AKI (Estonia) - 2.1-1/24/1246-3074-22
From GDPRhub
| AKI - 2.1-1/24/1246-3074-22 | |
|---|---|
 | |
| Authority: | AKI (Estonia) |
| Jurisdiction: | Estonia |
| Relevant Law: | Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 13.10.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | Delfi Meedia AS |
| National Case Number/Name: | 2.1-1/24/1246-3074-22 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Estonian |
| Original Source: | AKI (in ET) |
| Initial Contributor: | dt |
The DPA ordered a media company to remove a data subject’s image from online articles and to replace their name with initials since the publication caused excessive harm to the person while the public interest in the depicted events diminished over time.
English Summary
Facts
An individual (the data subject) filed a complaint with the Estonian DPA (AKI) after failing to receive a response from a media publisher (the controller) to his request for data erasure under Article 17 GDPR.
The data subject requested the controller to remove his name and photo from news articles arguing that the processing of his personal data affected his and his family’s livelihood and well-being.
The DPA made the same request to the controller. The controller proposed an alternative solution, namely de-indexing the articles. However, the data subject rejected the controller’s solution. Therefore, the DPA re-submitted the request for data erasure. The controller once again refused to comply with the erasure request and de-indexed the articles.
Holding
The DPA found that the news articles in question caused excessive harm to the data subject. Furthermore, the DPA noted that there was diminished public interest in the information contained in the news articles.
Therefore, the DPA ordered the controller to remove the image of the data subject and to replace his name with initials in specific articles in line with Article 17 GDPR. Failing to do so, the DPA may impose a penalty payment of €200 repeatedly and for each violation until the controller complies with the order.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Estonian original. Please refer to the Estonian original for more details.
PROTECTION OF PRIVACY AND STATE TRANSPARENCY PRECISE WARNING in the case of personal data protection No. 2.1-1/24/1246-3074-22 Precept maker Kaire Jürgenstein, lawyer of the Data Protection Inspectorate Time of precept making 13.10.2025 in Tallinn and place Recipient of the precept – Delfi MeediaAS (10586863) e-mail address of the personal data processor: info@delfi.ee Members of the Management Board of the personal data processor responsible person RESOLUTION Based on § 56 (1) of the Personal Data Protection Act (IKS) and Article 58 (2) (c) and (g) of the General Regulation on the Protection of Personal Data (IKÜM), the Data Protection Inspectorate issues a mandatory precept for compliance: - to remove the photograph and name of X from the articles set out in the factual circumstances of this precept warning and replace name with initials or characters. The Data Protection Inspectorate has set the deadline for compliance with the precept as 27.10.2025. The compliance with the precept must be reported to the Data Protection Inspectorate's e-mail address info@aki.ee by this deadline at the latest. CHALLENGE REFERENCE This precept can be contested within 30 days by submitting either: - a challenge under the Administrative Procedure Act to the Director General of the Data Protection Inspectorate or - a complaint under the Administrative Court Procedure Code to the administrative court (in this case, the challenge in the same matter cannot be reviewed again). Challenging the precept does not suspend the obligation to comply with it or the implementation of the measures necessary for compliance. PENALTY WARNING If the precept is not complied with by the specified deadline, the Data Protection Inspectorate will impose the following on the addressee of the precept based on § 60 of the Personal Data Protection Act: A penalty of 200 euros for each violation related to the article. A penalty payment may be imposed repeatedly until the injunction is complied with. If the addressee does not pay the penalty payment, it will be transferred to the bailiff to initiate enforcement proceedings. In this case, the bailiff's fee and other enforcement costs will be added to the penalty payment. WARNING OF MINORITY PENALTIES For failure to comply with the injunction pursuant to Article 58(2) of the General Regulation on the Protection of Personal Data, misdemeanor proceedings may be initiated on the basis of Section 69 of the Personal Data Protection Act. The extrajudicial proceeding for the misdemeanor is the Data Protection Inspectorate. FACTS AND CIRCUMSTANCES X is in the proceedings of the Data Protection Inspectorate (AKI) regarding the processing of his personal data by Delfi Meedia AS in various articles. According to the complainant, years later, he has continued to experience repeated embarrassing moments in his professional and private life, which affect his and his family's livelihood and well-being, although the complainant has not been criminally punished or convicted. The complainant applied to Delfi under Article 17 of the Code of Civil Procedure with a request to remove the complainant's name and photos from the articles and replace the name with characters, but did not receive a response from the data processor. The complainant applied to AKI with a request to remove his photos from the articles and replace his name with a pseudonym or characters. The articles in question: /../ AKI submitted an inquiry to Delfi Meedia