Article 85 GDPR: Difference between revisions

From GDPRhub
 
(19 intermediate revisions by 6 users not shown)
Line 185: Line 185:


==Legal Text==
==Legal Text==
<br /><center>'''Article 85 - Processing and freedom of expression and information'''</center><br />
<br /><center>'''Article 85 - Processing and freedom of expression and information'''</center>


<span id="1">1.  Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.</span>
<span id="1">1.  Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.</span>


<span id="2">2.  For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from CHAPTER II (principles),CHAPTER III (rights of the data subject),CHAPTER IV (controller and processor),CHAPTER V (transfer of personal data to third countries or international organisations),CHAPTER VI (independent supervisory authorities),CHAPTER VII (cooperation and consistency) and CHAPTER IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.</span>
<span id="2">2.  For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from CHAPTER II (principles), CHAPTER III (rights of the data subject), CHAPTER IV (controller and processor), CHAPTER V (transfer of personal data to third countries or international organisations), CHAPTER VI (independent supervisory authorities), CHAPTER VII (cooperation and consistency) and CHAPTER IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.</span>


<span id="3">3.  Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.</span>
<span id="3">3.  Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.</span>
Line 197: Line 197:


==Commentary==
==Commentary==
The GDPR provides for stringent requirements when personal data is processed. It is required, among other things, to have a legal basis for each processing operation (Article 6, 9 or 10 GDPR), answer requests from data subjects, including erasure requests (Article 17 GDPR) and to delete personal data when they are longer necessary, in accordance with the storage limitation principle (Article 5(1)(e) GDPR). In other words, the processing of personal data is not an activity which can be taken lightly.


=== (1) Reconciling Data Protection Rules with Freedom of Expression ===
This, in turn, may have a negative impact on the circulation of information, and therefore on freedom of expression. For some actors having limited resources indeed, such as artists, independent journalists, or simple citizens, complying with the GDPR may become too challenging, and therefore deter them from expressing themselves. In other instances, the stringent obligations imposed by the GDPR, such as the obligation to inform data subjects (Article 12 to 14 GDPR), may defeat the very purpose of the processing, such as when a whistle-blower intends to disclose classified information, or when a journalist investigates fraudulent actions. Article 85 provides guidance to Member States on how to reconcile the different interests at stake in order to ensure that freedom of expression is not unduly restricted following the application of data protection rules.
Data protection legislation is certainly aimed at reducing or at least controlling the amount of information in circulation. In order to process an individual's personal data, it is necessary, among other things, to respect certain principles, to comply with requests to exercise the data subject's rights, including deletion, and more generally to comply with the obligations incumbent on the data controller (organisational and security measures, international transfer of data, submission to the scrutiny of supervisory authorities). In other words, the processing of personal data is not a simple activity.  


At the same time, the GDPR recognises that there are many other areas of human and social experience that require the processing of personal data in relation to which it is not always appropriate to apply the full data protection framework. In doing so, the law maker accepts an intrinsic limit to the very applicability of the GDPR (or at least some its parts). In other words, the GDPR recognises that a journalist, academic, artist or writer, is allowed to fulfil their respective social function freely, and should not always be subject to all the stringent requirements provided for by data protection legislation.  
From the point of legislative history, Article 85 GDPR is a development of Article 9 of the 95/46 directive of the European Union. Article 9 obliged Member States to provide derogations from the directive for the processing of personal data carried out ''solely'' for journalistic purposes or the purpose of artistic and literary expression, and only if they are necessary to reconcile the right to privacy with the rights governing freedom of expression. Article 85 GDPR goes beyond this provision by removing the ‘solely’.


Article 85(1) deals precisely with offering a legal framework to reconcile the data subject’s right to data protection with the performance of equally crucial interest of proving society with free, informed and unencumbered information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What such “reconciliation” consists of is mostly a matter of necessity, as specified in Article 85(2) below.
=== (1) Reconciling data protection rules with freedom of expression ===
One of the first landmark cases before the CJEU which highlighted potential conflicts between data protection law and freedom of expression was ''Lindqvist''.<ref>CJEU, Case C-101/01 ''Lindqvist'', 6 November 2003 (available [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:62001CJ0101&from=EN here]).</ref> Mrs Lindqvist was an active member of Alseda, a small community in Sweden. At the end of 1998, she set up internet pages on her personal computer to disseminate information on the local activities. These pages also contained personal information on Mrs Lindqvist as well as other people in the community, including their first and sometimes full names. Mrs Lindqvist also described the work done by some of her colleagues and their hobbies, their family circumstances or their telephone number. She also mentioned that one of her colleagues had injured her foot and was working part-time.


