Analysis of the article according to derogation categories in EU Member States

In order to analyse this study case, a member state per derogation was chosen to do so in light of the letter of the law applicable in that jurisdiction, which are Croatia (a) 0), Ireland (b) 0.83), Cyprus (c) 0.67), Estonia (d) 0.5), Italy € 0.83) and Portugal (f) 0.17:

Table 6: Member States and the text of the derogations to be analysed in the study case

EU Member State

Type of Derogation (in accordance with

Table 3)

National Legislation

Letter of the Law

Croatia (a) 1 Implementing

Act of the General Data

90 BRANDEIS, Louis and WARREN, Samuel D.; The right to privacy; Harvard Law Review, Nr. 4; 1890;

pg. 196.

91 United Kingdom Data Protection Act, 2018; available on https://www.legislation.gov.uk/ukpga/2018/12;

accessed on 10/04/2022; Point 5 Nr. 2.

92 Ibid., Point 5 Nr. 3.

47 Protection

Regulation

Ireland (b) 0.83 (i) Irish Data

Protection Act

Art. 43: “ (1) The processing of personal data for the purpose of exercising the right to freedom of expression and information, including processing for journalistic purposes or for the purposes of academic, artistic or literary expression, shall be exempt from compliance with a provision of the Data Protection Regulation specified in subsection (2) where, having regard to the importance of the right of freedom of expression and information in a democratic society, compliance with the provision would be incompatible with such purposes.

(2) The provisions of the Data Protection Regulation specified for the purposes of subsection (1) are Chapter II (principles), other than Article 5(1)(f), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries and international organisations), Chapter VI (independent supervisory authorities) and Chapter VII (cooperation and consistency).

(3) The Commission may, on its own initiative, refer any question of law which involves consideration of whether processing of personal data is exempt in accordance with subsection (1) to the High Court for its determination.

(4) An appeal shall, by leave of the High Court, lie from a determination of that Court on a question of law under subsection (3) to the Court of Appeal.

(5) In order to take account of the importance of the right to freedom of expression and information in a democratic society that right shall be interpreted in a broad manner.

Cyprus (c) 0.67 Law 125(I) Of

2018 - Law Providing For The Protection Of Natural

Art. 29 Nr. 1: “The processing of personal data or special categories of personal data or personal data relating to criminal convictions and offenses, which is carried out for journalistic or academic purposes or for purposes of artistic or literary

Chapter V– Real Life implications

48 Persons With

Regard To The Processing Of Personal Data And For The Free Movement Of Such Data

expression, is permitted, provided that those purposes are proportionate to the aim pursued and respect the essence of the rights as set out in the Charter of Fundamental Rights of the European Union and in the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), which was ratified by the ratifying law on the European Convention for the Protection of Fundamental Rights and in Part II of the Constitution.

Estonia (d) 0.5 Estonia Personal

Data Protection Act (2018) and Personal Data Protection Act (Implementation Act) (2019)

Nr 4 (PDPA): “Personal data may be processed and disclosed in the media for journalistic purposes without the consent of the data subject, in particular disclosed in the media, if there is public interest therefor and this is in accordance with the principles of journalism ethics. Disclosure of personal data must not cause Excessive damage to the rights of any data subjects.”

Italy (e) 0.33 Personal Data

Protection Code (denoting the existence of Deontological rules relating to the processing of personal data in the exercise of journalistic activity

published pursuant to art.

20, paragraph 4, of Legislative

Decree 10

August 2018, n.

101 - 29

November 2018)

Section 102: “2. The rules of conduct referred to in paragraph 1 shall set out appropriate safeguards for the rights and freedoms of the data subject, and in particular: a) rules based on fairness and non-discrimination in respect of users, to be abided by also in communication and dissemination of data, pursuant to the provisions of this Code and the Regulation that are applicable to the processing of data for journalistic purposes or else for

publication of papers, essays and other intellectual works also in terms of artistic expression;” and Section 136: “1. This Title shall apply in pursuance of Article 85 of the Regulation to processing operations: a) that are carried out in the exercise of the journalistic profession and for the sole purposes related thereto; b) that are carried out by persons included either in the list of free-lance journalists or in the roll of trainee journalists as per Sections 26 and 33 of Law No 69 of 03.02.63; or c) that are aimed exclusively at publishing or circulating, also occasionally, articles, essays and other intellectual

49 works also in terms of academic, artistic or literary expression.”

Art. 6 of Deontological rules relating to the processing of personal data in the exercise of journalistic activity: “1. The disclosure of news of significant public or social interest does not conflict with respect for the private sphere when the information, even detailed, is essential due to the originality of the fact or the relative description of the particular ways in which it occurred, as well as the qualification of the protagonists.”

