Article 85 GDPR: Difference between revisions

From GDPRhub
Line 197: Line 197:


=== (1) Reconciling Data Protection Rules with Freedom of Expression ===
=== (1) Reconciling Data Protection Rules with Freedom of Expression ===
Data protection legislation is certainly aimed at reducing or at least controlling the amount of information in circulation. In order to process an individual's personal data, it is necessary, among other things, to respect certain principles, to comply with requests to exercise the data subject's rights, including deletion, and more generally to comply with the obligations incumbent on the data controller (organisational and security measures, international transfer of data, submission to the scrutiny of supervisory authorities). In other words, the processing of personal data is not a simple activity.


At the same time, the GDPR recognises that there are many other areas of human and social experience that require the processing of personal data in relation to which it is not always appropriate to apply the full data protection framework. In doing so, the law maker accepts an intrinsic limit to the very applicability of the GDPR (or at least some its parts). In other words, the GDPR recognises that a journalist, academic, artist or writer, is allowed to fulfil their respective social function freely, and should not always be subject to all the stringent requirements provided for by data protection legislation.  
===== The impact of the GDPR on freedom of expression =====
The GDPR provides for stringent requirements when personal data are processed. It is required, among other things, to have a legal basis for each processing operation ([[Article 6 GDPR|Article 6]], [[Article 9 GDPR|9]] or [[Article 10 GDPR|10 GDPR]]), answer requests from data subjects, including erasure requests ([[Article 17 GDPR]]) and to delete personal data when they are longer necessary, in accordance with the storage limitation principle ([[Article 5 GDPR|Article 5(1)(e) GDPR]]). In other words, the processing of personal data is not an activity which can be taken lightly. This, in turn, may have a negative impact on the circulation of information, and therefore on freedom of expression. For some actors having limited resources indeed, such as artists, independent journalists, or simple citizens, complying with the GDPR may become too challenging, and therefore deter them from expressing themselves. In other instances, the stringent obligations imposed by the GDPR, such as the obligation to inform data subjects ([[Article 12 GDPR|Article 12]] to [[Article 14 GDPR|14 GDPR]]), may defeat the very purpose of the processing, such as when a whistle-blower intends to disclose classified information, or when a journalist investigates fraudulent actions.
 
Article 85 GDPR hence provides exemptions for these areas of human or social lives where strictly applying data protection law would unduly restrict freedom of expression. More particularly, it recognizes that journalists, academics, artists and writers should be allowed to fulfill their respective social function without being unduly burdened by data protection rules. In that perspective, Article 85(1) GDPR requires member States to reconcile the right to data protection with the right to freedom of expression by adopting specific exemptions in national law, including for the processing of personal data for the purpose of journalism, or for academic, artistic or literary expression.  


