Journalism vs. data privacy: The GDPR dilemma in reporting crimes

When reporting crimes, news portals (hereinafter often referred to as controllers who determine the means and purposes of processing personal data) frequently publish personal data (any information that directly or indirectly identifies an individual, as defined in Article 4(1), Regulation 2016/679). For instance, during the Madeleine McCann case, news agencies published unproven allegations against the accused (Bubola, 2023). Similarly, in the case of Amanda Knox, details about her romantic relationships were widely publicised (Biography.Com Editors & Piccotti, 2024). In Julian Assange's espionage trial, extensive reporting included details about his living conditions and relationships (BBC News, 2024; Psaropoulos, 2024). This practice creates a tension between the public’s right to freedom of expression and information and individuals' right to have their data protected from controllers (American Chamber of Commerce Bulgaria, 2020), both of which are fundamental human rights under the EU legal system (Case of Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, 2017). Balancing and harmonising these rights which, currently disharmonised across the EU risk chilling effects on both freedom of expression and data protection rights, is crucial to fulfilling the GDPR's objectives (Recital 3, GDPR).

Personal data related to crimes received a broad definition under the GDPR as criminal conviction and offence data (Article 10, GDPR). Any personal data linked to a court conviction, including information about judges and lawyers, qualifies as personal criminal conviction data (Case of Khelili v. Switzerland, 2011). Personal data linked to any penal laws is classified as personal offences data (Case C-489/10, para. 37). Overall, anyone’s personal information in a crime report may comprise personal criminal conviction and offences data.

Publishing crime-related news is crucial in democracies, as journalists serve as societal watchdogs, informing the public, shaping opinions, and exercising their freedom of expression and information (Erdos, 2016; Case of M.L. AND W.W. v. Germany, 2018; Rucz, 2022). However, data subjects also have the right to data protection to prevent harm from such dissemination (Etienne, 2012, p. 151). Compromising this data can significantly harm their privacy – facilitating open-source intelligence use and enabling discrimination by employers and landlords (Georgieva, 2020). Individuals might find it impossible to escape their past, affecting their present and future (Georgiades, 2020, p. 1151; Faisal, 2023, p. 96). Thus, reporting crimes requires balancing two fundamental rights protected by the Charter of Fundamental Rights of the European Union (the Charter) (Faisal, 2021, p. 2). Article 52(1) of the Charter, which outlines principles and conditions of limiting fundamental rights, allows limiting any fundamental right only if it is strictly necessary and serves a general interest. Therefore, news agencies must process personal criminal conviction and offence data carefully, ensuring compliance with these limitations.

The default GDPR application restricts news agencies from easily reporting crime stories involving personal criminal convictions and offences data. Article 10 of GDPR allows processing such data only when 1) under the control of official authorities, or 2) authorised by Union or Member State law with appropriate safeguards for data subjects’ rights and freedoms. Without these permissions, news agencies rely on Article 85 GDPR (journalistic exemption), which allows the processing of criminal conviction and offences data for journalistic purposes, exempting them from most GDPR provisions, including Article 10.

Article 85 empowers Member States to balance or reconcile rights by defining journalistic exemptions. However, the power is not exclusive. The phrase "Member States shall provide for exemptions…" in Article 85(2) indicates that Member States must exempt controllers from certain GDPR chapters when necessary, implying that fewer exemptions than the provisions outlined in those chapters are unacceptable. Conversely, full exemptions from GDPR compliance may also be inconsistent with Article 52(1) of the Charter and Article 85. Member States can define the scope of journalistic exemption according to their legal and cultural contexts, but it must align with EU law. (Miadzvetskaya & Van Calster, 2020, p. 151). It must be remembered that, according to the principle of supremacy of the EU law, EU law presides over Member State law in terms of EU policies (Case 6/64).

Evidence shows that Member States have varying standards for journalistic exemptions, often inconsistent with EU law. Countries such as Austria, Italy, and Bulgaria narrowly define these exemptions, restricting news portals' ability to process criminal conviction and offence data for journalistic purposes (Erdos, 2016, p. 179). In contrast, Nordic countries like Norway, Sweden, and Finland provide broad exemptions, allowing extensive data processing by news portals (Erdos, 2016, p. 179; Bitiukova, 2023). The Bulgarian Constitutional Court has invalidated national laws requiring journalists to balance rights using specific criteria, deeming them incompatible with EU case law (American Chamber of Commerce Bulgaria, 2020). The European Data Protection Board (EDPB) should prioritise this in its working plan, while the Court of Justice of the European Union (CJEU) case laws may help fill the existing void. Analysis of relevant CJEU case laws supports a functional approach to defining journalistic exemptions, consistent with Article 52(1) of the Charter. This approach allows anyone (beyond journalists) to process personal criminal conviction and offence data, provided the processing is strictly necessary to communicate information, opinions, and ideas to the public in their general interest (Brimblecombe & Fenwick, 2022; Case C-73/07; Case C-345/17). Therefore, purposes that are discrete and privatised fall outside the scope of the journalistic exemption (Erdos, 2015, p. 138).

This disharmonisation contradicts GDPR objectives, as the GDPR established the European Data Protection Board (EDPB) to ensure consistent application across the Union (Article 70(1), GDPR). The promised legal certainty is undermined (Recital 13, GDPR), complicating compliance for controllers, creating uneven protection, impeding cross-border data flows, and disrupting the EU market's seamless operation.

In conclusion, an EU-wide shared standard for journalistic exemption is essential to address these discrepancies.