Datatilsynet (Norway) - 20/02379
From GDPRhub
| Datatilsynet - 20/02379 (PVN-2020-19) | |
|---|---|
 | |
| Authority: | Datatilsynet (Norway) |
| Jurisdiction: | Norway |
| Relevant Law: | Article 85 GDPR Personopplysningsloven § 3 |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 02.02.2021 |
| Published: | 02.02.2021 |
| Fine: | None |
| Parties: | Bergens Tidende Complainant |
| National Case Number/Name: | 20/02379 (PVN-2020-19) |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Norwegian |
| Original Source: | Personvernnemda (in NO) |
| Initial Contributor: | n/a |
Personvernnemda (PVN) holds that the posting of personal data related to a credit rating and bankruptcy case for a news article falls under the exemption for journalistic activities. PVN highlights that the wording of the national implementation of the exemption is too broad and must include a balancing of proportionality.
English Summary
Facts
The newspaper Bergens Tidende published a story regarding an insolvency case, which highlighted that the tax authority had declared the complainant bankrupt due to unpaid taxes. The article also mentioned that the complainant had payment remarks and execution proceedings against him, and that the information was collected from a credit rating. The newspaper later informed that some of the information was factually incorrect. The complainant also filed a complaint with the Norwegian Press Complaints Commission ("Pressens Faglige Utvalg"), where the complaint was upheld.
Dispute
Did the publishing of the complainants personal data fall under the exemption for journalistic activity in the national legislation?
Holding
PVN remarked that the wording of the exemption for journalistic activities in Personopplysningsloven § 3 was broader than Article 85 GDPR. It highlighted that the exemption was not absolute, but that freedom of expression needed to be proportionally balanced against the right of privacy.
PVN based the assessment on the wording of Article 85 GDPR, The Norwegian Constitution § 100, The European Convention of Human Rights Article 10, and the International Covenant on Civil and Political Rights (ICCPR) Article 10 and Article 19.
PVN refers to C-73/07 para. 55 and 56 to support their view of the assessement of proportionality and that the exemption must be read in light of freedom of expression.
PVN agreed with the complainant that the exemption for journalistic activities was not absolute. However, the personal data collected in the specific case was for an article under an established newspaper with editorial control and with a clear public interest. The complaint was therefore rejected.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
PVN-2020-19 Collection and publication of credit information in an article in Bergens Tidende
The Data Inspectorate's reference:
The Data Inspectorate's reference: 20 / 02379-1
Decision of the Privacy Board 2 February 2021 (Mari Bø Haugstad, Line Coll, Hans Marius Graasvold, Ellen Økland Blinkenberg, Hans Marius Tessem, Morten Goodwin)
The case concerns a complaint from A on the Data Inspectorate's decision of 18 February 2020 that the collection and publication of credit information about him in a newspaper article in Bergens Tidende in the summer of 2019 was done exclusively for journalistic purposes and thus is not contrary to the Personal Data Act, cf.
Background to the case
In the summer of 2019, Bergens Tidende published an article stating that real estate investor A had filed for bankruptcy by the tax authorities and that the reason was paid tax claims. It appears in the article that A has several payment remarks and disbursement transactions and that the information is obtained from a credit information company. The article was published in both the newspaper's paper and online editions.
A believes that Bergens Tidende has illegally obtained credit information about him and that the newspaper, against his better judgment, has published incorrect information. Bergens Tidende denies this and points out that extracting credit information is an ordinary journalistic method in Norwegian newsrooms and that the information was in the public interest. The newspaper has subsequently revealed errors in the published information and has corrected this on the website.
A complained to Bergens Tidende and their collection and publication of credit information about him to the Data Inspectorate in a letter on 9 August 2019. In a decision of 18 February 2020, the Data Inspectorate concluded that the newspaper's collection and publication of A's credit information is done exclusively for journalistic purposes and is covered by the exception in the Personal Data Act § 3.
A also brought the case before the Press' professional committee (PFU), which on 26 February 2020 concluded that Bergens Tidende behaved in a manner worthy of criticism with a lack of quality assurance of the information, cf. section 3.2 in the Vær Varsom poster. PFU's assessment in general was that A's financial situation was of public interest and that Bergens Tidende had objective grounds for obtaining and publishing the credit information.