Article 85(1) deals precisely with offering a legal framework to reconcile the data subject’s right to data protection with the performance of equally crucial interest of proving society with free, informed and unencumbered information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What such “reconciliation” consists of is mostly a matter of necessity, as specified in Article 85(2) below.
Article 85(1) deals precisely with offering a legal framework to reconcile the data subject’s right to data protection with the performance of equally crucial interest of proving society with free, informed and unencumbered information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What such “reconciliation” consists of is mostly a matter of necessity, as specified in Article 85(2) below.
===== Balancing data protection and privacy with freedom of expression =====
Lindqvist:
===== Public Interest as a Guiding Principle =====
In its judgment on Google Spain, the CJEU clarified the relationship between data protection and freedom of information. According to this, courts must balance the sensitivity of the information with the public interest in knowing it.<ref>CJEU, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., margin numbers 97-99 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5444812 here]) </ref>
Equally relevant to this issue are the indications offered by the European Court of Human Rights. In fact, under Article 52(3) of the EU Charter, “''in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention''”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the European Convention on Human Rights, further guidance on Article 85 GDPR on Article 85 GDPR can be found in the case-law of the ECtHR.<ref>''Tinnefeld'' in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (Beck 2020, 3rd ed.) (accessed 9 August 2021).</ref>
The ECtHR's case-law has consistently recognised the role of the press for the proper functioning of a democratic society. In this sense, the media not only serve as “''public watchdog''” but also contribute to production and circulation of information and ideas in the public interest. “''Freedom of the press'',” the Court has stated, “''gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society''”. Furthermore, the Court has consistently made clear that the right to privacy protected by Article 8 of the Convention and the right to freedom of expression “''are equal rights that states must balance, based on the criteria the Court has identified in its caselaw''”.<ref>''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.</ref>
In the case ECtHR, Von Hannover v. Germany, the Court found that two photographs depicting a royal family on holiday and published in two German newspapers violated the right to privacy pursuant to Article 8 of the European Convention on Human Rights because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted a Prince in poor health, and since the health of the Prince was a matter of public concern the ECtHR found no violation of Article 8.  In reaching its ruling the ECtHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression. Firstly, whether the information contributes to a debate of general interest; secondly, how well known is the person concerned and the subject matter of the report; thirdly, the prior conduct of the person concerned; fourthly, content, form and consequences of the publication; and fifth, the circumstances in which the photos were taken.<ref>Entirely taken from Global Freedom of Expression, Von Hannover v. Germany (No. 2) (available [https://globalfreedomofexpression.columbia.edu/cases/von-hannover-v-germany-no-2/ here]) (accessed on 9 August 2021).</ref>


=== (2) Exemptions ===
=== (2) Exemptions ===
Line 218: Line 232:
Careful commentators, whose conclusions we fully share, note that in all cases the exception must be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition, but not to the data of buyers that the art gallery holds for its economic activity.<ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 11 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 9 August 2021).</ref> In the latter case, the exemption is not necessary to safeguard the artist’s freedom of artistic expression (but only a rather unjustified privilege).  
Careful commentators, whose conclusions we fully share, note that in all cases the exception must be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition, but not to the data of buyers that the art gallery holds for its economic activity.<ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 11 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 9 August 2021).</ref> In the latter case, the exemption is not necessary to safeguard the artist’s freedom of artistic expression (but only a rather unjustified privilege).  


===== Freedom of Expression and Information =====
===== Journalistic expression =====
On this point, the first question concerns the extent of the concept of 'expression'. In general, there seems to be a sort of overlap between the notion of 'expression' and that of 'journalism'. Theoretically, therefore, the privilege stemming from – the national implementation of – Article 85 would only be granted to those who qualify as journalists.  
On this point, the first question concerns the extent of the concept of 'expression'. In general, there seems to be a sort of overlap between the notion of 'expression' and that of 'journalism'. Theoretically, therefore, the privilege stemming from – the national implementation of – Article 85 would only be granted to those who qualify as journalists.  


Line 224: Line 238:


However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is not covered by Article 85. <ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 9 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 09 August 2021).</ref>
However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is not covered by Article 85. <ref>''Pötters'' in Gola, DS-GVO, Article 85 GDPR, margin number 9 (Beck, 2018, 2<sup>nd</sup> ed.) (accessed 09 August 2021).</ref>
===== Public Interest =====
In its judgment on Google Spain, the CJEU clarified the relationship between data protection and freedom of information. According to this, courts must balance the sensitivity of the information with the public interest in knowing it.<ref>CJEU, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., margin numbers 97-99 (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5444812 here]) </ref>
Equally relevant to this issue are the indications offered by the European Court of Human Rights. In fact, under Article 52(3) of the EU Charter, “''in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention''”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the European Convention on Human Rights, further guidance on Article 85 GDPR on Article 85 GDPR can be found in the case-law of the ECtHR.<ref>''Tinnefeld'' in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (Beck 2020, 3rd ed.) (accessed 9 August 2021).</ref>
The ECtHR's case-law has consistently recognised the role of the press for the proper functioning of a democratic society. In this sense, the media not only serve as “''public watchdog''” but also contribute to production and circulation of information and ideas in the public interest. “''Freedom of the press'',” the Court has stated, “''gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society''”. Furthermore, the Court has consistently made clear that the right to privacy protected by Article 8 of the Convention and the right to freedom of expression “''are equal rights that states must balance, based on the criteria the Court has identified in its caselaw''”.<ref>''Reventlow'', Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.</ref>
In the case ECtHR, Von Hannover v. Germany, the Court found that two photographs depicting a royal family on holiday and published in two German newspapers violated the right to privacy pursuant to Article 8 of the European Convention on Human Rights because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted a Prince in poor health, and since the health of the Prince was a matter of public concern the ECtHR found no violation of Article 8.  In reaching its ruling the ECtHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression. Firstly, whether the information contributes to a debate of general interest; secondly, how well known is the person concerned and the subject matter of the report; thirdly, the prior conduct of the person concerned; fourthly, content, form and consequences of the publication; and fifth, the circumstances in which the photos were taken.<ref>Entirely taken from Global Freedom of Expression, Von Hannover v. Germany (No. 2) (available [https://globalfreedomofexpression.columbia.edu/cases/von-hannover-v-germany-no-2/ here]) (accessed on 9 August 2021).</ref>


===== Artistic, Literary and Academic Expression =====
===== Artistic, Literary and Academic Expression =====

Revision as of 16:15, 6 October 2021

Article 85 - Processing and freedom of expression and information
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text

Article 85 - Processing and freedom of expression and information

1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from CHAPTER II (principles), CHAPTER III (rights of the data subject), CHAPTER IV (controller and processor), CHAPTER V (transfer of personal data to third countries or international organisations), CHAPTER VI (independent supervisory authorities), CHAPTER VII (cooperation and consistency) and CHAPTER IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

3. Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.

Relevant Recitals

Recital 153: Processing of Personal Data Solely for Journalistic Purposes, or for the Purposes of Academic, Artistic or Literary Expression
Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data pursuant to this Regulation. The processing of personal data solely for journalistic purposes, or for the purposes of academic, artistic or literary expression should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the Charter. This should apply in particular to the processing of personal data in the audiovisual field and in news archives and press libraries. Therefore, Member States should adopt legislative measures which lay down the exemptions and derogations necessary for the purpose of balancing those fundamental rights. Member States should adopt such exemptions and derogations on general principles, the rights of the data subject, the controller and the processor, the transfer of personal data to third countries or international organisations, the independent supervisory authorities, cooperation and consistency, and specific data-processing situations. Where such exemptions or derogations differ from one Member State to another, the law of the Member State to which the controller is subject should apply. In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly.

Commentary

(1) Reconciling Data Protection Rules with Freedom of Expression

The impact of the GDPR on freedom of expression

The GDPR provides for stringent requirements when personal data are processed. It is required, among other things, to have a legal basis for each processing operation (Article 6, 9 or 10 GDPR), answer requests from data subjects, including erasure requests (Article 17 GDPR) and to delete personal data when they are longer necessary, in accordance with the storage limitation principle (Article 5(1)(e) GDPR). In other words, the processing of personal data is not an activity which can be taken lightly. This, in turn, may have a negative impact on the circulation of information, and therefore on freedom of expression. For some actors having limited resources indeed, such as artists, independent journalists, or simple citizens, complying with the GDPR may become too challenging, and therefore deter them from expressing themselves. In other instances, the stringent obligations imposed by the GDPR, such as the obligation to inform data subjects (Article 12 to 14 GDPR), may defeat the very purpose of the processing, such as when a whistle-blower intends to disclose classified information, or when a journalist investigates fraudulent actions.

