KC - № 8/ 6p.93-26.11.2019
From GDPRhub
| KC - № 8/ 6p.93-26.11.2019 | |
|---|---|
 | |
| Court: | KC (Bulgaria) |
| Jurisdiction: | Bulgaria |
| Relevant Law: | Article 25h(2) of the GDPR implementation law |
| Decided: | 15.11.2019 |
| Published: | |
| Parties: | |
| National Case Number/Name: | № 8/ 6p.93-26.11.2019 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Bulgarian |
| Original Source: | KC (in Bulgarian) |
| Initial Contributor: | n/a |
The Bulgarian Constitutional Court (Конституционен съд - KC) declared Article 25h(2) of the GDPR national implementation law unconstitutional because they set disproportionate limits to the freedom of expression and information .
English Summary
The provision at stake regulated the protection of personal data in the context of journalistic activities. The Court found that this provision created legal uncertainty and set limits to the right of freedom of expression and information. The Court found these limits disproportionate to the objective pursued, in the context of journalistic expression. Finally, the Court stressed that declaring an implementing provision unconstitutional does not impede the full implementation of the GDPR, since GDPR is directly applicable and most of its provisions are directly effective.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the original. Please refer to the Bulgarian original for more details.
R E W E N I E No. 8
Sofia, 15 November 20 1 9
(Promulgated SG No. 99 of November 26, 2019)
Constitutional Court composed of: Boris Velchev - President, Members: Georgi Angelov, Anastas Anastasov, Grozdan Iliev, Mariana Karagiozova-Finkova, Konstantin Penchev, Philip Dimitrov, Tanya Raykovska, Nadezhda Dzelepova, Pavlina Panova, Atiras Vetar - Protocolist Kristina Encheva , examined in private session on November 15, 2019, Constitutional Case No. 4/201 9 , reported by Judge Mariana Karagiozova-Finkova .
The proceedings are based on Art. 1, item 2 and item 4 in connection with Art. 1 of the Constitution of the Republic of Bulgaria (the Constitution).
At a sitting held on June 18, 2019, the Constitutional Court, by admissibility, decided to consider, in substance, the request of fifty-five Members of the 44th National Assembly under item 1 - to establish the unconstitutionality of the provision of Article 25h , para 2 of the Law on Protection of Personal Data ( LPPD ) (created by § 26 of the Law on Amendment and Supplementation of the LPPD, prom. SG, issue 17 of 26 February 2019), as well as under item 2.1 and item 2.2 - to decide on the conformity of the same legal provision with generally recognized norms of international law and with the international treaties to which the Republic of Bulgaria is a party.
The request of the MPs, as allowed by the Constitutional Court, is to establish the unconstitutionality of the norm in Article 25h, paragraph 2 of the Law on Protection of Personal Data (established by § 26 of the Law on Amendment and Supplementation of the LPPD SG No. 17 of February 26, 2019, which entered into force at the time of referral to the Constitutional Court) as inconsistent with Art. 4, para. 1, Art. 39 - 41, Art. 11, para 1 and art. 54, para 2 of the Constitution and deciding on the conformity of the same norm with Article 10 of the Convention for the Protection of Human Rights and Fundamental Freedoms (CPCPR, the Convention), with Art. 19 of the UN Universal Declaration of Human Rights ( UDHR ) and Art. 19 of the International Covenant on Civil and Political Rights (ICCPR ) .
The reasons for the request are divided into two parts. In the first part, the centrality in the argumentation of the alleged unconstitutionality of Article 25h, paragraph 2 of the LPPD are the considerations related to violation of the rule of law ( Article 4, paragraph 1 of the Basic Law ). There have been consistent arguments, citing the case-law of the Constitutional Court, for the non-compliance of the disputed norm with the basic requirements of the rule of law in a formal sense . According to the petitioner, the streamlined and unclear formulations of the stated "criteria" in Article 25h and Article 2 open the possibility of subjectivity in the exercise by the Commission for the Protection of Personal Data of the control of the legality of the activity for journalistic purposes. The request also contradicts the requirements of proportionality, proportionality, prohibition of excessiveness, as elements of the content of the rule of law. It is concluded that the impugned provision renders freedom of expression and opinion exceptional, and that the right to the protection of personal data is raised in principle without a constitutional basis. Arguments for contradiction with the provisions of Articles 39-41 of the Constitution have been presented. Stressing the particular importance of the press and the media for the existence of democracy and the existence of a strong ban on censorship in the Basic Law, the request maintains that the introduction of streamlined , unclear "criteria" and restrictions on the use of personal data for journalistic purposes goals are essentially equivalent to censorship. The contradiction of art. 25h, para 2 of LPPD with art. 11, para 1 (principle of political pluralism) and with art. 54, para. 2 of the Constitution . In the second part of the request the arguments for non-compliance of Art. 25h, para 2 of LPPD with art. 10 of the ECtHR, with Article 19 of the UDHR and with Article 19 of the ICCPR in the context of the case law of the European Court of Human Rights ( ECtHR ) .
From the invited institutions, opinions were presented by the President of the Republic of Bulgaria, the Council of Ministers ( CU ) , the Supreme Administrative Court ( SAC ) and the Commission for Personal Data Protection ( CPDP ) .
According to the President of the Republic of Bulgaria the request is justified. It is justified the view that with the criteria introduced in art. 25h, paragraph 2 of the LPPD the disputed provision does not contribute to the equilibrium between the rights, but is an excessive, unbalanced measure that gives preference to the right to protection of personal data over freedom of expression. and information, which is why it is contrary to the principle of the rule of law ( art. 4, para. 1 of the Basic Law ) and is "in deviation from the constitutional obligation to provide a free space for the deployment of the individual in civil society from state intervention (art. 4, a . 2, Ex. 2). " The opinion also states that Regulation (EU) 2016/679 ( Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data and on repeal of Directive 95/46 / EC (General Data Protection Regulation) of 27 April 2016 , OJ of 4.5.2016 , L 119/1 , hereinafter Regulation 2016/679 or Regulation ) , and the preceding Directive 95/46 / EC ( repealed ) , do not contain such a list of criteria, and that the balance between the two fundamental rights is always specific dimensions that require flexible individual judgment, taking into account the particularities of the particular case. Referring to the case-law of the Constitutional Court and the European Courts, the President maintains that the understanding of the need to have equal respect for the rights under Articles 8 and 10 of the CPCHR is not complied with by the ECtHR and considers that the provision in Article 25h, paragraph 2 LPPD is inconsistent with Art. 19 of the UDHR and Art. 10, para. 1 and 2 of the CPEA.
The ICJ found the request unfounded and unfounded. It is argued that the rule of law has not been violated, since the criteria introduced in Article 25h, paragraph 2 LPPD create conditions for legal certainty and predictability in the assessment of the balance between competing rights; not only the protection of personal data, but also the possibility of their legitimate use. The opinion notes that the criteria are clearly formulated and provide the necessary order in accordance with the rule of law, required by Regulation 2016/679, guarantee the predictability of CPDP actions. Pointing out that the rights of the individual are constitutionally placed as a limiter of Articles 39-41 of the Constitution, the opinion concludes that the contested criteria assess the lawfulness of the processing of personal data and guarantee the balance between privacy and freedom of expression and information. The ICJ contends that the lack of criteria would lead to unlawful interference with privacy in the pursuit of journalistic activity, scientific or artistic creativity, and therefore there is no contradiction with Article 54, paragraph 2 of the Constitution. Referring to the ECtHR's practice, the opinion assumes that the disputed criteria are derived from this practice and are not inconsistent with Article 10 of the ECtHR, Article 19 of the UDHR and Article 19 of the ICCPR.
The Supreme Administrative Court ( SAC ) finds the claim unfounded. The opinion maintains that the criteria set out in the disputed provision are in fulfillment of an obligation under Article 85 of Regulation 2016/679, are not vague and should be evaluated with a view to their purpose, and interpretation is a way of overcoming "the inevitable imperfections of regulations. " It is seen that the restriction of the rights under Articles 39 - 41 of the Constitution is admissible because it aims to "prevent the violation of the rights and legitimate interests (among them the right to protection of personal data) of another". It is considered that the criteria in art. 25h, para 2 of LPPD, in view of the ECtHR practice, are not inconsistent with art. 10 of the CRPD, as well as with Article 19 of the UDHR and Article 19 of the ICCPR.
The CPDP finds the claim unfounded and unfounded in its entirety. It is maintained that the provision in Article 25h, paragraph 2 of the LPPD corresponds to, arising from Regulation 2016/679 the obligation to comply with the law on the right to the protection of personal data with the right to freedom of expression and information. The opinion states that the criteria are derived from the case law of the ECJ, the ECtHR and the Constitutional Court and were introduced in order to avoid conflict and to ensure a balance between the two fundamental rights, which are not absolute. It is maintained that the non-exhaustive listing and alternative application of the contested criteria guarantee transparency, uniform interpretation and application, sustainability and legal certainty, which are the main guarantee against subjectivity in carrying out the balance assessment.
