3 The journalistic exemption in the GDPR

3.1 Introduction and background

The main legal tool regarding data protection issues at the EU level is the GDPR. It contains the general principles and rules that apply to all processing of personal data within the EU or involving EU citizens. Within its provisions, it is possible to find a specific reference to the issues at stake. We are obviously talking about the so-called “journalistic exemption”, as stated by Article 85 of the GDPR, which is shown in the box below.

Article 85. Processing and freedom of expression and information
1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
3. Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.

This clause was included in the GDPR as a kind of solution to alleviate the tensions between freedom of expression and the right to data protection. Indeed, it was aimed at codifying the general need to balance these two fundamental rights. At a glance, it simply left in the hands of the Member States the possibility to exempt those who exercise their freedom of expression for “journalistic purposes” from specific GDPR rules and obligations (Biriukova, 14). This journalistic exemption was not a novelty in the EU regulation. The article 9 of the Data Protection Directive of 1995, the predecessor of the GDPR, already included a similar provision, which brought some divergence in the regulation of this issue in the EU Member states. A Recommendation by the Article 29 Working Party1 summarized the situation by dividing the Member states in three main groups:

  1. In some cases data protection legislation does not contain any express exemption from the application of its provisions to the media. This is the current situation in Belgium, Spain, Portugal, Sweden and the United Kingdom.
  2. In other cases the media are exempted from the application of several provisions of data protection legislation. This is the current situation in the case of Germany,11 France, The Netherlands, Austria and Finland. Similar derogations are envisaged by the draft Italian legislation.
  3. In other cases the media are exempted from general data protection legislation and regulated by specific data protection provisions. This is the case in Denmark for all media and in Germany in relation to public broadcasters, which are not covered by federal or Länder data protection laws, but are subject to specific data protection provisions in the inter-Länder treaties which regulate them.

The GDPR only introduced minor changes in this scenario. As a matter of fact, article 85 of the GDPR provides a very broad framework for action to the Member States. They are to concrete the scope of the journalistic exemption and the circumstances in which it applies. However, for their regulatory developments to be valid, they must be aligned with the provisions of the RGPD and the European Convention of Human Rights (ECHR), of course. Therefore, one must think about the rules to be followed in the journalistic environment from a double perspective. On the one hand, one must always keep in mind a series of rules that are embedded in the GDPR and/or the ECHR and the jurisprudence by the EUCJ and the ECtHR. These must be strictly followed in the practice of this profession. On the other hand, one must consider that there may be certain differences between Member states, depending on the particular regulatory framework. In any case, they should not be excessive since the principles and rules of the GDPR and the ECHR must always be respected.

Nevertheless, it is important to highlight that some Member states have not fully adhered to these standards. In Bulgaria, for instance, the Constitutional Court has recently declared the national approach towards the implementation of Article 85 unconstitutional. This was due to the inclusion of an article in the Personal Data Protection Act that set out 10 criteria for deciding whether journalists have complied with the balance between the right to information and that of personal data protection. The Court considered that such criteria were too vague and could create a risk of arbitrary interpretations, a circumstance that opened the way for the Commission for Data Protection to have unpredictable power to interpret it not necessarily in the public interest regarding pluralistic information about the policies and activities of government2.

Furthermore, In Romania, the data protection regulator had been criticized for using the GDPR to silence the critical voices in the national media. In November 2018, it was reported a case in Romania that might serve well to reflect the tension between data protection and freedom of speech. It was related to an article about corruption scandal involving a politician and his close relationships to a company being investigated for fraud that was published on the Bucharest-based Rise Project Facebook page. Sometime after the publication, the Romanian data protection authority (ANSPDCP) sent a series of questions to the journalists who authored the article. In theory, this was due to the necessity to ensure a balance between the right to the protection of personal data, the freedom of expression and the right to information. The authority held that that Rise journalists had violated GDPR in publishing the videos, photos, and documents—in essence, the private data of Romanian citizens—to support the reporters’ allegations. The journalists were asked for information which could reveal the article’s sources, under the advertisement that if they did not cooperate, they could have to face a penalty of up to 20 million euros (Warner, 2019). A bunch of twelve human rights and media organisations reacted to this request by sending an open letter to ANSPDCP that called for ANSPDCP to carefully analyse GDPR cases that might endanger freedom of expression. It also demanded an urgent and transparent mechanism to be put in place for assessing claims involving data processing operations for journalistic purposes. At the same time, sixteen digital rights NGOs sent a letter to the European Data Protection Board, with ANSPDCP and the European Commission in copy, asking for GDPR not to be misused in order to threaten media freedom in Romania (Benezic, 2018). Later on, some European parliamentarians in Brussels criticized the case against the Rise Project and disputed the Romanian interpretation of GDPR enforcement. Finally, this all led to warnings from the European Commission (Nielsen, 2018). However, at the present moment it is hard to know what might finally happen, since the case is currently ongoing.

