Lorna Woods, Professor Emerita, University of Essex
Photo credit: Océanos y
dados, via Wikimedia commons
Introduction
This case deals with one of the
perennial questions that has faced legal regimes which recognise special
treatment for journalism and new media since the advent of “new media”, that
is, how far are such exceptions and preferential treatment extended? While a
question for individual States to balance the freedom of expression concerns
with other rights and societal interests, for the EU there is also the fact
that Member States seemingly take very different approaches. The Swedish rules, the subject of this case,
provide broad protections and exemptions from data protection rules; but are
they compatible with the GDPR?
The Facts
The case originated when ND, who
had been convicted a criminal offence, sought to have details of that offence
removed from the database provided, for a fee, by Legal Newsdesk Sweden. The database allows individuals and
businesses to search for those who have been subject to criminal prosecution
before a Swedish court. ND’s request for erasure of the data was not met and ND
sought damages for failure to comply with data protection rules. Legal Newsdesk
Sweden relied on a Swedish law exempting journalism from the GDPR, and the fact
that the relevant authority had granted Legal Newsdesk Sweden a certificate
confirming the protection applied (utgivningsbevis). Further this meant
that the only remedies available to ND against Legal Newsdesk Sweden would be
criminal prosecution or civil claims for defamation.
The Questions
The case revolved around the
Swedish law’s compatibility with the GDPR and specifically whether the rules
fell within the space created by Article 85. Article 85 provides:
(1) Member
States shall by law reconcile the right to the protection of personal data
pursuant to this Regulation with the right to freedom of expression and
information, including processing for journalistic purposes and the purposes of
academic, artistic or literary expression.
(2) For
processing carried out for journalistic purposes or the purpose of academic
artistic or literary expression, Member States shall provide for exemptions or
derogations from Chapter II (principles), Chapter III (rights of the data
subject), Chapter IV (controller and processor), Chapter V (transfer of
personal data to third countries or international organisations), Chapter VI
(independent supervisory authorities), Chapter VII (cooperation and
consistency) and Chapter IX (specific data processing situations) if they are
necessary to reconcile the right to the protection of personal data with the
freedom of expression and information.
The national court referred three
questions around the scope of Article 85(1) and (2) and their relationship to
one another:
Is the list
in Article 85(2) exhaustive or does Article 85(1) allow member States to adopt
legislative measures in relation to further categories of activity?
Does the
Swedish approach of limiting the remedies available to a person to criminal
proceedings or defamation find an appropriate balance between freedom of expression
and data protection?
Can the
making available of information based on public documents in a database for a
fee without any processing or editing
constitute processing of personal data for the purposes identified in Article
85(2) (specifically journalistic purposes)?
Judgment
As regards the first question, the
Court held that the right to derogation from data protection rules applies
only in relation to the categories enumerated in Article 85(2). The Court noted
that Article 85(1) establishes a general rule about reconciliation of freedom
of expression and GDPR requirements, but Article 85(2) operationalises it. Although the term "including" confirms
that journalistic, academic, artistic, and literary processing are only part of
that reconciliation, paragraph 1 in itself does not grant independent exemption
authority; that is the role of Article 85(2). The requirement to provide
exceptions only applies to those exceptions listed. Exceptions are interpreted
narrowly, and taking this approach provides a “fair balance”, as required by
the principle of proportionality, between Charter rights.
As regards the second question,
Article 85(2) lists the rights that may be limited, and that list does not
include the rights to remedies provided for in the GDPR. While there is Member State procedural
autonomy, the GDPR confers directly effective rights and they can only be
limited by conditions found in the GDPR. This means limitations such as those
found in the Swedish law are not compatible with the GDPR.
The third question concerned
whether the provision of the database constituted processing of personal data
for journalistic purposes. The Court
confirmed, first, that the making available of documents to the public constituted
processing. That exemptions were to be provided if necessary to provide the
balance specified in Article 85(1). Moreover, the definition of journalism from
Article 9 Directive 95/46 was in principle transposable to inform the concept
of journalistic purposes, which was not otherwise defined, for the GDPR. The Court referred to the definition in Satskunnan
Markkinaporsii and Satamedia (Case C-73/07):
“disclosure
to the public of information, opinions or ideas, irrespective of the medium
which is used to transmit them”.
