Ethics and data protection

01The framework in outline

Investigations that handle information about identifiable people are processing personal data, and the General Data Protection Regulation applies alongside Irish implementing law. The framework recognises journalistic purposes and provides for exemptions from parts of it, but the exemptions are conditional and partial rather than a general exclusion.

The duties that persist in practice are proportionality, minimisation, accuracy, security and a decision about retention. This page describes practice at a general level; it is not legal advice, and specific situations should be checked with a qualified lawyer or the publication's data-protection adviser.

02Proportionality before collection

The question to answer before gathering anything is what public interest the work serves and whether the intrusion is proportionate to it. Public interest means matters the public has a legitimate stake in — the use of public money, safety, abuse of power, wrongdoing — and not simply anything an audience would find interesting.

Proportionality is a live test rather than a form filled in at the start. As an investigation narrows, the material needed changes, and collection that was justified at the outset may cease to be. Recording the assessment and revisiting it is what makes the judgement defensible.

03Minimisation in practice

Minimisation means holding what the story requires and no more. Bulk collection because material might later be useful is the opposite of it, and it creates a store of personal data that has to be secured and could be lost or compelled.

Special categories — health, political opinion, religious belief, trade-union membership, sexual life, biometric data — and information about children require particular restraint. Where a dataset contains fields the investigation does not need, removing them early reduces both risk and the burden of protecting them.

04Security of research material

Research files should be encrypted at rest and in transit, access-limited to those who need them, and separated from general working documents. Devices need full-disk encryption; backups need the same protection as originals; shared drives need reviewed permissions rather than default ones.

Communication with sources deserves specific thought: which channel, what metadata it leaves, what is stored on a device that could be lost, seized or examined. A source who is exposed by poor operational practice is harmed by the journalism intended to serve the public interest.

05Assessing harm before publication

Harm assessment asks who could be affected by publication and how. It covers direct subjects, family members, colleagues, bystanders visible in material, sources who could be identified by process of elimination, and vulnerable people whose situation may be worsened by exposure.

The output is usually not a decision to publish or not, but a decision about detail: whether a name is necessary, whether an address or workplace should be omitted, whether an image should be cropped, whether a distinguishing characteristic should be withheld. Each of those choices should be recorded with its reason.

06Right of reply and accuracy

People and organisations criticised in a report should be given the substance of the allegations and a fair opportunity to respond before publication. This is an accuracy safeguard as much as a fairness one: replies routinely correct misreadings of documents and identify context that changes a finding.

Accuracy duties also apply to inference. Presenting a plausible interpretation of records as an established fact is inaccurate even where each underlying record is correct, and the distance between what documents show and what they suggest should be visible in the language used.

07Retention and deletion

Every investigation should end with a retention decision: what is kept, for how long, in what protected form, and what is deleted. Material may need to be retained to defend a published story, but that justifies keeping specific evidence rather than an entire working archive.

The decision should be written down and applied, including for copies on personal devices and in message threads. An undeleted research file is a standing risk to the people it describes long after the story has been forgotten.

08Material a person published about themselves

The fact that someone posted something publicly is the beginning of the analysis, not the end of it. Most people publish for an audience they can picture — friends, colleagues, a local community — and material that circulates far beyond that audience can cause harm the author never contemplated. Reproducing a post to an audience of hundreds of thousands is a different act from the one the author performed, even where no rule was broken in finding it.

The questions that follow are practical. Is the person a public figure acting in a public capacity, or a private individual who happened to be present? Does the material need to be reproduced, or can it be described? Would quoting it identify someone else — a bystander, a family member, a colleague visible in an image? Has the person since deleted it, which is a signal about their own view even where an archived copy exists?

Children and people in vulnerable situations require more caution rather than a different rule. Material posted by or about a child, information touching health or immigration status, and anything indicating a person is at risk are treated as reasons to describe rather than reproduce, and to withhold identifying detail unless the public interest specifically requires it. Where a decision is finely balanced, it is recorded with its reasoning before publication, not reconstructed afterwards.

09Publishing the ethical reasoning

Where a story involved a difficult decision — withholding a name, using material of contested provenance, publishing a document with redactions — a short note explaining the reasoning increases the reader's ability to judge the work.

This is not a confession of doubt. It states what was decided and why, and it is one of the few available ways to demonstrate that a method existed rather than asserting that one did.