AS, to which the data processor replied /../ AKI submitted based on the response letter a proposal to Delfi MeediaAS to remove the complainant's photos and name from the articles, to which Delfi Meedia AS replied in the negative, but with its own justifications and proposal. In its proposal, the data processor proposed deindexing the articles as a solution, which would make the articles inaccessible to search engines and ensure the best balance of media rights and would be the least infringing measure on freedom of the press. The AKI submitted the data processor's proposal to the complainant for the publication of an opinion. The complainant considered the proposal to be insufficient and therefore inappropriate. The AKI took the complainant's opinion into account and submitted another proposal to the data processor with its own justifications for the inappropriateness of deindexing. The data processor Delfi Meedia AS responded to the proposal with some delay, stating, among other things, that the articles had been deindexed. The AKI's proposal was refused and personal data was not removed from the articles. PERSONAL DATA PROCESSOR'S EXPLANATION The data processor Delfi MeediaAS stuck to the previously presented justifications and explanations in its response letter and does not consider the anonymization of the articles to be justified. Regardless of the fact that more than 20 years have passed since the information was published, public interest in the topic has not disappeared, considering the nature of the information published and its importance in society. Even if it is accepted that the public interest may decrease over time, the publishers are of the opinion that the decrease has not occurred to an extent that would justify the anonymization of these articles. The public interest in the coverage of /../ and in the process of publishing the applicant's personal data is permanent. In addition, these articles still serve a general preventive purpose today. The public interest is considered to be permanent if the person whose data is published holds a position in society that requires high credibility. X's position at that time was /../, which requires high credibility. Thus, the public interest in both the topic and the person of the data subject has been preserved. The published topic is of significant importance in society and /../. The data processor points out that the applicant has not claimed that the information published in the articles was obtained unlawfully or that it was factually incorrect. The absence of /../ cannot in any case prove the absence of /../. 2 (10)Despite the fact that in /../ there was no act provided for in the /../ Penal Code, the /../ act and the perpetrator of this act cannot be minimized in any way. In the opinion of the data processor, the committed act characterizes the complainant. Delfi agrees that certain reputational damage may be associated with the published articles. However, Delfi considers that it would be liable if incorrect information were published about the complainant. The complainant's reputation is damaged by /../, not by its coverage in the media. In order to fulfill their functions and ensure credibility, archives must be complete and accurate. Requests by data subjects to delete their data submitted to media organizations may have a crippling effect on the exercise of freedom of expression, as media outlets may start to refrain from digitally preserving press archives and to exclude information about identifiable persons from news. In addition, it cannot be ruled out that the information contained in the press archive, including personal data, may again become of public interest in the future, e.g. if the applicant were to become a public figure in the future or if he were to commit new acts that entail public interest. The subsequent modification of an article originally lawfully published in the web archive is not justified solely by the fact that the article itself will remain (in an amended form). However, taking into account the time perspective of the topic covered in the articles, Delfi has de-indexed the disputed articles. The articles are also not linked to each other, which means that when reading one article, articles written on the same topic are not linked together. Therefore, the articles cannot be found using search engines via the applicant's name. JUSTIFICATIONS OF THE DATA PROTECTION INSPECTION 1. According to Article 5(1)(b) and (c) of the GDPR, personal data may only be processed for clearly specified and legitimate purposes and may not be used in a manner that is not in accordance with their original purpose. In this case, the original purpose of the articles was to inform the public about specific events. However, the purpose must be reassessed years later, when the news value has disappeared over time and the person's life has changed - whether the continued display of his or her name and photograph in the digital archive is still necessary. If this purpose can be fulfilled by processing less data, such as pseudonymisation, this should be preferred in order not to interfere with the rights of the person 1 more than is necessary. 