A submitted a timely appeal against the Data Inspectorate's decision on 10 March 2020. The Data Inspectorate notified Bergens Tidende of the complaint, and the newspaper sent its comments in a letter on 27 April 2020. The Data Inspectorate assessed the appeal, but found no reason to change its decision. The case was sent to the Privacy Board on 15 October 2020. The parties were informed of the case in a letter from the board, and were given the opportunity to comment. To submit comments in a letter to the tribunal on 2 November 2020.
The case was dealt with in the tribunal's meeting on 2 February 2021. The Privacy Board had the following composition: Mari Bø Haugstad (chair), Line Coll, Hans Marius Graasvold, Ellen Økland Blinkenberg, Hans Marius Tessem and Morten Goodwin. Secretariat leader Anette Klem Funderud was also present.
The Data Inspectorate's assessment in outline
The Norwegian Data Protection Authority is based on the Personal Data Act § 3, which makes exceptions for large parts of the rules of the Personal Data Act if the processing of personal data takes place exclusively for journalistic purposes.
The Norwegian Data Protection Authority first assesses whether Bergens Tidende's collection of credit information about A has been done solely for journalistic purposes. The audit refers to a similar case in the Privacy Board (PVN-2010-1) where the board concluded that Mastiff TV's collection of credit information about a person whose research for the TV program TV2 helps you was a processing of personal information that took place exclusively for journalistic purposes. The same applies in the Authority's assessment in this case. The tribunal's decision from 2010 applied to the legal situation under the Personal Data Act 2000, but the Authority points out that the scope of application for «journalistic purposes» is the same under the Personal Data Act 2018 as under previous law, cf. Prop. 56 LS (2017-2018), chapter 38.1, first paragraph.
Thereafter, the Data Inspectorate considers whether Bergens Tidende's publication of the credit information on A has also been done exclusively for journalistic purposes and is also covered by the exception in § 3.
In assessing whether the information has been published for journalistic purposes, the Data Inspectorate points out that the Authority assesses whether the information contributes to debate or disseminates current information of general societal interest and is communicated for a journalistic purpose. Furthermore, it is relevant to what extent the person in question is generally known, the content, form and consequences of the published information, and the circumstances surrounding how the information was obtained and the truthfulness of this.
The Norwegian Data Protection Authority takes as its starting point that publications from Bergens Tidende are regarded as journalistic activities. The Authority then makes an assessment of the article's content and points out that the content, where the person in question is a business person with ownership of several important properties in Bergen, must be considered to have a certain role in public life. In the Authority's assessment, this points in the direction that the information is of general interest. The audit points out that the article provides current information related to a dispute about an important building in the center of Bergen, and contributes to debate. The audit considers this to be the core area for what is considered a journalistic purpose.
To A's allegation that the information in the article is demonstrably incorrect, the audit refers to PVN-2018-18 where the tribunal stated that no requirements are set for the actual quality of the journalistic work. The decisive factor is the nature and purpose of the treatment.
The Norwegian Data Protection Authority concludes that the newspaper's collection and publication of credit information about A took place exclusively for journalistic purposes and is thus covered by the exception in the Personal Data Act § 3.
After receiving the complaint from A, the Data Inspectorate makes a new assessment of the case based on the allegations that appear in the complaint, in particular the allegation that in the application of § 3 a balance must be struck between the two rights privacy and freedom of expression against each other, through a proportionality assessment.
The Data Inspectorate conducts a review of various legal sources, and then maintains its assessment that both the collection and publication of the credit information about A took place exclusively for journalistic purposes and is covered by the exception in the Personal Data Act § 3.
A view of the matter in brief
Bergens Tidende's processing of his personal data is not covered by the journalist exemption in the Personal Data Act § 3. EU law sources show that where national legislation makes exceptions from the rules in the Privacy Ordinance for journalistic purposes, a balance must be struck between the need for freedom of expression and the privacy of the person or persons who have personal information published in the media. Publication in the media constitutes a major encroachment on privacy.
The Data Inspectorate believes that there is no opportunity to comply with EU law in this case, because the preparatory work for the Personal Data Act, Prop. 56 LS (2017-2018) page 104 provides for a different assessment. Such an understanding of the Personal Data Act § 3 is contrary to EU law and the Privacy Ordinance, and is a violation of the Personal Data Act § 1 and Norway's obligations under international law through the incorporation of the Privacy Ordinance. There is no basis for placing decisive emphasis on the said preparatory work. The wording of § 3 should be interpreted in line with the EU legal understanding where the term "exclusively for journalistic purposes" is assessed against the privacy of the data subject in the specific case. The ECtHR stated in case 931/13 that freedom of expression must be assessed against the right to privacy.The EMD assumed that emphasis should be placed on privacy in the interpretation of the journalist exemption, cf. section 198.
