange for money. It will have a beneficial chilling effect on health workers who apparently think it's perfectly okay to access someone's medical records in order to find the telephone numbers of their in-laws, who they're having a fight with, or the bank clerk in Haywards Heath who thinks it's fine to look at someone's bank records in order to provide the case in her husband's defence in a sex attack trial. That's what we're dealing with. What's that got to do with the press? If you're not doing this stuff, get out of the way.

  • Yes. I entirely understand those problems.

    Can I just ask you about one other thing, which is perhaps not unrelated. Ex-directory telephone numbers. Mr Jay asked you about the databases such as GB Group, and as I understand your evidence, your position at the moment is that have you no reason to think that they operate unlawfully?

  • It's actually better than that. I was reminded in the break that the Information Commissioner's office had been consulted by GB Group when they started, and while that doesn't provide a Good Housekeeping seal of approval, it does at least indicate that there was a responsible data controller seeking to establish what the rules were, and we have seen evidence of information being corrected and numbers being withdrawn in relation to subject access requests.

    But as I said earlier, just because that information is available online quite lawfully doesn't provide a cover for obtaining the same information through unlawful means.

  • Yes. So we may be in the position that a journalist can lawfully obtain an ex-directory telephone number from GB Group or one of their competitors?

  • If somebody has either shared their number with a provider and isn't particularly concerned about whether or not it's shared more widely, or there's simply been a mistake and that individual hasn't withdrawn the number from the service, yes, that's certainly the case.

  • But if that number is not available on a database lawfully held by GB Group or someone else, then would it be your position that if a journalist wanted to obtain that number in order to contact someone to contribute to a story or to put a story to them, that would be a public interest ground for obtaining the data?

  • Because of the need to contact the individual for a quote?

  • Yes. So why would you not do the old basic journalistic stuff of ringing around and getting the number? I'm amused to see, for example, that my second statement has helpfully redacted the address of the office of the Information Commissioner. I think that's taking privacy a little far.

  • If you want to contact me, you don't need my home number. You ring up the office and you say, "It's urgent we speak to Mr Graham, please contact him, tell him to ring us", and that's what reporters do. You don't have to ring up a private investigator to bribe someone at the Driver and Vehicle Licensing Centre to get details.

  • Suppose it's a retired civil servant who is not on good terms with his ex-office.

  • Then you might well in that case have a public interest defence. I'm not quite sure where this is going because you can't generalise from the specific. I didn't notice many of them in the Motorman dossier, by the way.

  • There is at least one, actually.

  • I must have missed that. Actually, Mr Davies, you raise that point. You'll see in the transcript of the Select Committee hearing that I was embarrassed by questioning from Mr Farrelly, the MP, who was talking about the case of Peter Kilfoyle, the former minister, who was apparently incandescent that he hadn't been informed by the Information Commissioner's office that the Mail, I think, had been trying to get hold of his home number. I was flustered and I said I'd better go and find out more about this, and when I looked at the file, this was on the weekend that he had resigned from the government. It was a Sunday night, and news desks, very reasonably, I felt, wanted to get hold of his information.

    So I wrote to the Mr Kilfoyle and said, "You're very welcome to exercise your subject access request, come and view the material and so on but that's what it's about", and I heard no more.

    That's an example of a manifestly defensible use of that service.

  • But is it? Why wouldn't a journalist simply have been able to contact the relevant ministry from which he had resigned and say, "We are very keen that Mr Kilfoyle have the opportunity to make some comment. Could you please ask him to phone us"?

  • Perhaps they tried that, I don't know. But if someone's just stormed out of the government, the ministry's not going to be terribly helpful in putting you in touch with the ex-minister.

  • So that is a situation, Mr Graham, where, as I understand it, you think that the journalist might very well have a public interest defence?

  • I say it's arguable, anyway.

  • It's arguable. That's the difficulty, isn't it? Because once we're into the territory of it's arguable, and it's a prison sentence if you're wrong, do we not have a chilling effect?

  • But all you have to advance is the reasonable belief that the story you're pursuing was in the public interest. Really, if you can't make that case, you shouldn't be in journalism. It's a very, very good increased defence for journalists.

  • I'm just wondering how far that goes. So you say if there's a reasonable belief that the story you're pursuing is in the public interest, then that would be a public interest defence to obtaining an ex-directory telephone number?

  • I'm not going to allow you, Mr Davies, to use the opportunity to try and tie the Information Commissioner down. Let me say what I presently believe, and then people can make submissions in due course.

    I presently believe that the new potential provision contains both subjective and objective elements, so not only must the journalist believe that it's in the public interest to do so, but there must be reasonable grounds for that belief. Thereafter, if I follow up your earlier question, the Information Commissioner would have to decide whether there was evidence to rebut that defence before he thought of bringing a prosecution.

    If he thought of bringing a prosecution because he thought he could rebut the defence, it would be open to the journalist to advance the defence in court. If the court decided against the journalist, then it would have to decide on a scale how grave the particular offence was, and in my experience of sentencing criminal cases, which extends over 27 years, I don't think you'll find that there would be any question of a mandatory sentence in those circumstances at all.

  • Yes, all right. I think I have ventilated the two points I wanted to raise.

  • Thank you very much indeed.

  • Mr Graham, thank you very much.

    Yes, Mr Barr. Do I gather from the fact that there are two chairs that we are having two witnesses together?

  • We are, sir. Good morning. It's going to be Google first, and the witness statement by Google has been provided by Ms Daphne Keller, but in communications with Google, it's become clear that in order for the Inquiry to have the full benefit of answers from a broad-ranging experience at the company, it's going to help if Mr David John Collins sits with Ms Keller and they answer from their collective expertise.

  • Please could I call Ms Keller and Mr Collins.