=== (2) Exemptions ===
Following a complaint against Mrs Lindqvist at the national level, the latter was fined SEK 4000 (approximately EUR 450) by the Swedish DPA for not complying with the applicable data protection legislation. Mrs Lindqvist appealed that decision, and in the context of these proceedings, the national court referred several questions to the CJEU. One of these questions directly addressed the need to achieve a balance between the exercise of Mrs Lindqvist’s freedom of expression and the right to privacy and data protection of the others.
Under Article 85(2) GDPR, for processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.<ref>''The exemption under the Directive was narrower, as it provided exemptions for processing “solely” for “journalistic purposes or the purpose of artistic or literary expression,” if they were necessary from a free speech perspective. Article 85 of the GDPR omits the “solely” requirement and provides exemptions for the purpose of reconciling free speech with data protection. Article 85 refers to journalism, academia, art, and literature as examples of circumstances in which such exemptions would be necessary, resulting in a broader scope for exemption from GDPR rules''”. See, ''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound,  114 (2020), pp. 31–34.</ref> The extent of what is "necessary" for this purpose is necessarily a matter of interpretation by the national and European courts.  
 
In this respect, the CJEU considered that the 1995 EU Data Protection Directive (the GDPR’s predecessor) do not necessarily bring a restriction which conflicts with the general principles of freedom of expression, but it is up to the national courts to ensure a fair balance between the rights and interests in question.<ref>CJEU, Case C-101/01 ''Lindqvist'', 6 November 2003, margin number 90.</ref> In the specific case, Mrs. Lindqvist's freedom of expression in her work to contribute to the local religious life had to be weighed against the protection of individual rights. To balance these two, the court emphasised on the importance of respecting the principle of proportionality that means taking into account all the circumstances of the case before it before making a decision.<ref>CJEU, Case C-101/01 ''Lindqvist'', 6 November 2003, margin number 99.</ref>
 
In line with this case law, Article 85 GDPR requires Member States to adopt exemptions at the national level to achieve a balance between data protection on the one side, and freedom of expression and information on the other side, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. These exemptions should allow journalists, academics, artists and writers to fulfil their respective social function without being unduly burdened by data protection rules.


==== Scope of the Exceptions within the GDPR framework ====
Article 85(1) GDPR sets out a legal framework to reconcile the data subject’s right to data protection with the performance of the equally crucial interest of providing society with free, informed and impartial information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What this “''reconciliation''” consists of is mostly a matter of necessity, as specified in Article 85(2) GDPR, discussed below.  
As mentioned above, the GDPR recognises the need to protect freedom of expression (whatever the form) and authorises Member States to adopt, where necessary, statutory derogations to a large part of the GDPR itself, including data processing principles, data subject's rights, rules on international transfers, and even the subjection to the scrutiny of the supervisory authorities. Much (if not everything) seems to be abstractly possible in order to protect freedom of expression.


On this point, we note that such favourable treatment does not seem to be reserved for the protection of other primary interests such as those provided for by [[Article 23 GDPR]] (to which we refer for a complete analysis of the relevant discipline). National security, for example, may allow derogations to the GDPR, but only to the data subject's rights, and only on the condition that such a restriction ''"respects the essence of the fundamental rights and freedoms" and is "necessary and proportionate [...] in a democratic society"''.  
In general, Article 85(1) should be interpreted as a regulatory mandate for member states to to reconcile the rights to data protection with the rights to freedom of expression and information.<ref>Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1075.</ref> Article 85(2) sets out the implementation requirements for 85(1) to be fulfilled. While not outlined, the academic commentary agrees that Article 85(1) should not be read as requiring member states to reconcile data protection with freedom of expression and information in areas which are not linked to the purposes outlined in Article 85(2).<ref>Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1074. For example, a proposal by the European Parliament to impose a duty on Member States to balance data protection and freedom of expression and information independent of any specific purposes of processing was not adopted.</ref>


Conversely, when freedom of expression (including artistic, literary or academic expression) is taken into account, the GDPR authorises much broader restrictions as described above. In other words, it seems that the GDPR restrictions justified by overriding interests such as national security, defence, and crime prevention ([[Article 23 GDPR|Article 23(1)(a-j) GDPR]]) allow for far fewer GDPR restrictions than those granted by freedom of expression.
=== (2) Exemptions ===
Under Article 85(2) GDPR, when processing is carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) where necessary to reconcile the right to the protection of personal data with the freedom of expression and information<ref>“''The exemption under the Directive was narrower, as it provided exemptions for processing “solely” for “journalistic purposes or the purpose of artistic or literary expression,” if they were necessary from a free speech perspective. Article 85 of the GDPR omits the “solely” requirement and provides exemptions for the purpose of reconciling free speech with data protection. Article 85 refers to journalism, academia, art, and literature as examples of circumstances in which such exemptions would be necessary, resulting in a broader scope for exemption from GDPR rules''”. See, ''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.</ref> The extent of what is "necessary" for this purpose is necessarily a matter of interpretation by the national and European courts.  


