Personal Data Protection and Safeguarding Draft Act June 2019 expression, as the unlawful collection and processing of personal data—particularly if it involves journalists—would affect the ability of the media to operate and to effectively pursue investigations and receive information from confidential and other sources. 1. Failure to Include Journalistic, Artistic, Literary, and Other Cultural Exemptions In the Draft Act, Article 12 states that the processing of private data within the framework of relevant laws without their consent is allowed in several circumstances. However, there is no mention of any exemption for artistic, literary, and cultural purposes. This is a serious shortcoming in the proposed law. More worryingly, the processing for journalistic purposes is not considered at all. The Draft Act further fails to recognise freedom of expression interests, such as the free exchange of information by individuals, as well as the aforementioned artistic, literary, and cultural purposes. Nearly all countries around the world that have adopted data protection acts have specifically included a clear exemption for journalistic, artistic, literary, and other cultural purposes which allows for the rules limiting processing to be waived for those purposes. There should also be exemptions for the discharge of any legal obligation to make information publicly available, such as the maintenance of archives for historical or other public interest purposes, or under right to information laws. Moreover, such exemptions or limitations must be interpreted broadly so as to give meaningful effect to the rights to freedom of expression and to information. This exemption was first set out in Article 9 of the EU Data Protection Directive 95/45, the old European legal framework with regards the processing of personal data. The European Court of Justice, in the case cited above stated that its provisions applied beyond just the official media: “the exemptions and derogations provided for in Article 9 of the directive apply not only to media undertakings but also to every person engaged in journalism". It stated that the journalistic exemption applied “if their object is the disclosure to the public of information, opinions, or ideas, irrespective of the medium which is used to transmit them. They are not limited to media undertakings and may be undertaken for profit-making purposes". The breadth of protected freedom of expression related activities has been extended with the adoption of the Regulation on Data Protection (GDPR). Article 85 on the “processing of personal data and freedom of expression and information” states that: 1. The national law of the member state shall reconcile the right of protection of personal data pursuant to this Regulation with the right of freedom of expression and information, including the processing of personal data for journalistic purposes and the purposes of academic, artistic, or literary expression. 2. For the processing of personal data carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from the provisions in Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (co-operation and consistency) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information (...). Specific protections for freedom of expression have also been incorporated in the Modernised Council of Europe Convention 108 on Data Protection. Article 11 (b) states that Member States must incorporate an exemption when it is necessary for the “the protection of the data subject or the rights and fundamental freedoms of others, notably freedom of expression".73 The commentaries on the Convention further explained that: Littera b. concerns the rights and fundamental freedoms of private parties, such as those of the data subject himself or herself (for example when a data subject’s vital interests are threatened because he or she is missing) or of third parties, such as freedom of expression, including freedom of journalistic, academic, artistic, or literary expression, Council of Europe, Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data, Amending protocol to the Convention for the Protection of Individuals with Regard to the Processing of Personal Data, adopted by the Committee of Ministers at its 128th Session in Elsinore on 18 May 2018, Art. 11. https://rm.coe.int/convention-108-convention-for-the-protection-ofindividuals-with-regar/16808b36f1. 73 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 22 of 58