Portugal (f) 0.17 (i) Law 58/2019 of August 8^th – Implementation Law

Art. 24: 1 - The protection of personal data, under the terms of the GDPR and this law, does not prejudice the exercise of freedom of expression, information and the press, including the processing of data for journalistic purposes and for the purposes of academic, artistic or literary expression.

2 - The exercise of freedom of information, especially when revealing personal data provided for in paragraph 1 of article 9 of the RGPD and in article 17 of this law, must respect the principle of human dignity provided for in the Constitution of Portuguese Republic, as well as the personality rights enshrined therein and in national legislation.

3 - Treatment for journalistic purposes must respect national legislation on access to and exercise of the profession.

4 - The exercise of freedom of expression does not legitimize the disclosure of personal data such as addresses and contacts, with the exception of those that are generally known.”

a) Croatia

The constitution of Croatia, revised in 2013, has on its writing several provisions regarding data protection. On the matters of freedom of expression, it is present in its art. 38, reading

Chapter V– Real Life implications

50

“Freedom of thought and expression shall be guaranteed. Freedom of expression shall specifically include freedom of the press and other media of communication, freedom of speech and public expression, and free establishment of all institutions of public communication. Censorship shall be forbidden. Journalists shall have the right to freedom of reporting and access to information.”⁹³, as seen to encompass journalistic activities as an essential part of the exercise of freedom of expression.

Article 35 protects one’s private life, reading “Everyone shall be guaranteed respect for and legal protection of personal and family life, dignity, reputation and honour”⁹⁴, while arts 34 and 36 enunciate the inviolability of one’s home regarding searches, and the privacy of correspondence, respectively.

As shown in the table above, they have not adopted a journalistic derogation within their GDPR implementing legislation.

Regarding this case, had it been published on a Croatian journal, it would raise no issues, since it is a constitutional right that no censorship is allowed.

On a more critical note, and given the writing of Art. 85 Nrs. 1 and 2, should they have not opted for a complete derogation, in light of art. 38 of the constitution, instead of no mention at all?

b) Ireland

The Irish constitution, revised in 2019, adopted in its art. 40 Nr. 6 (1) i) that “The State guarantees liberty for the exercise of the following rights, subject to public order and morality: The right of the citizens to express freely their convictions and opinions. The education of public opinion being, however, a matter of such grave import to the common good, the State shall endeavour to ensure that organs of public opinion, such as the radio, the press, the cinema, while preserving their rightful liberty of expression, including

93 Art. 38 of the Croatian Constitution

(https://www.constituteproject.org/constitution/Croatia_2013?lang=en).

94 Ibid., Art. 35.

51 criticism of Government policy, shall not be used to undermine public order or morality or the authority of the State.”⁹⁵, as their stance on the freedom of expression.

A similar provision to Croatia has been made regarding the inviolability of home but none regarding privacy nor privacy of correspondence.

Article 43, above stated in the table, shows the derogation adopted by Ireland, which transcribes in its Nr. 2 what is stated in Art. 85 of the GDPR, however the only debate noted was regarding the protection of journalistic sources and notes⁹⁶.

The Irish chosen derogation is not a complete derogation as it excludes Art. 5 Nr. 1 f) and Chapter IX from the derogation itself.

Regarding this case, and since their stance was the one of the GDPR, this would pose no issue since, in this instance, these Chapters would be incompatible with freedom of expression and of information, meaning that this article would comply with the GDPR and the Irish Data Protection Act.

c) Cyprus

The Cypriot constitution, revised in 2013, has the right to a private life written in Art. 15, in Art. 16 the inviolability of home and of correspondence, except when duly justified by law or warrant (Nr. 2) and Art. 17 the secrecy of correspondence except in situations falling within its Nr. 2.

Article 19 Nr. 1 of the Cypriot implementation law allowed this derogation as long as it is proportional, having this topic been studied in Chapter II of this dissertation, as well as assuring safeguard of the rights in CFRUE and EDHR, while, simultaneously, in its Nr. 2 stating that Arts. 14 (information to be provided where personal data have not been

95 Art. 40 Nr. 6, (1) i) of the Irish Constitution

(https://www.constituteproject.org/constitution/Ireland_2019?lang=en).

96 Seanad Éireann debate - Tuesday, 6 Mar 2018, Vol. 256 No. 9 (available on:

https://www.oireachtas.ie/en/debates/debate/seanad/2018-03-06/9/?highlight%5B0%5D=data&highlight%5B1%5D=protection&highlight%5B2%5D=bill , accessed 01/08/2022).

