In November 2021 the Supreme Administrative Court (Decision No. 11636 of 16 November 2021) rendered a rather significant decision which will not only determine the courts’ case law for the future but will also set an example of how media should approach personal data.

The case was initiated by a complaint of a public figure to the Commission for Personal Data Protection (CPDP) against an electronic media outlet. The media had publicly announced information about the person’s physical identity (names, PIN with the last four digits deleted, address), economic identity (property with a full address, description, price, entries, mortgage, deletion of mortgage, financial situation, participation, and membership in a non-governmental organisation) and social identity (profession, place of work, employment, affiliation information).

The media justified the publication of these data with journalistic purposes and argued that it used publicly accessible information from the Registry Agency.

In its argumentation, the Supreme Administrative Court supported the reasoning previously sustained by the Constitutional Court that the balance of these two competing rights requires a specific case-by-case assessment. The Constitutional Court annulled the provision of the Personal Data Protection Act stipulating fixed criteria regarding the admissibility of personal data processing for the purposes of journalism, academic, artistic, or literary expression. You can find more on the Constitutional Court’s decision and its impact here.

The Supreme Administrative Court emphasised that under the Personal Data Protection Act the processing of personal data carried out for journalistic purposes is lawful when carried out for the exercise of freedom of expression and the right to information, insofar as the privacy is respected. The decision stated that the online media outlet acting as a data controller has violated the principle of data minimisation, which resulted in the imbalance between the two rights. According to the argumentation of the Supreme Administrative Court, the need to inform the public about the facts and to preserve the topic of the article can be carried out successfully without indicating the date of birth of the public figure or the exact number of his apartment and the property identifier. The fact that this information is publicly available in a public registry does not justify the disclosure of personal data as the publication in the public registry has different purposes than media publications. Moreover, the information available in the public registry is not immediately accessible to the public, but a certain administrative procedure should be followed. The processing of personal data for the purpose of journalistic activity, therefore, is a completely separate processing with its own purposes, which should comply independently with the requirements of the GDPR.

The decisions of the Constitutional Court and the Supreme Administrative Court coincide with the jurisprudence of the European Court of Human Rights and the European Court of Justice.

The balance between the rights must be found through a rational and pragmatic approach that takes into account the specific circumstances of each case. The current line of interpretation is likely to be followed by other courts and will be the basis for establishing lasting case law in resolving disputes on the balance between freedom of expression and the right to information on the one hand and personal data protection on the other. There is no doubt that this decision will also have a significant social and public impact in the context of journalistic expression resulting in the media’s more considerate approach regarding personal data publication.  

The complete text of the Supreme Administrative Court’s decision can be found here.

‍