Article 85 GDPR

From GDPRhub
Revision as of 16:08, 9 August 2021 by SR (talk | contribs) (→‎Commentary)
Article 85 - Processing and freedom of expression and information
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 85 - Processing and freedom of expression and information


1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from CHAPTER II (principles),CHAPTER III (rights of the data subject),CHAPTER IV (controller and processor),CHAPTER V (transfer of personal data to third countries or international organisations),CHAPTER VI (independent supervisory authorities),CHAPTER VII (cooperation and consistency) and CHAPTER IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

3. Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.

Relevant Recitals

- Recital 153

Commentary

(1) Reconciling data protection rules with freedom of expression, including academic, artistic or literary expression

Data protection legislation is certainly aimed at reducing or at least controlling the amount of information circulating in the system. In order to process an individual's personal data, it is necessary, among other things, to respect certain principles, to comply with requests to exercise the data subject's rights, including deletion, and more generally to comply with the obligations incumbent on the data controller (organisational and security measures, international transfer of data, submission to the scrutiny of supervisory authorities). In other words, the processing of personal data is not a simple activity.

At the same time, the GDPR recognises that there are many other areas of human and social experience that require the processing of personal data in relation to which it is not always appropriate to apply the full data protection framework. In doing so, the law maker accepts an intrinsic limit to the very applicability of the GDPR (or at least some its parts). In other words, the GDPR recognises that a journalist, academic, artist or writer, are allowed to fulfil their respective social function freely, and should not always be subject to all the stringent requirements provided for by the Data Protection Regulation.

Article 85(1) deals precisely with offering a legal framework to reconcile the data subject’s right to data protection with the performance of equally crucial interest of proving society with free, informed and unencumbered information (regardless of whether it refers to journalistic, scientific, artistic or literary expression). What such “reconciliation” consists of is mostly a matter of necessity, as specified in Article 85(2) below.

(2) Exemptions

Under Article 85(2) GDPR, for processing carried out for journalistic purposes or the purpose of academic, artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.[1] The extent of what is "necessary" for this purpose is necessarily a matter of interpretation by the national and European courts.

Scope of the exceptions within the GDPR framework

As mentioned above, the GDPR recognizes the need to protect freedom of expression (whatever the form) and authorises Member State to adopt, where necessary, statutory derogations to a large part of the GDPR itself, including data processing principles, data subject's rights, rules on international transfers, even the very subjection to the scrutiny of the supervisory authorities. In other words, much (if not everything) seems to be abstractly possible in order to protect freedom of expression.

On this point, we note that such favourable treatment does not seem to be reserved for the protection of other primary interests such as those provided for by Article 23 GDPR (to which we refer for a complete analysis of the relevant discipline). National security, for example, may allow derogations to the GDPR, but only to the data subject's rights, and only on condition that such restriction "respects the essence of the fundamental rights and freedoms" and is "necessary and proportionate [...] in a democratic society".

Conversely, when freedom of expression (including artistic, literary or academic expression) is taken into account, the GDPR authorises much broader restrictions as described above. In other words, it seems that the GDPR restrictions justified by overriding interests such as national security, defence, crime prevention (Article 23(1)(a-j) GDPR) allow for far fewer GDPR restrictions than those granted by freedom of expression.

Necessary to reconcile

The core of this provision is clearly the concept expressed in the final part of paragraph 2 "necessary to reconcile". Member States may therefore reduce the scope of a principle or right, or modify the obligations of the controller, only if this is "necessary to reconcile" the GDPR with the exercise of freedoms of expression and information, including academic, artistic or literary freedom.

Careful commentators, whose conclusions we fully share, note that in all cases the exception must be justified by a communication purpose. For example, a proportionate exemption will rightfully apply to an artistic photo meant for an exhibition but not to the data of buyers the art gallery holds for its economic activity.[2] In the latter case, the exemption is not necessary to safeguard the artist’s freedom of artistic expression (but only a rather unjustified privilege).

Freedom of expression and information

On this point, the first question concerns the extent of the concept of 'expression'. In general, there seems to be a sort of overlap between the notion of "expression" and that of “journalism”. Theoretically, therefore, the privilege stemming from – the national implementation of – Article 85 would only be granted to those who qualify as journalists.