Article 85 GDPR hence provides exemptions for these areas of human or social lives where strictly applying data protection law would unduly restrict freedom of expression. More particularly, it recognizes that journalists, academics, artists and writers should be allowed to fulfill their respective social function without being unduly burdened by data protection rules. In that perspective, Article 85(1) GDPR requires member States to reconcile the right to data protection with the right to freedom of expression by adopting specific exemptions in national law, including for the processing of personal data for the purpose of journalism, or for academic, artistic or literary expression.

Article 85(1) deals precisely with offering a legal framework to reconcile the data subject’s right to data protection with the performance of equally crucial interest of proving society with free, informed and unencumbered information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What such “reconciliation” consists of is mostly a matter of necessity, as specified in Article 85(2) below.

Balancing data protection and privacy with freedom of expression

Lindqvist:

Public Interest as a Guiding Principle

In its judgment on Google Spain, the CJEU clarified the relationship between data protection and freedom of information. According to this, courts must balance the sensitivity of the information with the public interest in knowing it.[1]

Equally relevant to this issue are the indications offered by the European Court of Human Rights. In fact, under Article 52(3) of the EU Charter, “in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the European Convention on Human Rights, further guidance on Article 85 GDPR on Article 85 GDPR can be found in the case-law of the ECtHR.[2]

The ECtHR's case-law has consistently recognised the role of the press for the proper functioning of a democratic society. In this sense, the media not only serve as “public watchdog” but also contribute to production and circulation of information and ideas in the public interest. “Freedom of the press,” the Court has stated, “gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society”. Furthermore, the Court has consistently made clear that the right to privacy protected by Article 8 of the Convention and the right to freedom of expression “are equal rights that states must balance, based on the criteria the Court has identified in its caselaw”.[3]

In the case ECtHR, Von Hannover v. Germany, the Court found that two photographs depicting a royal family on holiday and published in two German newspapers violated the right to privacy pursuant to Article 8 of the European Convention on Human Rights because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted a Prince in poor health, and since the health of the Prince was a matter of public concern the ECtHR found no violation of Article 8.  In reaching its ruling the ECtHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression. Firstly, whether the information contributes to a debate of general interest; secondly, how well known is the person concerned and the subject matter of the report; thirdly, the prior conduct of the person concerned; fourthly, content, form and consequences of the publication; and fifth, the circumstances in which the photos were taken.[4]

(2) Exemptions

Under Article 85(2) GDPR, for processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.[5] The extent of what is "necessary" for this purpose is necessarily a matter of interpretation by the national and European courts.

Scope of the Exceptions within the GDPR Framework

As mentioned above, the GDPR recognises the need to protect freedom of expression (whatever the form) and authorises Member States to adopt, where necessary, statutory derogations to a large part of the GDPR itself, including data processing principles, data subject's rights, rules on international transfers, and even the subjection to the scrutiny of the supervisory authorities. Much (if not everything) seems to be abstractly possible in order to protect freedom of expression.

On this point, we note that such favourable treatment does not seem to be reserved for the protection of other primary interests such as those provided for by Article 23 GDPR (to which we refer for a complete analysis of the relevant discipline). National security, for example, may allow derogations to the GDPR, but only to the data subject's rights, and only on the condition that such a restriction "respects the essence of the fundamental rights and freedoms" and is "necessary and proportionate [...] in a democratic society".

Conversely, when freedom of expression (including artistic, literary or academic expression) is taken into account, the GDPR authorises much broader restrictions as described above. In other words, it seems that the GDPR restrictions justified by overriding interests such as national security, defence, and crime prevention (Article 23(1)(a-j) GDPR) allow for far fewer GDPR restrictions than those granted by freedom of expression.

Necessary to Reconcile

The core of this provision is clearly the concept expressed in the final part of paragraph 2 "necessary to reconcile". Member States may reduce the scope of a principle or right, or modify the obligations of the controller, only if this is "necessary to reconcile" the GDPR with the exercise of freedoms of expression and information, including academic, artistic or literary freedom.