In a letter to the Constitutional Court Association of Bulgarian Journalists ( UWB ) emphasizes that the request to declare unconstitutional Article 25h, paragraph 2 of the LPPD fully complies with the principles, expressed and defended repeatedly by the Union and in support of the request. The rejection of the request in its entirety is advocated by the National Council for Journalistic Ethics ( NSW ) , the Association for the Protection of Personal Data ( AAPP ) and the Bulgarian Lawyers for Human Rights Foundation ( PLHR ) . In addition, the opinion of the Access to Information Program ( AIP ) Foundation supports the request made by the UPS .
The NSW argues that the provision challenged in the request is not unconstitutional and complies with the international treaties to which the Republic of Bulgaria is a party , arguing on the basis of clarifying the content of the criteria in Article 25h, paragraph 2 of the LPPD in the context of cited decisions of the ECtHR and the Constitutional Court. It is maintained that this legislative solution seeks to assist data controllers and public authorities in striking the right balance between freedom of expression and the right to the protection of personal data.
The AEDC emphasizes that the law specifically sets out the criteria for assessing the balance between the right to protection of personal data and the right to freedom of expression and information. achieving a certain level of legal certainty and predictability and creating clarity for the addressees of the provision in art. 25h, para 2 of LPPD . This legislative approach is considered to be in line with the requirements and principles of a democratic society for reconciling the two competing rights .
The PLAC Foundation limits its reasoning in the opinion submitted to maintaining compliance of the provision in Article 25h, paragraph 2 of the LPPD with Article 10 ECHR, Article 19 of the UDHR and Article 19 of the ICCPR . Considers, in the context of the ECtHR case-law cited, that the criteria for assessing the balance provided for in the impugned provision do not give priority to the protection of personal data, but constitute a regulation of the positive obligations of the State to protect the privacy of citizens from unlawful interference , and, that because of the identity of the provisions in Art. 10 ECHR, Art. 19 of the UDHR and Art. 19 of the ICCPR the national constitutional regulation on freedom of expression, the provision of Article 25h , paragraph 2 of the LPPD is in accordance with these international norms and acts.
Referring to the case law of the Constitutional Court and the criteria adopted in a number of ECtHR decisions on the balance between freedom of expression and the right to seek, receive and impart information and protect privacy , the AIP is of the view that a flexible approach is needed in balancing them. He maintains that the communication rights of citizens under Articles 40 and 41 of the Basic Law should be considered as a principle, and their restriction is an exception to the principle and subject to narrow interpretation. The opinion concludes that there is no public need to create a more detailed framework in the matter under discussion and with the criteria in art. 25h, paragraph 3 LPPD creates a risk of judgment of "permit type", which is constitutionally inadmissible in respect of of freedom of speech.
The written legal opinions expressed by Prof. Ph.D. Nelly Ognyanova and Assoc. Prof. Zhana Popova are in support of this request.
Prof. Ph.D. Nelly Ognyanova argues and submits arguments for the unconstitutionality of the disputed provision ( Article 4 of the basic law ) and for the non-compliance with the CPPP. Taking into account the practice of the ECtHR, regarding the requirement for accessibility and predictability of a law restricting freedom of expression, it is stated that the provision of Article 25h, paragraph 2 is not formulated sufficiently accurately, clearly and precisely and is inconsistent with the rule of law. It is concluded that this provision is inconsistent with Article 10 of the CPPPC, since it cannot be considered as an act with the qualities of a law within the meaning of the same provision .
According to Assoc. Prof. Popova , the provision in 25h, para. 2 LPDP the efforts of the state institutions are directed at limiting the journalistic work. It is argued that the provision is unconstitutional. It is justified to conclude that the uncertainties and imprecise criteria set out in the contested provision create legal uncertainty, which is why it is contrary to the rule of law. It states that the criteria disproportionately restrict freedom of expression and impede the right of access to information, which is a violation of Articles 39, 40 and 41 of the Constitution. It is argued that the disputed provision also contradicts the freedom of artistic, scientific and technical creativity guaranteed by the Constitution in Article 54, paragraph 2.
The Constitutional Court, discussing the arguments and considerations for the unconstitutionality of Article 25h, paragraph 2, and non-compliance with the said international treaties to which the Republic of Bulgaria is a party, at the request of the Members of the 44th National Assembly, and the opinions expressed by the invited institutions, non-governmental organizations and the legal written submissions in the case to give a ruling, having regard to the following:
The provision challenged before the Constitutional Court in Article 25h, paragraph 2 of the LPPD states:
Art. 25h (1) Obpabotvaneto na personal danni charter zhypnalictichecĸi tseli, ĸaĸto and charter aĸademichnoto, xydozhectvenoto or litepatypnoto izpazyavane e zaĸonocaobpazno, ĸogato ce izvapshva charter ocashtectvyavane na na cvobodata izpazyavane and ppavoto na infopmatsiya, when tool zachitane na na neppiĸocnovenoctta personal zhivot.
(2) Beware of picking, sending, picking, or other means of personal data for the purposes of al. 1, shall become available, the balance between the two shall be free of notice and the right of information and the right of protection of the personal data shall be given
1. the personal data;
2. influencing, protecting your personal data, or pulling in your personal privacy would result in no privacy or privacy;
3. there are personal, and personal data, which are exempted from the administration;
4. the text and the effect of the statement, by virtue of which, they fall within the meaning of paragraph 1;
5. the importance of disclosing personal data or disclosing it to the public for the sake of excommunication;
6. the statement is given by the data subject to the person who is in charge of the duty under art. 6 of Zaĸona charter ppotivodeyctvie na ĸopyptsiyata and charter otnemane na nezaĸonno ppidobitoto imyshtectvo, or e person in charge, ĸoeto popadi ectectvoto na cvoyata deynoct or polyata as often in obshtectveniya zhivot ec in low-zanizhena zashtita na lichnata ci neppiĸocnovenoct or chiito deyctviya imat vliyanie vapxy obshtectvoto;
7. the statement whether the data is valid for the data, and is for the protection of his or her personal data and / or information about his or her personal life;
8. Purpose, content, form, and effects of the statement, through which it is set, shall apply. 1;
9. Responding to the statement, through this, it will come to light on par. 1, with more advanced citizenship rights;
10. Other organisms other than those of the case at hand.
This provision is part of the amendments made to the LPPD to ensure, first and foremost, the effective implementation of Regulation 2016/679, and in particular, to implement the mandate provided for in the Member States in Art. 85 of the Regulation.
With the adoption of Regulation 2016/679, the Union was the first to exercise competence in the field of the protection of individuals with regard to the processing of personal data. However, Member States are given discretion to exercise their competence in the subject matter and in accordance with the requirements of Article 85 of the Regulation.
In connection with this legal context of the adoption of the provision of Article 25h, paragraph 2 of the LPPD, the Constitutional Court finds it necessary to make the following clarification relevant to its further reflections:
Only the Court of Justice of the European Union ( ECJ ) has exclusive jurisdiction to interpret EU primary law and to rule on the validity and interpretation of acts of the Union institutions . In cooperation with the national courts, the ECJ has practically ruled on the conformity with Union law of national legislative measures implementing it through the request for a preliminary ruling under Article 267 of the Treaty on the Functioning of the European Union ( TEC Decision of 26 February 2013 in Case C-617/10 Åklagaren v Hans Åkerberg Fransson, para.19 and the ECJ practice cited there ) .
Regulation 2016/679 has been adopted as 'general' within the meaning of a 'general' regulation. Thus, the name of the act itself emphasizes that it also includes provisions of a general nature in the field of personal data protection and the Member States are given discretion to accept exemptions and derogations, subject to those requirements, including the processing of data. personal data for journalistic purposes or for the purposes of academic, literary and artistic expression ( hereinafter also "for the purposes of journalistic expression" ) . This gives specificity to the provision of Article 85 of the "general" Regulation - its implementation is through a national legislative act. Similar to the acts transposing EU directives, this national act is necessary in order to comply with the instructions in certain provisions of the Regulation itself in the internal law of the Member States and to ensure its effective implementation and achievement of its objectives.
The procedural rule is adopted in the exercise of discretionary power by an EU Member State and is subject to constitutional review on a general basis. At the same time, the amendments and supplements to the LPPD (promulgated SG, issue 17 of February 26, 2019), part of which is the disputed Article 25h, paragraph 2, of the completely new Chapter Four of the LPPD, were created in one common public authority space for the Union and the Member States - these have been undertaken, as indicated in the grounds of the draft LPP LPPD, to ensure implementation of Regulation 2016/679 and transposition of Directive (EU) 2016/680 ( Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 ) in the national legal order. The impugned provision was adopted, in particular, in pursuance of the mandate provided for the national legislator under Article 85 of this EU Regulation. The legal basis for its adoption is Article 16 TFEU, which has an expanded expression in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union ( OJ C 202/389, 7.6.2016, hereinafter the HOPES or the Charter ) . The provisions of Articles 51 and 52 thereof are essential for the regime for the exercise of fundamental rights enshrined in the Charter, and in particular on the legitimacy of their restriction . The ECJ's practice in the matter of protection of privacy and personal data and the right to freedom of expression and information, and by virtue of Article 52 (3) HOPES - ECtHR practice, on the interpretation and application of these fundamental rights of the EUSCR, which correspond to them, bind both the EU institutions and the Member States when acting within the scope of European Union law (PES) and, first and foremost , the national legislator (ECJ ruling of 26 February 2013 in C-617/10, Åklagaren v.Hans Åkerberg Fransson, paras 19 and 20, quoting There is a practice of SES). Also, the CPTUP , to which all EU Member States are parties, is integrated into the national legal order, applies directly and with priority over national laws that contradict it, and binds national courts and public authorities . The essential point is that the texts of the Convention cannot be read and applied beyond their interpretation in the jurisprudence of the ECtHR , which is highly evolutionary .
