Article 85 GDPR: Difference between revisions

From GDPRhub
(3 intermediate revisions by the same user not shown)
Line 197: Line 197:


=== (1) Reconciling Data Protection Rules with Freedom of Expression ===
=== (1) Reconciling Data Protection Rules with Freedom of Expression ===
===== The impact of the GDPR on freedom of expression =====
The GDPR provides for stringent requirements when personal data are processed. It is required, among other things, to have a legal basis for each processing operation ([[Article 6 GDPR|Article 6]], [[Article 9 GDPR|9]] or [[Article 10 GDPR|10 GDPR]]), answer requests from data subjects, including erasure requests ([[Article 17 GDPR]]) and to delete personal data when they are longer necessary, in accordance with the storage limitation principle ([[Article 5 GDPR|Article 5(1)(e) GDPR]]). In other words, the processing of personal data is not an activity which can be taken lightly. This, in turn, may have a negative impact on the circulation of information, and therefore on freedom of expression. For some actors having limited resources indeed, such as artists, independent journalists, or simple citizens, complying with the GDPR may become too challenging, and therefore deter them from expressing themselves. In other instances, the stringent obligations imposed by the GDPR, such as the obligation to inform data subjects ([[Article 12 GDPR|Article 12]] to [[Article 14 GDPR|14 GDPR]]), may defeat the very purpose of the processing, such as when a whistle-blower intends to disclose classified information, or when a journalist investigates fraudulent actions.  
The GDPR provides for stringent requirements when personal data are processed. It is required, among other things, to have a legal basis for each processing operation ([[Article 6 GDPR|Article 6]], [[Article 9 GDPR|9]] or [[Article 10 GDPR|10 GDPR]]), answer requests from data subjects, including erasure requests ([[Article 17 GDPR]]) and to delete personal data when they are longer necessary, in accordance with the storage limitation principle ([[Article 5 GDPR|Article 5(1)(e) GDPR]]). In other words, the processing of personal data is not an activity which can be taken lightly. This, in turn, may have a negative impact on the circulation of information, and therefore on freedom of expression. For some actors having limited resources indeed, such as artists, independent journalists, or simple citizens, complying with the GDPR may become too challenging, and therefore deter them from expressing themselves. In other instances, the stringent obligations imposed by the GDPR, such as the obligation to inform data subjects ([[Article 12 GDPR|Article 12]] to [[Article 14 GDPR|14 GDPR]]), may defeat the very purpose of the processing, such as when a whistle-blower intends to disclose classified information, or when a journalist investigates fraudulent actions.  


Article 85 GDPR hence provides exemptions for these areas of human or social lives where strictly applying data protection law would unduly restrict freedom of expression. More particularly, it recognizes that journalists, academics, artists and writers should be allowed to fulfill their respective social function without being unduly burdened by data protection rules. In that perspective, Article 85(1) GDPR requires member States to reconcile the right to data protection with the right to freedom of expression by adopting specific exemptions in national law, including for the processing of personal data for the purpose of journalism, or for academic, artistic or literary expression.  
One of the first landmark cases before the CJEU which highlighted potential conflicts between data protection law and freedom of expression was ''Lindqvist''.<ref>CJEU, Case C-101/01 ''Lindqvist'', Judgment of 6 November 2003.</ref> Mrs Lindqvist was an active member of the parish of Alseda in Sweden.  At the end of 1998, she set up internet pages on her personal computer at home to enable parishioners to be informed about the activities of the parish. Those pages also contained personal information on Mrs Lindqvist, as well as 18 of her colleagues in the parish, including their first names and sometimes their full names. Mrs Lindqvist also sometimes described the work done by her colleagues and their hobbies, their family circumstances or their telephone number. She also mentioned that one of her colleagues had injured her foot and was working part-time on medical grounds. Following a complaint against Mrs Lindqvist at the national level, the latter was fined SEK 4 000 (approximately EUR 450) by the Swedish DPA for not complying with the applicable data proteciton legislation. Mrs Lindqvist appealed that decision, and in the context of these proceedings, the national court referred several questions to the CJEU. One of these questions directly concern the need to achieve a balance between the exercise, by Mrs Lindqvist, of her freedom of expression, and the right to privacy and data protection of her colleagues. In this respect, the CJEU considered that the 1995 EU Data Protection Directive (the predecessor of the GDPR) did not in itself entail a restriction contrary to the principle of freedom of expression or other fundamental rights.<ref>CJEU, Case C-101/01 ''Lindqvist'', para 90.                                </ref> The CJEU specified however that it was for the national authorities and courts responsible for applying the national legislation implementing the directive to ensure a fair balance between the rights and interests in question.<ref>CJEU, Case C-101/01 ''Lindqvist'', para 99.</ref>