==== Necessary to Reconcile ====
==== Public interest as a guiding principle ====
The core of this provision is clearly the concept expressed in the final part of paragraph 2 "''necessary to reconcile''". Member States may reduce the scope of a principle or right, or modify the obligations of the controller, only if this is "necessary to reconcile" the GDPR with the exercise of freedoms of expression and information, including academic, artistic or literary freedom.
In ''Google Spain'', the CJEU clarified the relationship between data protection and freedom of information. According to this judgment, national courts must balance the sensitivity of the information with the public interest in knowing it.<ref>CJEU, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., margin numbers 97-99 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5444812 here]).</ref> Equally relevant to this issue is the case-law of the European Court of Human Rights (ECtHR) on the interpretation of the provisions of the European Convention on Human Rights (the Convention).<ref>In fact, under Article 52(3) of the EU Charter, “''in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention''”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the Convention, further guidance on Article 85 GDPR can be found in the case-law of the ECtHR. See, ''Tinnefeld'' in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (C.H. Beck 2020, 3rd edition).</ref> The ECtHR's case-law has consistently recognised the role of the press for the proper functioning of a democratic society. In this sense, the media not only serve as “''public watchdog''” but also contribute to the production and circulation of information and ideas in the public interest. The ECtHR has notably stated that “[f]''reedom of the press'' ''gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society''”. Furthermore, the ECtHR has consistently made clear that the right to privacy and the right to freedom of expression “''are equal rights that states must balance, based on the criteria the Court has identified in its case law''”.<ref>''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.</ref> Further, in ''Von Hannover v. Germany'', the ECtHR found that two photographs depicting a royal family on holiday and publishing their reportage in two German newspapers violated the right to privacy pursuant to Article 8 of the Convention because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted “''a Prince in poor health, and since the health of the Prince was a matter of public concern, the ECtHR found that the publication of such information did not violate Article 8 of the Convention''”. In reaching its decision, the ECtHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression: “''firstly, whether the information contributes to a debate of general interest; secondly, how well known the person concerned and the subject matter of the report is; thirdly, the prior conduct of the person concerned; fourthly, content, the form and consequences of the publication; and fifth, the circumstances in which the photos were taken''”.<ref>Global Freedom of Expression, Von Hannover v. Germany (No. 2) (available [https://globalfreedomofexpression.columbia.edu/cases/von-hannover-v-germany-no-2/ here]).</ref>


Careful commentators, whose conclusions we fully share, note that in all cases the exception must be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition, but not to the data of buyers that the art gallery holds for its economic activity.<ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 11 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 9 August 2021).</ref> In the latter case, the exemption is not necessary to safeguard the artist’s freedom of artistic expression (but only a rather unjustified privilege).  
==== Scope of the exceptions within the GDPR framework ====
As mentioned above, the GDPR recognises the need to protect freedom of expression (whatever the form) and authorises Member States to adopt, where necessary, statutory derogations to a large part of the GDPR itself, including data processing principles, data subject's rights, rules on international transfers, and even the subjection to the scrutiny of the supervisory authorities. Much (if not everything) seems to be abstractly possible in order to protect freedom of expression. On this point, we note that this favourable treatment does not extend to the protection of national security, defence, or other important objectives of general public interest listed in [[Article 23 GDPR]] (to which we refer for a complete analysis of the relevant discipline). National security, for example, can in some instances be invoked as a ground to derogate from the GDPR, but only with respect to the data subject's rights, and only on the condition that such a restriction ''"respects the essence of the fundamental rights and freedoms"'' and is ''"necessary and proportionate [...] in a democratic society"''. Conversely, when freedom of expression (including artistic, literary or academic expression) is taken into account, the GDPR envisages much broader exemptions to its own rules. Thus, it seems that the GDPR restrictions justified by overriding interests such as national security, defence, and crime prevention ([[Article 23 GDPR|Article 23(1)(a-j) GDPR]]) allow for far fewer GDPR restrictions than those granted by freedom of expression.


===== Freedom of Expression and Information =====
==== Necessary to reconcile ====
On this point, the first question concerns the extent of the concept of 'expression'. In general, there seems to be a sort of overlap between the notion of 'expression' and that of 'journalism'. Theoretically, therefore, the privilege stemming from the national implementation of Article 85 would only be granted to those who qualify as journalists.  
Article 85(2) GDPR poses one condition for exemptions on the basis of freedom of expression to be valid: they must be "''necessary to reconcile''" the right to the protection of personal data with the freedom of expression and information. Member States may thus restrict the scope of a data protection principle, limit the exercise of a right by a data subject, or reduce the obligations of controllers, only if this is necessary to achieve a reconciliation between the GDPR and the freedoms of expression and information, including academic, artistic or literary expression. Some commentators rightfully note that the exemption must in any case be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition, but not to the data of buyers that the art gallery holds for its economic activity.<ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 11 (C.H. Beck, 2018, 2<sup>nd</sup> edition).</ref> Indeed, in the latter case the exemption is not necessary to safeguard the artist’s freedom of artistic expression, but only to allow the art gallery to maintain an economic advantage. Beyond this, Article 85(2) GDPR seems to leave full discretion to Member States to determine in which circumstances a reconciliation is necessary, and how it can be achieved. The approach adopted at the national level therefore varies from one Member State to another. Some have provided some details on the scope of these exemptions in their national data protection law (as in the Belgian data protection law).<ref>See Article 24 of the Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel.] while other simply refer to the wording of Article 85 GDPR without further specifications (as in the French data protection law).[ See Article 80 of the ''Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés'', as modified after the entry into force of the GDPR.</ref>


