Problems in ensuring the proper implementation of personal data processing for journalistic purposes in the Ukrainian and European Union law

First of all, it is necessary to clarify the essence of the right to the protection of personal data and the right to journalism in order to understand how they relate to the interests of society. According to Article 8 of the European Convention on Human Rights (ECHR), everyone has the right to respect for their private and family life, their home and their correspondence. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary for a democratic society in the interests of national security, public safety or the economic well-being of the country; for the prevention of disorder or crime; for the protection of health or morals; or for the protection of the rights and freedoms of others.

Article 8 of the EU Charter of Fundamental Rights (CFR) also states that everyone has the right to the protection of personal data concerning them. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access data that have been collected concerning them and the right to have it rectified.

At the same time, Article 10 of the ECHR declares freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.

In addition, Article 19 of the International Covenant on Civil and Political Rights (ICCPR) states that everyone shall have the right to freedom of expression; this right shall include freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of their choice.

Besides, the International Principles of Journalistic Ethics that were approved at the international conference in Paris in 1983 also provide for a person's right to private life. In particular, this is mentioned in the sixth principle – respect for private life and human dignity. An integral part of the professional standards of the journalist is respect for the right of the individual to privacy and human dignity, in conformity with provisions of international and national law concerning the protection of the rights and the reputation of others, prohibiting libel, calumny, slander and defamation.

Thus, the freedom to receive information and ideas concerns the mass media in the aspect of giving them directly or journalists as their representatives the opportunity to transmit such information and ideas to the public as this is necessary for the normal functioning of any democratic society. Therefore, regardless of the absence of a direct indication of the right to journalism in Article 10 of the ECHR, it logically follows from it, as evidenced by a significant array of cases of the ECtHR and the reality that victims of violations of the right to freedom of expression, especially on the part of state authorities, more often than anyone else, it is journalists.

For example, in the Declaration of the Committee of Ministers on the Protection of Journalism and the Safety of Journalists and Other Media Participants, adopted by the Committee of Ministers on 30 April 2014, at the 1,198th meeting of the Permanent Representatives of Ministers of the Council of Europe, it is noted that journalists and other media participants in Europe are increasingly persecuted, intimidated, deprived of liberty, physically assaulted and even killed because of their investigative work, views or reporting. These violations and crimes are often accompanied by insufficient efforts to bring perpetrators to justice by public authorities, leading to a culture of impunity.

As for the regulation of these rights in Ukraine, considering the fact that the Verkhovna Rada of Ukraine ratified both the ECHR and the ICCPR, the Ukrainian side definitely recognises all the rights and freedoms defined in them.

Regarding direct national regulation, article 32 of the Constitution of Ukraine guarantees that no one can experience interference in their personal and family life, except for the cases provided for by the Constitution of Ukraine. It is not allowed to collect, store, use and distribute confidential information about a person without their consent, except in cases specified by law, and only in the interests of national security, economic well-being and human rights. Moreover, according to para.1 of Article 34 of the Constitution of Ukraine, everyone is guaranteed the right to freedom of thought, speech and free expression of their views and beliefs.

To conclude, the provision of the right to privacy, the protection of personal data and the implementation of journalistic activities are important elements of the progress and development of a democratic society. However, the realisation of the right to journalism may require the use of personal data of other persons and formally come into conflict with their right to inviolability of private life.

The American Society of Professional Journalists in its code advises weighing the consequences of disclosing personal information about private and public persons: realise that private people have a greater right to control information about themselves than public figures and others who seek power, influence or attention. Weigh the consequences of publishing or broadcasting personal information.

Such contradictions in a democratic society are considered only in court in order to achieve a balance between these rights, but sometimes, it is difficult to ensure equally effective protection. Therefore, legal regulation in the field of personal data should establish certain exceptions for such activities and at the same time provide appropriate guarantees of compliance with the right to privacy. For this purpose, the GDPR was developed, the content of which are discussed in the following text.

The GDPR is one of the most crucial steps in the global recognition of the importance of data protection, which, however, might come into conflict with freedom of expression. The GDPR requires member states to balance data protection and other fundamental rights, including freedom of expression since the text of Regulation contains a general declaration of observance of all fundamental rights and freedoms and the need to find a balance between them in accordance with the principle of proportionality.