Article 85(1) deals precisely with offering a legal framework to reconcile the data subject’s right to data protection with the performance of equally crucial interest of proving society with free, informed and unencumbered information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What such “reconciliation” consists of is mostly a matter of necessity, as specified in Article 85(2) below.
In line with this case law, Article 85 GDPR requires Member States to adopt exemptions at the national level to achieve a balance between data protection on the one side, and <span id="1">freedom of expression and information on the other side, including processing for journalistic purposes and the purposes of academic, artistic or literary expression</span>. These exemptions should allow journalists, academics, artists and writers to fulfill their respective social function without being unduly burdened by data protection rules.  


===== Balancing data protection and privacy with freedom of expression =====
Article 85(1) deals precisely with offering a legal framework to reconcile the data subject’s right to data protection with the performance of equally crucial interest of proving society with free, informed and unencumbered information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What such “reconciliation” consists of is mostly a matter of necessity, as specified in Article 85(2) GDPR, discussed below.
Lindqvist:


===== Public Interest as a Guiding Principle =====
=== (2) Exemptions ===
In its judgment on Google Spain, the CJEU clarified the relationship between data protection and freedom of information. According to this, courts must balance the sensitivity of the information with the public interest in knowing it.<ref>CJEU, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., margin numbers 97-99 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5444812 here]) </ref>
Under Article 85(2) GDPR, for processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.<ref>“''The exemption under the Directive was narrower, as it provided exemptions for processing “solely” for “journalistic purposes or the purpose of artistic or literary expression,” if they were necessary from a free speech perspective. Article 85 of the GDPR omits the “solely” requirement and provides exemptions for the purpose of reconciling free speech with data protection. Article 85 refers to journalism, academia, art, and literature as examples of circumstances in which such exemptions would be necessary, resulting in a broader scope for exemption from GDPR rules''”. See, ''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound,  114 (2020), pp. 31–34.</ref> The extent of what is "necessary" for this purpose is necessarily a matter of interpretation by the national and European courts.


Equally relevant to this issue are the indications offered by the European Court of Human Rights. In fact, under Article 52(3) of the EU Charter, “''in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention''”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the European Convention on Human Rights, further guidance on Article 85 GDPR on Article 85 GDPR can be found in the case-law of the ECtHR.<ref>''Tinnefeld'' in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (Beck 2020, 3rd ed.) (accessed 9 August 2021).</ref>
==== Public Interest as a Guiding Principle ====
In its judgment ''Google Spain'', the CJEU clarified the relationship between data protection and freedom of information. According to this judgment, national courts must balance the sensitivity of the information with the public interest in knowing it.<ref>CJEU, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., margin numbers 97-99 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5444812 here]) </ref>


The ECtHR's case-law has consistently recognised the role of the press for the proper functioning of a democratic society. In this sense, the media not only serve as “''public watchdog''” but also contribute to production and circulation of information and ideas in the public interest. “''Freedom of the press'',the Court has stated, “''gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society''”. Furthermore, the Court has consistently made clear that the right to privacy protected by Article 8 of the Convention and the right to freedom of expression “''are equal rights that states must balance, based on the criteria the Court has identified in its caselaw''”.<ref>''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.</ref>
Equally relevant to this issue is the case-law of the European Court of Human Rights (ECtHR) on the interpretation of the provisions of the European Convention on Human Rights (the Convention). In fact, under Article 52(3) of the EU Charter, “''in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention''”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the Convention, further guidance on Article 85 GDPR can be found in the case-law of the ECtHR.<ref>''Tinnefeld'' in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (Beck 2020, 3rd ed.) (accessed 9 August 2021).</ref>