In theory, this approach may pose considerable problems for those who are not professional journalists. In practice, however, the problem loses part of its relevance. In fact, according to Recital 153, the term 'journalism' is to be interpreted broadly. Processing for journalistic purposes therefore includes data processing which is in connection with the expression of an opinion or aimed at creating one within the public. In particular, the aforementioned Recital clarifies that the privilege does not only apply to the classic professional press,<ref>CJEU, Tietosuojavaltuutettu/Satakunnan Markkinapörssi Oy, C-73/07, 16 December 2008, margin number 110 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=76075&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5443040 here]) </ref> but also to the audiovisual sector, i.e. telemedia and radio, as well as for news and press archives. In addition, people without journalistic training also benefit from the exemption insofar as they carry out investigative research activities.<ref>''Pötters'' in Gola DS-GVO, Article 85 GDPR, margin number 8 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 09 August 2021).</ref>
This concept is also reflected in Article 52 of the Charter of Fundamental Rights. Article 52(1) states; ''“Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.'' Thus, both Article 52 of the Charter alongside Article 85 of the GDPR sets limits on how member states may reconcile the right to freedom of expression and information.


However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is not covered by Article 85. <ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 9 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 09 August 2021).</ref>
Since freedom of expression (Article 11 and 13) and data privacy (Article 8) are both in the Charter of Fundamental Rights, it would run counter to the equal ranking of the fundamental rights to data protection, freedom of expression and information if Member States would provide unnecessary derogations.<ref>Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1073.</ref> This necessity principle can therefore be seen as a way to ensure that the rights are actively balanced. Blanket exemptions from the GDPR in the fields of journalism, academia, arts and literature are not in line with Union Law.<ref>Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1073.</ref>
===== Journalistic expression =====
The first question on journalistic expression concerns the scope of the concept of 'expression'.<ref>Note the term Journalistic Expression and Purposes is used interchangibly by the courts.</ref> In general, there seems to be a sort of overlap between the notion of 'expression' and that of 'journalism'. Thus, theoretically the privilege stemming from (the national implementation of) Article 85 GDPR would therefore only be granted to those who qualify as journalists. In theory, this approach may pose considerable problems for those who are not professional journalists. In practice, however, the problem loses part of its relevance. Recital clarifies that the privilege does not only apply to the classic professional press,<ref>CJEU, Satakunnan Markkinapörssi Oy, C-73/07, 16 December 2008, margin number 110 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=76075&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5443040 here]).</ref> but also to the audio-visual sector, i.e. television and radio, as well as for news and press archives. In addition, people without journalistic training also benefit from the exemption insofar as they carry out investigative research activities.<ref>''Pötters'' in Gola DS-GVO, Article 85 GDPR, margin number 8 (C.H. Beck, 2018, 2<sup>nd</sup> edition).</ref>


===== Public Interest =====
In fact, according to Recital 153 GDPR the term 'journalism' is to be interpreted broadly. Journalistic purposes are not limited to data processing by media corporations but rather any person engaging in journalistic purposes. Processing for journalistic purposes includes data processing which is in connection with the expression of an opinion or aimed at creating one within the public. According to AG Kokott information is in the public interest if it either related to a current public debate, public hearings before a tribunal, transparency of public life or information on the ideas and attitudes, as well as conduct, of prominent politicians.<ref>AG Kokott, Opinion in Case -73/07.</ref>
In its judgment on Google Spain, the CJEU clarified the relationship between data protection and freedom of information. According to this, courts must balance the sensitivity of the information with the public interest in knowing it.<ref>CJEU, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., margin numbers 97-99 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5444812 here]) </ref>


Equally relevant to this issue are the indications offered by the European Court of Human Rights. In fact, under Article 52(3) of the EU Charter, “''in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention''”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the European Convention on Human Rights, further guidance on Article 85 GDPR on Article 85 GDPR can be found in the case-law of the ECtHR.<ref>''Tinnefeld'' in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (Beck 2020, 3rd ed.) (accessed 9 August 2021).</ref>
However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is not covered by Article 85 GDPR.<ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 9 (C.H. Beck, 2018, 2<sup>nd</sup> edition).</ref> Similarly, in line with the ''Lindqvist'' case-law discussed above, an individual sharing personal data on social media will still be subject to the provisions of the GDPR, ''except'' if the sharing of such information participates to a public debate and is covered by freedom of expression, or if it is shared in the course of a purely personal or household activity (for example, in a closed message group).<ref>We refer, in that respect, to the Commentary on [https://gdprhub.eu/Article%202%20GDPR Article 2(2)(c) GDPR].</ref>


