Generally, if the reporter lawfully obtained it, it would be the person who released the data to the reporter, and not the reporter, who would have the responsibility.