In the case ECtHR, Von Hannover v. Germany, the Court found that two photographs depicting a royal family on holiday and published in two German newspapers violated the right to privacy pursuant to Article 8 of the European Convention on Human Rights because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted a Prince in poor health, and since the health of the Prince was a matter of public concern the ECtHR found no violation of Article 8.  In reaching its ruling the ECtHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression. Firstly, whether the information contributes to a debate of general interest; secondly, how well known is the person concerned and the subject matter of the report; thirdly, the prior conduct of the person concerned; fourthly, content, form and consequences of the publication; and fifth, the circumstances in which the photos were taken.<ref>Entirely taken from Global Freedom of Expression, Von Hannover v. Germany (No. 2) (available [https://globalfreedomofexpression.columbia.edu/cases/von-hannover-v-germany-no-2/ here]) (accessed on 9 August 2021).</ref>
The ECtHR's case-law has consistently recognised the role of the press for the proper functioning of a democratic society. In this sense, the media not only serve as “''public watchdog''” but also contribute to production and circulation of information and ideas in the public interest. The ECtHR has stated in particular that “''[f]reedom of the press'' ''gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society''”. Furthermore, the ECtHR has consistently made clear that the right to privacy and the right to freedom of expression “''are equal rights that states must balance, based on the criteria the Court has identified in its caselaw''”.<ref>''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.</ref>


=== (2) Exemptions ===
In the case ''Von Hannover v. Germany'', the ECtHR further found that two photographs depicting a royal family on holiday and published in two German newspapers violated the right to privacy pursuant to Article 8 of the Convention because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted a Prince in poor health, and since the health of the Prince was a matter of public concern, the ECtHR found that the publication of such information did not violate Article 8 of the Convention. In reaching its decision, the ECtHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression: firstly, whether the information contributes to a debate of general interest; secondly, how well known is the person concerned and the subject matter of the report; thirdly, the prior conduct of the person concerned; fourthly, content, form and consequences of the publication; and fifth, the circumstances in which the photos were taken.<ref>Entirely taken from Global Freedom of Expression, Von Hannover v. Germany (No. 2) (available [https://globalfreedomofexpression.columbia.edu/cases/von-hannover-v-germany-no-2/ here]) (accessed on 9 August 2021).</ref>
Under Article 85(2) GDPR, for processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.<ref>“''The exemption under the Directive was narrower, as it provided exemptions for processing “solely” for “journalistic purposes or the purpose of artistic or literary expression,” if they were necessary from a free speech perspective. Article 85 of the GDPR omits the “solely” requirement and provides exemptions for the purpose of reconciling free speech with data protection. Article 85 refers to journalism, academia, art, and literature as examples of circumstances in which such exemptions would be necessary, resulting in a broader scope for exemption from GDPR rules''”. See, ''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound,  114 (2020), pp. 31–34.</ref> The extent of what is "necessary" for this purpose is necessarily a matter of interpretation by the national and European courts.


==== Scope of the Exceptions within the GDPR Framework ====
==== Scope of the Exceptions within the GDPR Framework ====
As mentioned above, the GDPR recognises the need to protect freedom of expression (whatever the form) and authorises Member States to adopt, where necessary, statutory derogations to a large part of the GDPR itself, including data processing principles, data subject's rights, rules on international transfers, and even the subjection to the scrutiny of the supervisory authorities. Much (if not everything) seems to be abstractly possible in order to protect freedom of expression.
As mentioned above, the GDPR recognises the need to protect freedom of expression (whatever the form) and authorises Member States to adopt, where necessary, statutory exemptions to a large part of the GDPR itself, including data processing principles, data subject's rights, rules on international transfers, and even the subjection to the scrutiny of the supervisory authorities. Much (if not everything) seems to be abstractly possible in order to protect freedom of expression.


On this point, we note that such favourable treatment does not seem to be reserved for the protection of other primary interests such as those provided for by [[Article 23 GDPR]] (to which we refer for a complete analysis of the relevant discipline). National security, for example, may allow derogations to the GDPR, but only to the data subject's rights, and only on the condition that such a restriction ''"respects the essence of the fundamental rights and freedoms" and is "necessary and proportionate [...] in a democratic society"''.  
On this point, we note that such favourable treatment does not seem to be reserved for the protection of national security, defence, or other important objectives of general public interest listed in [[Article 23 GDPR]] (to which we refer for a complete analysis of the relevant discipline). National security, for example, can in some instances be invoked as a ground to derogate from the GDPR, but only with respect to the data subject's rights, and only on the condition that such a restriction ''"respects the essence of the fundamental rights and freedoms" and is "necessary and proportionate [...] in a democratic society"''.  