The ECtHR's case-law has consistently recognised the role of the press for the proper functioning of a democratic society. In this sense, the media not only serve as “''public watchdog''” but also contribute to production and circulation of information and ideas in the public interest. “''Freedom of the press'',” the Court has stated, “''gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society''”. Furthermore, the Court has consistently made clear that the right to privacy protected by Article 8 of the Convention and the right to freedom of expression “''are equal rights that states must balance, based on the criteria the Court has identified in its caselaw''”.<ref>''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.</ref>
There does seem to be a minimum standard to journalistic purposes as at least some journalistic, academic, artistic editing or treatment of the data is necessary to qualify. The mere provision of lists of addresses, address books and, telephone or classified directories does not justify an exemption or derogation.<ref>Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1078. See also case [[OGH - 6Ob129/21w]].</ref>


In the case ECtHR, Von Hannover v. Germany, the Court found that two photographs depicting a royal family on holiday and published in two German newspapers violated the right to privacy pursuant to Article 8 of the European Convention on Human Rights because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted a Prince in poor health, and since the health of the Prince was a matter of public concern the ECtHR found no violation of Article 8.  In reaching its ruling the ECtHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression. Firstly, whether the information contributes to a debate of general interest; secondly, how well known is the person concerned and the subject matter of the report; thirdly, the prior conduct of the person concerned; fourthly, content, form and consequences of the publication; and fifth, the circumstances in which the photos were taken.<ref>Entirely taken from Global Freedom of Expression, Von Hannover v. Germany (No. 2) (available [https://globalfreedomofexpression.columbia.edu/cases/von-hannover-v-germany-no-2/ here]) (accessed on 9 August 2021).</ref>
===== Artistic, literary and academic expression =====
From a systematic point of view, artistic, literary or academic expression seem to be equated with journalistic expression (as seen above). For this reason, in the absence of more specific indications from both the CJEU and ECtHR, it seems reasonable to apply the same conclusions and principles to these sectors. In this vein, the exemption would be valid for a photo, book or article containing personal data, but only if it is intended to be published, for example, in an art gallery, library or scientific journal. Conversely, data processing carried out by the photographer, writer or academic which is not intended for public discussion (e.g. the record of the gallery's customers) will not fall within the scope of the exception. This nonetheless obviously depends on the national implementation of Article 85 GDPR. At present, not all Member States have specific legislation on artistic, literary or academic expression.<ref>European Commission, EU Member States notifications to the European Commission (available [https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu/eu-countries-gdpr-specific-notifications_en here]) (accessed 9 August 2021).</ref> This contributes in no small measure to the uncertainties surrounding the processing of personal data in these areas.


===== Artistic, Literary and Academic Expression =====
This concept is also echoed in Article 13 Charter of Fundamental Rights. In fact, ''“[the] right is deduced primarily from the right to freedom of thought and expression.”''<ref>FRA, Article 13, <http://fra.europa.eu/en/eu-charter/article/13-freedom-arts-and-sciences> accessed 23/10/23.</ref>
From a systematic point of view, artistic, literary or academic expression seem to be equated with journalistic expression (in the sense just seen above). For this reason, in the absence of more specific indications from both the CJEU and ECtHR, it seems reasonable to apply to these sectors the same conclusions and principles. In this vein, the exemption would be valid for a photo (book or article) containing personal data, but only if is intended to be published, for example, in an art gallery (library or scientific journal). Conversely, data processing carried out by the photographer (writer or academic) which is not intended for public discussion (e.g. the record of the gallery's customers) will not fall within the scope of the exception. On this matter, very much obviously depends on the national implementation of Article 85. At present, not all European countries have specific legislation on artistic, literary or academic expression.<ref>European Commission, EU Member States notifications to the European Commission (available [https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu/eu-countries-gdpr-specific-notifications_en here]) (accessed 9 August 2021).</ref> This contributes in no small measure to the uncertainties surrounding the processing of personal data in the mentioned areas.


=== (3) Notification to the Commission ===
=== (3) Notification to the Commission ===
Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them. The actual national transposition of these exceptions must be notified immediately to the Commission. Indeed, there is a need for monitoring of the GDPR exemption measures to be taken by individual Member States.
Each Member State has the obligation to notify the Commission of the provisions of national law which were adopted pursuant to Article 85(2) GDPR and, without delay, any subsequent amendment(s) affecting them. The actual national transposition of these exemptions must immediately be notified to the Commission. Indeed, there is a need for monitoring the exemption measures adopted by each Member States to ensure that the latter have complied with the principle set out in Article 85 GDPR.


==Decisions==
==Decisions==
Line 249: Line 255:


[[Category:Article 85 GDPR]]  
[[Category:Article 85 GDPR]]  
[[Category:GDPR]]
[[Category:GDPR Articles]]

Latest revision as of 14:25, 7 November 2023

Article 85 - Processing and freedom of expression and information
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 85 - Processing and freedom of expression and information

1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from CHAPTER II (principles), CHAPTER III (rights of the data subject), CHAPTER IV (controller and processor), CHAPTER V (transfer of personal data to third countries or international organisations), CHAPTER VI (independent supervisory authorities), CHAPTER VII (cooperation and consistency) and CHAPTER IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

3. Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.

