CHAPTER IX
Provisions relating to specific processing situations
Author: Alexander Dix
- Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
- For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
- Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.
A. Preliminary remarks
The right to informational self-determination or data protection is to be seen as a basic precondition for communicative autonomy[1] and as fundamental right to communicative development.[2] It is closely linked to and not in principal conflict with other essential communicative rights such as freedom of speech and freedom of information.[3] None of the fundamental rights mentioned above automatically takes precedence over any of the other rights (→ mn. 18). They have in common that they shall facilitate communication in a free society[4] and therefore do not only protect individual interests but simultaneously the public good. While the freedom of the media is constitutive for a democratic polity and according to the jurisprudence of the European Court of Justice is an essential basis for a democratic and pluralistic society on which the European Union is based (Art. 2 TEU),[5] the right to informational self-determination/data protection – as the German Constitutional Court has put it – beyond individual chances of development secures the functioning of “a democratic community based on the citizens’ options to act and to participate”.[6] Freedom of information in turn is a prerequisite for exercising the right to informational self-determination as well as the right to free speech. (→ Art. 12 mn. 3).[7] Nevertheless the relationship between informational self-determination and data protection on one hand and the other essential fundamental communicative rights, in particular freedom of speech and freedom of information is not without tensions, especially if different subjects of fundamental rights are involved. Meanwhile there is international consensus that the rules on data protection cannot be applied without restrictions on those forms of data processing which take place in the context of free speech and freedom of information.[8] Since there are as yet no common European standards in this contentious field, the Regulation has obliged the Member States to find an adequate balance between the fundamental rights concerned.[9] The European Commission in its first evaluation of the GDPR noted persisting differences in the laws of Member States concerning the reconciliation of the right to the protection of personal data with freedom of expression and information, and the proper balancing of these rights and announced that it will continue its assessment of national legislation.[10]
B. Legislative history
As early as 1970 the Parliamentary Assembly of the Council of Europe had stressed in a resolution on the relationship between the right to privacy and freedom of expression that the exercise of free speech must not destroy the existence of privacy.[11] Convention No. 108 of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data of 1981 allows for derogations from most material provisions of data protection if provided for by the law of parties to the Convention and if necessary in a democratic society to protect inter alia the rights and freedoms of others.[12] However, derogations from the provisions concerning data security[13] are not allowed for under this Convention.
Directive 95/46 of the European Union in Art. 9 obliged Member States to provide for derogations and exemptions from certain provisions of the Directive for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic and literary expression, but only if they are necessary to reconcile the right to privacy with the rights governing freedom of expression.[14]
The Commission had drafted its initial proposal very much following the model of Art. 9 of the Directive although it went beyond this provision in proposing to allow for derogations and exemptions from the provisions regarding codes of practice (Art. 40 and 41). The Parliament proposed to delete the restriction to journalistic, artistic and literary purposes. The Council on the other hand pleaded to retain these restrictions and to extend the provision to academic purposes of processing. Furthermore the Council proposed to split the provision into two paragraphs the first of which should oblige the Member States to reconcile the right to protection of personal data with freedom of expression and freedom of information. In a new second paragraph Member States should be called upon to provide for specific exemptions and derogations from all substantial provisions of the Regulation regarding the processing of personal data for these purposes as far as this is necessary to reconcile the right to privacy with the freedom of expression and information. This was accepted during trilogue. The Council proposal to state in a Recital that privacy should generally take precedence over the user’s interest in information was not accepted.[15]
C. Structure and scope of the provision
The normative structure of Art. 85 shows little plausibility. Para. 1 obliges the Member States to adopt legal rules by which the right to the protection of personal data “pursuant to this Regulation” is reconciled with the right to freedom of expression and freedom of information “including processing” for specific privileged purposes. Para. 2 again provides for an obligation of the Member States to legislate insofar as exemptions and derogations are necessary to reconcile the right to data protection with freedom of expression and information. This obligation – in contrast to para. 1 – concerns exclusively the processing for privileged purposes.[16] Therefore paras. 1 and 2 of Art. 85 have overlapping areas of application as far as journalistic, academic, artistic and literary purposes are concerned. The obligation under para. 2 – in contrast to para. 1 – is restricted by the explicit conditions that exemptions and derogations have to be necessary to reconcile data protection and freedom of expression and information. However, it would run counter the equal ranking of the fundamental rights to data protection, freedom of expression and information if Member States would provide for unnecessary exemptions and derogations. This follows also from the term “to reconcile”. If the competing fundamental rights are not in conflict in certain circumstances then there is no need for legislation to reconcile them. Therefore blanket exemptions to and derogations from the Regulation in the field of journalism, academia, arts and literature are not in line with Union law.[17] On the other hand the scope of Art. 85 para. 1 goes beyond that of para. 2 in that it includes, but is not restricted to the processing for journalistic, academic, artistic and literary purposes. The question therefore arises whether Member States in Art. 85 para. 1 are called upon to reconcile data protection with freedom of expression and information areas which are not linked to the purposes expressly mentioned in this provision. This is particularly relevant to non-journalistic and other expressions within the scope of the Regulation, i.e. outside the household exemption (Art. 2 para. 2 lit. c). The answer to this question is negative for a number of reasons.[18] For once the proposal by the European Parliament to provide for a duty of the Member States to balance in general data protection and freedom of expression and information independently of any specific purposes of processing was not adopted. In addition the duty to notify to the Commission under Art. 85 para. 3 which is limited to provisions under Art. 85 para. 2 would make little sense. Had the Member States an additional and independent obligation to regulate under Art. 85 para. 1 the duty to notify would have to apply to these regulations as well (→ mn. 27).[19] Finally a general mandate for the Member States to balance data protection with freedom of expression and information also in the area of non-journalistic expressions would run counter the aim of European harmonisation of data protection and would on the contrary lead to a completely heterogeneous development of legislation in this crucial field.[20] Despite its misleading drafting Art. 85 para. 1 does not oblige the Member States to clarify by legislation the relationship between data protection and freedom of expression in general if there are already civil law provisions or (as e.g. in Germany) jurisprudence by national courts on this question in place. The separate relevance of Art. 85 para. 1 in relation to para. 2 lies in the necessary adaptation of national law in the area of journalistic, academic or literary data processing which may not provide for exemptions and derogations from data protection law but positive measures to protect the designated purposes (→ mn. 8 et seq., 22). Furthermore exemptions or derogations from Chapter VIII (Remedies, liability and penalties) regarding the specific purposes mentioned in both paragraphs may not be based on Art. 85 para. 1 since this would render the exclusion of this Chapter in Art. 85 para. 2 meaningless.[21]
[…]
[1]Simitis in Simitis, BDSG, § 1 mn. 35, 36 with further references.
