The decision in this inquiry relates to a balancing between the fundamental right to data protection and the fundamental right to freedom of expression and information.

Summary of Inquiry

The DPC has completed a complaint based inquiry into MIG’s processing of personal data in relation to a series of news reports in the print and online editions of the Irish Independent, Herald and Sunday Independent newspapers. The purpose of the inquiry was to examine if any obligations on the controller arising under Articles 5(1)(a), 5(1)(c), 5(2), 6 and 9 GDPR had been engaged and, if engaged, whether MIG infringed those obligations in publishing the personal data relating to the Complainant as contained in the relevant newspaper articles.

As a preliminary issue, the DPC examined the jurisdiction of the DPC to conduct an inquiry into a media outlet in light of the exemption set out in section 43 of the Data Protection Act 2018 (‘the 2018 Act’). That section implements the requirements of Article 85 GDPR, to provide that ‘Member States shall by law reconcile the right to the protection of personal data pursuant to [GDPR] with the right to freedom of expression and information.’ The section exempts certain processing of personal information for journalistic purposes from compliance with certain provisions of the GDPR where compliance with the provision would be incompatible with the purpose of exercising the right to freedom of expression and information. The GDPR provisions to be considered include those related to the rights of data subjects, the obligations of controllers and the powers and functions of supervisory authorities.

The DPC held that the DPC has the power to use the provisions of the 2018 Act to inquire into a complaint which raises issues concerning potential infringements of the GDPR and which also directly and centrally engages a data controller’s freedom of expression right. 

Neither the GDPR nor the fundamental right to protection of an individual’s personal data contained in Article 8 of the EU Charter of Fundamental Rights are subordinate to the freedom of expression right.  Article 85 GDPR and section 43 of the 2018 Act expressly recognise the latter right, but also recognise that it must be weighed in individual cases against data protection rights. In some circumstances it may take precedence over certain GDPR provisions, including those related to the principles of processing (apart from the principle of integrity and confidentiality) contained in Article 5 GDPR and the requirement for lawfulness of processing contained in Article 6 GDPR.  The regulatory powers and functions granted by the GDPR may be avoided only to the extent that the exercise of those powers and functions would be incompatible with the exercise of the right to freedom of expression and information.  The potential incompatibility of certain GDPR provisions (including the supervisory and enforcement powers of the DPC) with the exercise of freedom of expression and information does not prevent, or is not inconsistent with, the DPC conducting an inquiry in order to assess the very applicability of the section 43 exemption.  Further, if the DPC finds that the exemption applies to the particular circumstances, then the DPC must carry out a further analysis to examine the extent to which section 43 curtails the exercise of the provisions listed in section 43(2) of the 2018 Act in the particular case.

In this inquiry, the DPC conducted a detailed analysis on the facts of the complaint, in which it carried out a balancing exercise to determine whether the processing of the complainant’s personal data by MIG in exercise of its right to freedom of expression and information for journalistic purposes was permitted because the application of certain GDPR provisions to prevent that publication would have been incompatible with such purposes. This required an assessment of where a fair balance lies between the freedom of expression right and the Complainant’s right to protection of her personal data.

The DPC examined the legal basis for journalistic expression in terms of the Irish Constitution in Article 40.6.1°(i), which sets out that the ‘education of public opinion’ is ‘a matter of such grave import to the common good’ and that the press has a ‘rightful liberty of expression’, along with the text of Article 10 of the European Convention of Human Rights, which highlights that the ‘exercise of the right to freedom of expression may be subject to formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society.’ The DPC analysed precedents from Irish decisions on conflict between the right of free expression and the right to privacy or data protection. The DPC then went on to apply case law of the Court of Justice of the EU and of the European Court of Human Rights in determining the appropriate balance of competing human rights.

Having regard to the totality of the evidence before it, the DPC found that the exemption under section 43(1) of the Data Protection Act 2018 applies to the reporting by MIG about which complaint was made by the Complainant, and the DPC therefore dismissed the Complaint under section 112(1)(b) of the Data Protection Act 2018.