Against this background, in order to rule on the substance, the Constitutional Court also takes into account the relevant provisions of the EU's founding Treaties , the Charter and Regulation 2016/679, the ECHR, as well as those established in the case law of the ECJ and the ECtHR, which are key in the subject matter of both fundamental rights. - the right to the protection of personal data and the right to freedom of expression and information - understandings and concepts, in clarifying the meaning and scope of the provision challenged in the request in art. 25h, paragraph 2 of the LPPD ( in this sense, the decision in joined cases C-411 / 10 and C-493/10 , NS v Secretary of State for the Home Department and ME et al.v R efugee Applications Commissioner and Minister for Justice, Equality and Law Reform , para. 58 - The ECJ agrees that '.. the Member State which exercises …. the discretion conferred by a regulation applies Union law within the meaning of Article 51 ( 1) of the Charter 'and Judgment of 13 July 1989 in Wachauf, 5/88, Recueil, p. 2609 and judgment of 4 March 2010 Chakroun, Case C-578/08, Case I-1839). The Constitutional Court refers to these relevant sources of Union law, acts and other documents of the Council of Europe and international law, insofar as is necessary to rule on the present case.
I. Right to privacy and right to protection of personal data: European legal framework - Council of Europe and European Union; national legal context.
- the European legal framework
The understanding of personal data protection in the EU evolves in relation to the traditional concept of privacy, which is understood as the right to a certain sphere of autonomy for the individual, above all in relations with public authorities. In Europe, fundamental rights, along with protection against national constitutions, are guaranteed by both major supranational systems - the CPCPO, to which all EU Member States are parties to an international treaty, and the ECtHR, and one based on the ECtHR, the last word on its interpretation and application. ECJ jurisprudence. These systems work closely together to guarantee fundamental rights. The ECJ interprets rights in harmony with national constitutional traditions and, when interpreting the Charter, follows this interpretation of the Convention, which refers to its corresponding rights in both acts ( Article 52 ( 3 ) of the Charter; ECJ judgment in joined cases Volker und Markus Schecke GbR (C-92/09) and Hartmut Eifert (C-93/09) v Land Hessen , para.51 ) , contained in the jurisprudence of the ECtHR. In particular, Article 8 of the Convention, similar to the provision in Article 7 of the Charter, provides that everyone has the right to respect for his private life, his family, his home and communications. Respect for fundamental rights is a general principle of EU law ( related cases C-402/05 P and C - 415 / 05P, Yassin Abdullah Kadi and Al Barakaat International Foundation v Council of the European Union and Commission of the European Communities , ECR 2008 I-06351 ) and the ECJ are their guarantor in the overall process of building the EU's constitutional framework, where it has a leading role. Thus, the right to privacy of the individual ECJ protects even before the Charter is recognized as having equal force with the founding Treaties of the EU ( in this sense, the ECJ Decision of 26 June 1980 in Case 136/79 - National Panasonic (UK ) Limited v Commission of the European Communities , EC R 1980 , p. 02033 , para.17 et seq. ) . Also, Article 8 of the HOPES establishes the right to the protection of personal data without having a corresponding provision in the CPPPP, as well as in Council of Europe Convention 108 of 28.01.1981 on the protection of individuals with regard to the automated processing of personal data , which specifically refer to this right. With Convention 108, the Council of Europe makes the earliest attempt to harmonize privacy legislation and is the first binding instrument in international law ( treaty ) in this field in Europe . It is also important to note here that Convention 108 also contains exceptions to this right - e.g. it provides that States Parties may derogate from certain provisions thereof, where such derogation is provided for in national legal order and is a necessary measure in a democratic society in the interests of the protection of national security, public security and, inter alia, protection of the rights and freedoms of others or, where personal data are used for statistical purposes, or for the purposes of research without creating the risk of violation of privacy ( Art . 9 ) . The modernization of Convention 108 in 2018 places emphasis on the principle of proportionality and legality, as well as on the minimization of personal data processed ( Convention 108, ratified by law on 29.05.2002 , SG No. 56 of 7.06.2002 ; ratified on 19.09.2019) . is also the Protocol to amend the Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data , which modernizes Convention 108 ) . The ECtHR does not find it necessary and comprehensive to define the term "privacy" and consistently upholds the broad interpretation of the right to privacy ( in this sense, the Decision of 29 April 2002). in the case of Pretty v. United Kingdom, arr. 2346/02, para. 63 ) , emphasizing that it adhered to a pragmatic rather than a legal or formal approach of its own ( in this regard, Botta v. Italy, ap . 21439/93 , para. 27) . In practice, the ECtHR implements Article 8 of the CPCPS so as to include the right to the protection of personal data ( to this effect Judgment of 16.02.2000 in Amann v. Switzerland , p . 27798/95 ; Judgment of 27 June 2017 in Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland , pp . 931/13 , para. .137 ) . When the ECtHR recognizes that personal data protection is also it provides the same safeguards as provided for by law with regard to the protection of personal data - the right of access of the data subject to the data collected about him, the right to delete personal data in public registers, etc. ( Gaskin v. The United Kingdom , pp . 10454/83 ; Leander v. Sweden , pp . 9248/81 ) .
Unlike Article 8 of the CPPPC, Article 8 of the Charter not only differentiates the right to the protection of personal data from the protection of privacy, but also provides for additional guarantees in paragraphs 2 and 3 of the same provision, namely that personal data must be processed fairly, for specific purposes and on the basis of the consent of the data subject or other legitimate reason specified by law, and that everyone has the right of access to the data concerning him and the right to correct such data as controls for compliance with those rules are exists by an independent public authority.
The existence of two different provisions, as well as their content, confirm that by recognizing the intersection of the two rights under discussion ( they systematically follow one after the other ), the Charter at least formally distinguishes them. The ECJ refers to the practice of the ECtHR and adopts a non-restrictive interpretation of the concept of privacy - any information about an identified or identifiable individual. The ECJ affirms an open, spirit-based interpretation of both Directive 95/46 ( repealed ) , which is the first legally binding act of the EU regulating the right to protection of personal data and of the current Regulation 2016/679 ( in this sense ECJ judgment in Case C-93/09 Hartmut Eifert v Land Hessen , Joined Cases C-92/09 and C-93/09 , ECR 2010 I-11063 ) .
The right to privacy is not absolute and may, but only in compliance with the requirements of Article 8 of the CPPPO, be limited by law, pursue one or more legitimate goals, and, what is essential, the restriction is necessary in democratic society. The CRPD provides in Article 8 ( 2 ) a comprehensive list of the goals justifying the restriction of this right, indicating inter alia the protection of the rights and freedoms of others. HOPES is formulated relatively more openly and allows restriction for general interest purposes recognized by the EU, or if the restriction meets the need to protect the rights and freedoms of others , while respecting the principle of proportionality ( Art. 52 (1) HOPES ) .
Following the entry into force of Convention 108 of 1981. The PES is developing in the direction of deploying the individual's control over his or her own data . The improvement of existing technological capabilities and the development of the information society has led to the adoption of Directive 95/46 ( repealed ) for the protection of individuals with regard to the processing of personal data and for their free movement. Directive 95/46 ( repealed ) is heavily influenced by national laws in this matter, where often the right to the protection of personal data is based on human dignity and the right to information self-determination ( eg Germany ) or is linked to the right to personal integrity ( eg France ) . Initially, the right to the protection of personal data is governed by an act of secondary EU law, and for a long time in its practice the ECJ has put forward the importance of Directive 95/46 ( repealed ) in achieving a digital single market, while not neglecting its binding nature. economic goals and those for the protection of fundamental freedoms, and much later - fundamental rights. For the first time, the ECJ explicitly referred to the right to the protection of personal data in the case Promusicae ( Decision of 29 January 2008) in Case C-275/06 Productores de Música de España (Promusicae) v Telefónica de España SAU , para.63, Reports of Cases 2008 I-00271 ) , citing Article 8 of the HOPES. Also, in the Bavarian Lager judgment, the ECJ emphasizes that, in comparison with the right to privacy, the PEC rules on the protection of personal data create specific enhanced protection ( Case C-28/08 P , European Commission v The Bavarian Lager Co. Ltd , Reports of Cases 2010 I-06055 , para. 60 ) . This change in the practice of the ECJ is related to the entry into force in 2009. of the Treaty of Lisbon and the recognition of the EU Charter of Primary Law ( Art. 6 ( 1 ) TEU and Art . 16 TFEU ) .
