Persónuvernd - 2020082249
|Persónuvernd - 2020082249|
|Relevant Law:||Article 85 GDPR|
Article 39 Act 90/2018 on Data Protection and the Processing of Personal Data
Article 6 Act 90/2018 on Data Protection and the Processing of Personal Data
Article 71 Constitution of the Republic of Iceland
Article 73 Constitution of the Republic of Iceland
Article 26 Act 38/2011 on Media
|National Case Number/Name:||2020082249|
|European Case Law Identifier:||n/a|
|Original Source:||Persónuvernd (in IS)|
The Icelandic DPA (Persónuvernd) considered that it was not competent to rule in a binding manner as to whether processing of personal data by a media entity for journalistic purposes breached the Icelandic Act 90/2018 or the GDPR. Instead, it considered that a court should balance the right to freedom of expression and the right to privacy.
English Summary[edit | edit source]
Facts[edit | edit source]
As the Icelandic DPA receives complaints on media coverage of individuals on a regular basis, it has decided to issue an opinion on the relationship between freedom of expression of the media and the privacy of individuals. This new opinion comes as an update of previous opinions regarding privacy and the media issued in the context of older laws.
Holding[edit | edit source]
The Icelandic DPA outlined the importance of media and freedom of expression in a democratic society. It went on to say that the media must also guarantee democratic principles, including the respect for rights such as the right to privacy.
The DPA outlined that freedom of expression, as well as the right to privacy, were enshrined in the Icelandic Constitution. The right to freedom of expression can be found under Article 73, whilst the right to privacy falls within Article 71 of the Constitution. Elaboration on the latter Article can be found in the national Act 90/2018 and the GDPR.
The Icelandic DPA outlined that Article 6 Act 90/2018 provides for the harmonization of the right to privacy and freedom of expression. The Article is based on Article 85 GDPR which obliges member states to reconcile data protection law and freedom of expression in national law. Article 6 Act 90/2018 establishes that only Article 5(1)(a) and (d), Articles 24, 26, 28, 29, 32, 40-43 and 82 GDPR will apply in the context processing for journalistic purposes.
The Icelandic DPA then went on to describe its tasks pursuant to Article 39 Act 90/2018. This includes deciding whether there is a breach of the Act or the GDPR on the basis of complaints made. However, the DPA does not consider itself to be competent to assess the boundaries between the constitutional rights to privacy and freedom of expression where a media entity is concerned. It deems that a court is better place to make such decisions. Therefore, the DPA does not have jurisdiction to determine whether an individual has gone beyond it constitutional right to freedom of expression and thereby breached another’s right to data protection. The DPA mentioned that depending on the fact, it could rule on the legitimacy of processing where the data controller is a non-media entity (individual or private company).
In any case, parties processing personal data for journalistic purposes must comply with Article 5(1)(a) and (d), Articles 24, 26, 28, 29, 32, 40-43 and 82 GDPR. The Iceland DPA then went on to outline what certain of these provisions entailed (such as Article 5(1)(a) and (d)) for journalists. It notably highlighted that under Article 26 Media Act 38/2011, journalists have a duty to respect human rights including the right to privacy.
The Icelandic DPA also provided some suggestions as each case is to be determined on a case by case basis. The sensitivity of the personal data is significant. Additionally, the status of the person in question (whether they are a public figure, for example) should be considered. This is particularly important as Article 73 of the Constitution on freedom of expression has been interpreted broadly by Icelandic courts where it concerns public figures. The context of the publication must be considered before publishing personal information.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.