Return to the EPC homepage.



Since the very first draft of proposed EU legislation on the processing and free movement of personal data, newspaper and magazine publishers throughout Europe have been concerned at the potential impact of such a directive on the freedom of the press.  It is crucial to the maintenance of a free press that the processing (i.e. collection, storage, processing and final publication) of personal data for journalistic and editorial purposes should be exempted from the scope of the directive. 

The text that was agreed in the Common Position of the Member States was, in our view, the minimum protection needed to guarantee that journalistic freedom was ensured during the implementation of legislation at national level. 

The final version of the directive, adopted by the Member States, contains a last minute amendment (*). This limits the scope of the original exemption significantly by introducing a legislative basis to test against the public interest the rights of publishers to process and ultimately publish personal data  - on a case by case approach. The amendment poses a threat to the fundamental freedom of expression. 

Freedom of expression

Article 10 of the European convention for the protection of Human Rights and Fundamental Freedoms guarantees the freedom of information and the right to receive and impart information.  This is reflected in some EU Member States' national constitutions and also in the Recitals of the Directive, which emphasise the necessity for Member States to provide exemptions and derogations necessary effectively to balance these freedoms with the fundamental rights of individuals.

The need for a broad exemption to guarantee the freedom of the press

The EPC's concern is that, unless there is a broad exemption for publishers for editorial content, the new data protection requirements would provide real practical impediments to newspaper publishing and seriously jeopardise much of our investigative journalism. A case-by-case approach, judged on public interest grounds would be a threat to the freedom and independence of the press in Europe. Furthermore, we would be very concerned if the supervisory authorities were empowered to take ad hoc decisions as to whether or not a particular case was of "important public interest". This would impose unacceptable obligations on publishers to prove necessity in each case.

Data collection and investigative journalism

During the course of their day to day work, journalists collect and store an enormous amount of information, far more than is ever published.  Journalists and their editors need to check facts with as many sources as possible to corroborate their information and make sensible judgements as to if, how and when to use this information.  This means that much data, both personal and general, is stored by journalists and publishers in manual and electronic form. 

Confidentiality of sources

Some of this information has been disclosed to journalists in confidence and as such in the secure knowledge that their sources will not be disclosed.  This confidentiality would be threatened if those under investigation, or officers of the Law or Regulatory Authorities, were able to gain access to confidential files. Publishers are very concerned at the direct conflict between a law relating to the disclosure of information and our commitment to observing confidentiality of our sources. 

Investigation and injunction

We are concerned that persons under investigation, notably those who are alleged wrong-doers or suspected of behaving badly, could seek a request for an injunction, and thus interfere with investigative journalism and the freedom of the press.  Under threat of an injunction, confidential sources would dry up; publication could be delayed; and ultimately the investigation might be thwarted which would be contrary to the public interest. 


Publishers are concerned that Data Protection legislation will be used as a means of introducing a wider right of privacy.  Any attempt to introduce restrictive privacy measures  via legislation designed for different purposes will not be acceptable to publishers as it would threaten the freedom of the press. 

The impact of digital technology

The advent of digital technology makes it easier to store, process and manipulate large amounts of detailed text and images.  But this is not sufficient reason to increase powers of an individual's access to information held by publishers. It is undoubtedly technically easier for individuals to access and search such information in digital format; we are concerned that we face challenges to the editorial process, using data protection legislation as justification. 


Internal Market and Financial Services
Free movement of information, company law and financial information
Free movement of information and data protection, including international aspects


Working Party on the Protection of Individuals
with regard to the Processing of Personal Data

Recommendation 1/97
Data protection law and the media.
Adopted by the Working Party on 25 February 2023


1. Introduction

2. General Aspects

2.1 Freedom of expression and the protection of privacy

2.2 Legislative history of art. 9 of the directive.

2.3 Summary of the current situation in national law.

3. Conclusions
Done at Brussels, 25 February 2023
For the Working Party
The Chairman

The working party on the protection of individuals with regard to the processing of personal data

set up by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995,

having regard to Articles 29 and 30 paragraph 3 of that Directive,

having regard to its Rules of Procedure and in particular to articles 12 and 14 thereof has adopted the present recommendation:

1.  Introduction

Article 9 of directive 95/46/EC on the protection of individuals with regard to the processing of personal data and the free movement of such data (‘the directive’) reads as follows:

    Member States shall provide for exemptions or derogations from the provisions of this          Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.
The Working Party, following the mandate laid down in art. 30 1 a) of the directive, started discussions during its first meeting on the possible implementation of article 9. Working Documents were presented by the UK and the German delegations. During the debate it emerged that national laws currently differ as to the application of data protection provisions to the media.