In the assessment of the journalist exemption, requirements must be set for the content of journalism. Media houses do not have free access to publish incorrect personal information. Bergens Tidende knowingly and intentionally published incorrect credit information. The Privacy Board's decision in PVN-2010-01 has limited legal source weight, as that case only concerned collection, and not publication of credit information.
It becomes too easy when the Data Inspectorate does not set any requirements for the content of journalism, if the purpose of Bergens Tidende was journalistic. Section 3 of the Personal Data Act must entail a certain minimum requirement for privacy, so that media houses do not have free access to publish personal data they know is incorrect.
Credit information is only relevant according to its purpose when the data subject takes an action that triggers a credit application. There is no credit relationship between A and Bergens Tidende. Beyond these cases, the registered person does not have control over which information forms the basis for the credit information, which entails an increased risk that the credit information is incorrect. It is in these cases that the data subject needs privacy, in contrast to the tax returns in the EMD judgment (931/13), where the data subjects had a strong right to a fair hearing on the accuracy of the information.
The newspaper's processing of credit information about A is subject to the rules in the Privacy Ordinance. Bergens Tidende does not have a legitimate interest in publishing the information, cf. the Privacy Ordinance Article 6 no. 1 letter f. In the balancing of interests, A's privacy outweighs the consideration of the newspaper's interest in publishing the information. The newspaper does not have a legitimate interest as long as Bergens Tidende itself is aware that the credit information is incorrect, something the newspaper was made aware of before publication.
To the extent that the Data Inspectorate does not reverse the decision on this basis, the balance test that must be performed to assess whether there is a legitimate interest must mean that A's interests in any case outweigh the newspaper's interests. The incorrect credit information had real consequences for A and this was visible to Bergens Tidende.
The publication does not meet the requirements for fair processing pursuant to Article 5 (1) (a) of the Regulation, nor is it compatible with the requirement that personal data must be correct and, if necessary, updated, cf. Article 5 (1) (d). on the criticism from Pressens Faglige Utvalg (PFU) where they concluded that Bergens Tidende acted critically in the absence of quality assurance of the information.
Even though A is to a certain extent a person known to parts of the business community, it is not true that A has "a certain role in public life", as the Data Inspectorate has assumed. A's limited public interest is a further factor that makes it obvious that Bergens Tidende did not have a legitimate interest in publishing the credit information about him.
Bergens Tidende's view of the case in brief
The Data Inspectorate's decision is correct. The Norwegian Data Protection Authority has correctly concluded that Bergens Tidende's collection and publication of credit information was done for "exclusively journalistic purposes" and that the matter therefore falls under the exception in the Personal Data Act § 3.
A's assertion that what is regarded as "exclusively journalistic purposes" must also depend on a closer balancing of the data subject's privacy in the specific case is not correct. The provision does not allow for such specific considerations in the individual case, cf. Prop. 56 LS (2017-2018), section 14.5, where it is emphasized, among other things:
«The Ministry therefore proposes that the applicable law be continued until further notice, so that an exception is made for most of the regulation's rules when processing exclusively for journalistic, artistic and literary purposes, see the proposal § 3. This means that in the same way as under current law is stated in the legal text which provisions apply, and that this does not depend on a necessity or proportionality assessment in the individual case. "
This is supported by statements given by the Law Department in the Ministry of Justice and Emergency Preparedness in connection with a new, but not adopted proposal to amend the Personal Data Act § 3. In the consultation memorandum from September 2019 (Snr 19/4154) the Law Department emphasizes that the right to freedom of expression and information on the one hand and the right to privacy on the other is weighed up in the actual formulation of the current Personal Data Act § 3. Furthermore, it is stated on page 23:
"However, the current provision does not allow for further assessments of the extent to which exceptions are necessary with regard to freedom of expression and information in the individual case. Thus, exceptions will apply to the same extent for all treatment purposes that are considered "journalistic" etc. In other words, the current § 3 does not allow to distinguish between cases that are at the core of the exception rule, and cases that are in the marginal zone […] »
The Ministry also emphasizes on page 25 that any future nuances of the provision are not intended to involve any changes in the legal status of media with a central editorial function that is affiliated with a press professional autonomy scheme. That is the case for Bergens Tidende.