As an aspect of developing innovative forms of data processing, the importance of the protection of personal data is constantly increasing. As the use of personal data for economic purposes is improved with the advancement of information technology, jurisdictions recognizing the right to the protection of personal data, as well as the EU by Article 8 of the Charter, are expected to guarantee the exercise of this right. To this end, the EU adopts Regulation 2016/679, which, in accordance with the Charter, many references to privacy are dropped and replaced with the right to protection of personal data. The Regulation as a whole embraces the ideas and principles of Directive 95/46 ( repealed ) and seeks to achieve the unfulfilled objective of harmonizing EU data protection legislation.
In line with this objective - to provide an equally high level of protection of personal data within and outside the EU , and given the fact that many Member States' constitutions do not establish the right to protection of personal data as separate from the law inviolability, and this also applies to the Constitution of the Republic of Bulgaria, the practice of the ECtHR and that of the ECJ ( mainly in the implementation of Directive 95/46 ) , with the definitions of key concepts in the matter under consideration and upholding principles, remain relevant and relevant. today.
Although privacy and data protection are closely linked in jurisprudence of the ECJ and the ECtHR, their specificity is taken into account in the specific circumstances ( indicative of the distinction between the two rights is the ECJ ruling of 13 May 2014 in Case C-131/12 Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD ) and Mario Costeja González ; the ECJ links, but also differentiates between the two rights in both Case C-73/07 , Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy , para 55, as well as in the judgment of 6 October 2015 in Case C ‑362/14 Maximillian Schrems v Data Protection Commissioner, para.39 ) . Despite their partial overlap, these rights have differences in material scope. Information relating to the private life of an individual does not necessarily include all information about an identified or possibly identifiable ( direct or indirect ) individual. However, the protection of personal data covers this information. This scope is based on the definition of personal data in Convention 108 and in Regulation 2016/679 and is broader than the right to privacy, which should be taken into account when interpreting Article 8 of the Charter ( Article 6 (1 TEU and Article 52 (7) of the Charter; ECJ judgment of 26 February 2013 in Case C-617/10 , Åklagaren v. Hans Åkerberg Fransson, para.20 ) . Also, unlike Art. 8 of the CPPPC ( cited above ) Art. 8 ( 2 ) , first sentence, HOPES is more of a "permissive" character - if the standards of processing of personal data specified therein are followed ( good faith processing, for a specific purpose, on the consent of the data subject or other legitimate reason stated in law ) is considered to be lawful ( Judgment of the ECJ in Joined Cases Volker und Markus Schecke GbR (C-92/09) and Hartmut Eifert (C-93/09) v Land Hessen , para. 49 ) . The general clause on the admission of restrictions on the rights provided for in the Charter, including under Articles 7 and 8, is in Article 52 ( 1 ) thereof and provides that they must be provided for by law, respect the fundamental content of the said rights and freedoms and, while respecting the principle of proportionality, be necessary , inter alia , to protect the rights and freedoms of others .
In general, the rules on personal data protection are viewed by the Council of Europe and the European Union as an attempt to take into account the threat to the information security of individuals arising from the increasing consumption of high-tech data-processing tools in today's digital society.
As stated, the terms "personal data" and "processing of personal data" are broadly defined in Article 4 ( 1 ) and ( 2 ) of the Regulation: "personal data" means any information relating to an identified or natural person who can be identified ("data subject"); an identifiable natural person is an identifiable person, directly or indirectly; 'Processing' means any operation or combination of operations carried out with personal data or a set of personal data by automatic or other means such as the collection, recording, organization, and inter alia , disclosure by transmission, distribution or any other means of making the data accessible . Taking into account available technologies and technological developments for data processing ( recital 26 in the preamble to the Regulation ) , in practice, this means that all data is potentially personal and any activity related to personal data is processing of the same. Understanding of the processing of personal data, as stated, has a broad scope and thus much of the modern communications covered by the right to freedom of expression and the right to information are also covered by the right to the protection of personal data in the EU . Moreover, under Article 85 of the same regulation, certain exceptions and derogations are granted to the discretion of the Member States, in particular as regards the processing of personal data for journalistic purposes, for the purposes of academic, literary or artistic expression ( under (only "journalistic processing" ) . They are intended to guarantee the balance of the right to the protection of personal data with other fundamental rights, in the case of Article 85 ( journalistic purposes ) - with the right to freedom of expression and information, in accordance with the principle of proportionality. The application of such exceptions to the right to the protection of personal data, defined as exceptions for a special purpose, requires the balancing of the two fundamental right.
- the national legal context
As can be seen from the above, in the European legal context there is no accepted model of the relationship between the right to privacy and the right to the protection of personal data. The doctrine outlines three broad models in which the right to the protection of personal data is regarded as a separate but complementary right aimed at protecting human dignity, evolving / growing from the first or that the right to the protection of personal data is independent. an autonomous right that performs a number of functions, including but not limited to protecting privacy . In particular, in the EU legal order, this right develops into a fundamental right that gives the individual more control, through a considerable number of rights, including the "right to be forgotten", over a wider range of data that pertain to him. It may be assumed that the third model most accurately reflects the real real relations between the two rights ( taking into account the accelerated and often unpredictable development of information and communication technologies ) , but neither model offers a clear explanation of the nature of the relations between the rights of the defense of personal data and the right to privacy. This ambiguity makes it difficult to identify the interests underlying the rights as well as to determine the extent to which they are affected, which is important in assessing the compliance of a restrictive measure with the principle of proportionality.
The Constitution of the Republic of Bulgaria does not include in its established catalog of fundamental rights, the right to protection of personal data as separated from privacy and the ensuing rights enshrined in Article 32, paragraph 1 . In addition to the above, it is noteworthy that Convention 108 of 1981 ( the Council of Europe Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data ) , as well as Directive 95/46 and Regulation 2016/679 place emphasis on their title. on the protection of individuals with regard to ( automated under Convention 108 ) the processing of personal data. In Convention 108, the term personal data is used in the context of rights and fundamental freedoms, and in particular the right to privacy ( Article 1 thereof ) . Directive 95/46 ( EU secondary legislation repealed ) introduces, for the first time and before the Charter, the right to the protection of personal data in the Union legal order, and the Charter in turn promulgates it as an independent fundamental right, systematically enshrined as soon as possible. the right to privacy. Convention 108 was ratified by the Republic of Bulgaria by a law adopted by the XXIXth National Assembly on May 29, 2002 (State Gazette No. 56 of 2002 ) and promulgated in 2003 ( State Gazette No. 26 of March 21, 2003) . . ) by which an act becomes part of the internal law of the country. In 2000. the Law on access to public information ( promulgated in the State Gazette, issue 55 of 7 July 2000 ) , which uses the term "personal information". LPDP ( Official Gazette, SG No. 1 of January 4, 2002, effective as of January 1, 2002, last amended and supplemented SG, No. 17 dated February 26, 2019 ) , introducing in national law, Directive 95/46 ( repealed ) was adopted on 21.12.2001. and pursuant to paragraph 5 of the Transitional and Final Provisions thereof, shall enter into force on 1 January 2002. It follows from the foregoing that the LPPD for the first time uses the concept of "right to protection of personal data" in national law and also in the context of the right to privacy. The grounds of the draft law state that the protection of personal data is related to ensuring the privacy of citizens, their honor and their good name and their right of access to the information collected from them by public authorities and other persons. In the case-law of the Constitutional Court it is used as "inviolability his privacy and personal data, "" privacy right, "" personal data protection, "and" personal data protection right, "or only" personal data " ( Decision No. 6/2004, Decision No. 4/2012 , Decision No. 6 of 2012, Decision No. 13 of 2012; Decision No. 3/2002 ) . The use of the union "and" between "inviolability of privacy ”and“ personal data ”in case # 4/2012 talk about putting one in a row and tying the two rights. Generally, in these cases, the terms "personal data" and "right to privacy" are used either in relation to privacy or in order to refer to the elements of privacy. It should be noted immediately that in connection with the mandatory interpretation of "communication rights" ( Articles 39-41 of the Basic Law ) in decision No. 7 of 1996, which precedes the adoption of the LPPD and the case-law of the court, the Constitutional Court outlines the scope of constitutionally established restrictions on these rights in relation to the protection of other constitutionally established values. Stressing that privacy (Article 32, paragraph 1 of the Constitution and ensuing rights ) is a leading restrictive ground, the court adopts a broad understanding of "privacy" and relates it to a complex of interests along with the secrecy of correspondence and the inviolability of the dwelling ( respectively Article 33, Paragraph 1 and Article 34, Paragraph 1 ) , which are all constitutionally protected rights. They also state that they are not absolute and that freedom of expression and information are subject to restriction. The court distinguishes information relating to the intimate sphere of the person ( personal data is the medium of information ) from that which is made public in the context of public debate. The foregoing allows us to accept in the present case that the right to privacy is at the heart of the right to the protection of personal data, which is in line with an evolving understanding in the European legal context. This is important given that in paragraph 1 of Article 25h of the LPPD, which introduces a general rule in Article 25h as a standard complex, the term 'privacy' is used, which is the concept adopted in the Basic Law, and, therefore, , the constitutionally established protection and standards for this right restrictions ( as well as the right to freedom of expression and information ) , within the meaning clarified in the cited decision No 7/1996, are also relevant to the right to the protection of personal data.