2. The processing of personal data must comply with the conditions set out in Articles 5 and 6 of the GDPR. According to Article 5(1) of the GDPR, the processing of personal data must be ensured to be lawful, fair and transparent to the data subject. The requirement of lawfulness means that one of the conditions specified in Article 6, paragraph 1, must be met. 3. In accordance with Article 85 of the IKÜM, special rules have been established in Estonia for the processing of personal data for journalistic purposes, the purpose of which is to protect freedom of expression and information. According to the current IKS § 4 (processing of personal data for journalistic purposes) that entered into force on 15. January 2019, personal data may be processed for journalistic purposes without the consent of the data subject, in particular, to be published in the media if this is in the public interest and is in accordance with the principles of journalistic ethics. The publication of personal data may not unduly harm the rights of the data subject. The previous section 11(2) of the Personal Data Protection Act, which entered into force on 1 January 2008, provided that personal data may be processed for journalistic purposes and made public in the media without the consent of the data subject if - there is an overriding public interest in doing so and - it is in accordance with the principles of journalistic ethics - the disclosure does not unduly prejudice the rights of the data subject. 1Explanatory Memorandum to the Personal Data Protection Act, § 4. 3 (10)4. Pursuant to Article 17 of the Personal Data Protection Act, a person has the right to request that the data processor delete personal data relating to him or her. A person has the right to request that his or her data be deleted and the controller is obliged to delete them if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; the person withdraws consent and there are no other grounds for continuing the processing; the person objects and there are no overriding legitimate grounds for the processing. If the previous coverage has become historical and the person is no longer a person in the public spotlight then removing their name from the article may be justified. All the more so if this does not change the content of the article and does not prevent the public from obtaining information about what happened. According to Article 17(3) of the Privacy Act, deletion of data cannot be requested to the extent that the processing of personal data is necessary for the exercise of the right to freedom of expression and information. However, if there is no public interest in the disclosure of personal data or if it would unduly prejudice the rights of the data subject, the disclosure of personal data must be stopped. 5. The data subject shall have the right to object to the processing of personal data in accordance with Article 21(1) unless there are overriding legitimate grounds for the processing or the data subject objects to the processing in accordance with Article 21(2). Article 21(1) of the GDPR provides that the data subject shall have the right, on grounds relating to his or her particular situation, to object at any time to processing of personal data concerning him or her based on Article 6(1)(p)(e) or (f). The controller shall not further process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, 2 rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. 6. According to the case-law of the European Court of Human Rights (ECtHR), any data relating to a person falls within the scope of the protection of privacy. However, privacy is not an absolute right – it is limited by the rights of other persons. Among other things, privacy may also be restricted to protect freedom of expression. 3 Such a restriction is also contained in § 4 of the Personal Data Protection Act. 7. The ECtHR clarified in its Grand Chamber judgment of 04.07.2023 Hurbain v. Belgium, which circumstances should be taken into account when trying to balance, on the one hand, the right to be forgotten online and, on the other, the freedom of the press. The Court found in paragraph 205 of the judgment that the balancing of these different, equivalent rights, which must be exercised in the context of a request to amend archived journalistic content online, should take into account the criteria that the AKI analyses as follows : 1) the nature of the archived information; 2) the time that has elapsed since the events and the initial transmission of the information; 3) the contemporary interest in the information; 4) whether the person requesting the right to be forgotten is well-known and his or her conduct after the events; 5) the negative consequences that the continued availability of information on the Internet causes to the individual; 6) the level of availability of information in the digital archive; and 7) the impact of the deletion of information on freedom of the press. In the present case, the applicant has submitted a request for the pseudonymization of his name and the deletion of his photograph in the aforementioned 34 articles. The person's name is reflected in all 34 articles and the photograph in 19 articles. I. Nature of the archived information 8. The articles reflect X as /../ against /../, including /../. In addition, the press relate his professional decisions and actions, including his communication with /../. Through the articles presented against X, accusations are made regarding his professional activities and management decisions, which have led to 2Tallinn District Court 2-23-6477, p 17.1. 3According to both Article 8(2) of the European Convention on Human Rights and § 26 of the Constitution, privacy may be restricted also for the protection of the rights and freedoms of others. 4 (10) negative public opinion and investigations. The articles deal with his resignation and new developments in relation to his work, but /../, where his role is discussed and the consequences of his actions are examined. 