There are, however, some other Member states that have taken the opposite way. For instance, Sweden considered that article 85 of the GDPR gave a larger space for exemptions to the member States than the Data Protection Directive did, not least because article does not requires that the processing shall be carried “solely” for journalistic purposes (a wording that was included in the Directive). Moreover, the Swedish Government put to the forth that recital 153 of the GDPR states that the concept of freedom of expression has to be interpreted broadly. On this basis, the new Data Protection Act is including wider exemptions or derogations than the Personal Data Act of 1998 (McCullagh, 45).

3.2 The personal scope of the exemption

What does journalistic purposes mean? What does in mean “journalism”? There is nothing similar to a definition of journalism in the Regulation, since it was removed from the first drafts of the GDPR3. Some of the Member states have created their own definitions. Most of them are quite open, with the main exception of Austria, which reserved the exemption exclusively to “media undertakings, media services and their employees” (Cullagh, 2019, 5).

However, it seems quite clear that the GDPR bets for an open, inclusive meaning of the term, which might be applicable even though the national regulation does not reflect it. Indeed, in the Buivids case4, the CJEU accepted that the journalist exception was applicable to a citizen who published a video recording in youtube, proved that the object of the recording and publication thereof was the disclosure of information, opinions or ideas to the public. Similarly, in the Satamedia case5 the CJEU ruled that data collection and dissemination activities could also be considered “journalistic”, if their aim was to disclose to the public information, opinions or ideas, no matter the means employed. The fact that the controller was a nonmedia organization for profit-making purposes was considered irrelevant to these purposes.

It is not clear what would happen if an Austrian organization that could be considered as a media undertaking or a media service implements any of the derogations or exceptions provided by article 85. Somehow, this would provoke a conflict between the Austrian regulation and the GDPR, which explicitly begs for a broad extension of the concept of journalism. In our opinion, it is probable that the interpretation by the GDPR would prevail.

Keeping this in mind, it seems that a broad definition of journalism makes much more sense than a narrow one. Natalija Bitiukova has written that “journalism refers to the production and distribution of information and news to an indeterminate number of people in pursuit of the public interest and contribution to the public debate” (Bitiukova, p.4). Her wording works perfectly well with the GDPR, in our opinion.

Journalism, thus, must be considered as an activity that covers all output on news, current affairs, consumer affairs or sport6. This is because the exemption covers information processed only for journalism. The concept can also include publisher and editors of internet blogs or web pages since comments made on these tools should be considered as a manifestation of their own freedom of expression. Of course, this doesn’t mean that every blog or comment posted online will be journalism, since some bloggers simply intend to take part in normal social interaction or other recreational internet use. Moreover, search engines are expressly excluded from the concept and therefore, of using the exception7.

3.3 Processing personal data: the material scope

As merely shown, article 85 specifies that exemptions or derogations might be applicable to everyone who is aimed at disclosing to the public information, opinions or ideas. However, what type of data could be considered as such? Which personal data can be processed for journalistic purposes without having to comply with the GDPR? Again, there is not a simple answer to this question. In principle, Member states have a word on the material scope of the journalist exemption and their policies are not always the same. For instance, article 7 of the Romanian law no. 190/2018, which introduces derogations for the processing of personal data for journalistic purposes, offers only three alternative scenarios under which personal data can be processed for journalistic purposes8:

  1. if it concerns personal data which was clearly made public by the data subject;

  2. if the personal data is tightly connected to the data subject’s quality as a public person; or

  3. if the personal data is tightly connected to the public character of the acts in which the data subject is involved. If either of these three situations applies, the GDPR (except for the Sanctions chapter) is entirely excluded from application.