Conversely, when freedom of expression (including artistic, literary or academic expression) is taken into account, the GDPR authorises much broader restrictions as described above. In other words, it seems that the GDPR restrictions justified by overriding interests such as national security, defence, and crime prevention ([[Article 23 GDPR|Article 23(1)(a-j) GDPR]]) allow for far fewer GDPR restrictions than those granted by freedom of expression.
Conversely, when freedom of expression (including artistic, literary or academic expression) is taken into account, the GDPR envisages much broader exemptions to its own rules. In other words, it seems that the GDPR restrictions justified by overriding interests such as national security, defence, and crime prevention ([[Article 23 GDPR|Article 23(1)(a-j) GDPR]]) allow for far fewer GDPR restrictions than those granted by freedom of expression.


==== Necessary to Reconcile ====
==== Necessary to Reconcile ====
The core of this provision is clearly the concept expressed in the final part of paragraph 2 "''necessary to reconcile''". Member States may reduce the scope of a principle or right, or modify the obligations of the controller, only if this is "necessary to reconcile" the GDPR with the exercise of freedoms of expression and information, including academic, artistic or literary freedom.
Article 85(2) GDPR poses one condition for exemptions on the basis of freedom of expression to be valid: they must be "''necessary to reconcile''" <span id="2">the right to the protection of personal data with the freedom of expression and information.</span> Member States may thus restrict the scope of a data protection principle, limit the exercise of a right by a data subject, or reduce the obligations of controllers, only if this is necessary to achieve a reconciliation between the GDPR and the freedoms of expression and information, including academic, artistic or literary expression.
 
Careful commentators, whose conclusions we fully share, note that in all cases the exception must be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition, but not to the data of buyers that the art gallery holds for its economic activity.<ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 11 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 9 August 2021).</ref> In the latter case indeed, the exemption is not necessary to safeguard the artist’s freedom of artistic expression, but only to allow the art gallery to maintain an economic advantage.  


Careful commentators, whose conclusions we fully share, note that in all cases the exception must be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition, but not to the data of buyers that the art gallery holds for its economic activity.<ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 11 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 9 August 2021).</ref> In the latter case, the exemption is not necessary to safeguard the artist’s freedom of artistic expression (but only a rather unjustified privilege).  
For the rest, Article 85(2) GDPR seems to leave full discretion to Member States to determine in which circumstances a reconciliation is necessary, and how such reconciliation can be achieved. The approach adopted at the national level therefore varies from one Member State to another; some of them have provided some details on the scope of these exemptions in their national data protection law (as in the Belgian data protection law),<ref>See Article 24 of the Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel.</ref> while other simply refer to the wording of Article 85 GDPR without further specifications (as in the French data protection law).<ref>See Article 80 of the ''Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés'', as modified after the entry into force of the GDPR.</ref>


===== Journalistic expression =====
===== Journalistic expression =====
Line 237: Line 236:
In theory, this approach may pose considerable problems for those who are not professional journalists. In practice, however, the problem loses part of its relevance. In fact, according to Recital 153, the term 'journalism' is to be interpreted broadly. Processing for journalistic purposes therefore includes data processing which is in connection with the expression of an opinion or aimed at creating one within the public. In particular, the aforementioned Recital clarifies that the privilege does not only apply to the classic professional press,<ref>CJEU, Tietosuojavaltuutettu/Satakunnan Markkinapörssi Oy, C-73/07, 16 December 2008, margin number 110 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=76075&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5443040 here]) </ref> but also to the audiovisual sector, i.e. telemedia and radio, as well as for news and press archives. In addition, people without journalistic training also benefit from the exemption insofar as they carry out investigative research activities.<ref>''Pötters'' in Gola DS-GVO, Article 85 GDPR, margin number 8 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 09 August 2021).</ref>
In theory, this approach may pose considerable problems for those who are not professional journalists. In practice, however, the problem loses part of its relevance. In fact, according to Recital 153, the term 'journalism' is to be interpreted broadly. Processing for journalistic purposes therefore includes data processing which is in connection with the expression of an opinion or aimed at creating one within the public. In particular, the aforementioned Recital clarifies that the privilege does not only apply to the classic professional press,<ref>CJEU, Tietosuojavaltuutettu/Satakunnan Markkinapörssi Oy, C-73/07, 16 December 2008, margin number 110 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=76075&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5443040 here]) </ref> but also to the audiovisual sector, i.e. telemedia and radio, as well as for news and press archives. In addition, people without journalistic training also benefit from the exemption insofar as they carry out investigative research activities.<ref>''Pötters'' in Gola DS-GVO, Article 85 GDPR, margin number 8 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 09 August 2021).</ref>


