6 Additional issues

6.1 Subject access requests

Accessing the information stored by journalists can be very important, both for the subjects they cover and for other people. The former, however, have a right of access that others do not have. Article 85, however, allows Member States to limit that right. In this section we will introduce some considerations on how this limitation is usually formulated. In doing so, we will focus on both the right of access and the right not to disclose the sources of information, which is widely acknowledged in Europe.

According to article 15 of the GDPR, the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and information regarding the purposes of the processing, the categories of data concerned, the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations, the envisaged period for which the personal data will be stored, etc.

On this basis, a journalist should provide the data subjects with the information that he or she holds about them, unless he or she considers that in doing so he or she would be unable to build the story. Under such circumstances the exceptions and derogations of article 85 would prevail against their right to access. Needless to say, this would only happen under the assumption that your story is in the public interest. The higher the interest is, the stronger your right not to disclose your information with the data subject becomes. Quite often, it might happen that you could provide access to some of the information about the processing or the personal data used without causing damage to the aims of your investigation. If this is the case, you should proceed without delay.

The negative to provide the information requested might perfectly be justified even after the story is published. If you have strong reasons to consider that this might be against public interest, if you are able to explain why responding would undermine future investigations or publications, or journalistic activities more generally, you could refuse the request. But you will always have to give a good reason to oppose it. Finally, do not forget that you must not include any information about other people unless they have consented, or it is reasonable to supply it without their consent.

6.2 Confidential sources

Sources of information are sacred to journalists. Several international instruments ensure their adequate protection; among others, the Resolution on Journalistic Freedoms and Human Rights, adopted at the 4th European Ministerial Conference on Mass Media Policy (Prague, 7-8 December 1994) and the Resolution on the Confidentiality of Journalists’ Sources by the European Parliament (18 January 1994, Official Journal of the European Communities No. C 44/34). Moreover, Recommendation No. R(2000) 7 on the right of journalists not to disclose their sources of information was adopted by the Committee of Ministers of the Council of Europe on 8 March 2000. Moreover, in general domestic law and practice in member States provide for explicit and clear protection of the right of journalists not to disclose information identifying a source in accordance with Article 10 of the Convention for the Protection of Human Rights and Fundamental Freedoms.

Thus, there is a legal framework that allows journalist to keep their sources unveiled. This right can only be limited under the conditions mentioned by Principle 3(b) of Recommendation No. R(2000) 7, namely:

reasonable alternative measures to the disclosure do not exist or have been exhausted by the persons or public authorities that seek the disclosure, and

the legitimate interest in the disclosure clearly outweighs the public interest in the non-disclosure, bearing in mind that:

an overriding requirement of the need for disclosure is proved,

the circumstances are of a sufficiently vital and serious nature,

the necessity of the disclosure is identified as responding to a pressing social need, and

member States enjoy a certain margin of appreciation in assessing this need, but this margin goes hand in hand with the supervision by the European Court of Human Rights.

The above requirements should be applied at all stages of any proceedings where the right of non-disclosure might be invoked.

Finally, we must not forget that revealing a source also implies data processing. And that the source is also a data subject that has the rights conferred on it by the GDPR. Therefore, if the source is an individual, you will probably be able to preserve his or her identity on the basis of the GDPR. Indeed, if the subject of a story makes a subject access request and this could only be satisfied by disclosing the identity of your sources, you can only proceed if the source consents, or if it is reasonable to do so, all circumstances considered. If the source is an organization, circumstances change since they do not have personal data. So, journalist need to rely upon the journalism exemption to withhold its identity if they are not willing to reveal its name or if it is not appropriate to disclose it.

6.3 Minors and vulnerable population

You must be especially careful if you are willing to process data of minor or vulnerable population. First, the legal basis for such processing might be feeble. Consent of a minor will only be valid if such minor can provide it according to the Member state legal framework. The GDPR establishes a minimal age, but Member states are empowered to raise it. Therefore, you must get informed about this. If the minor or the vulnerable people are unable to consent, their legal representatives should provide consent.

If you cannot obtain an informed consent, then processing should be based on the legitimate interest basis. However, the legitimate interest pursued by the controller does not apply “where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” Therefore, it is highly improbable that the balancing test allows for the processing of personal data corresponding to minors. In our opinion, similar thought are applicable to vulnerable population. The Guidelines on Safeguarding Privacy in the Media include a summary of two cases related to minors.

