Does Journalistic Use of Public Personal Data Deserve Privacy Protection?
On 16 December 2008 the European Court of Justice
("ECJ") rendered a
judgment on a preliminary question regarding
the journalistic use of personal data by a Finnish commercial
company.
The Finnish Court that presented the question to the ECJ had been
requested to rule on a dispute between the Data Protection
Ombudsman and the Data Protection Board (the
tietosuojavaltuutettu and the
tietosuojalautakunta, respectively).
Facts of the Dispute
The dispute has arisen due to the manner in which two companies
within one group of companies, called Satakunnan Markkinapörssi
Oy ("Markkinapörssi") and Satamedia Oy
("Satamedia"), process personal data.
Markkinapörssi is an undertaking that publishes a list of 1.2
million names (note: there are 5.2 million people living in
Finland) each year in regional editions of a newspaper (the
Veropörssi). In this list, people who have an income above a
certain limit are mentioned. Besides name, year of birth and place
of residence, the taxable income from employment, wealth and
capital are mentioned, as well as the total amount of taxes due..
In addition to this very extensive list, Markkinapörssi, together
with Satamedia, has developed a text-messaging system with which
people can request, by text message, the above-mentioned
information about a particular person, against payment of two euro.
As a result of this investigation, the tietosuojavaltuutettu, or
the Data Protection Ombudsman, which had held an investigation into
the processing by the two companies after complaints of private
persons, requested the Data Protection Board to prohibit this
service. The Board refused to do so, just like the lower court. The
standpoint was that all information originates from public
government documents which everybody may examine, so that the rules
regarding the protection of personal data did not apply.
The Preliminary Questions
The higher Court, however, doubted the processing of this
information and submitted four preliminary questions to the ECJ,
namely:
- Is there processing of personal data, now that public
information is collected, classified and subsequently made
public for commercial purposes?
- In this case, is there processing for journalistic
purposes, which is excepted from the scope of the
Directive?
- Does the Directive preclude the commercial further use of
personal data that have been collected for journalistic
purposes?
- Can personal data that have already been made public in the
media fall under the Directive?
The ECJ gave an affirmative answer to the first two questions.
There is indeed processing of personal data and the journalistic
processing thereof. The collection, publication and subsequent
making retrievable of the data mentioned must be regarded as
processing within the meaning of the Directive. According to the
ECJ, the concept of journalistic must, in principle, be interpreted
broadly, in order to be able to guarantee the right to freedom of
speech. A too strict interpretation thereof that is established
beforehand, could affect this right. It follows from the answer to
the second question that the third question must be answered
negatively. The Directive does not by definition preclude
commercial processing, because this processing may be classified
under journalist purposes. The national court must assess in each
separate case whether there is (still) journalistic processing. The
text-messaging system could therefore fall under the journalistic
exception, as a result of which part of the rules regarding the
protection of personal data will not apply. The precise extent of
the journalistic exception is determined by the Member State
itself.
To conclude, with regard to the fourth question the ECJ considered
that the scope of the Directive cannot be restricted further than
in the cases as mentioned in Article 3 of the Directive. Exceptions
are processing exclusively for household purposes, and processing
that relate to public and state security, defense and criminal
procedure. The processing by Markkinapörssi and Satamedia do not
fall under these exceptions, and as such in principle fall under
the Directive. That is why the Finnish Court has to decide on the
basis of national law whether the journalistic exception applies.
If it does not, the rules for the protection of personal data apply
in full.
Conclusion
This judgment confirms the scope of the Personal Data Protection
Directive once again. The Directive also applies to personal data
originating from public sources. In addition thereto, it becomes
clear how the journalistic freedom and the rules of the Privacy
Directive can be reconciled with each other. The Directive
prescribes that the Member States must make exceptions to the
Directive to the extent that these exceptions are required to
reconcile the right to privacy with the rules concerning the
freedom of speech. Also, the publishing of a list with personal
data from which information can be requested at will against
payment, may possibly be classified as a journalistic exception.
The judgment that the Finnish Court will render in this case is
therefore first and foremost dependent on the Court's
adjudication of the journalistic quality of the list and the
text-messaging system, and, in addition thereto, on the manner in
which the Finnish legislator has transposed the Directive.
It is important to realize that the ECJ gives a broad
interpretation of the exception for journalistic purposes. The
question is whether in the Netherlands a similar processing would
fall under the journalistic exception and even if this would be the
case, a large part of the Personal Data Protection Act (Wet
bescherming persoonsgegevens) ("Wbp")) would still
apply. The journalistic processing of personal data, for instance,
also requires a purpose and a basis and is subject to the
requirements with regard to careful processing and security. Due to
the rather limited wording of the journalistic exception in the
Wbp, the Wbp also largely applies to journalistic processing of
personal data, even where this concerns public data.