The document discusses the complexities of data protection laws as they apply to journalism under GDPR, particularly the balance between data protection and freedom of expression. It highlights the variability in how member states implement these regulations, along with the supervisory roles of data protection authorities. The text also addresses the challenges posed by citizen journalism and the potential for co-regulatory approaches to manage these new dynamics.

1. Dr David Erdos
University of Cambridge

2. Why a Tension? Broad Scope & Broad Duties
Data Principles
& Legal
Grounds
Transparency
& Control
Rights
Sensitive Data
Rules
Integrity &
Supervision
Personal
Data
Processing


3. Journalism: Very Special GDPR Treatment
 Article 85(2):
 Recital 153 (following CJEU Satamedia case law):
o Only should adopt limits were “necessary for the purpose of
balancing” DP & freedom of expression in EU Charter.
o Only “certain provisions” require derogations (N.B. art. 85(2) itself
excludes chapter on remedies, liabilities & penalties).
o Should interpret journalism “broadly”.
“For the processing carried out for journalistic purposes … Member
States shall provide exemptions or derogations … if they are necessary
to reconcile the right to the protection of personal data with the
freedom of expression and information.”

4. Journalism in Member State DP Law
 Substance:
o Vast majority subject journalism to qualified DP standards
o But wide divergence ranging from no explicit limitation (e.g.
Spain, Croatia) through to complete exemption (e.g. Sweden)
 Supervision:
o Some court supervision exists in all States.
o Some DPA supervision exists in almost all States, in a few
outsourced to specialist body (e.g. Lithuania) & in well over half
with explicit legal limits.

5. Taking Stock
 DPAs remain “the guardian” of DP rights even in
relation to journalism.
 Standard-setting & enforcement duties follow.
 But many (usual and unusual) challenges:
 Resource
 Legal
 Epistemic

6. Solutions: Encouraging Meta/Co-Regulation?
No Self-Regulatory Body
- Fully independent assessment.
- “Advise and persuade” not ruled out.
- But use of formal powers more likely.
Non-Accredited Body
- Encourage use by data subjects.
- Take into account, liaise and cooperate.
- But ultimately independent assessment
Accredited Body (cf. GDPR, A 40-41)
- Meta-regulatory review.
- Reasonableness standard otherwise.
- Intervene in serious individual cases

7. “Citizen Journalism”: A Proverbial Elephant?
 Not only media but also amateurs engage in journalism.
 Supervisory role here could overwhelm DPAs.
 But problem can be mitigated:
 Core of co-regulatory standards developed with media could
also prove useful in citizen context.
 Number of “impactful” amateurs may be more manageable.
 Platforms might play a similar co-regulatory role here with
oversight & without invalidating core freedoms.

8. For More Developed Thoughts: