News‎ > ‎

Freedom of expression must be properly understood in the context of personal data protection, too!

postat 13 nov. 2018, 06:50 de Office Mediasind   [ actualizat la 13 nov. 2018, 06:50 ]
To the attention of the National Supervisory Authority for Personal Data Processing

B-dul Gh. Magheru, nr. 28-31, sector 1, Bucharest

E-mail address:

November 13, 2018

Freedom of expression must be properly understood in the context of personal data protection, too

We are addressing you this open letter in the context of the public controversy created by the request you have asked to the journalists from RISE Project to provide you with information about posting on the Facebook page of a journalistic material.

As human rights organizations, supporting both the rights to freedom of expression
and freedom of the press, as well as the right to privacy, we would like to make some clarifications that we hope that will be useful to you in addressing situations similar to this one, particularly with regard to freedom of expression (because we know that the area of personal data and private life is your object of activity), clarifications which could help you to understand the unambiguous reaction of the European authorities (1).We are also implying that the Authority urgently needs to implement a working system regarding the requests that concern data processing for journalistic purposes.

1. Not only private life is a fundamental right, but also freedom of expression

Both the right to privacy and the right to freedom of expression enjoy equal treatment, none
being above the other. An authority can not arbitrarily invoke restrictions on the right to
freedom of expression, much less when it comes to a subject of public interest, as in
this case. In order to decide which of these two rights is a priority, they must be weighed, being necessary to make a fair balance, taking into account the particularities of each case. 

To reduce the discussion only to the 3 derogations in art. 7 of Law 190/2018 is a simplistic approach, as long as it is clear that the purpose of the General Data Protection Directive (GDPR) is not to limit the freedom of speech. At the same time, there are many normative acts on human rights signed by Romania (we nominate here only two - the Charter of Fundamental Rights of the European Union and the European Convention on Human Rights) to be taken into account when it comes to a conflict between two or more rights. The European Court of Human Rights (ECHR) has a wide range jurisprudence on balancing the right to freedom of expression and the right to private life, and this balancing test considers at least 6 extremely important factors for each case (2). So it would have been necessary for ANSPDCP to consider - both in  internal discussions, but also in subsequent public clarifications - these aspects of proportionality and  the fair weighing of the two fundamental rights (3).

2. Protecting sources is crucial for journalists in order that the right to freedom of expression to be guaranteed

Protection of journalistic sources is one of the basic conditions in guaranteeing press freedom. Jurisprudence of the ECHR consistently emphasizes that attempting to compel a journalist to disclose his sources infringes his right to the freedom of receiving and distributing information, so it violates his right to freedom of expression. The Court has held that urging journalists to disclose their sources affects free movement of information, to the detriment of democracy, therefore it can be justified only in exceptional cases. (4)

That is why the reaction of journalists and European institutions is absolutely normal since they learned that the Authority would have asked for the "source" of the information protected by RISE Project. Here we consider the Authority's role to take into account the sensitivities of the conflict of rights, first of all to state why in that case exceptions to data collection for journalistic purposes do not apply. Secondly, if the Authority decides to go further, not being derogations, the Authority should state that the request for these cases do not relate to journalistic sources, that it rather seeks to identify whether the data are collected directly from the data subject or from other sources (or public sources) for the possible application of Articles 13 and 14 of the GDPR.

We can only hope that, in fact, we are dealing with an inadequate communication and not with a desire to have access to the sources of journalists.

3. Threats are not to be found in an address from a public authority
Your request to RISE Project indicates that they are subject to a fine of 3000 lei per day for
every day of delaying the answer to your request, which has a deadline of 10 days. In addition you also announced that they are subject to a fine of up to € 20,000,000 for violating art. 83 of the General Data Protection Regulation, highlighting the reference to "Not granting access" in the text you have written. 
This sounds like a threat (although the text is in line with the provisions of the Regulation), and the part related to "Access" to documents raises the same issues as the above. All the more so as no one in Europe has not yet granted a fine of 20 million euros. In fact, not even 1 million. We believe not even 100,000.
In conclusion, with respect to the above mentioned three points, we note that the request made to RISE Project has left the impression of a hasty action without a thorough analysis of the situation, which fueled public belief that there had been a political motivation generated by the subject of the journalistic material, and not a mere objective and impartial investigation made by the Authority of overseeing the field of personal data processing.

We make these remarks because both fundamental rights are equally important and we do not want that the role of the Authority to look like being reduced to a tool of political control and blocking the necessary debates in a democratic society.

We believe that the Authority urgently needs to implement a working system regarding the requests that involve the press. This working system has to be conceived only on the basis of public consultations with media and bodies with expertise in the field of freedom of expression and press freedom from Romania and the European Union. We look forward to your proposals in this regard.

 Association for Technology and the Internet - ApTI

Active Watch

Center for Public Innovation


Center for Independent Journalism

Spiritual Militia

The Romanian Union of Journalists MediaSind

The Romanian Center for Investigative Journalism

The Journalists' Society of Galati

Funky Citizens

Foundation for the Development of Civil Society

CeRe: Center for Resources for Public Participation


2. O analiză detaliată a acestor factori și a cazurilor CEDO relevante poate fi găsită la
3. Ne referim la documentul publicat pe 9.11.2018 pe site-ul Autorității
4. Goodwin v. United Kingdom, Cerere nr. 17488/90, Hotărâre 27 martie 1996, ; Curtea Europeană a Drepturilor Omului - “Protecția Surselor
Jurnalistice” - Document publicat în septembrie 2018 ; “International standards:
Regulation of media workers” Capitolul “Protection of sources”, Article 19,