The exemption in section 32 of the Data Protection Act 1998 should be narrowed in scope, so that it no longer allows, by itself, for exemption from: (a) the requirement of the first data protection principle to process personal data fairly (except in relation to the provision of information to the data subject under paragraph 2(1)(a) of Part II Schedule 1 to the 1998 Act) and in accordance with statute law; (b) the second data protection principle (personal data to be obtained only for specific purposes and not processed incompatibly with those purposes); (c) the fourth data protection principle (personal data to be accurate and kept up to date); (d) the sixth data protection principle (personal data to be processed in accordance with the rights of individuals under the Act); (e) the eighth data protection principle (restrictions on exporting personal data); and (f) the right of subject access. The recommendation on the removal of the right of subject access from the scope of section 32 is subject to any necessary clarification that the law relating to the protection of journalists' sources is not affected by the Act.