Article 85 of the GDPR establishes that member states shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. According to para.3 of this article, the individual member states define the journalistic exemption and notify the Commission of the provisions of the law that it has adopted.

The question is whether the distinctions between the national implementation can create practical difficulties for journalists operating in different member states. Media representatives in one EU country might be exempted from the requirements to comply with some of the data protection rules, whereas others not. The EU left it to the member states to strike the difficult balance between data protection and freedom of expression because different member states have different traditions in this context. For example, the Netherlands tends to give more weight to freedom of expression than Spain (Hoofnagle et al., 2019).

It is also important to define the scope of Article 85 of the GDPR, who exactly falls under the journalistic exemption – any person who publishes information or only professional journalists, and what type of activities can be considered as needed for ‘journalistic purposes’. The personal scope of Article 85 GDPR covers every person as such who can rely on the exemption, which is also confirmed by the Court of Justice of the European Union (CJEU) case law. For instance, in Satamedia, the CJEU stated that the journalistic exemption (of the DPD) applies to every person engaged in journalism (Satamedia, para.58). Since the GDPR brought only little changes in the DPD's journalistic exemption, statements about personal scope are still relevant.

In Google Spain, the Court recognised that any publisher of a webpage may with information about an individual could, depending on the purposes of the publication, legitimately fall within the scope of journalistic purposes. At the same time, the Court was very specific to explicitly state that operators of the search engines, such as Google, cannot rely on this derogation (Google Spain, para.85). Moreover, in Sergejs Buivids v Datu valsts inspekcija, the CJEU held that the fact that the applicant was not a professional journalist did not preclude the application of the journalistic exemption (Buivids, para.55), (Post, 2018).

At the same time, the material scope of Article 85 of the GDPR is the key to understanding what activities should be exempted. Recital 153 of the GDPR emphasises the need to provide for exemptions pursuant to Article 85(2) is most pressing for the audiovisual field and in news archives and press libraries. Moreover, in Satamedia, the Court took into account the importance of the right to freedom of expression in every democratic society and stated that it is necessary to interpret notions relating to that freedom, such as journalism, broadly (Satamedia, para.56).

The essential position can be found in Buivids where the Court established that journalistic activities are those which have as their purpose the disclosure to the public of information, opinions or ideas. Therefore, recording and uploading a video on a video-sharing platform may, according to the CJEU, be described as an activity performed for journalistic purposes. The CJEU held that processing of personal data may be considered to be for journalistic purposes if the video in question was published on an Internet site to draw to the attention of society alleged police malpractice (Buivids, para.60).

The ECtHR plays a very important role in balancing the right to journalism and the right to the protection of personal data since the Court compares Articles 8 and 10 of the ECHR, making it possible to get an answer to the question of whether there is widespread information about the private and family life of a public figure matter of public interest, whether the public's right to know that information prevails over the owner's right to protect it. Usually, the right to the protection of personal data is recognised by the court, but first, it is carefully ascertained whether such protection would not interfere with the right to express opinions using a proportionality test consisting of the following questions: (1)

whether the interference was ‘prescribed by law’,

In addition, the ECtHR, analysing whether the specified balance between the rights guaranteed by Articles 8 and 10 of the Convention, establishes the following: (1)

contribution of material (publication) to the discussion that is of public interest;

The specified criteria are analysed in the most detailed manner in the decisions of the ECtHR: Von Hannover v. Germany (No. 2) and Axel Springer AG v Germany. The first of these decisions concerned the complaints of the applicant, Princess Karolina von Hanover, under Article 8 of the Convention on the dissemination by the media of information about her personal life, namely, vacation photos taken while her father, Prince Rainier III of Monaco, was in a critical condition. The court established that the photograph was not offensive and was a matter of public interest; therefore, the balance between the applicant's rights to the protection of private life and the publishing house's right to freedom of expression was observed, the violation of Article 8 of the ECHR is absent.

Regarding Axel Springer AG v Germany, the owner of the newspaper complained that he had been fined 1,000 euros for distributing material about the private life of a well-known actor who had committed a crime. First of all, the Court emphasised that information about the investigation of crimes is a matter of general interest, but when such cases concern an actor, a well-known public figure, this further increases the public interest; therefore, the publication of such information is lawful, and the sanction applied to the newspaper is not justified. Consequently, there has been a violation of Article 10 of the ECHR.