II . Legal basis for balancing the right to freedom of expression and information and the right to the protection of personal data, when processing for journalistic purposes, in the context of the EPCPS, ECtHR practice and EU law.
The CRPD guarantees the right of freedom of expression in Article 10, the provision of which is close to that in Article 19 of the UDHR and Art. 19 ( 2 ) ICCPR - for the purposes of the latter, the right to freedom of expression for every individual includes the freedom to seek, receive and impart information and ideas of any kind, regardless of frontiers, whether orally, in writing or in print or as a work of art, or by any other means of your choice . This freedom is universally recognized, affirmed as a fundamental right and standard for all freedoms and is widely regarded as referring to the entire flow of information and ideas in society ( UN General Assembly Resolution 59 (1) of 14 December 1946 ) . In addition to the right of every individual, freedom of expression is associated with other subjects and, above all, with the press and with all the mass media that institutionalize it and serve in a democratic society as a guarantor of its information and effective civil control of government. Regional and national courts have embraced this broad vision of freedom of expression and emphasized the social function of the media in democratic political systems. The ECtHR has consistently maintained the position expressed in Handyside v. United Kingdom , pp . 5493/72, 1 EHRR 737, 7 December 1976 , para. 49 , that freedom of expression is fundamental to a democratic society and is one of the basic prerequisites for its progress and for the realization of each individual ( to that effect , Lingens v. Austria ; judgment of 18 July 2000 in vener v. Turkey ; judgment of 29 March 2001). Thoma v. Luxembourg, 29 March 2001 , et al. ) . Noting that freedom of expression refers to all kinds of information, including inconvenient and even shocking, because such are the requirements of pluralism and tolerance, without which there is no democratic society, the ECtHR in the Satakunnan & Satamedia Oy judgment emphasizes the need for strict Interpretation of Article 10 ( 2 ) of the CPTEC, which provides for the conditions under which the restriction of this fundamental right is permissible (Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland , pp . 931/13 ) . Moreover, the Court links the freedom to disseminate information with the right of everyone, and the public at large, to be informed and emphasizes the duty of the media to provide information on matters of public interest ( in the judgment in Satakunnan Markkinapörssi Oy and Satamedia Oy , paras 56 and 60 ) .
While the EU strongly defends the right to the protection of personal data and, in general, the privacy of the individual, the Union also explicitly recognizes the right of everyone to freedom of expression and freedom of information ( Article 11 of the HOPES ) . Both the ECtHR and the ECJ share the view that the right to freedom of expression is not only an independent fundamental right, but it plays a central role in the protection of other rights guaranteed by the Convention and the Charter. It implies the right to seek and receive information, and therefore the right of access to information for everyone and for society as a whole. Society can only participate effectively and effectively in the democratic process if there is information about the activities and policies of the public authority. The second paragraph of Article 11 of the Charter explicitly proclaims the freedom and pluralism of the media and thus recognizes and guarantees the effective exercise of the media function of "public watchman" in the democratic process. In accordance with Article 52 ( 3 ) of the HOPES, the ECJ follows the practice of the ECtHR and accepts that freedom of expression includes not only expression of opinion, but in accordance with the second sentence of Article 10 ( 1) of the ECHR and Article 11, paragraph 1, first sentence of the Charter, it encompasses - in the sense of freedom of communication - the freedom to receive and impart information or ideas, and that freedom of communication relates to any type of information ( Case C-73 / 07 , Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy , para.39 ) .
Beyond the absolute rights recognized by international law, fundamental rights are not unlimited in scope. Each legal system provides for certain restrictions on freedom of expression and information. While Article 10 ( 2 ) of the CPPEA states the requirements for the legitimacy of the restrictive measures imposed on this freedom, Article 11 of the HOPES does not contain such a prescription and the general restrictive clause is in Article 52 ( 1 ) of the Charter for the rights envisaged by it.
As shown in the first section of the statement of reasons, Regulation 2016/679 follows the line of enhanced protection of individuals with regard to the processing of personal data and, at the same time, of balancing other fundamental rights, in particular the freedom to expression and information, as these rights are enshrined in the CPPPC and the HOPES - guidelines outlined in both Convention 108 and Directive 95/46. The Charter guarantees the right to the protection of personal data, but it does not do so at the expense of freedom of expression and does not show that it claims to maintain one right as more important than the other ( Article 8 ( 1 ) of the Charter ) . Both the ECJ ( judgment of 9 November 2010 in Case C-92/09 Volker und Markus Schecke , para. 85 ) and the ECtHR are consistent in their position that freedom of expression has equal weight with other fundamental rights and their equal respect , as the ECtHR points out, is a matter of principle ( ECtHR judgment of 7 February 2012 in Von Hannover v Germany , para 100 , pp . 40660/08 and 60641/08) . According to the PPPHR, freedom of expression is not absolute, as is the right to privacy. States Parties to the Convention may interfere with this freedom ( regardless of the means by which opinions, ideas and information are expressed ) , but only under the conditions laid down in Article 10 ( 2 ) of the Convention, which fall into three categories: designed to protect the public interest ( national security, territorial integrity, public security, riot prevention or crime, protection of health and morals ) ; intended to protect the honor and goodwill or rights of others and to protect against the distribution of confidential information; necessary to maintain the authority and independence of the judiciary. In order for a restrictive measure to be acceptable, it must be provided for by law and necessary in a democratic society. The ECtHR, within its supervisory competence, emphasizes the "necessity" of the restrictive measure and maintains that national discretion lies within the interests of a democratic society to guarantee and maintain freedom of the press (Worm judgment of 29 August 1997, Reports 1997-V, para. 47) . Cases of legitimate restraint must be specified in law and can only be accepted if they are necessary in a democratic society.
The provision in Article 1 ( 2 ) defining the objectives of the Regulation ( " This Regulation protects the fundamental rights and freedoms of natural persons, and in particular their right to the protection of personal data ." ) , In connection with recital ( 4 ). it also confirms that the federal legislature has recognized that the absolute application of data protection rules entails a risk of materially encroaching on other fundamental rights. Noting in the cited recital that the right to the protection of personal data is not absolute and states that the Regulation respects all fundamental rights and observes the freedoms and principles recognized by the Charter as enshrined in the Treaties, in particular respect for privacy and family life, home and communications, protection of personal data and, inter alia , freedom In expressing opinion and freedom of information, the federal legislature has provided mechanisms for balancing the two rights. First of all, the general rules on personal data protection do not apply where processing them is undertaken in the context of Member States' activities falling outside the scope of the PES or in the course of a person's purely personal or domestic activities, as well as by the competent authorities for the purpose of preventing, investigating, detecting or prosecuting crimes or committing criminal offenses. the penalties imposed, including the prevention and prevention of threats to public security ( Article 23 of Regulation 2016/679 ) . In addition , among other cases of exemption from the general rules, certain exceptions and derogations are granted, as already noted, to the discretion of the Member States, in accordance with the provision of Article 85 of the same Regulation, if they are necessary to harmonize the law. of privacy protection with freedom of expression and information, because no fundamental right can always be the 'master' of a situation in relation to another competing interest with it. The application of such exceptions to the right to the protection of personal data, in particular the "journalistic exception" (an exception for journalistic purposes, for the purposes of academic, literary or artistic expression ) requires a balance between the two. basic rights - protection of personal data and freedom of expression and information.
It is important to note that in balancing conflicting interests, one of which is the right to freedom of expression and information, the leading position is to take into account the importance of this interest in a democratic society. This, according to the ECJ, requires a broad interpretation of the concepts related to this freedom , including the concept of journalistic activity ( in this sense, the Court's judgment of 14 February 2019 in Case C-345/17. Sergejs Buivids, para. 51, where The ECJ refers to decision of 16 December 2008 , Satakunnan Markkinapörssi and Satamedia, C ‑ 73/07 , EU: C: 2008: 727 , para. 56 ) . Both jurisdictions pay special attention to the duty of the media to receive on behalf of the public and to disseminate public interest information to the general public, focusing on the contribution of this information to the public debate ( in the context of a debate on common affairs ) and clarifying key concepts in the matter of balancing the right to privacy and the right to freedom of expression and information - "objectives of journalism" and "information of public interest" (the practice is widespread and the citation is exemplary: ECJ judgment of 13 May 2014 in Case C-131 / 12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González , paras 97-99; ECtHR judgment of 7 February 2012 in Von Hannover v Germany (2), p . 40660/08 and 60641/08 , paras 109-110 ; Judgment of 7 February 2012 in Axel Springer AG v Germany, App . 39954/08 , para. 90) . According to the ECtHR, Article 10 of the CRPD protects both the one who exercises his freedom of expression and the one who exercises the right to receive information and stresses that "the public has the right to receive information of public interest" ( in this sense, the Decision of 14 April 2009). Társaság a Szabadságjogokért v Hungary, para. 26, and pp . 37374/05 ; Judgment of 19 February 2013 in Fredrik Neij and Peter Sunde Kolmisoppi v. Sweden, pp . 40397/12, 9) . The Court also held that Article 10 applies not only to the content of the information, but also to the means of transmission or reception, since any restriction imposed on the medium inevitably interferes with the right to receive and impart information ( Judgment of 22 May 1990 in Autronic v. Switzerland , pp . 12726/8, para. 47). In the case of Sergejs Buivids, referring to its case-law, the ECJ considered that "journalistic activities" were those whose purpose was to publicly disclose information, opinions or ideas regardless of the medium of transmission (in this sense, the judgment of 16 December 2008 ., Satakunnan Markkinapörssi and Satamedia, C ‑ 73/07 , EU: C: 2008: 727 , para . 61 ( Judgment of the Court of 14 February 2019 in Case C-345/17. Sergejs Buivids, para. 53 ) . The Court also notes that these activities are not restricted to media enterprises and may have a business purpose. Journalistic activities also include various preparatory activities. The exceptions and derogations apply not only to media companies but also to any person engaged in journalistic activity ( to that effect, Case C-345/17 Buivid , cited above , § 52 ) . It should be recalled that recital 153 of Regulation 2016/679 provides that "In order to take into account the importance of the right to freedom of expression in any democratic society, such concepts as journalism, for example, need to be In the light of this practice, the Constitutional Court emphasizes that the stated objectives are inherent in journalistic activities. Therefore, exceptions and derogations are introduced solely for the purpose of journalistic activity or literary or artistic expression, arising from the fundamental right to freedom of expression and, if necessary, to harmonize the right to privacy and the rules governing freedom of expression.