The newspaper's collection and publication of the credit information was made "exclusively for journalistic purposes", and is covered by the exception in the Personal Data Act § 3, as the Authority assumes. It is also pointed out that PFU emphasizes that A's financial situation was in the public interest and that the newspaper had objective reasons for obtaining and publishing the credit information.
Judgment EMD 931/13 is not relevant in this case. The EMD found that mass publishing of tax information about approximately 1.2 million people could not be considered journalism. It was the scope of the processing of personal data that became decisive.
Bergens Tidende's collection and publication of credit information about A, as part of a current news item, must be considered to be at the core of journalistic activity.
Bergens Tidende takes note of PFU's assessment that the newspaper should ensure the quality of the information better. In any case, this is not relevant for the assessment of whether § 3 applies in this case.
Alternatively, if the Personal Data Act § 3 does not apply, the processing and publication of the credit information is in any case in accordance with the Personal Data Act.
The Privacy Board's assessment
Section 3 of the Personal Data Act reads:
"For the processing of personal data solely for journalistic purposes or for academic, artistic or literary purposes, only the provisions of the Privacy Ordinance Articles 24, 26, 28, 29, 32 and 40 to 43 apply, cf. the Privacy Ordinance Chapters VI and VIII and Chapter 6 and 7 of the law here. "
In our case, the question of whether the collection and publication of credit information about A, which Bergens Tidende did, took place "exclusively for journalistic purposes". If this condition is met, it follows from the provision that large parts of the Act and the Privacy Ordinance do not apply, including the rules on the basis of processing in Article 6 and principles for processing personal data in Article 5. The provisions that apply in any case apply to the data controller, possibly data processor's duties, as well as various rules on personal data security. These provisions are not relevant to the tribunal's assessment in this case.
Based on A's statement that, in applying § 3, a balance must be struck between the need for freedom of expression and the privacy of the person or persons who receive personal data published in the media (a proportionality assessment), the Privacy Board will first say something about the legal rule in the Personal Data Act § 3, as the tribunal understands it.
The provision in § 3 originates in Article 85 of the Privacy Ordinance, which is justified in the interests of freedom of expression, as this right is protected by Article 100 of the Constitution, Article 10 of the ECHR and Article 19 of the UN Convention on Civil and Political Rights (SP). It appears from the preparatory work for the Personal Data Act 2018, Prop. 56 LS (2017-2018), Chapter 38.1, and 14.2 that § 3 continues the legal situation that followed from the Personal Data Act 2000 § 7 and the EU Privacy Directive 95/46 / EC Article 9.
The provision covers everyone who processes personal data, regardless of profession, as long as the processing takes place solely for journalistic purposes or for academic, artistic or literary purposes. The Act applies in the usual way when the processing partly has other purposes, such as advertising for goods and services, cf. Prop. 56 LS (2017-2018), chapter 14.1. The decisive factor is the nature of the business and not the formal or professional status of the data controller.
In the EU Privacy Directive 95/46 / EC, the relationship to freedom of expression was regulated in Article 9, and this provision essentially coincides with Article 85 of the Privacy Regulation. Article 9 of the Directive (sections 55 and 56):
"In order to reconcile these two" fundamental rights "under the Directive, Member States shall provide for the exceptions to and limitations on the protection of information - and thus the exceptions to and limitations on the fundamental right to privacy - mentioned in Chapter II of the Directive, IV and VI. These exceptions may only apply to treatments which take place for journalistic purposes or for the purpose of artistic or literary activity covered by the fundamental right to freedom of expression, in so far as they are necessary to reconcile the right to privacy with the rules of freedom of expression. .
In order to take into account the importance of freedom of expression in any democratic society, the concepts associated with it, including the concept of journalistic purposes, must first be interpreted broadly. Secondly, in order to achieve a balanced balance between the two fundamental rights, the protection of the fundamental right to privacy requires that the exceptions and limitations on the protection of information provided for in the above chapters of the Directive be kept within the strictly necessary [».
The European Court of Justice hereby directs that the exceptions from the personal data protection in the directive cannot be more comprehensive than necessary ("necessary") to ensure freedom of expression. In this connection, the Tribunal also refers to Prop. 56 LS (2017–2018), Chapter 14.2. where it is stated that no exceptions shall be made from the protection of personal data to a greater extent than is necessary for reasons of freedom of expression and information, and that the scope of the exception rule therefore depends on the requirements of the rules on freedom of expression and information, cf. 100 and Article 10 of the ECHR. In other words, the balance between privacy and freedom of expression shall be based on a proportionality assessment. The European Court of Justice further emphasizes that the exemptions from the protection in the directive cannot go beyond strictly necessary,a wording that normally indicates a particularly strict proportionality assessment, and in the context in which this appears here, it is clear that it is the consideration for personal data protection that is taken into account.