9. The European Court of Justice, based on the case law of the ECHR, has found that in relation to the publication of data, the right to privacy and the right to freedom of expression and information must be considered, among other the content, form of the published information and the circumstances in which the information was obtained and the accuracy of the information. 4 10. The data processor has indicated that the published topic is of significant importance in society and guarantees /../. The published information has not been obtained unlawfully and is not factually incorrect. The AKI acknowledges that, although the subject matter may be important and /../ in society, this should not justify the publication of personal data in a manner that violates the data subject's right to privacy and fair treatment consistently over the years and even decades later. The publication of personal data, including characterising data, requires compliance with the principle of proportionality and a clear legal basis, especially in situations where there is no /../ to substantiate the alleged conduct. In the opinion of the AKI, in such sensitive situations where there is no legal approach or factually verifiable information to substantiate the alleged conduct, the press must carefully consider whether continued publication is indeed essential in the public interest, whether it may cause unjustified harm to the individual, and whether the purpose of the disclosure of the data outweighs the need for the protection of privacy. In addition, the publication should ensure the accuracy of the data, preservation of context, and the opportunity for the person concerned to present his or her point of view, in order to avoid unfair harm or misunderstandings. In the present case, the data processor does not see any justification that the purpose of the disclosure outweighs the need for privacy protection, which is why the continued publication of the articles by name decades later is not necessary. 11. The data processor has also found that the absence of /../ can in no case prove the absence of /../, because /../, which understandably does not mean that /../ would have been acceptable before that. The AKI finds that the media cannot justify the earlier disclosure on the basis of a law that came into force later . The fact that /../ cannot justify the retrospective assessment of earlier events in such a way that it would have a specific and considered justification for the continued publication of personal data. It has also been claimed in the articles about X that he /../. The AKI agrees with the complainant that /../ according to, but X has never been /../. 12. The AKI notes that the disclosure of data must be based on the principle that every person is equally protected before the law and that the disclosure of data may not replace the assessment of a court or other competent authority or disregard a reasonable and balanced consideration./../. Therefore, it is not justified for the media to treat a person as a criminal after the fact if the principles of criminal law alone do not allow it. The role of the press is not to take on the role of a judge or the prosecutor's office, arbitrarily deciding on innocence or guilt through the disclosure of personal data but to provide information that is of public importance and that promotes public debate. 13. In addition, it must be taken into account that the data processor has an obligation to ensure that the processing of personal data is lawful, fair and transparent (Article 5(1)(a) of the Data Protection Act), and the public interest in an event cannot automatically outweigh the rights and freedoms of an individual, especially if there is no clear need to disclose data that can identify a specific person. 14. The AKI does not consider that the preservation of the applicant’s name and image in the digital archive is necessary to preserve the historical significance of the event. II. Time elapsed since the events and the initial transmission of the information 15. The oldest articles about the applicant were published as of the current date /../ years ago, or /../ year, which is a relatively long time. The applicant does not dispute that the publication of personal data in the articles was lawful at the time of publication, but claims that their continued publication with his full name and photographs is not lawful. Therefore, the applicant has, after all this time, a legitimate expectation that he will be able to participate in public life without having to fear continued recourse to actions committed in the past. 16. In the opinion of the data processor, public interest in the topic has not disappeared, considering the nature and significance of the published information in society, although more than /../year has passed since the publication. Even if we accept that public interest may decrease over time, Delfi Meedia is of the opinion that the decrease has not occurred to an extent that would justify the anonymization of these articles. The public interest in the coverage of /../ and the publication of the applicant's personal data in the process is permanent. In Delfi's opinion, these articles still serve a general preventive purpose as of today. 