Careful commentators, whose conclusions we fully share, note that in all cases the exception must be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition, but not to the data of buyers that the art gallery holds for its economic activity.[6] In the latter case, the exemption is not necessary to safeguard the artist’s freedom of artistic expression (but only a rather unjustified privilege).

Journalistic expression

On this point, the first question concerns the extent of the concept of 'expression'. In general, there seems to be a sort of overlap between the notion of 'expression' and that of 'journalism'. Theoretically, therefore, the privilege stemming from – the national implementation of – Article 85 would only be granted to those who qualify as journalists.

In theory, this approach may pose considerable problems for those who are not professional journalists. In practice, however, the problem loses part of its relevance. In fact, according to Recital 153, the term 'journalism' is to be interpreted broadly. Processing for journalistic purposes therefore includes data processing which is in connection with the expression of an opinion or aimed at creating one within the public. In particular, the aforementioned Recital clarifies that the privilege does not only apply to the classic professional press,[7] but also to the audiovisual sector, i.e. telemedia and radio, as well as for news and press archives. In addition, people without journalistic training also benefit from the exemption insofar as they carry out investigative research activities.[8]

However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is not covered by Article 85. [9]

Artistic, Literary and Academic Expression

From a systematic point of view, artistic, literary or academic expression seem to be equated with journalistic expression (in the sense just seen above). For this reason, in the absence of more specific indications from both the CJEU and ECtHR, it seems reasonable to apply to these sectors the same conclusions and principles. In this vein, the exemption would be valid for a photo (book or article) containing personal data, but only if is intended to be published, for example, in an art gallery (library or scientific journal). Conversely, data processing carried out by the photographer (writer or academic) which is not intended for public discussion (e.g. the record of the gallery's customers) will not fall within the scope of the exception. On this matter, very much obviously depends on the national implementation of Article 85. At present, not all European countries have specific legislation on artistic, literary or academic expression.[10] This contributes in no small measure to the uncertainties surrounding the processing of personal data in the mentioned areas.

(3) Notification to the Commission

Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them. The actual national transposition of these exceptions must be notified immediately to the Commission. Indeed, there is a need for monitoring of the GDPR exemption measures to be taken by individual Member States.

Decisions

→ You can find all related decisions in Category:Article 85 GDPR

References

  1. CJEU, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., margin numbers 97-99 (available here)
  2. Tinnefeld in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (Beck 2020, 3rd ed.) (accessed 9 August 2021).
  3. Reventlow, Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.
  4. Entirely taken from Global Freedom of Expression, Von Hannover v. Germany (No. 2) (available here) (accessed on 9 August 2021).
  5. The exemption under the Directive was narrower, as it provided exemptions for processing “solely” for “journalistic purposes or the purpose of artistic or literary expression,” if they were necessary from a free speech perspective. Article 85 of the GDPR omits the “solely” requirement and provides exemptions for the purpose of reconciling free speech with data protection. Article 85 refers to journalism, academia, art, and literature as examples of circumstances in which such exemptions would be necessary, resulting in a broader scope for exemption from GDPR rules”. See, Reventlow, Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, 114 (2020), pp. 31–34.
  6. Pötters in Gola, DS-GVO, Article 85 GDPR, margin number 11 (Beck, 2018, 2nd ed.) (accessed 9 August 2021).
  7. CJEU, Tietosuojavaltuutettu/Satakunnan Markkinapörssi Oy, C-73/07, 16 December 2008, margin number 110 (available here)
  8. Pötters in Gola DS-GVO, Article 85 GDPR, margin number 8 (Beck, 2018, 2nd ed.) (accessed 09 August 2021).
  9. Pötters in Gola, DS-GVO, Article 85 GDPR, margin number 9 (Beck, 2018, 2nd ed.) (accessed 09 August 2021).
  10. European Commission, EU Member States notifications to the European Commission (available here) (accessed 9 August 2021).