Relevant Recitals

Recital 153: Processing of Personal Data Solely for Journalistic Purposes, or for the Purposes of Academic, Artistic or Literary Expression
Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data pursuant to this Regulation. The processing of personal data solely for journalistic purposes, or for the purposes of academic, artistic or literary expression should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the Charter. This should apply in particular to the processing of personal data in the audiovisual field and in news archives and press libraries. Therefore, Member States should adopt legislative measures which lay down the exemptions and derogations necessary for the purpose of balancing those fundamental rights. Member States should adopt such exemptions and derogations on general principles, the rights of the data subject, the controller and the processor, the transfer of personal data to third countries or international organisations, the independent supervisory authorities, cooperation and consistency, and specific data-processing situations. Where such exemptions or derogations differ from one Member State to another, the law of the Member State to which the controller is subject should apply. In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly.

Commentary

The GDPR provides for stringent requirements when personal data is processed. It is required, among other things, to have a legal basis for each processing operation (Article 6, 9 or 10 GDPR), answer requests from data subjects, including erasure requests (Article 17 GDPR) and to delete personal data when they are longer necessary, in accordance with the storage limitation principle (Article 5(1)(e) GDPR). In other words, the processing of personal data is not an activity which can be taken lightly.

This, in turn, may have a negative impact on the circulation of information, and therefore on freedom of expression. For some actors having limited resources indeed, such as artists, independent journalists, or simple citizens, complying with the GDPR may become too challenging, and therefore deter them from expressing themselves. In other instances, the stringent obligations imposed by the GDPR, such as the obligation to inform data subjects (Article 12 to 14 GDPR), may defeat the very purpose of the processing, such as when a whistle-blower intends to disclose classified information, or when a journalist investigates fraudulent actions. Article 85 provides guidance to Member States on how to reconcile the different interests at stake in order to ensure that freedom of expression is not unduly restricted following the application of data protection rules.

From the point of legislative history, Article 85 GDPR is a development of Article 9 of the 95/46 directive of the European Union. Article 9 obliged Member States to provide derogations from the directive for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic and literary expression, and only if they are necessary to reconcile the right to privacy with the rights governing freedom of expression. Article 85 GDPR goes beyond this provision by removing the ‘solely’.

(1) Reconciling data protection rules with freedom of expression

One of the first landmark cases before the CJEU which highlighted potential conflicts between data protection law and freedom of expression was Lindqvist.[1] Mrs Lindqvist was an active member of Alseda, a small community in Sweden. At the end of 1998, she set up internet pages on her personal computer to disseminate information on the local activities. These pages also contained personal information on Mrs Lindqvist as well as other people in the community, including their first and sometimes full names. Mrs Lindqvist also described the work done by some of her colleagues and their hobbies, their family circumstances or their telephone number. She also mentioned that one of her colleagues had injured her foot and was working part-time.

Following a complaint against Mrs Lindqvist at the national level, the latter was fined SEK 4000 (approximately EUR 450) by the Swedish DPA for not complying with the applicable data protection legislation. Mrs Lindqvist appealed that decision, and in the context of these proceedings, the national court referred several questions to the CJEU. One of these questions directly addressed the need to achieve a balance between the exercise of Mrs Lindqvist’s freedom of expression and the right to privacy and data protection of the others.

In this respect, the CJEU considered that the 1995 EU Data Protection Directive (the GDPR’s predecessor) do not necessarily bring a restriction which conflicts with the general principles of freedom of expression, but it is up to the national courts to ensure a fair balance between the rights and interests in question.[2] In the specific case, Mrs. Lindqvist's freedom of expression in her work to contribute to the local religious life had to be weighed against the protection of individual rights. To balance these two, the court emphasised on the importance of respecting the principle of proportionality that means taking into account all the circumstances of the case before it before making a decision.[3]

In line with this case law, Article 85 GDPR requires Member States to adopt exemptions at the national level to achieve a balance between data protection on the one side, and freedom of expression and information on the other side, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. These exemptions should allow journalists, academics, artists and writers to fulfil their respective social function without being unduly burdened by data protection rules.

Article 85(1) GDPR sets out a legal framework to reconcile the data subject’s right to data protection with the performance of the equally crucial interest of providing society with free, informed and impartial information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What this “reconciliation” consists of is mostly a matter of necessity, as specified in Article 85(2) GDPR, discussed below.

In general, Article 85(1) should be interpreted as a regulatory mandate for member states to to reconcile the rights to data protection with the rights to freedom of expression and information.[4] Article 85(2) sets out the implementation requirements for 85(1) to be fulfilled. While not outlined, the academic commentary agrees that Article 85(1) should not be read as requiring member states to reconcile data protection with freedom of expression and information in areas which are not linked to the purposes outlined in Article 85(2).[5]

(2) Exemptions

Under Article 85(2) GDPR, when processing is carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) where necessary to reconcile the right to the protection of personal data with the freedom of expression and information[6] The extent of what is "necessary" for this purpose is necessarily a matter of interpretation by the national and European courts.

