Personal data and freedom of expression

Overview

Country
Last reviewed
Personal data and freedom of expression 

Austria 05.06.2018 Sec 9 ADPA provides special provisions concerning the processing of personal data in the context of freedom of expression and information. According to this provisions, several regulations of the GDPR (especially its principles and rights of data subjects) do not apply to the processing of personal data for journalistic purposes as well as for scientific, artistic or literary purposes.
Belgium 17.05.2018 n/a
Czech Republic 16.05.2018 Section 16 of the DPA allows processing of personal data carried out by adequate means for journalistic purposes or for purposes of academic, artistic or literary expression. Sections 17 et seq. stipulate exceptions to information obligation (Section 17), protection of source and content of information (Section 18), exceptions to right to restriction of processing (Section 19), information about rectification and erasure (Section 20), and limitation of right to object (Section 21).
Denmark 22.05.2018 n/a
Finland 17.05.2018 Currently, only limited provisions of the Personal Data Act apply to the processing of personal data for purposes of journalism or academic, artistic or literary expression. The current approach is upheld in section 27 of the proposed Data Protection Act which defines the GDPR articles where the GDPR is not applicable for the purposes of journalism or academic, artistic or literary expression.
France 22.05.2018 Article 40 of the law n° 78-17 of the 6th of January 1978 relating to information technology, files and individual freedom, was not modified. The use of the right of erasure (« right to be forgotten ») can be refused when the processing of data is necessary for the exercise of the freedom of expression and right to be informed.
Germany 23.05.2018 Yes - § 35 of the new German Federal Data Protection Act ('FDPA') exempts the controller from its obligation to erase personal data where the erasure is, in case of non-automatic data processing, impossible, or only possible with disproportionately high effort and the data subject has a minor interest for erasure. § 27(2) FDPA restricts the data subjects' rights subject to certain further requirements.
Hungary 17.05.2018 n/a
Ireland  07.06.2018  Under section 43(1) of the Act, the processing of personal data for the purpose of exercising the right to freedom of expression and information, including processing for journalistic purposes or for the purposes of academic, artistic or literary expression, shall be exempt from compliance with certain provisions of the GDPR where, having regard to the importance of the right of freedom of expression and information in a democratic society, compliance with such provisions would be incompatible with such purposes.

The Data Protection Commission may refer any question of law which involves consideration of whether processing of personal data is exempt under section 43(1) to the High Court for its determination.
Italy 17.05.2018 No deviations from GDPR.
On the basis of the provisions of the Scheme, the Code of Practice concerning the processing of personal data in the exercise of journalistic activities (Annex A of IDPA) will remain in force.
Netherlands 17.05.2018 Draft Act provides that Act will not apply where personal data is processed for journalistic purposes or for the purposes
of academic, artistic or literary expressions. 

"Article 41 GDPR Execution Act provides that the GDPR Execution order does not apply where personal data are processed exclusively for journalistic purposes or for the purposes
of academic, artistic or literary expressions. In addition it sums up a list of chapters and articles in the GDPR that are also not applicable for these purposes: 
(a) article 7(3), 11(2);(b) chapter III;(c) chapter IV (with the exception of articles 24, 25, 28, 29 and 32);(d) chapter V;(e) chapter VI; and (f) chapter VII."
Poland 16.05.2018 PDPA provides that some provisions of GDPR will not apply where personal data is processed for journalistic purposes or for the purposes of academic, artistic or literary expressions. 
Spain 16.05.2018 n/a
Sweden 22.05.2018 The Data Protection Act provides that articles 5-30 and 35-50 of the GDPR shall not be applicable on processing of personal data for journalistic purposes or for purposes of academic, artistic or literary expressions.
UK 23.05.2018

The Act contains a number of specific provisions and exemptions dealing with processing for "special purposes", which covers journalism, academic, artistic and literary purposes.  These are the limited United Kingdom implementation of the requirement in Article 85 of the GDPR for Member States to reconcile the protection of personal data with the right to freedom of expression and they are modelled on the provisions in the Data Protection Act 1998.
 
Special Categories of Data- Lawful basis for processing: 

Schedule 1 (para 13) permits the disclosure of special categories of personal data (sensitive data) and criminal convictions data for "special purposes", provided it is in the substantial public interest and carried out with a view to the publication of the personal data by any person and the controller reasonably believes the publication would be in the public interest. It must also be carried out in connection with (i) the commission of an unlawful act (ii) dishonesty, malpractice or other seriously improper conduct (iii) unfitness or incompetence of a personal (iv) mismanagement in the administration of a body/association or (v) a failure in services provided by a body/association.  This would seem to permit in limited circumstance the disclosure of data to investigative journalists.
 
Exemptions based on Art 85 (2):

Schedule 2 (Part 5): Where personal data are processed for special purposes, with a view to publication by a person of journalistic, academic artistic or literary material and the controller reasonably believes that the publication would be in the public interest, then the "listed GDPR" provisions will not apply to the extent that the controller reasonably believes that the application of those provisions is incompatible with the special purposes.  Controllers must have regard to the ‘special importance of the public interest in the freedom of expression and information’ and to relevant codes of practice such as the OFCOM Broadcasting Code.