Editors’ note: This post was originally published on 12 February 2025

Section 179 of the Data Protection Act (DPA) 2018 places the Secretary of State under a duty to ensure that a Report is “la[id] before Parliament” on both the “use” and “effectiveness” of “relevant alternative dispute resolution procedures” in cases involving actual or alleged failures by media organisations, other than broadcasters, “to comply with the data protection legislation”. Such a duty applies at the end of a repeating three-year period. The procedures to be reported on are those provided by “persons who produce or enforce codes of practice” for such media organisations and are “alternative” in the sense of being extra-judicial. This duty was proposed after the Independent Press Standards Organisation (IPSO) – the principal self-regulator of the Press – stated (following Government pressure) that it would introduce a ‘compulsory’ arbitration procedure covering data protection. Speaking for the Government, the Advocate General for Scotland Lord Keen of Elie stated:

The effectiveness of dispute resolution will be determined by reference to its take-up and its resolution. It will then be for us – Parliament and the people – to determine in light of those facts whether we consider that further steps have to be taken.

This new duty was part of a package of Government measures which successfully saw off House of Lords’ demands for:

(i) the judiciary to award costs against media organisations who were not members of an approved regulator (such as Impress but (in)famously excluding IPSO) even in those court cases which were successfully defended (i.e. a version of Section 40 of the Crime and Courts Act 2013 which was never brought into force and was later repealed),

(ii) an Inquiries Act 2005 review into past unlawful or improper conduct by the media (i.e. a version of Part 2 of the Leveson Inquiry as had been initially promised).

This package also required the Information Commissioner’s Office (ICO) to produce a statutory data protection and journalism code (s. 124) and guidance on seeking redress against media organisations (s. 177) and placed it under an obligation to review journalism’s compliance with data protection law and good practice over a repeating period of initially four, and thereafter five, years (s. 178). Following on from an earlier blog exploring the ICO’s first statutory review of journalism under Section 178, this blog examines the fate to date of the Government’s reporting duties set out in Section 179.

As this blog highlights, the Government has not effectively published the statutory Reports and has not ensured that they analyse the effectiveness of media Alternative Dispute Resolution (ADR) by reference to both take-up and resolution as originally envisaged. Nevertheless, the data found in the Reports is useful and clearly shows that take-up of media ADR has been extremely low and also declining – in the case of the IPSO scheme from just 6 cases in the first period (2018-2021) to only 3 in the second (2021-2024). The Reports should, therefore, have found such schemes to have been generally ineffective and gone on to robustly examine why this has been the case. It is be hoped that, in making both Reports available online alongside this blog, a debate can commence on this and that Parliament might then consider the next steps required for effective dispute resolution, and redress where appropriate, to become a general reality in this space. It is also hoped that these statutory Reports will be both fuller and more effectively published in future.

Lack of Transparency and Timeliness

Given that the DPA 2018 was passed on 23 May 2018, the first Section 179 Report was to be “la[id] before Parliament” at the end of May 2021 and the second one at the end of May 2024. Guidance from the UK Parliament is also clear that “departments are responsible for ensuring their … Act Papers are published on gov.uk at gov.uk/official-documents promptly after laying” (emphasis added).

An immediate and serious problem is that neither Report can, in fact, be found on gov.uk or indeed has otherwise been effectively published by the Government. This is despite each Report clearly being labelled a “publication” and one explicitly stating that it “is available at www.gov.uk/official-documents”. This lack of transparency has rendered it impossible for the “people” to consider these Reports at all. The Department of Culture, Media and Sport (DCMS) did release both Reports subsequent to a Freedom of Information (FOI) request in the summer of 2024 and, without accepting that this was legally required, acknowledged at the end of September 2024 that it would be “better practice” for these to be published on gov.uk and that they would “endeavour to do so as soon as practicable”. As of the start of February 2025, this still has not happened. In order to ensure some transparency, both Reports have now been placed online (on the CIPIL website) alongside this blog.

Despite being required under law to be laid by the end of May 2021, the First Report indicates that it was not even commissioned by the Government until August 2022 and was not finally laid in the Commons and Lords until November 2022. Such a delay, of almost one and a half years, can only very partially be explained by Covid-19 and is clearly problematic. In contrast, the review for the Second Report was carried out in early 2024 and was duly laid in the Commons and Lords in (early) May 2024. Notwithstanding this, both Reports suffer from rather similar substantive flaws as elucidated below.

