Private journalistic activities – violation of personal data protection law?

In a hitherto little-discussed judgement handed down by the European Court of Justice (ECJ) in February 2019, the Court employed a broad interpretation of the term “journalistic activity” and stated in Case C–345/17 that, for example, the filming of police officers during the performance of their official duties and the subsequent publication of the video on YouTube may be considered a journalistic activity within the meaning of Article 9 of the Data Protection Directive (Directive 95/46/EC). This broad interpretation that non-professional journalistic research and publications are also covered by the concept of “journalistic activity” will undoubtedly also apply under the regime of the now applicable Article 85 of the General Data Protection Regulation (GDPR).

Given the evolution and proliferation of the internet, private individuals can now readily engage in “investigative journalism” at little expense. They can also reach a large audience in the process. From a data protection perspective, however, the question arises as to whether such private “journalistic activities” (for example, in the case of articles that “uncover” [alleged] “animal factories” or [alleged] “political machinations”) are permissible at all under data protection law. 

According to Article 85 of the GDPR, Member States shall ensure that the protection of personal data is reconciled with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

In Austria, there are very limited exceptions for journalistic activities from the scope of the GDPR. According to Section 9 of the Austrian Data Protection Act, only media companies and media services enjoy what is referred to as a “media privilege.” Thus, for example, publishing an article or film on a private blog is not covered by media privilege and is therefore subject to the GDPR.

However, this does not mean that (other) journalistic activities violate the GDPR per se, or that only media companies and services may research and publish personal data. Rather, the respective journalistic activity must be considered in relation to the GDPR. In order to argue the lawfulness of data processing for the purpose of the journalistic activity, Article 6.1.f of the GDPR could be applied. According to Article 6.1.f of the GDPR, processing shall be lawful where it is necessary to protect the legitimate interests of the controller (the “private journalist”), except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject (i.e. in particular privacy). In each specific case, the “private journalist” would have to argue that their freedom of expression and information outweighs the data subject’s interests and right to privacy. According to media reports, the producers of the “Ibiza video” are likely to argue along similar lines.

In summary, therefore:

• research and the findings of research published by private individuals may also constitute “journalistic activity”;
• private journalistic activity is not subject to “media privilege” as defined in Section 9 of the DPA;
• private journalistic activities therefore fall under the GDPR and Austrian Data Protection Law (DSG), under which data processing is only lawful if the rights of the private journalist and the public to freedom of expression and information outweigh the data subject’s interests, in particular their right of privacy;
• it remains to be seen whether Section 9 of the DSG as amended complies with the requirements of Article 85 of the GDPR; there are good reasons to believe that Section 9 of the DSG is too narrowly defined;
• in any case, restricting “media privilege” exclusively to media companies and services is also constitutionally questionable.