Chapter V– Real Life implications

52 obtained from the data subject) and 15 (right of access by the data subject) will apply as long as it does not “impair the right to freedom of expression and of information and journalistic secrecy”⁹⁷.

This derogation falls within category c) of the categorization provided by Dr. David Erdos as it needs to meet specific criteria, that in this situation is the respect for the rights enunciated in the binding texts above mentioned.

Given the writing of Art. 19 Nrs. 1 to 3 of the Cypriot constitution, that read “1. Every person has the right to freedom of speech and expression in any form; 2. This right includes freedom to hold opinions and receive and impart information and ideas without interference by any public authority and regardless of frontiers; 3. The exercise of the rights provided in paragraphs 1 and 2 of this Article may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary only in the interests of the security of the Republic or the constitutional order or the public safety or the public order or the public health or the public morals or for the protection of the reputation or rights of others or for preventing the disclosure of information received in confidence or for maintaining the authority and impartiality of the judiciary”. With due knowledge of the relevant principles of the ECHR and the CFRUE, the article could have been published as it was, as it would be in accordance with the aforementioned and the constitution and, based on a direct and unbiased interpretation, would be in compliance with the constitution as well.

d) Estonia

The Estonian constitution⁹⁸, revised in 2015, protects freedom of expression in Art. 45, reading “Everyone has the right to freely disseminate ideas, opinions, beliefs and other information by word, print, picture or other means. This right may be restricted by law to protect public order, morals, and the rights and freedoms, health, honor and good name of others. This right may also be restricted by law for state and local government public

97 Art. 29 Nr. 2 in fine of the Cyprus Constitution

(https://www.constituteproject.org/constitution/Cyprus_2013?lang=en).

98 Available on https://www.constituteproject.org/constitution/Estonia_2015?lang=en, accessed 01/08/2022.

53 servants, to protect a state or business secret or information received in confidence, which has become known to them by reason of their office, and the family and private life of others, as well as in the interests of justice. There is no censorship.”, as well as having the right to privacy protected under Art. 26.

On the matters of the derogation, and as showed in the above table, is based on the existence of public interest and not causing “excessive damage to the rights of any data subject”⁹⁹. Would, and/or should, a person of this status be considered of being of public interest? This would have to be through the assumption of celebrities counting as par excellence figures or not.

As there is no elaboration on the public interest in the PDPA not in the constitution, this could be interpreted in one of two ways:

1) Celebrities are to be considered as par excellence figures, in which their behaviour could be of public interest, or;

2) They are not to be considered par excellence figures, in which they should be granted an approximation as close as possible to any private citizen, meaning their behaviour would not be of public interest.

Whether it be through 1 or 2, if this was to be proven that it would have caused excessive damage to the person’s life, it would have to have been rectified.

With acknowledgment of the above, were it to be seen from analysis 1, and mentioning that despite not being an impossible task to prove excessive damage, it is still not easy, this could have been published due to their status. Were it be seen through stance 1, it could have been published as is due to their status, were it to be seen through stance 2, then it would most likely have to be changed before publishing.

e) Italy

The Italian constitution, revised in 2020, states in its Art. 21 that “Anyone has the right to

99 Art. 4 in fine of the Estonia Personal Data Protection Act

(https://resources.law.cam.ac.uk/cipil/documents/GDPR_English_From_Official_Bodies/Estonia%20-%20GDPR%20Implementation%20Act.pdf).

Chapter V– Real Life implications

54 freely express their thoughts in speech, writing, or any other form of communication. The press may not be subjected to any authorisation or censorship. (…) Publications, performances, and other exhibits offensive to public morality shall be prohibited. Measures of preventive and repressive measure against such violations shall be established by law”¹⁰⁰, noting that during their second-generation law, they had established a derogation that favoured journalism.

It is important to highlight that the Legislative Decree Nr. 196 of June 30th 2003101, in Annex A regarding the processing of data regarding the journalistic activity, it included a provision in its Art. 3 that reads “Protection of a person's residence and other private places of abode also extends to health care, custodial or rehabilitation institutions in compliance with the relevant legislation and with the appropriate use of invasive techniques”¹⁰², as well as having the deontological precepts made available by the Italian Journalism Society¹⁰³. Had this article been published in Italy, and in line with the above mentioned and the provisions in table 6, under section 136 of the Personal Data Protection Code, this would fall under line a) as it was carried out in the exercise of the journalistic profession.

Now on the matters of Art. 6 Nr.1 of the deontological rules, should this fall under

“significant public or social interest”¹⁰⁴?

Once again, if it were to fall under the par excellence category, that would be able to have an impact on society, were it not then it would fall outside of this scope.