17. AKI admits that although the public interest in /../ may be ongoing, the data processor has not justified the unrestricted disclosure of the full name and photographs of a specific person more than /../ years later. The preventive purpose remains, but there is no justification for what general preventive purpose the applicant's continued publication of personal data should serve. Over time, the social context and norms have changed, and at the same time, the complainant has developed a legitimate expectation of rehabilitation and participation in social life without a criminal record created by virtual journalism. The person has not subsequently remained in the public interest with similar accusations, which is why endless disclosure is disproportionate and violates the principle of personal data minimization. The public's right to information is also guaranteed in pseudonymous form, which is why the perpetual public exposure of information that allows the identification of a specific person is no longer justified. 18. AKI finds that the time that has passed since the event is sufficient to implement the right to be forgotten and the person's rights to rehabilitation must be ensured when publishing pseudonymous personal data in articles. III. Modern interest in information and deindexing 19. The data processor notes that it has deindexed the disputed articles, i.e. removed them from the search engine index. The articles are also not linked to each other, which means that when reading one article articles, articles written on the same topic are not linked together. Therefore, the articles are not searchable by the applicant's name in search engines. 20. AKI notes that although the articles have been deindexed, their content is still available to everyone free of charge and without restrictions, both through search engines and in the digital archive of publications, which means that the information is still accessible to everyone. Deindexing only makes the articles more difficult to find. This must be taken into account because in such a context, the easy distribution and access to information undermines the applicant's rights, including privacy. 21. X, who is seeking the right to be forgotten, is not widely known to the public and has not been in the public eye for the past 20 years. He has changed jobs, adjusted his life to the framework of ordinary social life and has not attracted any more attention with the behavior reflected in the articles or other illegal behavior. It follows that the continued public availability of his name and photographs no longer serves the public interest, but unreasonably impedes his right to rehabilitation and privacy. 22. In today's context, where information spreads instantly and people's backgrounds are routinely checked through internet searches, the retention of deindexed but freely available articles also means that the complainant's name and related data continue to be found, while public interest in a specific person has diminished. The public's interest no longer lies in his person, but in preventing and addressing problems in general, so the easy availability of Xpersonal data and its connection to an event do not create added value for society, but rather disproportionately amplify the infringement of his rights. 6 (10)23. Today's public interest no longer lies in the endless exposure of a specific person's name and photos, but rather in addressing and preventing a general issue. Public awareness of /../ problems has grown significantly in the meantime, and there are new cases, regulations and discussions that shape public discourse much more than the specific case of decades ago. Therefore, the association of the old article with a specific person does not add any additional value in today's discussion. 24. Although Delfi claims that the deindexed articles and their limited findability through search engines protect the integrity of the archive and freedom of expression, the applicant's identity in the digital archive still remains easily identifiable. The availability of the data causes irreversible damage to his private life, while the social value of the content of the articles would not change if the articles were pseudonymised. The deletion or pseudonymisation of the data would not restrict journalistic treatment or make historical memory inaccessible, but would ensure a legitimate balance between the public interest and the applicant's rights. 25. The "future public interest" stated by the data processor is hypothetical and does not justify the endless publication of his data. Given that the events took place over 20 years ago and that the applicant has not been in the public eye since the incident, the exercise of the right to be forgotten is justified in order to reduce the long-term and disproportionate damage to his reputation, professional position and private life. IV. Public interest and conduct after the events 26. Determining the public interest in an event involves assessing whether the information or event is of sufficient importance to justify making it easily accessible to the public, while taking into account the right to privacy and reputation of the individual. The contested articles disclosed the information that X is /../. The name and position are attached to all articles, and the /../ article also includes a photograph of the applicant. The AKI is of the opinion that at the time of the disputed case, nothing excessive was published about the applicant's private life that was not related to a current event, and the information published in the articles is largely limited to reporting on X's /../ and professional activities. 27. The temporal dimension is of great importance in assessing the public interest. The disputed articles were published in /../ , so a little more than /../ years have passed. Although no clear generalised limits can be drawn when defining the duration of public interest in time, the fact that public interest in the coverage of certain events and circumstances can be reduced over time cannot be ignored. The AKI points out that the applicant is not a public figure whose life and personal data are still routinely covered in the media. It also does not appear that the applicant is a person who is still justified in being in a state of so-called heightened attention (cf. e.g. repeat offenders). 