Public interest as a guiding principle

In Google Spain, the CJEU clarified the relationship between data protection and freedom of information. According to this judgment, national courts must balance the sensitivity of the information with the public interest in knowing it.[7] Equally relevant to this issue is the case-law of the European Court of Human Rights (ECtHR) on the interpretation of the provisions of the European Convention on Human Rights (the Convention).[8] The ECtHR's case-law has consistently recognised the role of the press for the proper functioning of a democratic society. In this sense, the media not only serve as “public watchdog” but also contribute to the production and circulation of information and ideas in the public interest. The ECtHR has notably stated that “[f]reedom of the press gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society”. Furthermore, the ECtHR has consistently made clear that the right to privacy and the right to freedom of expression “are equal rights that states must balance, based on the criteria the Court has identified in its case law”.[9] Further, in Von Hannover v. Germany, the ECtHR found that two photographs depicting a royal family on holiday and publishing their reportage in two German newspapers violated the right to privacy pursuant to Article 8 of the Convention because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted “a Prince in poor health, and since the health of the Prince was a matter of public concern, the ECtHR found that the publication of such information did not violate Article 8 of the Convention”. In reaching its decision, the ECtHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression: “firstly, whether the information contributes to a debate of general interest; secondly, how well known the person concerned and the subject matter of the report is; thirdly, the prior conduct of the person concerned; fourthly, content, the form and consequences of the publication; and fifth, the circumstances in which the photos were taken”.[10]

Scope of the exceptions within the GDPR framework

As mentioned above, the GDPR recognises the need to protect freedom of expression (whatever the form) and authorises Member States to adopt, where necessary, statutory derogations to a large part of the GDPR itself, including data processing principles, data subject's rights, rules on international transfers, and even the subjection to the scrutiny of the supervisory authorities. Much (if not everything) seems to be abstractly possible in order to protect freedom of expression. On this point, we note that this favourable treatment does not extend to the protection of national security, defence, or other important objectives of general public interest listed in Article 23 GDPR (to which we refer for a complete analysis of the relevant discipline). National security, for example, can in some instances be invoked as a ground to derogate from the GDPR, but only with respect to the data subject's rights, and only on the condition that such a restriction "respects the essence of the fundamental rights and freedoms" and is "necessary and proportionate [...] in a democratic society". Conversely, when freedom of expression (including artistic, literary or academic expression) is taken into account, the GDPR envisages much broader exemptions to its own rules. Thus, it seems that the GDPR restrictions justified by overriding interests such as national security, defence, and crime prevention (Article 23(1)(a-j) GDPR) allow for far fewer GDPR restrictions than those granted by freedom of expression.

Necessary to reconcile

Article 85(2) GDPR poses one condition for exemptions on the basis of freedom of expression to be valid: they must be "necessary to reconcile" the right to the protection of personal data with the freedom of expression and information. Member States may thus restrict the scope of a data protection principle, limit the exercise of a right by a data subject, or reduce the obligations of controllers, only if this is necessary to achieve a reconciliation between the GDPR and the freedoms of expression and information, including academic, artistic or literary expression. Some commentators rightfully note that the exemption must in any case be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition, but not to the data of buyers that the art gallery holds for its economic activity.[11] Indeed, in the latter case the exemption is not necessary to safeguard the artist’s freedom of artistic expression, but only to allow the art gallery to maintain an economic advantage. Beyond this, Article 85(2) GDPR seems to leave full discretion to Member States to determine in which circumstances a reconciliation is necessary, and how it can be achieved. The approach adopted at the national level therefore varies from one Member State to another. Some have provided some details on the scope of these exemptions in their national data protection law (as in the Belgian data protection law).[12]

This concept is also reflected in Article 52 of the Charter of Fundamental Rights. Article 52(1) states; “Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.” Thus, both Article 52 of the Charter alongside Article 85 of the GDPR sets limits on how member states may reconcile the right to freedom of expression and information.

Since freedom of expression (Article 11 and 13) and data privacy (Article 8) are both in the Charter of Fundamental Rights, it would run counter to the equal ranking of the fundamental rights to data protection, freedom of expression and information if Member States would provide unnecessary derogations.[13] This necessity principle can therefore be seen as a way to ensure that the rights are actively balanced. Blanket exemptions from the GDPR in the fields of journalism, academia, arts and literature are not in line with Union Law.[14]

Journalistic expression

The first question on journalistic expression concerns the scope of the concept of 'expression'.[15] In general, there seems to be a sort of overlap between the notion of 'expression' and that of 'journalism'. Thus, theoretically the privilege stemming from (the national implementation of) Article 85 GDPR would therefore only be granted to those who qualify as journalists. In theory, this approach may pose considerable problems for those who are not professional journalists. In practice, however, the problem loses part of its relevance. Recital clarifies that the privilege does not only apply to the classic professional press,[16] but also to the audio-visual sector, i.e. television and radio, as well as for news and press archives. In addition, people without journalistic training also benefit from the exemption insofar as they carry out investigative research activities.[17]

