Journalists are, to a certain extent, exempted from the application of the GDPR. The details are regulated by Member State law.
Because the exemptions and derogations for journalists are regulated by Member State law, they evidently differ from one Member State to another.
For example, according to the Belgian Act of 30 July 2018 implementing the GDPR, journalists are generally exempted from the prohibition to process sensitive and judicial data, from the duty to inform the data subject, to give access to the data on the data subject’s request, etc.
Other exemptions, however, such as providing the record of processing activities to the data protection supervisory authority, are only applicable if the application of this duty compromises an intended publication or is a control measure prior to such publication (Art. 24 of the Act).
Also relevant in this context is Recital 153 of the GDPR:
Where such exemptions or derogations differ from one Member State to another, the law of the Member State to which the controller is subject should apply. In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly.
An interesting question rises up: "should everybody who publishes messages on Facebook, tweets on twitter, photos on Instagram or videos on YouTube, be qualified as 'a journalist'?"
The Court of Justice of the European Union, in a judgment of 14 February 2019, gave an interesting answer to that question.
The Court was asked to answer the Latvian Supreme Court if the recording, in a police station, of police officers carrying out procedural measures and publication of the video on YouTube, may be regarded as the processing of personal data for journalistic purposes.
The case relates to a Mr. Buivids, who made a video recording in a station of the Latvian national police while he was making a statement in the context of administrative proceedings which had been brought against him. He filmed his meeting with the police officers secretly using his mobile phone and published the recorded video on YouTube (see https://www.youtube.com/watch?v=W7Wjc_9GTvQ).
The Latvian data protection agency estimated that Mr. Buivids violated the data protection legislation by having videotaped the police officers without informing them and requested him to remove the video from the internet.
In its decision of 14 February 2018, the Court of Justice first refers to its former jurisprudence according to which, in order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly. More precisely:
‘journalistic activities’ are those which have as their purpose the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them.
In other words, you don’t have to work as a professional journalist for a media undertaking to be qualified as a journalist. This jurisprudence has been confirmed by Recital 153 of the GDPR.
On the other hand, the Court emphasises that:
the view cannot be taken that all information published on the internet, involving personal data, comes under the concept of ‘journalistic activities’ and thus benefits from the exemptions or derogations.
In order to benefit from the exemptions and derogations granted to the processing of personal data for journalistic purposes, information has to be published on the internet for the sole purpose of thedisclosure to the public of information, opinions or ideas.
To determine whether this is the purpose of the publication, one must apply the criteria put forward by the European Court of Human Rights. This court has laid down a number of relevant criteria which must be taken into account, inter alia:
As far as the specific case of Mr. Buivids is concerned, the Court of Justice decides that:
the video recording of police officers in a police station, while a statement is being made, and the publication of that recorded video on a video website, on which users can send, watch and share videos, may constitute a processing of personal data solely for journalistic purposes, within the meaning of that provision, in so far as it is apparent from that video that the sole object of that recording and publication thereof is the disclosure of information, opinions or ideas to the public, this being a matter which it is for the referring court to determine.
Our conclusion is that the informative value of social media messages, photos or videos plays a crucial role in determining if such information can benefit from the exemptions and derogations granted to the processing of personal data for journalistic purposes.
The main question, in other words, is whether the published information has some interest for the public or is merely posted to disclose someone’s private activities, without any relevance for the public to know. Does the video contain a message, an opinion or an idea worthwhile to be communicated to the public: that is the question.