These decisions also confirm the opinion that a journalist serves society as a ‘public watchdog’, which spread thanks to the decision in Foglia v Switzerland, where the Court drew attention to the special importance of journalism in a democratic society and its role as a ‘watchdog’. At the same time, according to the European Court, journalistic freedom includes the right to use exaggerations or even provocations. This role of journalists is especially clearly revealed when publishing information about politicians. As the Court noted in Társaság a Szabadságjogokért v Hungary, allowing public figures to censor the press and public discussion under the guise of protecting their personal rights would be fatal to freedom of political expression. In short, the more public a person is, the more their right to privacy can be restricted and the less chance they have to protect their reputation. In Lingens v Austria, it is noted that a politician who is used to criticising his opponents should expect sharper criticism than other people (Lingens v Austria, para.43).

However, it should be remembered that the search for sensationalism by journalists can never be a justified violation of the right to the protection of personal information. In assessing whether there is a public interest justifying an interference with the right to respect for private life, one should focus, as noted by the ECtHR in Mosley v United Kingdom, on whether the publication is in the public interest, not on whether the public is interested in reading it.

For instance, in Standard Verlags GmbH v Austria (No. 2), a newspaper violated the privacy of the persons concerned when it published an article commenting on rumours that the wife of the Austrian President sought to divorce him and was maintaining close contact with another politician. According to the Court, journalists can report information concerning politicians' state of health, which might prevent them from exercising their duties, but the same freedom does not apply to pointless gossip about their marriages.

In contrast to this decision, the legitimate aim of the interference, according to the ECtHR, for example, in the case of L.B. v Hungary, can be the protection of the economic well-being of the country and the interests of third parties in relation to debtors through the provision of information about their financial condition. The Court also stated that since access to such information about the fulfilment of a person's tax obligations has an impact on the integrity of business and the functioning of the economy, the Court is ready to accept that the disclosure of a list of persons who owe a significant amount of taxes had informational value for the public as a matter of public interest (L.B. v Hungary, para.53).

According to the GDPR, EU member states have to define the journalistic exemption and notify the Commission of the provisions of its law that was adopted. Nani Jansen Reventlow points out that only 16 of 28 member states had legislated for a journalistic exemption and the quality of those provisions varies greatly, resulting in an inconsistent legal landscape for the protection of freedom of expression under the GDPR. For instance, he believes that the Slovak Republic's Data Protection Act could be problematic as it carves out an ‘exception to the exception’: Personal data may be processed for journalistic purposes without a data subject's consent, except where this would violate her personality protection or privacy. It is difficult to imagine how a reporter would be able to escape this circular reasoning when investigating a potential case of corruption (Reventlow, 2020).

Some member states such as Hungary and Croatia failed to implement any specific exemptions for journalistic expressions in their national legal order. Analysing the adopted legislation of other countries containing journalistic exemptions, it can be concluded that some countries are trying to establish as clearly as possible the personal and material scopes of the journalist exemption. For instance, according to the Austrian Data Protection Act, only media companies, media services and their employees may avail of the journalistic exemption when processing personal data for journalistic purposes. In contrast, the Romanian legislator introduced no limitation as to the personal scope of the journalistic exemption but seriously limited its material scope (Rucz, 2022).

On the other hand, some countries simply declare the general possibility of protecting freedom of expression. The Spanish Data Protection Act gives no indication at all of how GDPR requirements should be reconciled with journalism or freedom of expression. Other than a general mention of freedom of expression in the preamble and a provision in its operative section stating that everyone has the right to freedom of expression on the internet, the Act is silent about the GDPR, leaving great uncertainty on the protection offered to journalistic processing (Reventlow, 2020).

An interesting case also happened in Bulgaria, where the Constitutional Court declared the national approach towards the implementation of Article 85 unconstitutional. This was due to the inclusion of an article in the Personal Data Protection Act that set out 10 criteria for deciding whether journalists have complied with the balance between the right to information and that of personal data protection. The Court considered that such criteria were too vague and could create a risk of arbitrary interpretations, a circumstance that opened the way for the Commission for Data Protection to have unpredictable power to interpret it not necessarily in the public interest regarding pluralistic information about the policies and activities of government.

