9 Annex II

9.1 Comparative analysis of the regulatory framework at the EU Member states level

The main source for the information gathered is the Bird & Bird comparative analysis, except when othewise indicated.

9.1.1 Austria

Last Reviewed: 05.06.2018

Sec 9 ADPA provides special provisions concerning the processing of personal data in the context of freedom of expression and information. According to these provisions, several regulations of the GDPR (especially its principles and rights of data subjects) do not apply to the processing of personal data for journalistic purposes as well as for scientific, artistic or literary purposes.

9.1.2 Belgium

Last Reviewed: 13.09.2018

Section 16 of the DPA allows processing of personal data carried out by adequate means for journalistic purposes or for purposes of academic, artistic or literary expression. Sections 17 et seq. stipulate exceptions to information obligations (Section 17), protection of source and content of information (Section 18), exceptions to right to restriction of processing (Section 19), information about rectification and erasure (Section 20), and limitation of the right to object (Section 21).

9.1.3 Finland

Last Reviewed: 13.11.2018

According to Section 27 of the Data Protection Act only limited provisions of the GDPR apply to the processing of personal data for the purposes of journalism or academic, artistic or literary expression. This approach upholds the situation as it was under the abrogated Personal Data Act.

9.1.4 France

Last Reviewed: 11.02.2019

According to the French regulatory framework, when personal data is processed for journalistic, artistic or literary expression purposes, provisions regarding information notice, data transfers, data subject rights data, retention and the processing of special categories of data do not apply.

9.1.5 Germany

Last Reviewed: 23.05.2018

§ 35 of the new German Federal Data Protection Act (‘FDPA’) exempts the controller from its obligation to erase personal data where the erasure is, in case of non-automatic data processing, impossible, or only possible with disproportionately high effort and the data subject has a minor interest for erasure. § 27(2) FDPA restricts the data subjects’ rights subject to certain further requirements.

9.1.6 Ireland

Last Reviewed: 07.06.2018

Under section 43(1) of the Act, the processing of personal data for the purpose of exercising the right to freedom of expression and information, including processing for journalistic purposes or for the purposes of academic, artistic or literary expression, shall be exempt from compliance with certain provisions of the GDPR where, having regard to the importance of the right of freedom of expression and information in a democratic society, compliance with such provisions would be incompatible with such purposes. The Data Protection Commission may refer any question of law which involves consideration of whether processing of personal data is exempt under section 43(1) to the High Court for its determination.

9.1.7 Italy

Last Reviewed: 25.10.2018

IDPA title XII - sections 136-137-138-139 . The code of practice on the processing of personal data & journalistic activities (Annex A.1 of IDPA) remains in force. The compatibility of this code with the GDPR will be reassessed by the Italian Data Protection Authority (hereinafter, the “Authority”). The Authority should review it before the end of the calendar. Furthermore, Italy incorporated some principles regarding the journalistic exemption through a code of ethics, namely

  1. The requirement to avoid any kind of prior censorship.
  2. The exemption of the right to information in the collection of data when the professional exercise requires it.
  3. The journalist’s duty to rectify errors and inaccuracies without delay.
  4. The need to be particularly careful when the processing affects specially protected data In such circumstances, processing shall be limited to facts of undisputed public interest. Moreover, it shall be limited to the essential aspects of the information and avoid references to persons not related to them. Even in the case of matters that the interested party himself may have made public, or which are appreciated in public behaviour, the right to be protected is reserved.
  5. It is suggested that the “essentiality” of the information be sought, the proportionality of what is made public, so that it is limited to what is essential in relation to the case.
  6. When a news item relating to health is referred to, the dignity, decorum and private life of the affected person shall be respected, especially when serious or terminal illnesses are involved, abstaining from publishing analytical data or data of strictly clinical interest. However, an exception may be made to this requirement where, in accordance with the principle of proportionality, if the person concerned is in a position of particular public importance. The same applies to information on sex life.

9.1.8 Netherlands

Last Reviewed: 17.09.2018

Article 41 GDPR Execution Act provides that the GDPR Execution order does not apply where personal data are processed exclusively for journalistic purposes or for the purposes of academic, artistic or literary expressions. In addition it sums up a list of chapters and articles in the GDPR that are also not applicable for these purposes: (a) article 7(3), 11(2);(b) chapter III;(c) chapter IV (with the exception of articles 24, 25, 28, 29 and 32);(d) chapter V;(e) chapter VI; and (f) chapter VII. " Art. 41 UAVG limits the scope of certain obligations in connection with (compelling) general interests in alignment with art 23 GDPR. Therefore, it provides for exceptions to the rights of the data subject and the duties of the controller. The GDPR partially (art. 12 -21 and 34 GDPR) does not apply (insofar appropriate and proportionate) to data processing in view of - inter alia - important public interest objectives, public security, the protection of the data subject or of the rights and freedoms of others; and/or the collection of civil claims.

9.1.9 Spain

Last Reviewed: 05.03.2019

The SDPA does not include any legal precept that conciliates freedom of expression with data protection. There is only a reference to freedom of expression in the article 85 regarding the right to freedom of expression in internet that everyone has.

9.1.10 Sweden

Last Reviewed: 06.09.2018

Data Protection Act paragraph 1:7: the GDPR and the Data Protection Act shall not be applied to the extent that it would breach the laws on freedom of expression. The Data Protection Act provides that articles 5-30 and 35-50 of the GDPR shall not be applicable to the processing of personal data for journalistic purposes or for purposes of academic, artistic or literary expressions.

9.1.11 United Kingdom

Last Reviewed: 23.05.2018

The UK Data Protection Act 20181 offers a more nuanced take on the boundaries of the exemption, suggesting that some of the GDPR provisions would not apply to data processing where three cumulative conditions are met (Cain, 2018): - the data in question must be being processed with a view to the publication of journalistic material, - the data controller must reasonably believe that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and - the data controller must reasonably believe that the application of the listed GDPR provision would be incompatible with its journalistic purpose.

The UK ICO advises to consider the second condition– “public interest” – on case-to-case basis taking into consider existing codes of conduct and balancing the public interest in the subject matter with the level of intrusion into the private life of an individual. It is not surprising to see “public interest” included as one of the criteria as it features prominently in the jurisprudence of the ECtHR. Although the ECtHR refrained from providing a definition of the “public interest”, it recognized this notion to cover the public, political and historic debate, issues related to the politicians, behavior of the public servants, large corporations, governments, crime-related matters. However, other, less apparent matters may also be considered as meeting public or general interest (Bitiukowa, 21).