[2]Hoffmann-Riem, AöR 123 (1998), 513, 519 et seq.
[3]This view was taken by the Art. 29 Working Party in its first Working Paper of 1997 (WP 1, 5); similarly the German Constitutional Court, BVerfGE 65, 1, 43; Docksey, IDPL 2016, 195 (207) speaks of “mutual support” between privacy and freedom of expression.
[4]Dix in Simitis, BDSG, § 41 mn. 1; cf. Westphal in Taeger/Gabel, BDSG § 41 mn. 18 (both on the German Federal Data Protection Act – pre-GDPR version).
[5]Permanent jurisprudence by the ECJ, cf. Judgment of 21 December 2016, C-203/15 u. C-698/15, ECLI:EU:C:2016:970 (Tele 2 Sverige AB u. Secretary of State for the Home Department), para. 95 with further references.
[6]BVerfGE 65, 1, 43.
[7]Cf. ECtHR, Judgment of 8 November 2016, Application No. 18030/11 (Magyar Helsinki Bizottsag), paras. 149 et seq.
[8]Cf. the amended OECD Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data of 11 July 2013, para. 3 lit. b: “The principles in these Guidelines are complementary and should be read as a whole. They should not be interpreted … in a manner which unduly limits freedom of expression.“ However, the balance between the right to privacy and to data protection on the one hand and the freedom of information of internet users on the other differs significantly around the world, which has led the ECJ to reject the idea of a general obligation to de-reference under Art. 17 GDPR, see Judgment of 24 September 2019, C-507/17, ECLI:EU:C:2019:772 (Google/CNIL), para. 60. For a discussion of the relationship between the right to privacy and the First Amendment to the U.S. Constitution see Kaminski, Boston University Law Review Vol. 97, No. 176, 2017, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2927001 (last accessed 4 February 2012), and Skinner-Thompson, Georgetown Law Journal, Vol. 108 (2019) https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3344815 (last accessed 4 February 2023).
[9]Albrecht/Jotzo, 134.
[10]European Commission, Data Protection as a pillar of citizen’s empowerment and the EU’s approach to the digital transition – two years of application of the General Data Protection Regulation, 7.
[11]Resolution 428 (1970): “There is an area in which the exercise of the right to freedom of expression may conflict with the right to privacy, protected by Article 8 of the Convention on Human Rights. The exercise of the former right must not be allowed to destroy the existence of the latter.” (cited Council of Europe, Committee of Experts on Data Protection (1990).
[12]Art. 9 Abs. 2 lit. b Convention No. 108 of 28 January 1981; see also Art. 8 para. 2 ECHR. The modernized version of Convention No. 108 (“108 +”) – not yet in force – adds “notably freedom of expression„ to the list of possible exceptions and restrictions (Art. 11 para. 1 lit. b, Protocol CETS No. 223).
[13]Art. 7 Convention No. 108.
[14]See the fundamental critique of Art. 9 of the Directive by Erdos, ‘From the Scylla of Restriction to the Charybdis of License?’, 28 et seq.
[15]Cf. the references given by Albrecht/Janson, CR 2016, 500, 506.
[16]Cf. Recital 153.
[17]Hornung, ‘Spannungsverhältnis zwischen Datenschutz und Informationszugang im Strafverfahren’, 166 et seq.
[18]Concurring Kühling/Martini et al., 287 et seq.; Buchner/Tinnefeld in Kühling/Buchner, DS-GVO, Art. 85 No. 12; dissenting Hoidn in Roßnagel, Europäische Datenschutz-Grundverordnung, 268.
[19]Kühling/Martini et al., 288.
[20]Buchner/Tinnefeld in Kühling/Buchner, DS-GVO, Art. 85 mn. 12.
[21]This is subject to a controversial debate in Germany, see the references by Hornung, ‘Spannungsverhältnis zwischen Datenschutz und Informationszugang im Strafverfahren’, 154 et seq.