Under European data protection law, journalists enjoy some regulatory exemptions when processing personal data for journalistic purposes, balancing the right to the protection of personal data with the principle of freedom of expression.
A question which has however sparked some debate is whether so-called citizen journalists, such as bloggers, can rely on the derogation for journalistic purposes as well. In its judgment of 14 February 2019 in the Sergejs Buivids v. Datu valsts inspekcija case, the Court of Justice of the European Union (CJEU) has answered this question affirmatively.
Mr. Buivids posted a video on YouTube of him making a statement in a Latvian police station in the wake of an administrative offence. The Latvian Data Protection Authority (Datu valsts inspekcija) and two administrative courts believed that Mr. Buivids video was violating Latvia’s Natural Persons’ Data Protection Law (Fizisko personu datu aizsardzības likums). It was in this context that the Latvian Supreme Court referred two questions to the Court of Justice of the European Union (CJEU) for a preliminary ruling.
With its first preliminary question, the Latvian Supreme Court wanted to know whether the recording and the subsequent publishing of this recording fell within the scope of Directive 95/46. Unsurprisingly, the CJEU confirmed that a recorded image of an identified or identifiable natural person is personal data, and that the recording of this footage and its subsequent publication are to be considered as processing of personal data.
The second – and more interesting – question was whether Mr Buivids could rely on the derogation for journalistic purposes as provided by Article 9 of Directive 95/46 (of which Article 85 GDPR is a rough equivalent – see below). Although the Latvian Law on the Press and other Mass Media provides that only professional journalists, defined as persons who are employed by a news organisation or registered as a journalist by the press association can do so.
Relying on its previous case-law, the CJEU stated that the notion of ‘journalism’ should be interpreted broadly. Furthermore, it followed from the preparatory works of Directive 95/46 that the exemptions and derogations set out in Article 9 of Directive 95/46 not only applied to media companies, but to everyone carrying out journalistic activities. Consequently, the CJEU asserted that the fact that Mr. Buivids was not considered as a journalist under national law could not automatically lead to the conclusion he cannot rely on the derogation for journalistic purposes.
The CJEU stated that the decisive criterion is whether the sole purpose of the recording and the publishing of the video was to disclose information, opinion or comments to the public. To that the end, the Latvian Supreme Court could notably take into account the fact that the video in question was published with the intent to draw attention to the alleged police malpractice that took place while he was making his statement.
The CJEU thus affirmed that Mr. Buivids could rely on the derogation for journalistic purposes provided that the sole purpose of the recording and publication of the video was the public disclosure of information, opinions or ideas.
Directive 95/46 & GDPR
Although the judgment was delivered after the GDPR’s entry into application, it relates to a provision of Directive 95/46.
That being said, Article 85 GDPR is very similar to Article 9 of Directive 95/46: while Directive 95/46 spoke of “processing of personal data carried out solely for journalistic purposes”, Article 85 GDPR speaks of “processing carried out for journalistic purposes”. In other words, the word “solely” is no longer present.
As a result, the lessons in the Buivids judgment will be relevant also in relation to journalism exceptions under the GDPR.
Impact of the decision illustrated in Belgium and France
Two other EU Member States, France and Belgium, provide an excellent illustration of the difference of the potential impact of this judgment in EU Member States.
Belgium: The Belgian legislation does not indicate who can rely on the derogation for journalistic purposes. However, a court of first instance had ruled that a citizen who had posted a recording of racist incident on his blog site violated the old Belgian Privacy Act, the Act of 8 December 1992 on the protection of privacy in relation to the processing of personal data. The judgment was quashed on appeal. Notably, the Ghent Court of Appeal of 19 September 2018 ruled (ahead of the Buivids judgment) that a blogger can also invoke the derogation for journalistic purposes. As such, the judgment of the CJEU discussed will not have a major impact in Belgium but will be viewed as further confirmation of recent case law.
France: However, the judgment is likely to have a more significant impact in France. Pursuant to Article 80 of the French data protection act, only professional journalists can rely on the derogation for journalistic purposes. French law qualifies professional journalists as those who exercise, in a professional capacity, the activity of a journalist, in compliance with the ethical rules of this profession. The professional journalist is defined by the French labor law code (in its Article L.7111-3) as any person whose main, regular and remunerated activity is the exercise of his/her profession in one or more press companies, daily and periodic publications or press agencies and who derives the main part of his/her resources from them. The French Supreme court (Cour de Cassation) in a ruling dated 1 April 1962 further explained that, as per Article L.7111-3 of the labor law code, may be qualified as journalist – those who bring an intellectual and personal collaboration to a periodic publication with the view to inform the readers, whether or not they have a professional journalist card. This interpretation was extended by the French Supreme Court, 25 September 2013) to individuals who exercise their professional activity in press companies that enjoy editorial independence .
French law has thus adopted an organic criterion according to which a journalist is a person who is working in a media company. It does not take a functional approach whereby a journalist would be a person whose activity is to inform the public regardless of the structure and the context in which such activity is carried out.
Given the current strict definition and regime of professional journalists in France, a citizen blogger could not be considered as a professional journalist and therefore not benefit from the exemptions and derogations provided by Article 85 GDPR.
This strict approach is challenged by the CJEU decision from 14 February 2019. It would thus be interesting to see how the French Judge is going to rule now when confronted to such kind of video recording further to the CJEU decision. It seems that in any event the definition of “journalist” will have to evolve in France taking in consideration the possibilities made available by new technologies to post easily information to the public using social media.