Key Extracts from the Analysis

1. The DPC has the power to use the provisions of the 2018 Act to inquire into a complaint which raises issues concerning potential infringements of the GDPR and which also directly and centrally engages a data controller’s freedom of expression right.  Neither the GDPR nor the fundamental right to protection of an individual’s personal data contained in Article 8 of the EU Charter are subordinate to the freedom of expression right.  Article 85 GDPR and section 43 of the 2018 Act (‘Section 43’) expressly recognise the latter right, but also that it must be weighed in individual cases against data protection rights, and may even take precedence over certain GDPR provisions, including those contained in Articles 5 and 6 GDPR [1] and the regulatory powers and functions granted by the GDPR to the extent that the exercise of those powers and functions would be incompatible with the exercise of the right to freedom of expression and information.  The potential incompatibility of certain GDPR provisions (including the supervisory and enforcement powers of the DPC) with the exercise of freedom of expression and information does not prevent, or is not inconsistent with, the DPC conducting an inquiry in order to assess the very applicability of the Section 43 exemption.  Further, if the DPC finds that the exemption applies, then the DPC must carry out a further analysis to examine the extent to which Section 43 curtails the exercise of the provisions listed in section 43(2) in the particular case.
2. Article 85 and Section 43 make it clear that such restriction of the GDPR provisions would only be necessary in circumstances where the ‘compliance with the provision would be incompatible with [exercising the right to freedom of expression]’. By stating explicitly within the text of Section 43 that Article 5(1)(f) GDPR does not fall within the scope of any potential exemption, it is clear that Section 43 is not intended to exclude the full competency of the DPC to regulate compliance with the GDPR in all cases of journalistic processing.  It is accepted that the DPC would not have power to invoke certain aspects of its supervisory powers (and in particular its enforcement powers) as provided for under Chapter VI of the GDPR in some circumstances; but any such circumstances would need careful analysis to justify any restriction in the application of GDPR provisions provided to vindicate the data protection rights of data subjects. It is clear that the DPC may use its inquiry mechanism under the 2018 Act in order to conduct such assessments.
3. This balancing assessment is a function granted to the DPC by Section 43 itself. It is within the power of the DPC to determine by inquiry whether the exemption under section 43(1) in fact applies to the processing activities of any controller, including MIG, by considering:

• the purposes of the processing, i.e. is it for the purposes of exercising the freedom of expression right, for journalistic purposes and/or for the purposes of academic, artistic or literary expression; and
• whether compliance with aspects of the provisions exempted under section 43(2) would be incompatible with exercising the right to freedom of expression and information or for the purpose of academic, artistic or literary expression.

4. This Inquiry is the mechanism by which the DPC has considered it appropriate to conduct the relevant assessment in this case, using its powers under section 110 of the 2018 Act, given that the issues were raised as a result of a complaint made to the DPC.  The inquiry mechanism allows the DPC to make its assessment, and (in accordance with the requirements of fair procedures) present each side’s position (data subject and data controller) to the other and allow the parties concerned the facility to provide their reasoned views to the DPC.  If the DPC is satisfied that the exemption applies to the processing activities in question, having regard to the above factors, it can confirm if a controller has properly applied the exemption to the relevant processing activities and if the controller is exempted from complying with particular obligations under section 43(2) in respect of those processing activities. Therefore, the exemption cannot be used at the outset to exempt or prevent such analysis by the DPC as appears to be suggested by MIG, nor does it dictate the manner or mechanism by which this assessment is to be conducted.
5. The test to establish the need for an inquiry is not whether the DPC has formed a view that there is a ‘suspected infringement’ of a relevant enactment. Rather, under sections 109(5), 109(5)(e) and 110 of the 2018 Act, and when the DPC considers that a complaint cannot be resolved amicably, it can cause such ‘inquiry as it thinks fit’ to be conducted into the complaint (section 109(5)(e)) and, in relation to the inquiry jurisdiction under section 110, the DPC ‘may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted.’
6. The DPC therefore has a broad discretion both as to whether to carry out an inquiry and as to the form and scope of such an inquiry. Once an inquiry has as its purpose ascertaining whether there has been or is an infringement of the GDPR or of the 2018 Act, the DPC may in undertake an inquiry.
7. Section 43 of the 2018 Act (Data processing and freedom of expression and information) is the provision by which Irish law gives effect to the requirements of Article 85 GDPR.  It provides:-  

• The processing of personal data for the purpose of exercising the right to freedom of expression and information, including processing for journalistic purposes or for the purposes of academic, artistic or literary expression, shall be exempt from compliance with a provision of the Data Protection Regulation specified in subsection (2) where, having regard to the importance of the freedom of expression right in a democratic society, compliance with the provision would be incompatible with such purposes.
• The provisions of the Data Protection Regulation specified for the purposes of subsection (1) are Chapter II (principles), other than Article 5(1)(f), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries and international organisations), Chapter VI (independent supervisory authorities) and Chapter VII (cooperation and consistency).
• The Commission may, on its own initiative, refer any question of law which involves consideration of whether processing of personal data is exempt in accordance with subsection (1) to the High Court for its determination.
• An appeal shall, by leave of the High Court, lie from a determination of that Court on a question of law under subsection (3) to the Court of Appeal.
• In order to take account of the importance of the right to freedom of expression and information in a democratic society that right shall be interpreted in a broad manner.

8. Therefore, a two-part test is applicable to determine whether the exemption in Section 43 applies to processing of personal data:

• First, the processing in question must be for the purpose of exercising the right to freedom of expression and information, including processing for journalistic purposes or for the purposes of academic, artistic or literary expression.
• Second, compliance with the relevant provisions of the GDPR must be incompatible with those purposes, having regard to the importance of the freedom of expression right in a democratic society.