Notwithstanding, if one was to follow a literal interpretation of the aforementioned article, highlighting the passage that reads “ (…) does not conflict with respect for the private sphere when the information, even detailed, is essential due to the originality of the fact or the relative description of the particular ways in which it occurred, as well as the

100 Italian Constitution, available on https://www.constituteproject.org/constitution/Italy_2020?lang=en , accessed on 02/08/2022.

101 Italy’s previous data protection code, available on http://www.privacy.it/archivio/privacycode-en.html.

102 Ibid., Art. 3 Nr. 1.

103 Available on https://www.odg.it/etica-le-regole, accessed 02/08/2022.

104 Deontological rules relating to the processing of personal data in the exercise of journalistic activity published pursuant to art. 20, paragraph 4, of Legislative Decree 10 August 2018, n. 101, 29/11/2018;

available on https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9067692, accessed on 02/08/2022.

55 qualification of the protagonists”¹⁰⁵, although it mentions in its Nr. 2 “The private sphere of known persons or persons who exercise public functions must be respected if the news or data have no bearing on their role or public life”¹⁰⁶, and with due regards to Annex A of the code of practice on the protection of one’s residence, the photographs and information of a person’s place of residence could easily be interpreted as non-essential to the article itself, however this could also be interpreted as censorship, which is prohibited by Art. 21 of the constitution, so the article could have been published as is.

On a critical note, and the reason behind quoting Art. 6 Nr. 2, is that since there is no provision nor stance taken regarding celebrities, once again as par excellence, the writing of this article could very easily be rewritten by changing ‘on their role or public life’ to their role on society, encompassing both public figures and people who are known to the public’s private lives more broadly.

f) Portugal

The Portuguese constitution, last revised in 2005, protects in its Art. 37 the freedom of expression and of information, prohibiting censorship in its Nr. 2, Art. 38 established the freedom of press and of the media, as well as setting in Art.39 an independent administrative body to regulate the media. It also proclaims in Art. 26 Nr. 1 that “Everyone shall possess the right to a personal identity, to the development of their personality, (…) to a good name and reputation, to their likeness, to speak out, to protect the privacy of their personal and family life, and to legal protection against any form of discrimination”¹⁰⁷. When Portugal began drafting the GDPR national implementation law, a public consultation was carried out on behalf of the Working Party and the Journalists Union

105 Ibid., Art. 6 Nr.1.

106 Ibid., Art. 6 Nr. 2.

107 Art. 26 Nr. 1 of the Portuguese Constitution, available on https://www.constituteproject.org/constitution/Portugal_2005?lang=en , accessed on 03/08/2022.

Chapter V– Real Life implications

56 provided their founded opinion, also known as Deliberation 2019/494¹⁰⁸, on the GDPR’s position regarding journalism. Some key points that should be highlighted from it are:

- They acknowledged that people are increasingly sharing their personal information online¹⁰⁹;

- That journalists should fight censorship and restrictions to sources of information or diminish the right of freedom of expression and to inform, even being mandated to report situations where that happens;

- It is part of the Journalist Statutes, in Art. 14 Nr.2 h), that “Preserve, except for reasons of undeniable public interest, the reserve of intimacy, as well as respect for privacy according to the nature of the case and the condition of the people”¹¹⁰;

- That the written after Art. 5 of the GDPR should not be applicable to journalists due to being in direct conflict with European legislation on the right to freedom of expression and information and jurisprudence by the Courts of Justice;

- That is of the journalist’s discretion what information to process and use, as the processing for journalistic purposes should constitute a public interest.

The Portuguese implementation law is the one that shows the most pondering throughout, as even before this implementation law was finalised it included the aforementioned opinion from the Journalists’ Union, shows compliance to the Treaties and Conventions, as well as to Art. 85 of the GDPR, but it takes it one step further, in a good direction, to limit it to the extent of addresses and contacts that are not publicly known.

108Available on

https://app.parlamento.pt/webutils/docs/doc.pdf?path=6148523063484d364c793968636d356c6443397a615 8526c6379395953556c4a5447566e4c304e505453387851304644524578484c305276593356745a57353062 334e4a626d6c6a6157463061585a685132397461584e7a595738764e546b774d4456694d6a4174596d5a6d4 d5330304d6a6b7a4c574a6c5a445174596a41784d47497a4e7a6332596a46694c6e426b5a673d3d&fich=590 05b20-bff1-4293-bed4-b010b3776b1b.pdf&Inline=true, accessed on 07/08/2022.

109 Portuguese Journalist Statute, Law Nr. 1/99 of January 1st, available on https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=136&tabela=leis, accessed on 10/08/2022.

110 Portuguese Journalist Statute, Law Nr. 1/99 of January 1st, available on https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=136&tabela=leis, accessed on 10/08/2022;

Own translation.