However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is not covered by Article 85. <ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 9 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 09 August 2021).</ref>
However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is not covered by Article 85. <ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 9 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 09 August 2021).</ref> Similarly, in line with the ''Lindqvist'' case-law discussed above, an individual sharing personal data on social media will still be subject to the provisions of the GDPR, ''except'' if the sharing of such information participates to a public debate and is covered by freedom of expression, or if it is shared in the course of a purely personal or household activity (for example, in a closed message group). We refer, in that respect, to the Commentary on [[Article 2 GDPR|Article 2(2)(c) GDPR]].


===== Artistic, Literary and Academic Expression =====
===== Artistic, Literary and Academic Expression =====
From a systematic point of view, artistic, literary or academic expression seem to be equated with journalistic expression (in the sense just seen above). For this reason, in the absence of more specific indications from both the CJEU and ECtHR, it seems reasonable to apply to these sectors the same conclusions and principles. In this vein, the exemption would be valid for a photo (book or article) containing personal data, but only if is intended to be published, for example, in an art gallery (library or scientific journal). Conversely, data processing carried out by the photographer (writer or academic) which is not intended for public discussion (e.g. the record of the gallery's customers) will not fall within the scope of the exception. On this matter, very much obviously depends on the national implementation of Article 85. At present, not all European countries have specific legislation on artistic, literary or academic expression.<ref>European Commission, EU Member States notifications to the European Commission (available [https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu/eu-countries-gdpr-specific-notifications_en here]) (accessed 9 August 2021).</ref> This contributes in no small measure to the uncertainties surrounding the processing of personal data in the mentioned areas.
From a systematic point of view, artistic, literary or academic expression seem to be equated with journalistic expression (in the sense just seen above). For this reason, in the absence of more specific indications from both the CJEU and ECtHR, it seems reasonable to apply to these sectors the same conclusions and principles. In this vein, the exemption would be valid for a photo (book or article) containing personal data, but only if is intended to be published, for example, in an art gallery (library or scientific journal). Conversely, data processing carried out by the photographer (writer or academic) which is not intended for public discussion (e.g. the record of the gallery's customers) will not fall within the scope of the exception. On this matter, very much obviously depends on the national implementation of Article 85. At present, not all Member States have specific legislation on artistic, literary or academic expression.<ref>European Commission, EU Member States notifications to the European Commission (available [https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu/eu-countries-gdpr-specific-notifications_en here]) (accessed 9 August 2021).</ref> This contributes in no small measure to the uncertainties surrounding the processing of personal data in the mentioned areas.


=== (3) Notification to the Commission ===
=== (3) Notification to the Commission ===
Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them. The actual national transposition of these exceptions must be notified immediately to the Commission. Indeed, there is a need for monitoring of the GDPR exemption measures to be taken by individual Member States.
Each Member State has the obligation to notify to the Commission the provisions of national law which were adopted pursuant to Article 85(2) GDPR and, without delay, any subsequent amendment(s) affecting them. The actual national transposition of these exceptions must be notified immediately to the Commission. Indeed, there is a need for monitoring the exemption measures adopted by each Member States to ensure that the latter have complied with the principle set out in Article 85 GDPR.