“In Kahn v. Germany, pictures of two children of Oliver Kahn, a former goalkeeper of the German national football team, and his wife were featured in a magazine. The journalists were fined because they had violated the family’s right to privacy. All the photos showed the children in the company of their parents or on holiday, though the subject of the reports had not been the children themselves, but rather their parents’ relationship and Oliver Kahn’s career.
In Reklos and Davourlis v. Greece, taking pictures of a new-born baby without the consent of his parents (in the intensive unit to which only hospital staff should have had access) was considered to be a violation of the right to privacy even though the pictures were not published”.

Notice that this last sentence is particularly relevant, since it focuses on the need to have a legal basis for data processing at them moment when the photographs are made. The decision of not publishing them only avoids a subsequent unlawful processing (publication), but does not mend the previous infringement of the right to privacy.

6.4 Takeaway points

There are some tips that might serve well as a summary of the things that must know about data protection compliance. In general, you should always keep in mind that:

Publication of personal data means data processing. Therefore, you must be sure that you are allowed to show these data before proceeding to do so. At that moment you must have a legal basis that allows processing. Otherwise, it would be unlawful.
If the personal data is processed in order to serve the public interest (“journalistic purposes”), it is likely that the processing will not have to comply with some or all GDPR articles. Conversely, this means that if personal data is collected, analyzed or otherwise processed for other reasons, the GDPR will apply in full.
Publishing sensitive information might cause considerable harm to private life of the data subject. You must be sure that benefits to public interest justifies this harm. To this purpose, you should balance the interest at stake, considering different levels of intrusion into their private life of the data subject. Only when public interest considerations clearly prevail against their privacy you are allowed to publish this information.
The intervention of senior editorial or the use of expert input might be of great help to ensure that this requirement applies. Never forget that usually the interested journalists are not so objective while balancing the different interests involved.
Always remember that you should only gather data that are relevant to your investigation and might be of public interest. If, for instance, you are investigating a politician on the basis of a possible corruption practice and you discover sensitive information about his or her sexual orientation, you should not process it, provided that it is not relevant for the issue at stake. This is an essential requirement of the minimization principle, a key concept in the GDPR.
In particularly contentious cases, where it is not entirely clear if or to what extent the “journalistic exemption” applies to data processing, an audit trail should be kept in order to explain the data protection considerations, as well as the consultation from the lead supervisory authority, should be sought (Biriukova, 30).
Special precautions must be adopted where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures.
Data concerning vulnerable population and specially minors should only be processed if strong reasons justify it. You must be absolutely sure that they apply to the concrete processing before proceeding with it.

6.5 Questions & Answers

How to handle data publicly available in a non-structured format with the purpose of compiling a new dataset that could possibly lead to valuable information, but also harm vulnerable people. (e.g. scraping [public] personal data from a social media)?

In general, you should always find a suitable legal basis to data processing. As previously mentioned, legitimate interest is, in the absence of consent, the most suitable one. If we are talking about vulnerable population, this should be included prominently in the balancing test. Processing would only be lawful if public interest is so strong that it overwhelms the data subject interest.

Scraping as such does not introduce novelties in this basic rule. Even thought some data might be public, this does not mean that you can use them as you wish. In the case of data that are expressed in a social network, you should also take into account that you are also a user of that network. Thus, the Terms of Service are applicable to you. This should not in principle mean too much, but you should keep it in mind. Detailed information about this is available here:

Moreno Mancosu, Federico Vegetti, What You Can Scrape and What Is Right to Scrape: A Proposal for a Tool to Collect Public Facebook Data, Social media + Society, Volume: 6 issue: 3, Article first published online: July 31, 2020; Issue published: July 1, 2020, at: https://journals.sagepub.com/doi/full/10.1177/2056305120940703

How to behave when you want to send a press release to another journalist’s professional email address (assuming you didn’t have any prior contact). Should you ask for permission beforehand (and how, if not by email) or should you presume he has an interest on being informed, so you send her your press release and give her the possibility to opt-out?

In general, you can send emails to people’s professional addresses, provided that:

You have a good reason to think that the recipient can benefit from the information provided by the press release.
You should inform the recipient what personal data you are processing, for what purpose, and how they can remove their data from your mailing list, or change them, in case this list exists.
Furthermore, you should not process the addressees’ personal data (storage, for instance) for longer than necessary.

What about follow-up emails, for instance?

Sending follow-ups does not violate GDPR if it meets the three requirements described in the answer above. Data processing in case of a follow-up message should follow the same rules than a preliminary message.