On 14 February 2019 the Court of Justice of the European Union (CJEU) handed down its decision in Buivids, a case which pitted an amateur individual online publisher against the Latvian Data Protection Authority (DPA).

This important case raises fundamental questions concerning the scope of European data protection, the ambit of the personal/household exemption, the legal definition of journalism and the role of data protection as regards to this and also related academic, artistic and literary expression.

The Court’s answers to these questions highlight the close and tense interface between European data protection and freedom of expression.  At the same time, they provide only relatively limited insight as to how the serious tension between data protection, special expression and freedom of expression more broadly should be resolved.  What they do suggest, however, is that not only national legislators but also courts and regulators have active and important roles toplay within this space.

The full implications of this, as well as further guidance on how to balance data protection and special expression, should be provided in the forthcoming case of Stunt which will require the Court to consider whether national courts should disapply the ban on pre-publication injunctions against special expression processing which is set out in UK data protection legislation.  In addition, Grand Chamber CJEU judgments on internet search engines and data protection are awaited both in relation to sensitive data and the geographical reach of any remedy here.  In sum, slowly but surely, an albeit messy corpus of European jurisprudence on data protection and freedom of expression is in the process of gestation.

Facts and Questions Referred

The facts of the instant case are as follows.  In the context of making a statement in administrative proceedings brought against him, Mr Buivids made a “video recording in the station of the Latvian national police” (at [15]) which inter alia showed “police officers going about their duties” (at [16]).  He then published it on YouTube.  Presumably following a complaint, the Latvian DPA held that Buivids had thereby infringed data protection, notably by failing to provide the police officers with a transparency notice as specified in the law.

In August 2013, this DPA therefore ordered that he remove the video from YouTube (and other websites).  Buivids sought judicial review of this decision, arguing in the publication’s justification that he wished “to bring to the attention of society something which he considered to constitute unlawful conduct on the part of the police” (at [18]).  Whilst unsuccessful both initially and on appeal before the Regional Administrative Court, a further appeal to the Latvian Supreme Court resulted in this body issuing a preliminary reference asking the CJEU to clarify, firstly, whether Buivids’ activity fell within the scope of European data protection and, secondly, whether the journalistic derogation was engaged.

Given the time framework of the relevant processing, these questions were to be resolved by reference to the (now erstwhile) Data Protection Directive (DPD) 95/46.  Nevertheless, the General Data Protection Regulation (GDPR) 2016/679 has a very similar scope and structure; therefore, as explored below, the CJEU’s answers also have far-reaching implications for the future of European data protection.

Court of Justice Answers

The CJEU had absolutely no difficulty in finding that the recording and upload activity engaged the basic material scope of the DPD and that no exemption was applicable.  The recorded images rendered the police officers identifiable and so were indubitably “personal data” (at [31]) which had been subject to automatic data processing through Buivids’ digital photo camera since it stored the recording “on a continuous recording device, namely the memory of that camera” (at [35]).  The fact that this recording “was made on only one occasion” (at [36]) had no bearing on that basic issue.

The uploading of the data on to the internet constituted a further processing (at [37]).  Meanwhile, the DPD’s exemptions were clearly not engaged and, in any case,  full carve-outs had generally to be “interpreted strictly” (at [41]).  In particular, since Buivids had not restricted the dissemination of the video and had thereby permitted “access to personal data to an indefinite number of people”, the processing did not fall within the exempted “context of purely personal or household activities” (at [43]).

The Court found the second question on journalism much more difficult and complex.  In the first place, it acknowledged that in light of the “importance of the right to freedom of expression in every democratic society”, it was necessary to interpret “notions relating to that freedom, such as journalism, broadly” (at [51]).  The journalistic derogation could not be confined to an institutional or professional context but rather was applicable to “every person engaged in journalism” (at [52]).

However, echoing the Opinion of Advocate General Sharpston in the same case, the Court emphasised that “the view cannot be taken that all information published on the internet involving personal data, comes under the concept of ʻjournalistic activitiesʼ” (at [58]).  Rather, in order to see whether the journalistic derogation was engaged, the referring court was told to consider whether the recording and publishing of the video were “intended solely to disclose information, opinions or ideas to the public” (at [62]).  Furthermore, and in an important twist which did not directly answer any question posed to it, the CJEU emphasised that even if this definition was met this court would still need to determine “whether the exemptions or derogations provided for … are necessary in order to reconcile the right to privacy with the rules governing freedom of expression, and whether those exemptions and derogations are applied only in so far as is strictly necessary” (at [68]).

Part 2 of this post: “Analysis” will appear tomorrow.

David Erdos is a Fellow of Trinity Hall, Cambridge, a University Lecturer in Law and the Open Society and the Deputy Director, Centre for Intellectual Property and Information Law (CIPIL)