Does the protection of personal data limit freedom of expression?

The protection of personal data has become a crucial issue in the digital age, where freedom of expression is also essential to ensuring open dialogue within society. This duality, however, raises a fundamental question: does the GDPR, which aims to regulate the processing of personal data, limit this fundamental right?

The relevant provisions, such as Article 85 of the GDPR, require Member States to strike a balance between these two rights by adopting derogations and exemptions. The challenge therefore lies in seeking a harmonious reconciliation between data protection and freedom of expression, particularly in the context of the freedom to inform through the media and journalism.

This debate rests on considerations that are not confined to legal principles but also extend to societal concerns. Far from being an isolated issue, the interaction between data regulation and individual expression warrants sustained attention. By analysing the issues that arise from it, we will examine the framework of reference governing this coexistence, the limits imposed on private individuals, and the impact of the GDPR on journalists and the media.

If you would like to engage a lawyer specialising in GDPR matters, contact me!

1. Reconciling freedom of expression and the protection of personal data: how is it achieved?

Reconciling freedom of expression and the protection of personal data is a major challenge in the digital age. Personal data must be protected, but it is also essential to ensure that freedom of expression is not hindered. Article 85 of the GDPR provides a legal framework, stipulating that Member States must adapt their legislation in order to strike this balance. This requires taking into account the journalistic, academic, artistic or literary contexts in which data may be published without infringing the fundamental rights of others. It is important to note that the GDPR introduces a range of enabling measures and derogations, but these provisions must not result in an excessive restriction of freedom of expression. Indeed, in order to successfully achieve this reconciliation, several factors must be considered:

• The purposes for which the data are processed, which must justify the balance struck between the rights at stake.
• Respect for individuals' privacy, which must be weighed against the importance of communicating information of public interest.
• The limits set by French law, in particular through Article 80 of the 1978 Act, which provides derogations for processing carried out for journalistic purposes.

This need for reconciliation highlights the flexibility required in applying the GDPR. The latter, in connection with freedom of expression, reflects the complexity of reconciling the requirements of data protection with the need to inform the public. The path forward is thus marked out by the search for a form of regulation capable of safeguarding both the protection of personal data and the right to information.

This dynamic calls for reflection on the practical implications of these principles within society, particularly as regards the processing of data by journalists and the media. How can these professionals navigate this complex landscape? We will explore this question in the next section.

Let's discuss your needs for 15 minutes!

2. What are the limits of the GDPR regarding processing carried out by private individuals?

Within the framework of the protection of personal data, it is essential to understand the limits of the GDPR regarding processing carried out by private individuals. Fundamental rights must not be compromised, but situations involving informal or non-profit processing require particular attention. Indeed, the GDPR imposes clear obligations, but it also leaves room for manoeuvre in cases where freedom of expression and the public interest are at stake. For example, Article 85 of the GDPR allows Member States to provide for exceptions for processing related to information of public interest, while respecting the privacy of the data subjects. The limits imposed by the GDPR include, in particular:

• The need to obtain the explicit consent of individuals before any processing of their personal data.
• Transparency obligations, which require private individuals to inform the data subjects about the use of their data.
• The right to erasure, which allows any individual to request the deletion of their personal data under certain conditions.

Furthermore, where a private individual wishes to share information about others, in particular via social media or other public platforms, they face genuine legal constraints. Possible remedies may be considered, but the question of freedom of expression must always be addressed within the framework of compliance with data protection laws.

In this context, it is crucial to tread carefully between the desire to express oneself and the obligation to respect the privacy of others. Thus, data protection becomes not only a legal responsibility but also an ethical requirement for private individuals.

In short, the complexity of the GDPR's limits underscores the importance of balanced regulation that respects both freedom of expression and the requirements relating to data protection. This examination of the limits on the processing of data by private individuals sets the stage for a deeper reflection on the specific rules applicable to journalists and the media.

I want reliable legal documents!

3. How does the GDPR apply to journalists and the media in matters of freedom of expression?

The question of how the GDPR applies to journalists and the media raises fundamental issues, since these actors play a key role in freedom of expression and the dissemination of information. The importance of journalistic work is recognised, but this does not mean that journalists are exempt from the obligations laid down by the GDPR. Indeed, this regulation aims to establish general principles for the protection of personal data, while incorporating specific derogations for processing carried out for journalistic purposes. One of the key provisions in this regard is Article 80 of the French Data Protection Act, which allows the application of the GDPR to be adapted for certain data processing carried out in the course of journalistic activity. This means that journalists may process personal data under certain conditions, while not compromising the privacy of the data subjects. It is crucial to understand the following elements regarding the application of the GDPR to the media:

• Journalists benefit from a degree of flexibility as regards consent, where the public interest and the legitimacy of the information may justify processing data without the explicit consent of the data subject.
• By contrast, the principle of data minimisation must be strictly observed, which means that only the data strictly necessary for the purpose of informing the public may be collected and processed.
• The rights of data subjects, such as the right to erasure or the right to object, also apply here, except for data processing carried out strictly within a journalistic framework.

Generally speaking, the lack of clarity as to what constitutes "processing for journalistic purposes" broadens the debate. The case law of the Court of Justice of the European Union (CJEU) has regularly addressed this question, but a significant margin of interpretation remains as regards the definitions. Thus, the media must exercise caution when collecting and using personal data, in order to avoid potential litigation.

Moreover, the applicable legal framework varies from one Member State to another, which further complicates the situation. In France, for example, processing carried out for journalistic purposes may be excluded from certain obligations imposed by the GDPR, but it is essential to remain vigilant with regard to individuals' fundamental rights. This requires a balanced approach, in which information of public interest can be reconciled with data protection, yet without ever disregarding the right of individuals to have their data respected.

This complexity in the relationship between the GDPR, freedom of expression and the processing of personal data by journalists highlights the need for ongoing dialogue between these various stakeholders. The next step will be to examine how these principles translate into practice.