Unclear Scope and Limited Depth of Reports

As previously stated, Section 179 requires the Reports to assess both the “use” and “effectiveness” of “relevant alternative dispute resolution procedures” involving media organisations other than in broadcasting (which is subject to sui generis statutory regulation through Ofcom). However, an important caveat is that this duty is limited to those “cases” of dispute resolution “involving a failure or alleged failure … to comply with the data protection legislation”. Only two non-statutory procedures are designed to directly resolve disputes about data protection law per se, namely, the IPSO’s Arbitration Scheme and Impress’s Arbitration Scheme. The DPA 2018 Parliamentary proceedings make clear that it was such schemes which were to be the focus of the Reports. The only other procedure which directly focuses on data protection law is that which requires the statutory Information Commisssioner’s Office (ICO) to investigate, and consider taking enforcement action on the back of, complaints lodged by data subjects. Other procedures, including those run by IPSO and Impress, only consider disputes relating to their own extra-legal Codes although, since these do include commitments relating to both privacy and accuracy, the substantive overlaps with statutory data protection are both clear and strong.

Even if confined to procedures strictly concerned with data protection legal disputes, it is evident that a proper review of not only “use” but also “effectiveness” would need to be quite extensive. It is therefore of concern that both Reports, which were produced by the same Reviewer and have the same scope and structure, are extremely short – under ten pages in each case. It is also important to stress that the Government clarified during Parliamentary proceedings that the “effectiveness” of any procedure would be “determined by reference [both] to its take-up and its resolution”. It is therefore also a concern that both Reports were produced under Terms of Reference which only mandated consideration of “the effectiveness of those procedures where they have been used” (emphasis added).

Despite their brevity, neither Report confined itself to considering “relevant alternative dispute resolution procedures” concerned with data protection law strictly construed. Rather, consideration was also given to procedures based on extra-legal Codes as administered by IPSO, Impress and also national newspapers such as The Guardian (but not local or specialist Press sitting outside both IPSO and Impress). In contrast, the ICO statutory complaints procedure was deemed to fall outside of the statutory definition. This was despite the ICO being legally required to produce a journalism code under the DPA 2018 (which was not, in fact, sent to the Government until 6 July 2023 and not in force until 22 February 2024) and its complaints procedure being strictly concerned with alleged failures to comply with data protection law. Both reports justified exclusion this by reference to the fact that, although able to take other enforcement action, the ICO is unable to award individual compensation. However, this is equally true for IPSO’s Code complaints procedure which was considered. As a result of ICO’s exclusion, even basic information on the realities here are missing. (It may, however, be noted that the ICO’s statutory review of journalism report, which came out in early 2024, disclosed that it had received 488 journalism complaints between February 2020 and March 2022 but had declined to take any enforcement action in respect of journalism over that period or indeed throughout 23 May 2018 to 24 May 2022. These facts alone suggest that public external scrutiny of ICO’s track-record in this area would be very valuable).

As a result of their generally broad approach to relevant dispute resolution, both Reports include rudimentary information, principally of a statistical nature, on IPSO’s Code complaints procedure. (They similarly elucidate procedures run by Impress and four national newspapers which are not members of either it or IPSO, although given that IPSO oversees over 1,800 publications as against Impress’ roughly 200, IPSO is clearly the central actor under analysis). Unfortunately, however, the statistical information is generally not comparable between the Reports – for example, whereas the First Report states that 50,125 complaints in total were received during the initial review period (2018-2021), the Second Report notes that during the subsequent review period (2021-2024) IPSO received 8,837 “with a potential data protection element”. Moreover, what is not set out is the fact that the vast majority of complaints are rejected by IPSO during initial assessment. This was analysed in a January 2024 Report by the Press Recognition Panel – the Royal Charter body set up following Leveson Part One – as follows:

Even after excluding a number of categories of complaints from the total to remove potential duplications and matters clearly not within scope of the IPSO complaints scheme (third party or non-lead complainant, non-IPSO publisher, global jurisdiction, online reader comment, ongoing legal proceedings) then in the five years 2018 to 2022, IPSO investigated 3.82% … of the remaining complaints it received.

In addition, neither Report sets out any criteria for assessing the effectiveness of procedures or offers any independent assessment of this. Although the Second Report does include a partial summary of the April 2023 Review by Sir Bill Jeffrey which was commissioned by IPSO itself, it includes no mention at all of the Press Recognition Panel’s January 2024 Report. This found inter alia that “[t]he small proportion of complaints that pass IPSO’s initial assessment would suggest an approach of quickly rejecting complaints whenever possible”, that there was an “inequality of arms” even in the subsequent stages of the procedure, that IPSO had “never issued a fine against a publication” and that “[t]he limitations in practice of IPSO’s sanctions can leave complainants without an effective remedy”. (Although not noted in the Second Report, the latter issue was recognised even in the Jeffrey Review which argued that “[t]he move to digital, online delivery of news” had “reduced the ‘reach’ of [IPSO’s] sanctions for breaches of the Editor’s Code”).

