The Court of Justice of the European Union (CJEU) has acknowledged that individual citizens who publish material online in apparent breach of data protection laws may be able to benefit from a 'journalistic exemption' to avoid liability. 

Background

The Court was considering a case brought by a Latvian individual, Mr Buivids.  He had given a statement at a Latvian police station in relation to proceedings being brought against him. Mr Buivids believed that the police conducted themselves unlawfully whilst he was giving his statement and so decided to film the officers on his mobile phone before then uploading the footage to YouTube. Mr Buivids did not tell the police officers that he was recording them nor that he intended to publish the video. The faces and voices of certain officers were identifiable from the footage.

The National Data Protection Agency of Latvia found that the published video breached Latvia's legislation implementing Directive 95/46/EC (the predecessor to GDPR) because Mr Buivids had not informed the officers of his intention to process their personal data.

Mr Buivids challenged the decision, and the case ultimately reached the Latvian Supreme Court. The Supreme Court referred the case to the CJEU, seeking guidance as to:

• whether the act of filming police officers who are carrying on their duties in a police station and then publishing that footage is caught by the Directive; and 
• whether Mr Buivids could rely on the journalistic exemption i.e. was the data being processed "solely for journalistic purposes".  

The decision

The CJEU held that the act of recording and publishing the video did amount to processing of personal data under the data protection law. The carve-out for processing data in the context of a "purely personal or household activity" did not apply: Mr Buivids had not restricted access to the video but had made it available to the world, and so his activities went beyond the purely personal. 

Regarding the journalistic exemption, the Court held that the concept of "journalism" had to be construed broadly: "'journalistic activities’ are those which have as their purpose the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them". The Court confirmed that you do not need to be a professional journalist, or publish through traditional media, to benefit from the exemption. 

The CJEU left it to the Latvian Supreme Court to decide whether, on these facts, Mr Buivids' actions amounted to 'journalistic activities', and also how to balance Mr Buivids' right to freedom of expression against the police officers' right to privacy. So while the case does not provide complete clarity on when the exemption will apply, it does establish that, in the data protection world, what constitutes "journalism" can extend far beyond the realms of the traditional media industry.  

Although this case was decided under the old law, the principles will be equally applicable to cases brought under GDPR. 

Sergejs Buivids (Case C-345/17)