==Decisions==
==Decisions==

Revision as of 13:59, 25 November 2021

Article 85 - Processing and freedom of expression and information
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text

Article 85 - Processing and freedom of expression and information

1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from CHAPTER II (principles), CHAPTER III (rights of the data subject), CHAPTER IV (controller and processor), CHAPTER V (transfer of personal data to third countries or international organisations), CHAPTER VI (independent supervisory authorities), CHAPTER VII (cooperation and consistency) and CHAPTER IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

3. Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.

Relevant Recitals

Recital 153: Processing of Personal Data Solely for Journalistic Purposes, or for the Purposes of Academic, Artistic or Literary Expression
Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data pursuant to this Regulation. The processing of personal data solely for journalistic purposes, or for the purposes of academic, artistic or literary expression should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the Charter. This should apply in particular to the processing of personal data in the audiovisual field and in news archives and press libraries. Therefore, Member States should adopt legislative measures which lay down the exemptions and derogations necessary for the purpose of balancing those fundamental rights. Member States should adopt such exemptions and derogations on general principles, the rights of the data subject, the controller and the processor, the transfer of personal data to third countries or international organisations, the independent supervisory authorities, cooperation and consistency, and specific data-processing situations. Where such exemptions or derogations differ from one Member State to another, the law of the Member State to which the controller is subject should apply. In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly.

Commentary

(1) Reconciling Data Protection Rules with Freedom of Expression

The GDPR provides for stringent requirements when personal data are processed. It is required, among other things, to have a legal basis for each processing operation (Article 6, 9 or 10 GDPR), answer requests from data subjects, including erasure requests (Article 17 GDPR) and to delete personal data when they are longer necessary, in accordance with the storage limitation principle (Article 5(1)(e) GDPR). In other words, the processing of personal data is not an activity which can be taken lightly. This, in turn, may have a negative impact on the circulation of information, and therefore on freedom of expression. For some actors having limited resources indeed, such as artists, independent journalists, or simple citizens, complying with the GDPR may become too challenging, and therefore deter them from expressing themselves. In other instances, the stringent obligations imposed by the GDPR, such as the obligation to inform data subjects (Article 12 to 14 GDPR), may defeat the very purpose of the processing, such as when a whistle-blower intends to disclose classified information, or when a journalist investigates fraudulent actions.

One of the first landmark cases before the CJEU which highlighted potential conflicts between data protection law and freedom of expression was Lindqvist.[1] Mrs Lindqvist was an active member of the parish of Alseda in Sweden. At the end of 1998, she set up internet pages on her personal computer at home to enable parishioners to be informed about the activities of the parish. Those pages also contained personal information on Mrs Lindqvist, as well as 18 of her colleagues in the parish, including their first names and sometimes their full names. Mrs Lindqvist also sometimes described the work done by her colleagues and their hobbies, their family circumstances or their telephone number. She also mentioned that one of her colleagues had injured her foot and was working part-time on medical grounds. Following a complaint against Mrs Lindqvist at the national level, the latter was fined SEK 4 000 (approximately EUR 450) by the Swedish DPA for not complying with the applicable data proteciton legislation. Mrs Lindqvist appealed that decision, and in the context of these proceedings, the national court referred several questions to the CJEU. One of these questions directly concern the need to achieve a balance between the exercise, by Mrs Lindqvist, of her freedom of expression, and the right to privacy and data protection of her colleagues. In this respect, the CJEU considered that the 1995 EU Data Protection Directive (the predecessor of the GDPR) did not in itself entail a restriction contrary to the principle of freedom of expression or other fundamental rights.[2] The CJEU specified however that it was for the national authorities and courts responsible for applying the national legislation implementing the directive to ensure a fair balance between the rights and interests in question.[3]

In line with this case law, Article 85 GDPR requires Member States to adopt exemptions at the national level to achieve a balance between data protection on the one side, and freedom of expression and information on the other side, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. These exemptions should allow journalists, academics, artists and writers to fulfill their respective social function without being unduly burdened by data protection rules.

Article 85(1) deals precisely with offering a legal framework to reconcile the data subject’s right to data protection with the performance of equally crucial interest of proving society with free, informed and unencumbered information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What such “reconciliation” consists of is mostly a matter of necessity, as specified in Article 85(2) GDPR, discussed below.

(2) Exemptions

Under Article 85(2) GDPR, for processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.[4] The extent of what is "necessary" for this purpose is necessarily a matter of interpretation by the national and European courts.