As a result, while the GDPR does acknowledge the potential friction between journalistic freedoms and data protection standards, the flexibility reserved for Member States provides scope to implement overly narrow exemptions for journalist expressions. These narrow, or non-existent, exemptions can in turn allow the GDPR to be invoked in order to suppress public interest journalism and silence public watchdogs (Rucz, 2022). Therefore, some Member States have to revise or adapt their national laws to equally balance data protection with the right to journalism by providing more clarity on the scope of the journalistic exemption.

Ukraine strives to ensure non-discriminatory access to information while taking into account the interests of citizens and their right to privacy. Ukrainian journalists quite often reveal corruption schemes, abuses and shortcomings in the work of authorities and state institutions, which require the disclosure of certain personal data. In order to understand how the state tries to resolve this conflict of interests, first of all, turn to the requirements of the Law of Ukraine ‘On Protection of Personal Data’, which in Article 25 provides that the processing of personal data for journalistic and creative purposes is allowed without applying the provisions of this Law, provided that the balance between the right to respect for private life and the right to freedom of expression.

Under normal conditions, the specifics of journalistic activity do not fall within the scope of the Law. However, if the interference with a person's right to respect for private life as a result of the processing of their personal data by journalists is excessive, when compared with the public interest in the covered information (a person's personal data) or its public importance, issues of compliance with the legislation on the protection of personal data may be raised (Bem and Horodyskyi, 2018).

In the conditions of the current Russian-Ukrainian war, coverage of military events by journalists causes a growing need for the use of personal data. As the world's attention is riveted on the situation in Ukraine, one of the most effective tools journalists use to convey information and combat both censorship and Russian propaganda is reporting on the personal stories of Ukrainians affected by the war. Such content should be presented with the utmost respect for the dignity of the victims, so journalists should take care that such dissemination does not harm their legitimate interests as information about Russian war crimes is in many cases sensitive for the victims and their relatives, but the protection of personal data should not prevent freedom of speech.

Consequently, the development of real mechanisms for fulfilling the requirements of the legislation while maintaining a balanced approach is now a particularly urgent task. Considering this, as well as based on Ukraine's aspiration to become a member of the EU, the state should work to uphold democratic European values and prevent unjustified interference with freedom of speech.

Furthermore, in Ukraine, the publication of personal data directly by journalists to cover the activities of certain public figures is also a problematic issue. For example, in 2019, a former deputy of the Verkhovna Rada of Ukraine announced the personal data of the participants in the Radio Liberty project based on their investigations into its activities. Journalists, especially investigators, are guided by the public interest, and public figures should be aware of this and respect the right of media workers to focus on topics of possible abuse of power as a result of their non-public contacts with politicians, former politicians or businessmen. The disclosure of personal data of media employees endangers their lives and health, and threats and pressure have obvious signs of hindering the legitimate professional activities of journalists (LB.UA, 2019). Hereby, the question of the actual implementation of international standards of journalistic activity remains open, which will give more security guarantees to Ukrainian journalists.

Adoption of the GDPR not only created a more coherent data protection framework in the Union (GDPR, recital 7) but also provided for the possibility of applying the requirements established by it to stakeholders outside the EU, including Ukrainian ones. Despite the fact that Ukraine is not yet a member state of the EU, the rules acknowledged in the GDPR can be applied directly to Ukrainian entities since the GDPR has an extraterritorial effect.

According to clause 11 of the Action Plan, for the implementation of the Association Agreement between Ukraine and the EU approved in 2017, Ukraine should improve the legislation on personal data protection in order to bring it into line with the GDPR. However, regardless of the extent to which GDPR provisions are implemented in the national legislation of Ukraine, its requirements will apply to Ukrainian companies seeking cooperation with EU resident companies.

Accordingly, this applies to the journalistic exemption, which Ukrainian journalists can also use, but the high-quality implementation of international standards of journalism and directly of the GDPR should be a priority task for Ukraine. Cooperation with European countries will strengthen the state's capabilities in the field of personal data protection, which will also contribute to the creation of a coherent European environment in safety and security, without the fear of censorship or restraint for journalists in particular. For further cooperation between the countries of the EU and Ukraine in the field of balancing personal data protection and the right to journalism, the following steps can be taken: -

creation of independent bodies or commissions on national levels that will be responsible for monitoring journalistic activities and considering complaints regarding the unjustified distribution of personal data,

Such measures may contribute to the creation of effective legal regulation in EU member states and Ukraine in the field of personal data protection not only on paper but also by providing mechanisms for its implementation in practice.