Pandora Papers Leak

Recently the news has been reporting details of nearly 12 million documents leaked from offshore locations regarding the dealings of the superrich in offshore tax havens. It appears from the Pandora Papers leak that the dealings of the individuals in question are largely legal.

Given that our firm of solicitors practising in England and Wales, we are unable to comment on whether the leaked documents from the various offshore jurisdictions have been leaked illegally/in breach of data protection legislation in those jurisdictions. The Data Protection legislation would however apply to the processing of those documents once they were handed over to organisations in the UK.

The Pandora Papers were worked on in the UK by BBC Panorama and the Guardian.

Data protection laws

In the UK, data protection is governed by the Data Protection Act 2018, which incorporates the GDPR (UK GDPR). This legislation requires a company to have a basis for processing the data that they hold about individuals in accordance with the UK GDPR. The basis upon which a company in the UK can lawfully process data about an individual include and are limited to:

1. The individual has given informed consent;
2. The processing is necessary because of a contract that the company has with the individual;
3. The processing is necessary to comply with the law;
4. The processing is necessary to protect someone’s life;
5. The processing is necessary to perform a public task or a task in the public interest; or
6. There is a legitimate interest in processing the data of an individual.

Clearly, the individuals in question will not have consented to their data being processed. In respect of the above list, arguably the Guardian and Panorama could rely upon number five above as clearly tax avoidance/evasion is against the interests of the public at large.

This public interest criteria is reinforced for the Guardian and Panorama by the UK GDPR exemption in Schedule 2, paragraph 26 of the Data Protection Act 2018, which confirms that some of the provisions of GDPR “do not apply to the extent that the controller reasonably believes that the application of those provisions would be incompatible with” the purposes of journalism if:

Comment

Notwithstanding the fact that the Pandora Papers relate in part to individuals within the UK and that they contain sensitive personal data relating to them, there is little that they can do to prevent the Guardian and Panorama from processing that data due to the above referred to exemption unless the individuals are able to demonstrate that there is no public interest in the processing of data relating to that individual. The more high profile the individual the more likely it will be that the processing of the data for journalistic purposes is in the public interest. Whether the processing of an unknown individual’s data that has lawfully used a tax loophole to avoid paying tax could be in the public interest is less clear.

The Guardian and Panorama will however have needed to record the basis upon which they deemed the public interest criteria to apply and if a case does make its way to the Courts in respect of the Pandora Papers, such a note is likely to feature centrally in whether the public interest criteria has been met.