Alarmingly Low Arbitration Scheme Statistics

Notwithstanding their consideration of Code-based complaints, both statutory Reports do recognise that the arbitration schemes run by IPSO and secondarily by Impress lie at the formal core of the “relevant alternative dispute resolution procedures” definition set out in Statute. They also set out basic factual information and statistics on this. Nevertheless, neither Report provides an assessment of the effectiveness (or otherwise) of these schemes or even sets out any criteria for such an assessment. In relation to the second Report, this is despite even the Jeffrey Review raising concerns about the way IPSO was operating its scheme, namely, that its “website include[d] a list of barristers able to act as arbitrators, more than half of whom are from a set which no longer exists … [which] suggests that this aspect of IPSO’s work receives less attention than it deserves”. (Although the particular problem noted has been helpfully rectified, a somewhat similar issue is that the IPSO scheme’s “[c]laim checklist” still states that “[t]he use of personal data is regulated by the Data Protection Act 1998” when, in reality, this has not been case since 25 May 2018). In addition, despite this being recognised as a legitimate concern at the time Section 179 was enacted, neither Report notes that major national news outlets such as MailOnline have been able to stay members of IPSO whilst entirely rejecting IPSO’s arbitration scheme.

The justification which the statutory Reports put forward for the lack of an effectiveness assessment is that the low number of arbitration cases renders this infeasible. Certainly, the figures which the first and, even more so, second Reports very usefully set out are remarkably low. Thus, the First Report lays bare that in the initial three-year period there were just 6 IPSO arbitration cases involving alleged breaches of data protection (2 of which had settled, 1 of which had been withdrawn and 3 of which had “apparently not yet been concluded”) and that there was just 1 Impress arbitration case similarly involving data protection (which had been resolved by mutual agreement). Meanwhile, the Second Report reveals that during the subsequent three-year period the number of arbitration cases involving alleged breaches of data protection had dropped to just 3 in IPSO’s case (with none progressing to formal arbitration) and that there was no use at all of the Impress’s scheme (whether concerning data protection or otherwise). It must, therefore, be accepted that an analysis of effectiveness exclusively focused on the specific experiences in these few cases would have been rather dubious.

Nevertheless, at the time Section 179 was enacted Parliament was explicitly promised that “[t]he effectiveness of dispute resolution will be determined by reference to its take-up and its resolution”. The extremely low and declining take-up of these arbitration procedures (and especially IPSO’s given its potentially wide remit) provide clear evidence that (for whatever reason) they have not proved effective in adjudicating disputes (and providing redress where warranted). Given the clearly problematic trend, the Second Report in particular should have explicitly recognised this and gone on to carefully and systematically examine why these schemes are not proving effective in the way in which Parliament clearly hoped. This would also have enabled a proper consideration of how this unfortunate situation might meaningfully be addressed. However, although the Second Report does recognise these very low numbers and includes some brief commentary on this, it ultimately invokes the frankly alarmingly limited extent of arbitration take-up to argue that “the Government should consider ending [the Section 179] requirement when legislative time is available”. However, if that were carried through then all duties to report to Parliament on this issue would end and it would be even more likely that the worryingly limited reality of media ADR would garner little to no public attention. That this was the Report’s “single recommendation” must itself call into question whether the statutory review and reporting requirement has been operating in the way in which Parliament hoped at the time the DPA 2018 was enacted.

Conclusions

Both statutory Reports on Media ADR include useful and important statistics on the extremely low and apparently declining use of these non-judicial procedures. This contrasts with the IPSO Annual Reports in 2021, 2022 and 2023 and the Impress Annual Report 2023-24, which did not set out any such information. Nevertheless, despite the UK Parliament’s guidance to the contrary, neither Report was effectively published and it was therefore impossible for “the people” to consider this as had been explicitly forecast. Moreover, neither Report analyses the “effectiveness” of media ADR or even sets out clear criteria for such an analysis. This omission is justified by reference to the very low take-up of these procedures. However, at the time the DPA 2018 was enacted, Parliament was promised that the effectiveness of any procedure “will be determined by reference to its take-up and its resolution”. The very and increasingly low take-up provides clear evidence that the procedures in place have not proved to be generally effective in the resolution of disputes and the securing of redress where appropriate. The Reports could have recognised this and gone on to carefully analyse the reasons for this lack of take-up. So long as the Reports were then effectively published, such an analysis would have been useful in enabling Parliament and the people to consider necessary next steps. Hopefully, this blog and the making available of both Reports online might still kick-start such a debate and, at the least, ensure that fuller and genuinely transparent statutory Reports on media ADR are forthcoming going forward.

David Erdos is Professor of Law and the Open Society and Co-Director of the Centre for Intellectual Property and Information Law in the Faculty of Law and WYNG Fellow at Trinity Hall, University of Cambridge. He is also an associate member of Matrix Chambers.

This blog has also been posted on Inforrm’s Blog.

(Suggested citation: D. Erdos, ‘Lost in Inaction? The Statutory Reports on Media Alternative Dispute Resolution (ADR)’, U.K. Const. L. Blog (12th February 2025) (available at https://ukconstitutionallaw.org/))