As these three alternative scenarios are extremely limited compared with the current jurisprudence of both the European Court of Justice and the European Court of Human Rights. Both courts consider that there are several factors that need to be weighed in before an analysis, the most important ones being the contribution to a debate of public interest on the one hand and the damage to data subjects’ private life on the other. Therefore, the Romanian law does not seem to perform an adequate reconciliation between the right to the protection of personal data and the right to freedom of expression and information.

The United Kingdom adopted a totally different approach. Its Data Protection Act 2018 considers that the journalist exception applies to personal data processing where three cumulative conditions are met:

  • the data in question must be being processed with a view to the publication of journalistic material,
  • the data controller must reasonably believe that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest,
  • and the data controller must reasonably believe that the application of the listed GDPR provision would be incompatible with its journalistic purpose. This approach seems much more in line with the regulatory framework.

3.4 The condition for the exemption

The exemptions or derogations foreseen by article 85 are only applicable “if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information”. What does this necessity apply? Recital 153 provides valuable insight to answer this question:

Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data pursuant to this Regulation. The processing of personal data solely for journalistic purposes, or for the purposes of academic, artistic or literary expression should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the Charter. This should apply in particular to the processing of personal data in the audiovisual field and in news archives and press libraries. Therefore, Member States should adopt legislative measures which lay down the exemptions and derogations necessary for the purpose of balancing those fundamental rights.

Thus, the GDPR is willing to ensure an adequate balance between data protection and the right to freedom of expression and information, as enshrined in Article 11 of the Charter9. This is why derogations or exemptions from certain provisions of the GDPR only apply if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information. This idea of balancing both rights has been endorsed by the case-law of the ECtHR and the CJEU, which requires a balancing act to be carried out on case-by-case basis whenever there is a real conflict between such rights. The key point, however, is how to proceed to do so. The ICO states that in order to do this adequately, organizations should take into account:

  • the general public interest in freedom of expression,
  • any specific public interest in the subject matter,
  • the level of intrusion into an individual’s private life, including whether the story could be pursued and published in a less intrusive manner, and
  • the potential harm that could be caused to individuals. Existing guidance set out in industry codes of practice can help organisations to think about what is in the public interest10.

In this context, the notion of public interest is particularly relevant, according to the jurisprudence by the Court of Justice of the EU or the European Court of Human Rights, as mentioned in cases such as Buivids11 or Satakunnan v. Finland12. However, it is hard to concrete. Indeed, the ECtHR has historically refrained from providing a definition of “public interest”. Nevertheless, it declared, in the context of the Von Hannover cases13, that “an initial essential criterion is the contribution made by photos or articles in the press to a debate of general interest. Thus, it seems that this notion covers “the public, political and historic debate, issues related to the politicians, behavior of the public servants, large corporations, governments, crime-related matters. However, other, less apparent matters may also be considered as meeting public or general interest.” (Biriukova, 21).

To sum up, there are some variables that shall be surely present in the definition of public interest. It must involve “an element of proportionality – it cannot be in the public interest to disproportionately or unthinkingly interfere with an individual’s fundamental privacy and data protection rights. If the method of investigation or the details to be published are particularly intrusive or damaging to an individual, a stronger and more case-specific public interest argument will be required to justify that, over and above the general public interest in freedom of expression.” (ICO, 33) Indeed, public interest cannot be reduced to the public’s thirst for information about the private life of others or to the reader’s wish for sensationalism or even voyeurism, as was the case of publishing details of the sexual activities of a public figure. If the sole aim of an article is to satisfy curiosity of the readership regarding details of a person’s private life, it cannot be deemed to contribute to any debate of general interest to society (Guidelines on Safeguarding Privacy in the Media, 12). For instance, in the Standard Verlags GmbH v. Austria (No.2) case, it was judged that a newspaper had violated the privacy of the persons concerned when it published an article commenting on rumors that the wife of the then Austrian President sought to divorce him and was maintaining close contacts with another politician. In the opinion of the Court, journalists can not report pointless gossip about politicians’ marriages.