Public Interest as a Guiding Principle

In its judgment Google Spain, the CJEU clarified the relationship between data protection and freedom of information. According to this judgment, national courts must balance the sensitivity of the information with the public interest in knowing it.[5]

Equally relevant to this issue is the case-law of the European Court of Human Rights (ECtHR) on the interpretation of the provisions of the European Convention on Human Rights (the Convention). In fact, under Article 52(3) of the EU Charter, “in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the Convention, further guidance on Article 85 GDPR can be found in the case-law of the ECtHR.[6]

The ECtHR's case-law has consistently recognised the role of the press for the proper functioning of a democratic society. In this sense, the media not only serve as “public watchdog” but also contribute to production and circulation of information and ideas in the public interest. The ECtHR has stated in particular that “[f]reedom of the press gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society”. Furthermore, the ECtHR has consistently made clear that the right to privacy and the right to freedom of expression “are equal rights that states must balance, based on the criteria the Court has identified in its caselaw”.[7]

In the case Von Hannover v. Germany, the ECtHR further found that two photographs depicting a royal family on holiday and published in two German newspapers violated the right to privacy pursuant to Article 8 of the Convention because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted a Prince in poor health, and since the health of the Prince was a matter of public concern, the ECtHR found that the publication of such information did not violate Article 8 of the Convention. In reaching its decision, the ECtHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression: firstly, whether the information contributes to a debate of general interest; secondly, how well known is the person concerned and the subject matter of the report; thirdly, the prior conduct of the person concerned; fourthly, content, form and consequences of the publication; and fifth, the circumstances in which the photos were taken.[8]

Scope of the Exceptions within the GDPR Framework

As mentioned above, the GDPR recognises the need to protect freedom of expression (whatever the form) and authorises Member States to adopt, where necessary, statutory exemptions to a large part of the GDPR itself, including data processing principles, data subject's rights, rules on international transfers, and even the subjection to the scrutiny of the supervisory authorities. Much (if not everything) seems to be abstractly possible in order to protect freedom of expression.

On this point, we note that such favourable treatment does not seem to be reserved for the protection of national security, defence, or other important objectives of general public interest listed in Article 23 GDPR (to which we refer for a complete analysis of the relevant discipline). National security, for example, can in some instances be invoked as a ground to derogate from the GDPR, but only with respect to the data subject's rights, and only on the condition that such a restriction "respects the essence of the fundamental rights and freedoms" and is "necessary and proportionate [...] in a democratic society".

Conversely, when freedom of expression (including artistic, literary or academic expression) is taken into account, the GDPR envisages much broader exemptions to its own rules. In other words, it seems that the GDPR restrictions justified by overriding interests such as national security, defence, and crime prevention (Article 23(1)(a-j) GDPR) allow for far fewer GDPR restrictions than those granted by freedom of expression.

Necessary to Reconcile

Article 85(2) GDPR poses one condition for exemptions on the basis of freedom of expression to be valid: they must be "necessary to reconcile" the right to the protection of personal data with the freedom of expression and information. Member States may thus restrict the scope of a data protection principle, limit the exercise of a right by a data subject, or reduce the obligations of controllers, only if this is necessary to achieve a reconciliation between the GDPR and the freedoms of expression and information, including academic, artistic or literary expression.

Careful commentators, whose conclusions we fully share, note that in all cases the exception must be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition, but not to the data of buyers that the art gallery holds for its economic activity.[9] In the latter case indeed, the exemption is not necessary to safeguard the artist’s freedom of artistic expression, but only to allow the art gallery to maintain an economic advantage.

For the rest, Article 85(2) GDPR seems to leave full discretion to Member States to determine in which circumstances a reconciliation is necessary, and how such reconciliation can be achieved. The approach adopted at the national level therefore varies from one Member State to another; some of them have provided some details on the scope of these exemptions in their national data protection law (as in the Belgian data protection law),[10] while other simply refer to the wording of Article 85 GDPR without further specifications (as in the French data protection law).[11]

Journalistic expression

On this point, the first question concerns the extent of the concept of 'expression'. In general, there seems to be a sort of overlap between the notion of 'expression' and that of 'journalism'. Theoretically, therefore, the privilege stemming from – the national implementation of – Article 85 would only be granted to those who qualify as journalists.