9. The question for the DPC in relation to this issue is whether the particular reporting of the particular personal data and special category data of the Complainant in this case was for the purpose of exercising the freedom of expression right. If so, the DPC must consider whether compliance with the GDPR provisions set out in section 43(2) of the 2018 Act would have been incompatible with that right, noting also that the freedom of expression right is to be given a broad interpretation by the DPC (per section 43(5) of the 2018 Act).  This assessment for the purposes of section 43(2) of the 2018 Act requires the DPC to assess the compatibility of the exercise of freedom of information and expression against certain GDPR rights and obligations, including (in the context of this Complaint):

• the requirement for data processing to be fair and lawful (Article 5(1)(a) GDPR),
• the requirement for the controller to ensure that the personal data processed by it is adequate, relevant and limited to what is necessary in relation to the purposes of processing (Article 5(1)(c) GDPR),
• the requirement for the controller to be accountable for its data processing by being able to demonstrate compliance with the principles of processing set out in Article 5 GDPR (pursuant to Article 5(2) GDPR),
• the requirement for the controller to have a lawful basis for its data processing as contained in Article 6 GDPR,
• the requirement for the controller to meet one of the conditions contained in Article 9 GDPR in respect of any special category data processed, and
• the obligation to be subject to enforcement action or sanctions by the DPC as provided for under Chapter IV of the GDPR.

10. The balance between media publications in exercise of freedom of information and expression and the right of privacy of the individual about whom information is published will favour the freedom of expression where the information is published in the public interest.  This public interest has been interpreted as being an interest in publishing or disclosing information that contributes to a debate of general interest.  This is sometimes contrasted with the publication or disclosing of information which is merely interesting to the public (e.g. being titillating or at the level of mere gossip) but which does not contribute to any debate of general interest.
11. Article 85(1) GDPR requires that the right to protection of personal data pursuant to the GDPR must be reconciled with the right to freedom of expression and information, including processing for journalistic purposes. Section 43 requires an assessment of whether, inter alia, processing for journalistic purposes …shall be exempt from compliance with a provision of the [GDPR] specified [including processing principles and rights of the data subject] where, having regard to the importance of the right of freedom of expression and information in a democratic society, compliance with the provision would be incompatible with such purposes. This requires a balancing exercise of the obligation to respect a data subject’s personal data rights against the right of the public to be informed by the media about matters of public interest.
12. The European Court of Human Rights has said that the role or function of the person concerned and the nature of the activities that are the subject of the report and/or photo constitute important criteria. In that regard, the Court said that a distinction has to be made between private individuals and persons acting in a public context, as political figures or public figures. Accordingly, whilst a private individual unknown to the public may claim particular protection of his or her right to private life, the same is not true of public figures … A fundamental distinction needs to be made between reporting facts capable of contributing to a debate in a democratic society, relating to politicians in the exercise of their official functions for example, and reporting details of the private life of an individual who does not exercise such functions. Whilst in the former case the press exercises its role of ‘public watchdog’ in a democracy by imparting information and ideas on matters of public interest, that role appears less important in the latter case. Similarly,  although in certain special circumstances the public’s right to be informed can even extend to aspects of the private life of public figures, particularly where politicians are concerned, this will not be the case – even where the persons concerned are quite well known to the public – where the published photos and accompanying commentaries relate exclusively to details of the person’s private life and have the sole aim of satisfying the curiosity of a particular readership in that respect. In the latter case, freedom of expression calls for a narrower interpretation. [2]
13. It is true that the balance will not always favour the freedom of expression right. The ECtHR and the Irish courts have considered that the balance may tip in favour of an individual’s rights (which in many of the cases was their right to privacy), especially where the person was not a public figure and/or the matters reported concerned private activities of the individual (e.g. extra-marital affairs or an individual’s private sexual life). [3]
14. The DPC does not accept that rules about standards and burdens of proof are relevant to the identification of public interest in media publications. Newspapers are not in the same position as the court and do not decide on the application of legal rights.
15. The fact that medical information is at play is relevant to, but not determinative of, the balance to be struck between freedom of expression and the right to privacy. Medical information does require a very high level of protection. However, in this case, there was a clear nexus between the personal data published, including the special category data, and the debate in the general interest. Therefore, contrary to the Complainant’s submission, the DPC finds that the fact that the publications included data concerning health does not automatically determine the result of the balance against the right of freedom of expression and information.

[1]       Excluding Article 5(1)(f) GDPR.

[2]       Axel Springer AG -v- Germany App no 39954/08 (ECtHR 7 February 2012), [91].

[3]       E.g. Herrity v Associated Newspapers [2009] 1 IR 316; Von Hannover –v- Germany (Von Hannover I) [2004] ECHR 294; X (Infant) v Sunday World [2014] IEHC 696 (concerning details of an infant’s birth and questions about the infant’s paternity); and Nolan v Sunday World [2019] IECA 141 and paragraph 65 Bladet Tromsø and Stensaas v Norway App No 21980/93 (ECtHR,  20 May 1999) cited by the Complainant in her submissions on the Draft Decision.