The Guidelines on Safeguarding Privacy in the Media highlight that “in determining whether a person is a public figure, it is of little importance for journalists whether a certain person is actually known to the public. Journalists cannot be limited by the claims of concerned persons that they are not actually known to the public. What matters is whether the person has entered the public arena by participating in a public debate, by being active in a field of public concern or in public debate”. (Guidelines on Safeguarding Privacy in the Media, 12-20). A set of examples of sentences produced by the ECtHR and gathered in the Guidelines have been incorporated in the next table (full references are included in the Sources of Information section at the end of this Handbook).

These considerations open the gate to a more extensive debate: the debate on how to balance public interest against right to privacy. This will be analysed in the section of this Handbook devoted to legitimate interest as a legal ground for personal data processing.

3.4.1 Kurisprudence by the European Court of Human Rights about the concept of public interest

In Couderc and Hachette Filipacchi Associés v. France, a French magazine reported about the child fathered out of wedlock by Prince Albert II of Monaco. Publishing this information served the public interest to be informed about the rules of succession, which might prevent children born out of wedlock from succeeding to the throne. In addition, family members of the monarchy are also part of contemporary history; hence there is public interest in their lives.

In White v. Sweden, two newspapers published a series of articles in which various criminal offences were ascribed to Anthony White by a number of sources, including the murder of the former Swedish Prime Minister Olof Palme in 1986. The European Court of Human Rights considered that the unsolved murder of Olof Palme and the avenue of investigation were matters of serious public interest and concern.

In the case of Selistö v. Finland, a journalist was convicted and fined for having defamed a surgeon by writing two articles alleging that a patient had died as a result of the surgeon’s alcohol consumption during the night preceding the operation. The Court found that recounting the personal experiences of the surviving widower as well as matters of patient safety, concerned an important aspect of health care and as such raised serious issues affecting the public interest.

In Guseva v. Bulgaria, a representative of an association working on animal rights protection obtained three final court orders requiring a mayor to provide her with information relating to the treatment of stray animals found on the streets of the town over which he officiated. The treatment of animals was considered to be matter of general interest and to contribute to public debate.

In the case of Schweizerische Radio- und Fernsehgesellschaft SRG v. Switzerland the prison refused to allow a television station to carry out a televised interview inside a prison with a prisoner serving a sentence for murder. The media outlet had intended to broadcast the interview in one of the longest-running programmes on Swiss television. The Court stated that there is no doubt that a report about a convicted murderer who had always protested her innocence, attracted public interest and contributed on the discussion about proper functioning of the justice system.

However, pictures and information of a purely personal nature are not considered to contribute to a debate of general interest. In Von Hannover v. Germany, publishing pictures of Princess von Hannover participating in sports without her consent resulted in a violation of her right to privacy.

3.5 The material scope of the exception

Article 85 draws a broad scope for the exceptions and derogations, since it mentions Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations). Therefore, exceptions and derogations might cover general principles, the rights of the data subject, the controller and the processor, the transfer of personal data to third countries or international organisations, the independent supervisory authorities, cooperation and consistency, and specific data-processing situations.

However, it is essential to notice that this broad scope will not necessarily apply to all EU Member states. The clause explicitly states that Member states shall provide for exemptions or derogations, but it does not fix a concrete list of those exceptions. It only declares that they they shall by law reconcile the right to the protection of personal data pursuant with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. Therefore, the decision about the concrete measures to be adopted belongs to the Member states. They are supposed to develop such regulatory framework and notify to the Commission the provisions adopted regarding exemptions or derogations and, without delay, any subsequent amendment law or amendment affecting them.

At the present moment (November 2020), not all Members states have developed such legal framework. In Annex II we have included information about the regulation incorporated by EU Member states, including the data in which the modification was introduced. However, it might happen that some countries have changed their legal framework afterwards.