In theory, this approach may pose considerable problems for those who are not professional journalists. In practice, however, the problem loses part of its relevance. In fact, according to Recital 153, the term 'journalism' is to be interpreted broadly. Processing for journalistic purposes therefore includes data processing which is in connection with the expression of an opinion or aimed at creating one within the public. In particular, the aforementioned Recital clarifies that the privilege does not only apply to the classic professional press,[12] but also to the audiovisual sector, i.e. telemedia and radio, as well as for news and press archives. In addition, people without journalistic training also benefit from the exemption insofar as they carry out investigative research activities.[13]

However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is not covered by Article 85. [14] Similarly, in line with the Lindqvist case-law discussed above, an individual sharing personal data on social media will still be subject to the provisions of the GDPR, except if the sharing of such information participates to a public debate and is covered by freedom of expression, or if it is shared in the course of a purely personal or household activity (for example, in a closed message group). We refer, in that respect, to the Commentary on Article 2(2)(c) GDPR.

Artistic, Literary and Academic Expression

From a systematic point of view, artistic, literary or academic expression seem to be equated with journalistic expression (in the sense just seen above). For this reason, in the absence of more specific indications from both the CJEU and ECtHR, it seems reasonable to apply to these sectors the same conclusions and principles. In this vein, the exemption would be valid for a photo (book or article) containing personal data, but only if is intended to be published, for example, in an art gallery (library or scientific journal). Conversely, data processing carried out by the photographer (writer or academic) which is not intended for public discussion (e.g. the record of the gallery's customers) will not fall within the scope of the exception. On this matter, very much obviously depends on the national implementation of Article 85. At present, not all Member States have specific legislation on artistic, literary or academic expression.[15] This contributes in no small measure to the uncertainties surrounding the processing of personal data in the mentioned areas.

(3) Notification to the Commission

Each Member State has the obligation to notify to the Commission the provisions of national law which were adopted pursuant to Article 85(2) GDPR and, without delay, any subsequent amendment(s) affecting them. The actual national transposition of these exceptions must be notified immediately to the Commission. Indeed, there is a need for monitoring the exemption measures adopted by each Member States to ensure that the latter have complied with the principle set out in Article 85 GDPR.

Decisions

→ You can find all related decisions in Category:Article 85 GDPR

References

  1. CJEU, Case C-101/01 Lindqvist, Judgment of 6 November 2003.
  2. CJEU, Case C-101/01 Lindqvist, para 90.
  3. CJEU, Case C-101/01 Lindqvist, para 99.
  4. The exemption under the Directive was narrower, as it provided exemptions for processing “solely” for “journalistic purposes or the purpose of artistic or literary expression,” if they were necessary from a free speech perspective. Article 85 of the GDPR omits the “solely” requirement and provides exemptions for the purpose of reconciling free speech with data protection. Article 85 refers to journalism, academia, art, and literature as examples of circumstances in which such exemptions would be necessary, resulting in a broader scope for exemption from GDPR rules”. See, Reventlow, Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.
  5. CJEU, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., margin numbers 97-99 (available here)
  6. Tinnefeld in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (Beck 2020, 3rd ed.) (accessed 9 August 2021).
  7. Reventlow, Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.
  8. Entirely taken from Global Freedom of Expression, Von Hannover v. Germany (No. 2) (available here) (accessed on 9 August 2021).
  9. Pötters in Gola, DS-GVO, Article 85 GDPR, margin number 11 (Beck, 2018, 2nd ed.) (accessed 9 August 2021).
  10. See Article 24 of the Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel.
  11. See Article 80 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés, as modified after the entry into force of the GDPR.
  12. CJEU, Tietosuojavaltuutettu/Satakunnan Markkinapörssi Oy, C-73/07, 16 December 2008, margin number 110 (available here)
  13. Pötters in Gola DS-GVO, Article 85 GDPR, margin number 8 (Beck, 2018, 2nd ed.) (accessed 09 August 2021).
  14. Pötters in Gola, DS-GVO, Article 85 GDPR, margin number 9 (Beck, 2018, 2nd ed.) (accessed 09 August 2021).
  15. European Commission, EU Member States notifications to the European Commission (available here) (accessed 9 August 2021).