28. The public interest also lies in ensuring the fulfilment of the secondary purpose of journalism, namely the preservation of already reported news and making it available to the public, taking into account the importance of the Internet archive as a source for conducting research and its free availability. Although there may be a certain public interest in the events reported in the disputed articles today, the termination of the processing of the applicant's personal data (including the publication of his full name) does not necessarily mean a distortion of history if the public interest is primarily in the events described in the article. Personal data should be relevant, sufficient and limited to what is necessary in relation to the purpose of their processing. If the contested articles process the applicant's personal data for the purpose of fulfilling the secondary function of journalism (preserving history and making information available later), it must be assessed what is the necessary data set for fulfilling this purpose. 5Principle of Minimality. IKÜM pp 39 7 (10)29. Based on the above, the AKI is of the opinion that at present there is no public interest in the continued disclosure of the applicant as a person and his/her data. V. Negative consequences of the continued availability of information on the Internet for a person 31. The data processor has found that the public interest is considered to be lasting if the person whose data is being disclosed has a position in society that requires high reliability. X's position at that time was /../, now /../, which requires high reliability. Thus, according to the media, the public interest in both the topic and the person of the data subject has been preserved. The absence of the alleged decision can in no case be proven /../. 32. AKI notes that the existence of public interest does not depend solely on the data subject's position or the degree of presumed reliability. AKI agrees that /../ holds a position in society that requires high reliability, and assumes greater responsibility and reliability, but this argument alone does not justify the disclosure of personal data. The public interest must be substantial and lasting over time, and not be based solely on position or presumed reliability. In the present case, the person has not worked for /../ for nearly … years and therefore the alleged connection /../ can no longer justify a continuing public interest in the disclosure of his personal data. The fact that the person is currently working for /../ cannot automatically lead to a continuing and unchanging public interest over time. The /../ profession does require reliability in relation to patients, but this is inherently a /../ evolving field. The existence of a public interest cannot be inferred solely from the position – a specific and substantive reason is required as to why the disclosure of the applicant’s personal data would be important for society as a whole at the present time and relevant in time. 33. Although the media emphasises the continuing existence of a public interest and claims that the preservation of the articles serves a general preventive purpose, it nevertheless fails to take into account the temporal context, which the AKI analysed under point II. The problem can be presented to the public in a generalised form without the disclosure of decades of personal data that would permanently harm the individual. 34. The media’s claim that the absence of a /../ decision does not mean /../ is unfounded, as it puts the applicant in a public disgrace. In a state governed by the rule of law, it cannot be assumed that an unsubstantiated allegation is still true, especially if /../ did not establish the consequences of prosecution. Moreover, this approach violates the presumption of innocence, which is protected by both the Constitution and international human rights standards. 35. The media’s claim that the applicant’s reputation is damaged by the act itself, not by its coverage, is unconvincing. 6RKHKo 3-3-1-85-15, paragraphs 19-21 7EKo C-345/17, Sergejs Buivids, ECLI:EU:C:2019:122, paragraph 66; The ECtHR judgment of 28.06.2018 in cases no. 60798/10 and 65599/10, M.L. and W.W. v. Germany, p 95 provides essentially the same criteria in slightly different wording. 8Hurbain v Belgium and Google Spain (C-131/12) 8 (10) In the public consciousness, the act exists only through media coverage, which is why the information available from the articles shapes the image of the person and hinders his further life and professional development. If /../, their endless dissemination no longer becomes the fulfillment of a journalistic task, but a virtual punishment of the person. Therefore, the unrestricted availability of his full name and photographs no longer justifies the public interest, but causes unjustified and lasting damage to his reputation and privacy. 36. It must also be taken into account that in today's digital environment, it is not just about historical archival material, but information that can be found and spread instantly through keywords in search engines, which makes the infringement of a person's privacy significantly more intense than in the context of a traditional paper publication. This further increases the need to implement the right to be forgotten in order to ensure a fair balance between the public interest and the fundamental rights of the person. 