3.6 Applicable regulation

In general, journalist should try to avoid sending personal data outside the European Economic Area (EEA) without adequate protection. What counts as ‘adequate protection’ will depend “on the nature of the information, the purpose of the transfer and the legal position at the other end, among other things. This principle will not prevent online publication, even if this makes information available outside the EEA. If publication complies with the DPA in other respects (or is exempt as being in the public interest), it will be appropriate to publish it to the world at large.” (ICO, 26).

What if they are based in a Member state but willing to publish contents in other countries or in the web space? The GDPR states that “Where such exemptions or derogations differ from one Member State to another, the law of the Member State to which the controller is subject should apply”. This might cause weird consequences. For instance, it seems that a publications by a Spanish-based publisher (or blogger) could benefit from relatively lax rules on privacy of “celebrities” there, even if the publication in question would be barred if published by a French publisher and even though the Spanish publication is easily (and online directly) accessible from France. Furthermore, he or she could even benefit from fact of being based in Spain even if the publication was in French and directed at a French audience. This brief suggestion on applicable law is insufficient for the online environment. Unless this is more specifically addressed in the successor to the e-Privacy Directive, it might make the legal environment for free speech very unclear, particularly in the online digital environment (EDRI, 51).

  1. However, the Working Party also reported that “The differences between these three models should not however be over-estimated. In most cases, independently of any express derogation that may exist, data protection legislation does not apply fully to the media because of the special constitutional status of the rules on freedom of expression and freedom of the press. These rules place a de facto limit on the application of substantive data protection provisions or at least their effective enforcement. On the other hand the ordinary data”. See: Working Party on the Protection of Individuals with regard to the Processing of Personal Data, Data protection law and media, Recommendation 1/97, pp. 6-7, at: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/1997/wp1_en.pdf.↩︎

  2. Bulgaria’s Constitutional Court rejects data protection law clause, 17 November 2019↩︎

  3. Indeed, the draft read: “Member States should classify activities as”journalistic" for the purpose of the exemptions and derogations to be laid down under this Regulation if the object of these activities is the disclosure to the public of information, opinions or ideas, irrespective of the me dium which is used to transmit them. They should not be limited to media undertakings and may be undertaken for profit-making or for non-profit making purposes” (Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), COM/2012/011, https://eur-lex.europa.eu/ legal-content/EN/TXT/?uri=CELEX%3A52012PC0011).↩︎

  4. CJEU, Sergejs Buivids v. Datu valsts inspekcija, C–345/17, 14 February 2019.↩︎

  5. CJEU, Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy, C-73/07, 16 December 2008↩︎

  6. According to the ICO, “Taken together with art and literature, we consider it is likely to cover everything published in a newspaper or magazine, or broadcast on radio or television – in other words, the entire output of the print and broadcast media, with the exception of paid-for advertising (…) It would involve a wide range of activities, loosely grouped into production (including collecting, writing and verifying material), editorial, publication or broadcast, and management of standards (including staff training, management and supervision). In short, the exemption can potentially cover almost all information collected or created as part of the day to day output of the press and broadcast media, and comparable online news or current affairs outlets. However, advertising revenue, property management, financial debt, circulation, or public relations would not usually be considered as journalism.” (ICO, 29).↩︎

  7. CJEU, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, C-131/12, 13 May 2014, para. 81↩︎

  8. Complaint to the EU Commission by The Association for Technology and Internet (ApTI), 2018, at: https://www.apti.ro/sites/default/files/Complaint%20on%20Romanian%20implementation%20of%20the%20GDPR%20-%20ApTI.pdf↩︎

  9. Article 11. Freedom of expression and information. 1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. 2. The freedom and pluralism of the media shall be respected.↩︎

  10. ICO, p. 34↩︎

  11. CJEU, Sergejs Buivids v. Datu valsts inspekcija, C–345/17, 14 February 2019, paras 60-61.↩︎

  12. ECtHR, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, App no 931/13, 21 July 2015.↩︎

  13. ECtHR, Von Hannover v. Germany (No. 2), App Nos. 40660/08 and 60641/08, 7 February 2012, para. 109.↩︎