It was recognised that the Working Party could usefully give some guidance on the interpretation of article 9 of the directive. As a preliminary step it was agreed that the secretariat should collect information on the current legal situation and produce a report taking into account the report on ‘Data Protection and the Media’ issued by the Council of Europe in 1991.

A questionnaire drafted by the Working Party was distributed on 21 February 1996.

The Working Party discussed a working document at its third meeting and reached some conclusions which were discussed in detail in the fourth meeting. In the light of the content of these conclusions a consensus emerged for adopting the document as a recommendation within the meening of article 30 paragraph 3 of the directive. The recommendation was adopted by the Working Party on 25 February 1997.

The following section outlines some general aspects of the application of data protection law to the media including the legislative history of article 9 of the directive. Section three summarises some of the main features of the current legislative situation at national level. The fourth section includes the conclusions of the discussion of the working party as to the application of data protection law to the media.

Article 9 provides for limitations and exemptions from the application of certain provisions of the directive in relation to processing of data for journalistic purposes as well as for purpose of artistic and literary expression. The debates of the Working Party focused on data processing by the media for journalistic purposes. The present recommendation therefore focuses on exemptions and derogations in relation to processing for journalistic purposes.

2. General Aspects

2.1 Freedom of expression and the protection of privacy

Article 10 of the European Convention for the protection of Human Rights and fundamental freedoms (ECHR) establishes that:

    Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and to impart information and ideas without interference by public authority and regardless of frontiers.[..]
This right is one of the fundamental human rights deriving from the constitutional traditions common to the Member States and is one of the most characteristic elements of the legal heritage of democratic societies. Historically it was one of the first human rights to be demanded and indeed guaranteed in law. The press in particular received special legal and constitutional guarantees, in particular against prior censorship.

The right to privacy is similarly guaranteed by article 8 of the ECHR. Data protection comes within the scope of the protection of private life guaranteed under this article. Derogations to the principles of data protection and to article 8 of the ECHR must be in accordance with the law and must respect the principle of proportionality. Equally limits to freedom of expression, such as the ones that might derive from the application of data protection principles, must also be in accordance with the law and respect the principle of proportionality.

However the two fundamental rights must not be seen as inherently conflicting. In the absence of adequate safeguards for privacy individuals may be reluctant to freely express their ideas. Similarly identification and profiling of readers and users of information services is likely to reduce the willingness of individuals to receive and impart information.

2.2 Legislative history of art. 9 of the directive.

According to article F paragraph 2 of the Treaty on European Union the Union shall respect fundamental rights as guaranteed by the ECHR and the constitutional traditions common to the Member States.

The Community legislator has acknowledged the particular case of the media and the need to strike a balance between protection of privacy and protection of freedom of expression.

Art. 19 of the original Commission proposal provided that Member States might grant derogations from the provisions of the directive in favour of the press and the audiovisual media. The explanatory report made it clear that the key feature of this article is the obligation to balance the interests involved and that this balance may take into account the availability of other remedies or of a right of reply, the existence of a code of professional ethics, the limits laid down by the ECHR and the general principles of law.

Article 9 of the Commission’s modified proposal made the granting of derogations for the media mandatory. The text was also modified as to include journalists and in order to limit the derogations to journalistic activities.

The article was further modified to its current drafting so that derogations may not apply indiscriminately to all the data protection provisions. Under the current text the derogations are indeed mandatory but ‘only if they are necessary’ meaning that the derogations to each specific principle of the directive must be granted only in so far (French "dans la seule mesure où" German "nur insofern vor, als sich dies als notwendig erweist") as it is necessary to strike a balance between privacy and freedom of expression. Furthermore these derogations may only concern the general rules on the lawfulness of the processing of personal data, the rules on transfer of data to third countries and the rules on the supervisory authority. According to recital 37 no derogations from the rules on security shall be possible and the supervisory authorities responsible for this sector should be provided at least with certain ex-post facto powers such as the power to publish regular reports or to refer matters to the judicial authorities.

2.3 Summary of the current situation in national law.

The different national laws currently address the issue by taking one of the following approaches:

    a) In some cases data protection legislation does not contain any express exemption from the application of its provisions to the media. This is the current situation in Belgium, Spain, Portugal, Sweden and the United Kingdom.
    b) In other cases the media are exempted from the application of several provisions of data protection legislation. This is the current situation in the case of Germany, France, The Netherlands, Austria and Finland. Similar derogations are envisaged by the draft Italian legislation.
    c) In other cases the media are exempted from general data protection legislation and regulated by specific data protection provisions. This is the case in Denmark for all media and in Germany in relation to public broadcasters, which are not covered by federal or Länder data protection laws, but are subject to specific data protection provisions in the inter-Länder treaties which regulate them.
The differences between these three models should not however be over-estimated. In most cases, independently of any express derogation that may exist, data protection legislation does not apply fully to the media because of the special constitutional status of the rules on freedom of expression and freedom of the press. These rules place a de facto limit on the application of substantive data protection provisions or at least their effective enforcement.