The Tribunal considers that the above-cited statement from the European Court of Justice, even though it applied to Article 9 of the Directive, is also relevant to the interpretation of Article 85 of the Privacy Regulation, and the Tribunal assumes that Article 85 of the Regulation also provides guidance on proportionality assessment. Exceptions from the protection in the regulation can only be made if this is necessary to ensure sufficient arm-twisting for freedom of expression.
In case PVN-2018-14 (Processing of personal data on legelisten.no), the tribunal has pointed out that the solution chosen by the Norwegian legislature, where the Personal Data Act § 3 makes exceptions from the vast majority of the provisions in the Privacy Ordinance, makes it very difficult to make the nuanced trade-offs between freedom of expression and protection of personal data that both the practice of the European Court of Justice and the advocacy of the regulation, in the tribunal's assessment, presuppose must be done. The tribunal states in its decision under section 8.3:
"If it is first assumed that the treatment in question is covered by the exception in § 3, the registered person will largely fall outside the protection that follows from the GDPR. Such a legal situation may be difficult to reconcile with the state's obligations under Article 8 of the ECHR to ensure adequate protection of privacy, including the protection of personal data. For the tribunal, it is important to remember that the consideration for freedom of expression is not only taken care of by the Personal Data Act 2018 § 3, but also a number of other places in the GDPR. Of particular importance in this case is Article 6 of the GDPR, which in paragraph 1, letter f, provides guidance on a balance of interests where freedom of expression may constitute one of several legitimate interests. "
The tribunal therefore agrees with A that the exception in the Personal Data Act § 3 cannot be understood as absolutely as the wording of the provision dictates. In some cases, when assessing the extent of the exception in § 3, a balance must be struck between the consideration of freedom of expression and the consideration of the privacy of the person mentioned. According to the law today, this must be done by a possible restrictive interpretation of "exclusively journalistic activity".
With this as a legal starting point, the tribunal proceeds to assess the application of the Personal Data Act § 3 to the fact in this case.
Bergens Tidende is a media company with a central editorial function that is also affiliated with a press professional autonomy scheme, PFU. The newspaper's collection of personal information and publication in connection with news articles in the newspaper, represents the core area for journalistic activities. In such a situation, section 3 of the Personal Data Act does not allow for a balance of interests to be struck between freedom of expression and privacy. It is not the task of the privacy authorities to review the editorial board's assessment of this type of news article, including what information should be disseminated to the public, and whether the information in question has a general public interest or not. This applies regardless of whether the information published is correct or not.
A has referred to the EMD's judgment in Satakunnan Markkinapörssi OY and Satamedia OY v. Finlandfrom 27 June 2017, case 931/13 which concerned a media company's publication of tax information of approx. 1.2 million named persons. The publication was not considered to be covered by the journalist exemption. In the Finnish judgment, which the EMD endorsed, a distinction was made between the collection, storage and other processing of personal data before publication, which was clearly covered by the journalist exemption, and the subsequent processing of the information in the form of publication, which was not covered by the exception. The fact that it was media companies that had published the tax information was not in itself sufficient for the relevant processing of personal data to be covered by the journalist exemption. The prohibition against such mass publication of tax information was not found to be a violation of the protection of freedom of expression in Article 10 of the ECHR.The EMD, on the other hand, considered that the Finnish Administrative Court had found a reasonable balance between the consideration of respect for privacy on the one hand, and the consideration of freedom of expression on the other.
This case concerns something completely different, namely the newspaper editorial journalistic processing and publication of obtained credit information about a real estate investor who has been involved in legal proceedings due to a dispute over settlement after the sale of a centrally located property in the city. There is no doubt that this type of article, and thus both the collection and publication of personal information in that connection, has a purely journalistic purpose.
Following this, the tribunal agrees with the Norwegian Data Protection Authority that Bergens Tidende's processing of A's personal data is covered by the exception in the Personal Data Act § 3.
Conclusion
The Data Inspectorate's decision is upheld.
The decision is unanimous.
Oslo, 2 February 2021