The Court also referred to Recital 153 GDPR which
emphasises that the term should be interpreted broadly. The Court, however,
continued to say it
“cannot cover
all forms of expression but must be understood in a way that takes into account
what differentiates, from the point of view of the manner in which they are
created, journalistic expression from other forms of expression” [para 64]
The Court then referred to the
case law of the European Court of Human Rights on protection of journalism
within freedom of expression (Article 10 ECHR). From this body of
jurisprudence, the CJEU identified three aspects:
- carrying out the role of editing or adapting
material, or publishing according to an editorial line or policy;
- verification of factual claims for reliability; and
- compliance with journalistic ethics.
The Court suggested that a
service that simply makes criminal convictions available to anyone willing to
pay, without editorial review or processing, is unlikely to satisfy those
requirements. The Court did emphasise
that when the protections apply, they apply also to prior research as to
publication. So convictions can be useful
raw material for journalists, but the processing is for journalistic purposes only if those documents
are used exclusively for such activity.
Commentary
This judgment is a strong defence
of data protection and the coherence of the GDPR regime. The main point of interest in this judgment
is the Court’s approach to journalistic purposes. Before discussing that, it is
also worth noting that in the Court’s approach to the relationship between
Article 85(1) and 85(2), it has taken an approach with favours maximum
harmonisation rather than allowing too much space for Member States to go their
separate ways. This re-emphasises the
supremacy of EU law, and the narrowness of exceptions thereto, even when
States’ individual constitutions are in issue. It is arguably a narrow
interpretation of Article 85. There is a
question of how the balance that the Court has struck in Article 85(1) might
impact other forms of data processing that impact the public information sphere
– what for example, about search engines (already the subject of some
jurisprudence: Case C-136/17 GC
et al and Case C-460/20 TU
and RE v Google), social media and – increasingly – chatbots?
Rights are a theme throughout
this judgment but it is interesting to note that while the rights which the
Swedish rules sought to limit were those relating to remedies, the Court did
not rely on the right to a remedy as a fundamental right to support its
argument. Rather, it relied on the fact that these were directly effective
rights derived from the GDPR. The concern was the priority of EU legislative
objectives over national concerns.
The main significance is the
establishment of a three stage test for “journalistic purposes” which had
hitherto been undefined. The previous
position had been established in Satamedia, and further elaborated in Google
Spain (Case C-131/12) and Buivids
(Case C-345/17), all of which seemed to be orientated towards elaborating the
idea of informing the public which is the base of the definition in Satamedia. It is arguable, that Legal Newsdesk Sweden’s
activities might not fall within the scope of this definition anyway – though
the position was certainly unclear. In identifying further criteria, however,
the Court has provided more clarity and likely narrowed the scope of the
journalistic purposes exception. It is
interesting to note that the Court has taken cases about the level or
protection awarded to journalists within the ECHR jurisprudence to identify
qualifying criteria for being a journalist (of carrying out journalistic
purposes) in the GDPR context- a shift from assessing how to identifying who.
Whether this shift is significant in practical terms is rather uncertain – both
Courts seem to be asking if the person is behaving according to relevant standards
to gain the benefits of extra protection (and neither require institutional
affiliation as a precondition of receiving the status).
While the focus in the case was
just about resale of public information without any amendment,
contextualisation or commentary (and possibly data brokerage generally
including digital archives, research platforms, aggregators, and people-search
services), the implications go further and impact “citizen journalists”,
bloggers, gossip sites and other public communicators who might have assumed
that they would benefit from protections, even though they might also not have
bothered with fact checking and ethical considerations around news-gathering
and publication. While they might have argued that they contributed to informing
society, now there are more specific and arguably less vague requirements to
satisfy – those around verification and ethics. Although this is a narrowing of
their protections, it does not mean such speakers are off air – it means that
they have to pay more attention to how they acquire and retell stories. It is also important to note that the Court
has not as a point of principle excluded private actors (rather than those
earning a living from journalist) from the scope of state protections, and nor
does the fact that such activities are done for money affect the assessment of
whether they are done for journalistic purposes or not. And, of course,
traditional journalism and media are not affected by this ruling.
One final point is also clear:
the Swedish system will require significant overhaul if it is to comply with
GDPR requirements.
No comments:
Post a Comment