37. AKI is of the opinion that the data processor has not put forward any argument that would justify the continued publication of the applicant's personal data almost /../ years later. Based on the above arguments, it must rather be taken as a position that the continued processing of the applicant's personal data excessively harms his rights. VI. The degree of availability of information in the digital archive and the impact of the deletion of information 38. The articles reflecting the allegations made against the applicant are available to everyone, both through search engines and in the digital archive of publications, without any payment restrictions , which means that the information is easily accessible to everyone. This must be noted because in such a context, the easy dissemination and access to the information undermines the applicant's rights, including his reputation and privacy. The ECtHR has explained in the Hurbain v. Belgium judgment, p-s116, that digital archives have a significantly greater impact on individuals' privacy than paper archives. It is also possible to find personal data on the Delfi website with just a few clicks, especially considering that the articles are available to everyone free of charge and without any restrictions. 39. The nature of digital archives means that the information stored there is easily searchable, constantly accessible and reusable. This means that even long-published articles can resurface at any time and harm a person’s privacy, creating a situation where reputational damage is not limited in time. This effect is further amplified through search engines and algorithms, as outdated and sensational stories are often highlighted, leading to repeated and aggravated infringement. In this situation, the public’s right to information and freedom of the press, on the one hand, and the individual’s rights to privacy, good name and presumption of innocence, on the other. Public interest in an event does not necessarily require the permanent publication of a specific person’s name, especially if guilt has never been proven in court or the charges have become obsolete. 40. Pseudonymisation and removal of photographs is a proportionate measure that does not erase history, but rather reduces the unfair impact on a person’s life. Removing the name and photo from the article preserves the description of the event, preserving the public's right to know, but limits the excessive dissemination of outdated or misleading information directed at a specific person. This is in line with the presumption of innocence, the right to be forgotten and the protection of human dignity. Therefore, in the current situation, the deletion of personal data or at least their pseudonymization is necessary to prevent the continued damage to a person's reputation and rights in the digital environment. This is a measure that is both effective in protecting personal rights and the least restrictive of press freedom. VII. Conclusion 41. The public interest in both the topic and the person must be real and justified, not merely general access to information based on the interest of the press. The right to be forgotten based on Article 17 of the ECHR must be balanced with freedom of expression, but if the publication causes excessive harm and is no longer relevant, the removal or limited access to personal data must be considered. In addition, it must be taken into account that the permanent and easily found content of digital archives distorts the person's biographical narrative, giving the impression that the old and /../ is still relevant. Such a situation not only damages the person's reputation and privacy, but can also hinder his or her social and professional 9 (10) self-fulfilment, making everyday life unreasonably difficult. 42. Considering the circumstances and evidence presented in the complaint and the explanations of the media, the Inspectorate finds that the continued publication of personal data in this form in the articles published by AS Ekspress Grupp causes undue harm to the complainant in this case, because, in the opinion of the Inspectorate, the scope of public interest in the published circumstances and events (including the complainants personal data) has changed over time compared to the time of the publication of the article, and the continued processing of personal data has become excessively harmful to the person. In the absence of public interest in the complainant's person (including personal data), the continued processing of the complainant's personal data in the articles is neither justified nor proportionate, and the continued publication of personal data harms the complainant's private life as a data subject. 43. Based on the above, the Inspectorate finds that the publication of the applicant's personal data for journalistic purposes in the disputed articles has not met all the requirements for publication provided for in § 4 of the IKS due to the lack of public interest and excessive harm to the applicant's rights. If there is no legal basis for the processing of personal data, the processing of personal data is inadmissible. 44. In accordance with § 58(1) of the Personal Data Protection Act and Article 58(2)(c) and (g) of the General Data Protection Regulation , the Inspectorate has the right to issue an order to grant requests for the deletion of the personal data of the data subject in the articles referred to in this precept that concern the publication of X's personal data. (signed digitally) Kaire Jürgenstein Lawyer by the authority of the Director General 10 (10)
