Publishing of Personal Data in Media – When It Shall Not Be Held a Privacy Violation?

Publishing of Personal Data in Media – When It Shall Not Be Held a Privacy Violation?

Briefings
Tools
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Acting on the filed request for establishing of the violation of right to personal data protection, the Croatian data protection authority (“Authority”) passed on December 30, 2021, a decision pursuant to which publishing of personal data shall not be held violation of the right to protection thereof provided that it is made for the public interest.

Facts

The request concerned is filed due to the article published in an online newspaper, with regards to the spending of public funds approved by the European Social Fund for implementation of a particular project. Namely, the said article included a table containing – among other things – personal data of natural person, i.e., user of the respective funds (its name, surname, and amount collected on the basis on its work on the project).

In relation thereto, data subject claimed that there was no legal basis for such publication, thus its right to personal data protection is violated.

Holding

The Authority, however, rejected the subject complaint as unfounded, establishing that the respective article is published in accordance with Croatian Law on Media (“Law”), as well as with provisions of the General Data Protection Regulation of EU 2016/679 (“GDPR”).

Namely, articles 3(1) and (3)2 of the Law stipulate the freedom of speech and media, which – inter alia – includes freedom to express the opinion, media independence, freedom to collect, research and publish information in order to inform the public, as well as respecting the protection of human privacy and dignity. Freedom of media may be subject to restrictions only if and to the extent that it necessary in democratic society for, among other things, territorial integrity or public order, prevention of disorder or crime, protection of health and morals, protection of reputation or rights of others, prevention of confidential information disclosure or to preserve authority.

Conclusion of the Authority

According to the above, the Authority’s decision established that there is no privacy violation provided that the public interest prevails over the privacy protection, as well as that disclosure of personal data in this particular case is made in accordance with Article 5(1) of the GDPR, i.e., with the data minimization principle, pursuant to which personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Domestic Law on Public Information and Media

Pursuant to the provisions of the Law on Public Information and Media of the Republic of Serbia (Off. Gazette of RS, nos. 83/2014, 58/2015 and 12/2016 – authentic interpretation), public information is free and not subject to censorship, while uninterrupted flow of information through the media, as well as the editorial autonomy of the media, must not be jeopardized.

When it comes to informing about issues of public interest, the media publish information, ideas and opinions on phenomena, events and persons about which the public has a legitimate interest to know, regardless of the manner on which the information were obtained, whereby everyone has the right to be truthfully, dully and timely informed on the issues of public importance, and the media are obliged to respect that right.

As regards the personal information, it is prescribed that information from private life, i.e., personal record (exceptionally) may be published without the consent of the person whose private life it concerns (or a person who in accordance with the provisions of this regulation may provide relevant consent with respect to the information on another person), if in the specific case the interest of the public to get acquainted with the information, i.e., record, prevails over the interest to prevent such publication.

Among other examples, it is considered that the public interest particularly outweighs the interest to prevent the publication of information from private life, i.e., personal records of persons: in case the information, i.e., record, refers to a person, phenomenon or event of public interest (especially to a public or political official, while publishing of the information is in the interest of national security, public safety or economic well-being of the country); for prevention of disorders or crimes, protection of health or morals, or rights and freedoms of the others; if publication is for the interest of justice, national security or public safety; in case it is necessary to warn of danger (prevention of infectious disease, finding a missing person, prevention of fraud, etc.); if a person intended the information, i.e., record for the public, i.e., provided it to the media for the purpose of publishing; and if the person by its public statements and/or behavior in private, family or professional life attracted public attention and thus gave a reason to publish the information, i.e., record.

Given that in this particular case it is the information related to the manner of spending public funds, for the purpose of implementation of a certain project, and having in mind domestic legal solutions and court practice, it can be deemed that this is the information that the public has a legitimate interest to know about, thus it could be expected that the courts in Serbia in this case would decide in the same or similar way.

This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.

By Milan Petrovic, Partner, and Lara Maksimovic, Senior Associate, PR Legal