On 16 November 2021, the Supreme Administrative Court (‘SAC’) issued a judgment in a case of the Commission for Personal Data Protection against an electronic media regarding publication of a natural person’s personal data for journalistic purposes.
The SAC Judgment is of particular significance as it lays down criteria for assessing the balance between two competing rights, i.e. the right to freedom of expression and information and the right to protection of personal data, in so far as both rights are not absolute.
Mr Ventsislav Karadjov, Chairman of the Commission for Personal Data Protection (CPDP), expressed his expectation that the media will take into account the general considerations in the judgment concerned and recalled that in 2019 the Constitutional Court annulled certain provisions of the Personal Data Protection Act which attempted to introduce criteria for the use of personal data for journalistic purposes that journalists have to take into account in their publications in order not to infringe the General Data Protection Regulation (GDPR). Mr Karadjov said "In practice, the annulment by the Constitutional Court prioritised the jurisprudence, which in this case presents a precedent which needs to be carefully considered by the media in Bulgaria." The CPDP Chairman stressed that cases such as the case at hand are indicative of the way in which the media should reflect when processing personal data. Furthermore, according to Article 25h(1) of the Personal Data Protection Act (‘PDPA’), the processing of personal data for journalistic purposes is lawful when it is carried out to give effect to the freedom of expression and the right to information, while respecting privacy, i.e. again when assessing the balance between the two rights, while respecting the principle of ‘data minimisation’”.
In 2020 a public figure lodged a complaint with the CPDP against an electronic media, which published ‘for journalistic purposes’ information on the applicant’s identity (full name, a portion of the personal identity number/birthdate, address), economic identity (property and financial situation, participation and membership in a non-governmental organisation), social identity (occupation, place of work, employment, information on affiliation), all of which is personal data within the meaning of Article 4, paragraph 1 of Regulation (EU) 2016/679.
As stated in the Supreme Administrative Court’s judgment, the term ‘journalistic purposes’ is not defined by the legislator, but has been interpreted in the case-law, the essential element of the activity being the collection, analysis, interpretation and dissemination through the media of up-to-date and publicly significant information, and any journalistic activity is an expression of the freedom of expression in the rule of law.
The law allows the publication of personal data for journalistic purposes, but on a case-by-case basis, making bona fide assessment of the balance between the right to freedom of expression and information and the right to protection of personal data.
In its decision of 16 November 2021, the SAC explains for the first time how the assessment of which data is eligible to be published for journalistic publication is carried out in each individual case.
The court’s judgment defines the meaning of the restriction that the principle of ‘data minimisation’ entails. For the purpose of journalistic investigation, the necessary and sufficient personal data should be published to satisfy the freedom of expression and information. There must be no disproportionate interference with the privacy of individuals, of which the right to protection of personal data is derived. The judgment states that the fact that some of the information originates from the Property Register does not make the publication of the data lawful because the purposes of the Register are other than journalistic purposes and, moreover, the data are not immediately accessible to the public. In this sense, the processing of personal data for journalistic purposes is a further data processing operation, for another purpose, which should meet the requirements of the GDPR, including the principle of data minimisation.
In connection with the judgment, the CPDP Chairman adds, in a subsequent comment, that the judgment of the SAC applies not only to public figures, but also to any other citizen who is subject to a journalistic investigation. Such an investigation must provide the public with the information necessary to enable an objective and informed assessment to be made of whether a person has committed something wrongful, publicly or morally reprehensible, but without disproportionately affecting his or her privacy.
Mr Ventsislav Karadjov, the CPDP Chairman, explains "The right to information of the public needs to be balanced against the individual’s right to privacy. To do otherwise would mean a deliberate act of damaging the reputation of the person subject to the journalistic investigation. The fact that information from public sources has been used in this case does not mean that it is proportionate to the purpose of the investigation. The information in the Property Register has been collected for another purpose: it provides information on who is the owner of a specific property, where such property is located, whether the property is encumbered. Where such information is processed by journalists for other purposes, an assessment should be made by the media as to whether and to what extent publicly available information is irrelevant to the journalistic purposes of the investigation and, in that sense, whether it should be published in detail or only the part of it which contributes to clarifying the purpose of the investigation."