In theory, this approach may pose considerable problems for those who are not professional journalists. In practice, however, the problem loses part of its relevance. In fact, according to Recital 153, the term "journalism" is to be interpreted broadly. Processing for journalistic purposes therefore includes data processing which is in connection with the expression of an opinion or aimed at creating one within the public. In particular, the aforementioned Recital clarifies, the privilege does not only apply to the classic professional press,[3] but also to the audiovisual sector, i.e. telemedia and radio, as well as for news and press archives. In addition, people without journalistic training also benefit from the exemption insofar as they carry out investigative research activities.[4]

However, data processing carried out for purposes that are not primarily aimed at informing the public is not privileged. For example, the handling of suppliers or employee data for technical or administrative reasons is therefore not covered by Article 85. [5]

Public interest

In its judgment on Google Spain clarifies the relationship between data protection and freedom of information. According to this, courts must balance the sensitivity of the information with the public interest in knowing it.[6]

Equally relevant to this issue are the indications offered by the European Court of Human Rights. In fact, under Article 52(3) of the EU Charter, “in so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention”. Since the right to freedom of expression is equally protected by either Article 8 of the EU Charter and Article 10 of the European Convention on Human Rights, further guidance on Article 85 GDPR on Article 85 GDPR can be found in the case-law of the European Court of Human Rights (“ECHR”).[7]

The ECHR's case-law has consistently recognized the role of the press for the proper functioning of a democratic society. In this sense, media not only serve as “public watchdog” but also contribute to producing and circulating information and ideas in the public interest. “Freedom of the press,” the Court has stated, “gives politicians the opportunity to reflect and comment on the preoccupations of public opinion; it thus enables everyone to participate in the free political debate which is at the very core of the concept of a democratic society”. Furthermore, the Court has consistently made clear that the right to privacy protected by Article 8 of the Convention and the right to freedom of expression “are equal rights that states must balance, based on the criteria the Court has identified in its caselaw”.[8]

In the case ECHR, Von Hannover v. Germany, 7.2.2012, the Court found that two photographs depicting a royal family on holiday and published in two German newspapers violated the right to privacy pursuant to Article 8 of the European Convention on Human Rights because they did not reflect any matter of public interest detailed in the accompanying text. However, a third photograph depicted a Prince in poor health, and since the health of the Prince was a matter of public concern the ECHR found no violation of Article 8.  In reaching its ruling the ECHR set out the criteria which domestic courts should follow when balancing the right to privacy against the right to freedom of expression. Firstly, whether the information contributes to a debate of general interest; second, how well known is the person concerned and the subject matter of the report; thirdly, the prior conduct of the person concerned; fourthly, content, form and consequences of the publication; and fifth, the circumstances in which the photos were taken.[9]

Artistic, literary and academic expression

From a systematic point of view, artistic, literary or academic expression seem to be equated with journalistic expression (in the sense just seen above). For this reason, in the absence of more specific indications from both the ECJ and ECHR, it seems reasonable to apply to these sectors the same conclusions and principles. In this vein, the exemption would be valid for a photo (book or article) containing personal data, but only if is intended to be published, for example, in an art gallery (library or scientific journal). Conversely, data processing carried out by the photographer (writer or academic) which is not intended for public discussion (e.g. the record of the gallery's customers) will not fall within the scope of the exception. On this matter, very much obviously depends on the national implementation of Article 85. At present, not all European countries have specific legislation on artistic, literary or academic expression.[10] This contributes in no small measure to the uncertainties surrounding the processing of personal data in the mentioned areas.

(3) Notification to the Commission

Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them. The actual national transposition of these exceptions must be notified immediately to the Commission. Indeed, there is a need for monitoring of the GDPR exemption measures to be taken by individual Member States.

Decisions

→ You can find all related decisions in Category:Article 85 GDPR

References

  1. The “The exemption under the Directive was narrower, as it provided exemptions for processing “solely” for “journalistic purposes or the purpose of artistic or literary expression,” if they were necessary from a free speech perspective.7 Article 85 of the GDPR omits the “solely” requirement and provides exemptions for the purpose of reconciling free speech with data protection. Article 85 refers to journalism, academia, art, and literature as examples of circumstances in which such exemptions would be necessary, resulting in a broader scope for exemption from GDPR rules”. See, Reventlow, Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, Cambridge University Press, 2020, pp. 31–34.
  2. Pötters in Gola DS-GVO, Article 85 GDPR, margin number 11 (Beck, 2018, 2nd ed.) (accessed 09.08.2021).
  3. ECJ, C-73/07, Tietosuojavaltuutettu/Satakunnan Markkinapörssi Oy, 16.12.2008, § 110
  4. Pötters in Gola DS-GVO, Article 85 GDPR, margin number 8 (Beck, 2018, 2nd ed.) (accessed 09.08.2021).
  5. Pötters in Gola DS-GVO, Article 85 GDPR, margin number 9 (Beck, 2018, 2nd ed.) (accessed 09.08.2021).
  6. ECJ, C‑131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) et al., § 97-99
  7. Tinnefeld in Kühling, Buchner, GDPR BDSG, Article 85 GDPR, margin number 9 (Beck 2020, 3rd ed.) (accessed 09.08.2021).
  8. Reventlow, Can the GDPR and Freedom of Expression Coexist?, in AJIL Unbound, Cambridge University Press, 2020, pp. 31–34.
  9. Entirely taken from Global Freedom of Expression, Von Hannover v. Germany (No. 2), available here (https://globalfreedomofexpression.columbia.edu/cases/von-hannover-v-germany-no-2/) (accessed on 09.08.2021)
  10. Available here