On the other hand the ordinary data protection regime generally applies to non editorial activities performed by the media.

Data protection supervisory authorities when applying data protection law recognise the particularity of the media both where a special legal regime exists and where it does not.

The effective extent of the derogations furthermore cannot be assessed in abstract terms but it is dependent on the overall structure of the data protection legislation in each given country. Clearly the extent of the derogations needed is dependent on the extent to which the substantive rules would effectively have a bearing on the activities of the media.

The differences as to the application of data protection law to the media may also be explained by changing perspectives both on the role of data protection law and on the use of information technology by the media. In the early days of data protection the attention tended to focus on large mainframe-based databases. In those days the media seemed hardly concerned by such rules and no derogations from them therefore seemed necessary. The shifting emphasis of data protection law towards the notion of processing and the extensive use of information technology by the media have fundamentally changed the situation.

One important element that emerges from the current legislative situation in the Member States is that the media, or at least the press, are bound to respect certain rules which although not part of data protection legislation in a proper sense contribute to the protection of the privacy of individuals. Such legislation and the often rich case-law on the matter confer specific forms of redress which are sometimes considered a substitute for the lack of preventive remedies under data protection law.

The right to reply and the possibility to have false information corrected, the professional obligations of journalists and the special self-regulatory procedures attached to them, together with the law protecting honour (criminal and civil provisions concerning libel) must be taken into consideration when evaluating how privacy is protected in relation to the media.

The moving of traditional media towards electronic publishing and the provision of on-line services seems to add further elements for reflection. The distinction between editorial activities and non-editorial activities assumes new dimensions in relation to on-line services which, unlike all traditional media, allow an identification of the recipients of the services.

3. Conclusions

The foregoing seems to confirm that a general reassessment of the legislative framework for the application of data protection law to the media is needed in each Member State. In this regard it is necessary to evaluate to what extent the application of each provision of chapters II, IV and VI of the directive needs to be limited in order to protect freedom of expression.

In doing so several elements must be born in mind

  • Data protection law does in principle apply to the media. Derogations and exemptions may be granted only in relation to Chapter II on the general measures on legitimacy of data processing, Chapter IV on data transfers to third countries and Chapter VI on the powers of supervisory authorities. No derogation or exemption from the provisions on security may be granted. Supervisory authorities responsible for this sector must in all case retain certain ex-post facto powers.
  • Derogations and exemptions under article 9 must follow the principle of proportionality. Derogations and exceptions must be granted only in relation to the provisions likely to jeopardise freedom of expression and only in so far as necessary for the effective exercise of that right while maintaining a balance with the right to privacy of the data subject.
  • Derogations and exemptions under article 9 might not be necessary where the flexibility of various provisions of the directive or the derogations allowed under other specific provisions (which of course must also be interpreted narrowly) already allow a satisfactory balance between privacy and freedom of expression to be struck.
  • Article 9 of the directive respects the right of individuals to freedom of expression. Derogations and exemptions under article 9 cannot be granted to the media or to journalists as such, but only to anybody processing data for journalistic purposes.
  • Derogations and exemptions may cover only data processing for journalistic (editorial) purposes including electronic publishing. Any other form of data processing by journalists or the media is subject to the ordinary rules of the directive. This distinction is particularly relevant in relation to electronic publishing. Processing of subscribers data for billing purposes or processing for Direct Marketing purposes (including processing of data on media use for profiling purposes) fall under the ordinary data protection regime.
  • The directive requires a balance to be struck between two fundamental freedoms. In order to evaluate whether limitations of the rights and obligations flowing from the directive are proportionate to the aim of protecting freedom of expression particular attention should be paid to the specific guarantees enjoyed by the individuals in relation to the Media. Limits to the right of access and rectification prior to publication could be proportionate only in so far as individuals enjoy the right to reply or obtain rectification of false information after publication.
  • Individuals are in any case entitled to adequate forms or redress in case of violation of their rights.
In evaluating whether exemptions or derogations are proportionate, attention must be paid to the existing ethic and professional obligations of journalists as well as to the self regulatory forms of supervision provided by the profession.