In its practice, the ECJ balances the two fundamental rights in the context of the "journalistic exception" mainly in relation to the interpretation and application of Directive 95/46. Both the aforementioned Directive and Regulation 2016/679 contain provisions designated as a "journalistic exception" , which is why this practice remains relevant in the application of that regulation.
Balancing is an important point in assessing whether a restrictive measure complies with one fundamental right, in this case the right to freedom of expression and information, with the principle of proportionality, which is fundamental to modern constitutional democracies. It allows the specific circumstances of each case to be taken into account. According to the ECtHR, although broadly worded, the requirements of Article 10 ( 2 ) of the Convention make it clear that cases of legitimate restriction must be specified in law and can only be adopted if they are necessary in a democratic society ( in this sense, the Decision Worm v. Austria , 83/1996/702/894 , Reports 1997-V, paras 47-50 ) . The requirement for restrictions to be provided by law is an essential guarantor of the rule of law, and includes both the formal requirement of lawfulness - to have a legal / legal basis of restrictions, and the substantive requirement - the rule to have the qualities of law - to be formulated with sufficient precision and clarity and accessible to everyone. In the Sunday Times case, the ECtHR states that a rule cannot be regarded as a "law" unless it is formulated by sufficient precision to allow an individual to regulate his or her behavior so as to be able to anticipate the consequences that may arise in certain circumstances ( to this effect, Sunday Times v. United Kingdom , app . 06538/74, para.49 ) . Nor can the law grant unlimited discretion to restricting the freedom of expression of those empowered to exercise it ( to that effect , Hashman and Harrup v. United Kingdom, p . 25594/94, para. 35) . In addition, a number of rights can be seen as justifying the restriction of freedom of expression, including the right to privacy, family and communication. Whether a specific restrictive measure of freedom of expression aimed at protecting those rights is justified depends on the considerations of the specific nature of the particular restrictions and the circumstances, and is most often assessed in the context of the need to impose them ( to this effect stated in the ECtHR judgment in Worm v. Austria) . If a restrictive measure serves a legitimate aim, it must be "necessary in a democratic society", which, according to the ECtHR, justifies with pressing social need (See, to that effect, Handyside v T he United Kingdom , p . 5493/72 , §§ 48-49 ) . In this context, it is assessed whether the measure is appropriate ( rationally related to the objective ) , necessary ( there is no obvious and overwhelming alternative to achieving the least restrictive objective ) and adequate to the significance of the objective pursued. In order to carry out this assessment, the ECtHR and the ECJ apply criteria formulated by them, taking into account the circumstances on a case-by-case basis ( eg Decision since 2012. of the ECtHR in the case of Verlagsgruppe News GMBH and Bobi v Austria , and pp . 59631/09 , para 72; Judgment of 10 October 2013 in the case of Delfi AS v. Estonia , and pp . 64569/09 , para. 83, and in the cases already cited by Von Hannover (2), para. 109-113 and Axel Springer AG, para. 89-95 et al. ) . Opinion of Advocate General Sharpston in Case C-345/17 Buivids, cited above, states : (i) an assessment of the contribution to the public interest debate; (ii) an assessment of the degree of publicity of the person concerned; (iii) consideration of the subject matter of the report; (iv) consideration of the behavior of the person concerned so far; (v) reviewing the content, format and implications of the publication; and (vi) taking into account the circumstances in which the information was obtained. " ( Opinion delivered on 27 September 2018 , para . 62 ) .
The issues that arise in practice regarding the balancing of conflicting fundamental rights are few and they are the subject of ongoing debate in constitutional law doctrine and practice. Of these, significant are those concerning, first, the nature of the balancing method and, second, the timing of balancing. Without discussing the method of balancing in depth, the Constitutional Court notes that this is a pragmatic approach in jurisprudence in disputes in the area of rights. It is concerned with overcoming formalism in law and is focused on real life. Based on the argument for the non-absolute nature of rights, this approach ensures that each competing interest is recognized on its own merits - there are no losers and everyone gets due in the circumstances. Through it, law is able to reasonably follow the changing economic and social needs and to guarantee minimum "sacrifices" in the overall system of values that underpin fundamental rights. Balancing is, by its nature, an analysis and evaluation activity that is performed on a case-by-case basis and is recognized as an approach by the courts, which is the correct forum for resolving conflicts of rights. It is not an activity to organize rules to resolve future specific cases of tension between fundamental rights, appropriate to be universally enforced with a view to a firm hierarchy of interests and principles. Balancing gives preference to interests in specific circumstances and legal requirements, which makes it impossible to establish safe and consistent rules, but on the contrary, they are subject to change. It is noteworthy that both the ECtHR and the ECJ identify a series of criteria for balancing the right to freedom of expression and the right to privacy, which are addressed specifically by national jurisdictions. The Constitutional Court finds it appropriate to point all this out, since it explains to some extent why the introduction of such criteria in a general rule at the legal level has the risk of preventing balancing as an approach in its intended purpose - to be a way of gradually overcoming the inherent restriction inherent in everyone. law, while guaranteeing justice in society.
With regard to the second question, it is widely acknowledged that balancing is a "complex exercise" and is only undertaken after passing through other, logical, subsequent stages of the three-stage analysis established in the jurisprudence of the ECtHR and the ECJ and applied by national jurisdictions on the proportionality of the restrictive measure imposed on a fundamental right ( proportionality test ) . Proportionality and balancing are unity - the last and most important phase of the proportionality test, as an analytical judicial procedure, is balancing in its own sense (stricto sens u ) . The doctrine also states that before discussing the issue of the proportionality of a restrictive measure, if a reconciliation of fundamental rights in a conflict is necessary, it must first be determined ( in the event of a real conflict ) whether the measure in question affects the substance content of the right - its 'hard core'. The legal basis for this concept is the provision of Article 52 ( 1 ) of the HOPES. This is a general clause regarding the restriction of fundamental rights, which states the requirement to respect the fundamental / essential content of these rights and freedoms in the first place, and only then prescribes that restrictions may be imposed in accordance with the principle of proportionality and to achieve the goals it outlines. In accordance with this logical sequence of assessments of the restrictive measure, in the affirmative answer to the above question, no balancing is necessary. This is because a restrictive measure that calls into question the law itself as such is disproportionate in itself. Although not explicitly stated in the CPPPC, the obligation to respect the substantive content / core of fundamental rights is enshrined in the case law of the ECtHR. Belgian Linguistic in 1968 . ( Judgment of 23 July 1968 in Belgian Linguistic (2) , pp . 1474/62; 1EHRR - 252 ) . National constitutional courts also invoke the requirement to preserve the essential content of fundamental rights as a dimension of the rule of law, and the Constitutional Court is no exception to this practice. In affirming the this understanding of the substance of the fundamental rights of the ECJ plays an important role, in particular, in the field of privacy and the protection of personal data. The ECJ outlines, for the first time, the conditions for violations of the core core of fundamental rights under Articles 7 and 8 of the HOPES in the Digital Rights Ireland and Schrems cases ( Judgment of 8 April 2014 in Digital Rights Ireland v. Minister for Commc'n, ECLI: EU: C: 2014: 238; Judgment of 6 October 2015 in Case C-362/14, Schrems v. Data Protection Commissioner, CLI: EU: C: 2015: 650 , etc. ) . The aforementioned concept is implemented by the ECtHR and the ECJ to push the boundary of restrictive rights measures and serves as a means of judicial control over the intensity of state intervention in fundamental rights. Although rarely applied, the concept of affecting the substantive content of a fundamental right emphasizes the need for increased attention ( strict control ) to the intensity of entry into a fundamental right, in analyzing the proportionality of a statutory restrictive measure, and the Constitutional Court takes this into account in the present case.
III . Concerning the contradiction of Article 25h, paragraph 2 of the LPPD with Article 4, paragraph 1 of the Constitution.
From the above considerations, it can be seen that the objectification in domestic law of the "journalistic exception" under Article 85 of Regulation 2016/679 is the task of the EU Member States, which by law should reconcile the right to privacy and the right to freedom of expression and information, and bring them together. To this end, the national legislator has adopted several related provisions forming a normal complex in art. 25h, paras 1-5 of LPPD.
Although the provision in paragraph 1 of Article 25h of the LPPD is not included in the subject of the request, because it introduces a general rule with respect to the other provisions of Article 25h, as well as there is a reference to the rights under paragraph 1 in Paragraphs 2 and 3 thereof, the Constitutional Court finds the following note necessary. From the sense outlined in the previous section of "journalistic activity" as adopted by the ECJ in Case C ‑ 345/17 Buivids ( paras 51-53 ) , namely journalism aims at "the public disclosure of information, opinions or ideas irrespective of the medium of transmission " and the Opinion of the Advocate General in the same case ( ECJ, Opinion of Advocate General Sharpston in Case C-345/17 Buivids 48, as well as the Decision in the case cited above Satamedia C-73/07 , para. 58 - 61) , after indicating the criteria for a broad interpretation of the same concept, "… in view of those criteria, certain activities may be classified as 'journalistic activities' if their purpose is to publicly disclose information, opinions or ideas ". that journalistic goals by definition include the exercise of the right to information and freedom of expression. Article 25h, paragraph 1 of the LPPD states that "The processing of personal data for journalistic purposes, as well as for academic, artistic or literary expression, is lawful when carried out for the exercise of freedom of expression and the right of information, while respecting privacy. "The legislator uses the term 'journalistic objectives' and at the same time refers implicitly to it in the same text, which may cause more confusion than to be interpreted as an effort to adhere to the rule that derogations and exceptions are brought within the strictly necessary . Moreover, the text reproduces the basic constitutional position that the right to freedom of expression and the right to seek, disseminate and receive information is not absolute and has limits to its exercise in the rights of others.
The rule of law is a fundamental constitutional principle enshrined in Article 4 of the Constitution. The principle of legality is the nucleus of the rule of law in the formal sense. The requirements for accessibility and comprehensibility, precision, unambiguity and clarity of laws, and hence for predictability, for their compliance with the principles and values of the basic law, are among its most significant dimensions. Particularly strict is the intolerance to formulate vague, ambiguous legal provisions when the legislator enters the sphere of the rights and freedoms of the individual. Another important aspect of the requirement of legality is that the law must clearly indicate to its addressees what is inadmissible - otherwise, this law will have a "chilling effect" on freedom of expression, because everyone would be far from the scope of the rule, to avoid different censorship. The ECtHR maintains in the Sunday Times judgment ( The Sunday Times v. United Kingdom, App . 6538/74, para. 49 , ) that a rule can only be regarded as law if it is formulated with sufficient precision to allow the individual to regulate his or her behavior. Also, the ambiguous provisions lend themselves to too broad interpretations by both the relevant public authorities and those whose behavior is governed. Therefore, they create the potential for abuse and can be applied by public authorities in hypotheses that are not related to their primary purpose. All this leads to unpredictability and legal uncertainty for the addressees of a requirement introduced in the general rule. These understandings and positions are shared and maintained by the Constitutional Court in its practice and are relevant to the provision challenged in the request in Art. 25h, para 2 LPPD - the provision does not meet the requirements for intelligibility, precision, unambiguity and clarity (Decision No. 9 / 1994; Decision No. 5/2000) . It sets out criteria that must be taken into account in view of the lawfulness of the processing of personal data for the purposes of para. for journalistic purposes. This provision is addressed to both personal data processors and the CPDP supervisory authority and the court. They should assess whether and to what extent a balance has been achieved in journalistic material, between freedom of expression and information and the protection of personal data. The Constitutional Court notes that both Directive 95/46 ( repealed ) and Regulation 2016/679 do not include a list of such mandatory criteria. To interpret the Member States' mandate provided for in Article 85 of Regulation a , in the sense of implying a positive obligation to establish by law abstract criteria ( in this case, inexplicably, non-exhaustively listed ) for balancing the two potentially conflicting rights, in the burden of media / journalists is tantamount to a significant change in the spirit and reason of this provision. It itself, by providing for exceptions and derogations to the general rules, is an expression of the idea of balanced regulation in the field of personal data protection so as to ensure that this right is in balance with other fundamental rights, in accordance with the principle of proportionality, with enhanced protection of the individual's privacy ( recital ( 4 ) of Regulation 2016/679 ) . The development of national legislation in the direction of the above view for the purposes of Article 85 makes it extremely difficult to further delineate state interference with regard to freedom of expression of the media / journalists. This would also be contrary to the position adopted in the ECtHR and the ECJ commented on in the case-law, that leading in balancing the right to the protection of personal data and the right to freedom of expression and information is their equal respect and the assessment of the specific circumstances of each is required. individual case of a real conflict between these rights by the respective jurisdiction.
The objective pursued by the legislator in pursuit of the mandate provided for in Article 85 of the Regulation - to obtain legislative authorization to reconcile the right to the protection of personal data with the right to freedom of expression and information, including for journalistic purposes and for the purposes of academic, artistic or literary expression is legitimate. The establishment of the balancing criteria developed in the case law - ECtHR ( cited in Decision of 10 October 2013 in Delfi AS v. Estonia, and pp . 64569/09 , para. 83; Verlagsgruppe News GMBH and Bobi, 2012) v Austria , pp . 59631/09 ; see also the cited Opinion of Advocate General Sharpston in Case C-345/17 Buivids , para. 62 et al. , in a legal rule, conflicts with the very nature of balancing as pragmatic an approach for resolving fundamental rights conflicts aiming at a rational and not formally right outcome. Moreover, these judicially derived criteria are not precisely followed by the contested provision, they are combined with other requirements, some of which may have been read out in various acts and documents of the Council of Europe or the EU and are not exhaustively listed in the light of the case - law cited above. In particular, item 10, paragraph 2, art. 25h LPPD, after points 1-9 set out certain provisions, contain the phrase "other circumstances relevant to the case", which enhances the responsibility of the media as a data controller, researchers and literary and artistic creators to consider, and to prove, different circumstances. The criterion "nature of personal data" (Article 25h , paragraph 2, item 1 of LPPD ) is unclear - if the delimitation of sensitive and other data is considered, for example, the term "categories" should be used, as contained in in the Regulation and in the LPPD. Until the adoption of Regulation 2016/679, the term "data nature" was used to differentiate personal data from others, but in the context of accelerated development of information and communication technologies, this is no longer an actual problem. In any case, the use of vague concepts for a wider range of addressees, including the media / journalists, makes it impossible for them to comply with this criterion . Incomprehensible, indeterminate and overlapping are the criteria "nature and nature of the statement , whereby the rights under para 1 are exercised " (art. 25h of para 2 item 4) and" purpose, content, form and consequences of the statement by which the rights under para 1 are exercised " (art. 255 of para. 2 vol.8). The nature of a statement is clarified and taken into account precisely in the way of interpreting the purpose, content and form of that statement. The ambiguity of individual criteria raises the problem of the full application of the so-called. " Journalistic exception ". In addition, we can hardly talk about "processing personal data for journalistic purposes" and assessing the nature of the information or assessing the consequences and compliance with the rights of other citizens in the so-called "live, live" broadcasts. Unclear criteria also mean that the CPDP has the unpredictable ( discretionary ) power to interpret them not necessarily in the public interest for pluralistic information about the policies and activities of government. In addition to being a public-law body formed with the involvement of the executive - the government, the CPDP has administrative coercive measures, which, in addition to unclear criteria, lead to an increase in power asymmetry with the media and journalism in the long run ( in this meaning Decision No 1 of 2005 ) . It should also not be overlooked that Article 17 of the Regulation provides for the so-called. The "right to be forgotten", which is seen as an "unprecedented form of censorship online" and even that is the greatest threat to freedom of expression. The ECJ practice illustrates this in the Google Spain case ( Case C ‑ 131/12 already cited , Google Spain , paras 81, 94, 100 ) . In exercising its supervisory function, the CPDP, as well as the courts, have always relied on the criteria of proportionality developed in the jurisprudence of the CPDP. The ECtHR and the ECJ, and the practice of the other national supervisory authorities in the matter under discussion is no different. Following these ECtHR and ECJ decisions is particularly important as they are not only resolutions to specific legal disputes, but serve to clarify and develop the rules introduced by the Convention and the Charter of EU Law , which together with national law The system guarantees a high level of protection of fundamental rights. The Constitutional Court found in its case-law that it was not appropriate to introduce a priori views but to leave the practice to work out its own criteria (Decision No 7/19 96 d). The Court emphasizes that the proportionality test applied by the courts does not produce lasting results and does not dictate ready-made answers to legal problems relating to specific conflicts between rights. This is understandable given that the proportionality test, respectively, the balancing act, operates in the context of the human rights era, where justified disagreement applies even to the highest values of the established legal order.