In fact, according to Recital 153 GDPR the term 'journalism' is to be interpreted broadly. Journalistic purposes are not limited to data processing by media corporations but rather any person engaging in journalistic purposes. Processing for journalistic purposes includes data processing which is in connection with the expression of an opinion or aimed at creating one within the public. According to AG Kokott information is in the public interest if it either related to a current public debate, public hearings before a tribunal, transparency of public life or information on the ideas and attitudes, as well as conduct, of prominent politicians.[18]

However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is not covered by Article 85 GDPR.[19] Similarly, in line with the Lindqvist case-law discussed above, an individual sharing personal data on social media will still be subject to the provisions of the GDPR, except if the sharing of such information participates to a public debate and is covered by freedom of expression, or if it is shared in the course of a purely personal or household activity (for example, in a closed message group).[20]

There does seem to be a minimum standard to journalistic purposes as at least some journalistic, academic, artistic editing or treatment of the data is necessary to qualify. The mere provision of lists of addresses, address books and, telephone or classified directories does not justify an exemption or derogation.[21]

Artistic, literary and academic expression

From a systematic point of view, artistic, literary or academic expression seem to be equated with journalistic expression (as seen above). For this reason, in the absence of more specific indications from both the CJEU and ECtHR, it seems reasonable to apply the same conclusions and principles to these sectors. In this vein, the exemption would be valid for a photo, book or article containing personal data, but only if it is intended to be published, for example, in an art gallery, library or scientific journal. Conversely, data processing carried out by the photographer, writer or academic which is not intended for public discussion (e.g. the record of the gallery's customers) will not fall within the scope of the exception. This nonetheless obviously depends on the national implementation of Article 85 GDPR. At present, not all Member States have specific legislation on artistic, literary or academic expression.[22] This contributes in no small measure to the uncertainties surrounding the processing of personal data in these areas.

This concept is also echoed in Article 13 Charter of Fundamental Rights. In fact, “[the] right is deduced primarily from the right to freedom of thought and expression.”[23]

(3) Notification to the Commission

Each Member State has the obligation to notify the Commission of the provisions of national law which were adopted pursuant to Article 85(2) GDPR and, without delay, any subsequent amendment(s) affecting them. The actual national transposition of these exemptions must immediately be notified to the Commission. Indeed, there is a need for monitoring the exemption measures adopted by each Member States to ensure that the latter have complied with the principle set out in Article 85 GDPR.

Decisions

→ You can find all related decisions in Category:Article 85 GDPR

References

  1. CJEU, Case C-101/01 Lindqvist, 6 November 2003 (available here).
  2. CJEU, Case C-101/01 Lindqvist, 6 November 2003, margin number 90.
  3. CJEU, Case C-101/01 Lindqvist, 6 November 2003, margin number 99.
  4. Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1075.
  5. Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1074. For example, a proposal by the European Parliament to impose a duty on Member States to balance data protection and freedom of expression and information independent of any specific purposes of processing was not adopted.
  6. The exemption under the Directive was narrower, as it provided exemptions for processing “solely” for “journalistic purposes or the purpose of artistic or literary expression,” if they were necessary from a free speech perspective. Article 85 of the GDPR omits the “solely” requirement and provides exemptions for the purpose of reconciling free speech with data protection. Article 85 refers to journalism, academia, art, and literature as examples of circumstances in which such exemptions would be necessary, resulting in a broader scope for exemption from GDPR rules”. See, Reventlow, Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.
  7. CJEU, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., margin numbers 97-99 (available here).
  8. In fact, under Article 52(3) of the EU Charter, “in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the Convention, further guidance on Article 85 GDPR can be found in the case-law of the ECtHR. See, Tinnefeld in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (C.H. Beck 2020, 3rd edition).
  9. Reventlow, Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.
  10. Global Freedom of Expression, Von Hannover v. Germany (No. 2) (available here).
  11. Pötters in Gola, DS-GVO, Article 85 GDPR, margin number 11 (C.H. Beck, 2018, 2nd edition).
  12. See Article 24 of the Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel.] while other simply refer to the wording of Article 85 GDPR without further specifications (as in the French data protection law).[ See Article 80 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés, as modified after the entry into force of the GDPR.
  13. Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1073.
  14. Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1073.
  15. Note the term Journalistic Expression and Purposes is used interchangibly by the courts.
  16. CJEU, Satakunnan Markkinapörssi Oy, C-73/07, 16 December 2008, margin number 110 (available here).
  17. Pötters in Gola DS-GVO, Article 85 GDPR, margin number 8 (C.H. Beck, 2018, 2nd edition).
  18. AG Kokott, Opinion in Case -73/07.
  19. Pötters in Gola, DS-GVO, Article 85 GDPR, margin number 9 (C.H. Beck, 2018, 2nd edition).
  20. We refer, in that respect, to the Commentary on Article 2(2)(c) GDPR.
  21. Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1078. See also case OGH - 6Ob129/21w.
  22. European Commission, EU Member States notifications to the European Commission (available here) (accessed 9 August 2021).
  23. FRA, Article 13, <http://fra.europa.eu/en/eu-charter/article/13-freedom-arts-and-sciences> accessed 23/10/23.