EDPB reminds national data protection authorities to exercise their powers proportionally and in respect of fundamental rights

At the beginning of November 2018, the first GDPR-related privacy and freedom of expression case arose in Romania in connection to the publication by the RISE Project of several articles about a corruption investigation. The articles reported a close relationship between a road construction company that is currently under investigation for fraud, European funds, and a high-profile politician.

Shortly after the first article was published, the Romanian data protection authority (“ANSPDCP”) sent a series of questions to the RISE Project, including one asking about “the sources from where the personal data was obtained”. The DPA mentioned a possible penalty of up to €20 million if the journalists didn’t comply with its request, including a possible fine for “access to the data” under Article 83 (5) e) of the GDPR.

Privacy International, the European Digital Rights (EDRi), and the Association for Technology and Internet (ApTI), together with 15 other civil society organisations, sent a letter to the European Data Protection Board (EDPB) asserting that the GDPR ought not to be misused to threaten media freedom in Romania.

On 31 January, the EDPB briefly replied to the civil societies letter that Article 85 of the GDPR leaves the reconciliation of the rights to freedom of expression and data protection to Member States and noted that such reconciliation must always be done in respect of chapter VII of the GPDR and of the applicable jurisprudence of the CJEU and the ECtHR.

As such, this case gives a strong warning that the GDPR cannot be used as a tool to limit freedom of the press and the publication of public interest information. However, the EDPB found that it does not have the competence to intervene in assessing the actions of a national supervisory authority, such as those of the ANSPDCP. The EDPB mentioned instead the possibility to seek national judicial redress as a solution.

We welcome EDPB strongly stating that the protection of journalistic sources is fundamental for the freedom of the press and that the reconciliation of fundamental rights needs to respect applicable European jurisprudence.

We would also encourage the EDPB to use this opportunity to clarify its position regarding the implementation of Article 85 of the GDPR and to issue guidelines regarding the reconciliation of the right to protection of personal data with the right to freedom of expression, in accordance with Article 85 of the GDPR.

Contribution by Mozilla Fellow Valentina Pavel.