Referring again to the ECJ ruling in the case Schrems ( cited above Schrems v. Data Protection Commissioner, CLI: EU: C: 2015: 650) , the Constitutional Court recalls that where a measure imposing a restriction on the exercise of a fundamental right calls into question that right as such, that measure is incompatible with the Charter as it deprives a given right of its essence. Censorship is such a restrictive measure that affects the essential content of the right to freedom of expression and is therefore prohibited at the constitutional level ( art. 40, para . 1 ) . All censorship measures ( such as suspension and confiscation ) are an exception to the constitutionally established principle of freedom of the media and these restrictive measures should be followed, as indicated in decision No. 7/96. of the Constitutional Court, to be applied restrictively. In that judgment, the Court puts forward a number of other considerations in the same case, which merit consideration in the light of the subject-matter of the present case. First of all, it is emphasized that the hidden forms of censorship may in practice be a real threat to the effective exercise of the right to express and disseminate freely. In addition, noting that other acts of interference remain outside the constitutional text , the Court pays particular attention to legislative intervention, stating that " In the area where State legislative intervention is required, it must also cover the creation of mechanisms, to serve as a barrier against the intervention of both public authorities and third parties. " The right to the protection of personal data is a constitutionally protected value and is one of the strongest grounds for restricting the right to freedom of expression and information. The abstract open wording of fundamental rights in the constitutions leaves room for the legislator to share and constrain them, including the right to freedom of expression and information and "communication rights" as a whole. Constitutionally the legal limit ( limit of restriction ) for legislative entry into this fundamental right is its own substantive content - it is not subject to political renegotiation through current legislation. Affecting the means of exercising 'communication rights' - the media / journalism - also threatens the right to freedom of expression and the rights associated with it in one set of interests. The requirement for a priori application of the unclear criteria introduced by Article 25h, paragraph 2 of the LPPD ( as a rule ) leads to self-censorship and thus a disproportionate entry into the equal rights of the constitution, along with the inviolability of the individual (Article 32, paragraph 1). of the Basic Law ) , the right to freedom of expression and the right to information ( Articles 39 and 41 of the Basic Law ) . By violating the measure dictated by the urgent need to protect the privacy of personal data, the legislative restrictive measure ultimately impedes the attainment of the objectives of journalistic activity and the function of the media in a democratic society. Without regulation, the state would not be able to fulfill its positive obligations to guarantee fundamental rights. However, any regulation that goes beyond the social need for it is contrary to the logic of fundamental rights as a defense of the autonomous sphere of the individual against the state ( in this sense , Constitutional Court Decision No 2/2006 ) . In the present case, the mandate granted of the Member States, with the provision in Article 85 of Regulation 2016/679, the national legislator aims to find a reasonable way out of the conflict between the right to protection of personal data and the right to freedom of expression and information. This means, first of all, that the national legislator should take into account that the balancing act is a constitution-based approach and comply with the established balancing mechanism through the general clause on limitation of fundamental rights in Article 57, paragraph 2, and take into account the specific restrictions provided for therein as regards freedom of expression and information. The Constitutional Court in Decision No. 7/1996. explicitly notes this mechanism established by the constitutional legislator, referring to the special structure of Article 39 of the Basic Law. In it, the right of opinion is restricted because of another competing right - the right to personal dignity, honor and goodwill, which according to Art. the former is also constitutionally protected. The undertaken restriction of the right to freedom of expression and information, through the unclear criteria introduced in Article 25h, paragraph 2 of LPPD, goes beyond what is necessary to defend the other protected value - the inviolability of the the individual in connection with the processing of their personal data. As a consequence, this disproportionate measure also leads to a “contraction” of the mechanism aimed at balancing the two rights under Article 85 of Regulation 2016/679, which is reflected in the exemption from the general rules of the processing companies provided for in Article 25h, paragraph 3. personal data for the purposes of para 1 of art. 25h of LPPD. As already noted, the purpose of the Regulation is to reconcile the right to the protection of personal data and the right to freedom of expression and information in accordance with the principle recognized in modern constitutionalism for the equal respect of all fundamental rights. The impugned provision in Article 25h, paragraph 2 approaches in its intensity to the constitutional limit of restriction of freedom of expression and information, which defines it as disproportionate for the legitimate purpose pursued, which is why it is also constitutionally intolerable . The Constitutional Court is consistent in its position that where the ambiguities or uncertainties of a legal provision are sufficiently serious and call into question its ability to regulate the public relations which it is called upon to settle, then such legal provision is unconstitutional on the ground of breach of the rule of law (Decision No 9/1994). ; Answer No. 5/2000). This is exactly the same as the legal provision under the present request under Article 25h, paragraph 2 of the LPPD.
All this leads to a significant deviation from the established in the Basic Law, in the cited practice of the ECtHR and the ECJ, as well as in the practice of the Constitutional Court, the beginning of equal respect for fundamental rights , which is a leading moment in the balance between them. In essence, such an approach by the legislator is a step towards building a hierarchical order of fundamental rights and freedom of expression may be far beyond the dignity and goodwill or protection of public order and morality. Such a hierarchy, however, runs counter to international treaties and to the national constitutions of modern democratic rule of law, which establish the equality of rights and do not permit the permanence of restrictive measures, since this would be tantamount to rejecting them.
In addition, the Constitutional Court finds that the criteria introduced in the provision of Article 25h, paragraph 2 of the LPPD are not a necessary legislative measure to reconcile the right to protection of personal data and freedom of expression and information. The standards for the necessary measure are outlined in the case law of the ECtHR and the ECJ, as well as in the jurisprudence of the Constitutional Court - Decision No. 7/1996. and other judgments where the court ruled incidentally on the question of the conformity of a restrictive measure with the principle of proportionality as a rule of law dimension ( Judgment No 20 of 1998; Decision No 1 of 2002; Decision No 5 of 2003). ; Decision No. 5 of 2005, etc. ) . It is neither necessary nor sparing in the context of the processing of personal data for journalistic purposes. This measure is also unnecessary because the obvious alternative, with experience and practice and far less restrictive, has been ignored. - to strengthen self-control in the media industry, including by adopting codes of conduct developed jointly by media organizations and the CPDP, as is the current trend in democratic countries. It is precisely within such codes of conduct for journalists that issues such as the use of personal data from personal forms of communication in the high public interest and the importance of public debate information should be addressed. The Codes are an expression of the public negotiation of values in journalism as a profession that owes a debt to society and carries the full burden of fulfilling it responsibly without creating deliberate pseudo-journalistic misinformation and not serving as a tool for eroding media confidence. Regulation 2016/679 explicitly provides that these types of documents are intended to contribute to its correct implementation, taking into account the specific characteristics of the various processing data ( Chapter IV , Section 5, Art . 40 ) .
The Constitution contains the highest values which cannot be rejected or altered in their essence by the legislator, because they are the foundation of the established legal order. These higher values are an integral part of constitutional imperatives, for compliance with which all laws should be considered. It is the task of the Constitutional Court to defend the stability of the legal system based on constitutional imperatives and to protect it, including legislative threat.
Because the provision in Article 25h, paragraph 2 of the LPPD, with the unclear criteria of legality introduced by it, creates unpredictability and legal uncertainty and limits the right to freedom of expression and information disproportionately to the goal pursued, in the context of journalistic expression, the Constitutional the court finds that this provision should be declared unconstitutional on the grounds of contradiction with Article 4, paragraph 1 of the Constitution.
By declaring the provision in Article 25h, paragraph 2 of the LPPD as unconstitutional, it excludes any possibility that it may actually collide with Article 19 of the Universal Declaration of Human Rights, Article 19 of the ICCPR and Article 10 of the CPPPC . According to the provision of Article 151, paragraph 2, sentence two, of the Constitution, the declared unconstitutional act shall not apply from the day of the entry into force of the decision of the Constitutional Court. International treaties ratified, promulgated and in force are part of the domestic law of the country within the meaning of Article 5, paragraph 4 of the Constitution and are directly applicable. Therefore, the Constitutional Court does not find it necessary to assess the conformity of the disputed provision in Article 25h, paragraph 2 of the LPPD with the provisions of the above mentioned international treaties.
Failure to enforce an unconstitutional rule will not impede the full implementation of Regulation 2016/679, since this act of secondary EU law is directly applicable and most of its provisions have direct effect. It contains balancing of the two rights provisions , which is why national courts can follow the current case law of the ECJ, including in relation to the relevant case law of the ECtHR, and, if necessary, use the preliminary ruling proceedings under Article 267 TFEU. In this way, they can also effectively fulfill their role in the courts of the EU judiciary, which contributes to the unity of the PES and to the stability of the Union itself.
Led by the above, the Constitutional Court
REFERENCE:
Declares as unconstitutional the provision of Article 25h, paragraph 2 of the Law on Protection of Personal Data ( established by § 26 of the Law on Protection of Personal Data, promulgated SG, issue 17 of February 26, 2019 ) .
