Bygrave, Lee A --- "Balancing data protection and freedom of expression in the context of website publishing - recent Swedish case law" [2001] PrivLawPRpr 40; (2001) 8(4) Privacy Law and Policy Reporter 83

Balancing data protection and freedom of expression in the context of website publishing — recent Swedish case law

Lee A Bygrave

The Swedish Supreme Court (Högsta domstolen) has recently handed down a groundbreaking judgment concerned with the difficult balance between the interests in privacy and data protection on the one hand and freedom of expression on the other, in the context of website publishing.[1] The judgment is especially noteworthy for casting light on the extent to which the 1995 European Community (EC) Directive on data protection (the EU Directive),[2] together with national European legislation implementing the Directive, may apply to certain forms of online ‘journalistic’ activity. It could also cast light on the scope of the exemption for journalism in s 7B(4) of Australia’s Privacy Act 1988 (Cth).

Case facts

The defendant in the case was engaged in a campaign to spread information about alleged malpractice in the Swedish banking system. As part of this campaign, he established a website on which he published highly derogatory comments about particular Swedish banks and about named individuals working at these banks.

The primary issue before the Court was whether the defendant had thereby transmitted personal data to foreign countries in breach of the Personal Data Act (PDA) of 1998.[3] In tackling this issue, the Court first had to consider whether the defendant’s activity fell within the ambit of the PDA. It is with this question that the judgment is mainly concerned.

The question turns on interpretation of s 7 of the PDA which exempts from the bulk of the Act’s substantive provisions ‘such processing of personal data as occurs exclusively for journalistic purposes or artistic or literary expression’. Section 7 builds upon art 9 of the EC Directive which requires derogation from the main body of provisions in the Directive (that is, those in Chaps III, IV and VI) where as the processing of personal data ‘is carried out solely for journalistic purposes or the purpose of artistic or literary expression’ and the derogation is ‘necessary to reconcile the right to privacy with the rules governing freedom of expression’.[4]

The defendant argued that his website publishing was covered by the exemption for journalism in s 7. The argument was rejected by the lower courts (along with the Swedish Data Inspection Board (Datainspektionen)) which found that the data processing concerned was not carried out exclusively for journalistic purposes, since the processing was at least partly intended to spread derogatory information about the named individuals. The Supreme Court, however, found unanimously in favour of the defendant.

Court judgment

In reaching its decision, the Supreme Court pointed out that s 7 implements art 9 of the Directive. It then stated that art 9 is to be interpreted in conformity with the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR),[5] particularly arts 8 (providing the right to respect for private life) and 10 (providing the right to freedom of expression). The Court noted further that art 9 of the Directive, together with s 7 of the PDA, represent an attempt to balance the rights in arts 8 and 10 of the ECHR in accordance with the ‘principle of proportionality’ developed in the case law of the European Court of Human Rights (ECtHR).

In light of that case law — and particularly the fact that the right to freedom of expression in art 10 is accorded to ‘everyone’ — the Court held that the exemption for ‘journalistic purposes’ in art 9 of the Directive and s 7 of the PDA is intended to underline the importance of the free spread of information about issues of societal significance. Concomitantly, the exemption is not intended to cover only the established mass media or professionals working in it; information published by persons who are not professional journalists may also be covered.

The Court refused to delimit the exemption using criteria that assess the content and quality of communication by reference to the standards of established journalism. In the Court’s view, communication which fails to meet such standards may still be covered by the exemption. At the same time, the Court indicated that a basic purpose of journalistic activity is ‘to inform, exercise criticism and provoke debate about societal questions that are of larger significance for the general public’. The website publishing in question was found to fall squarely within this category.

The Court went on to note that the publishing of personal information via the one website could occur for a mixture of purposes — some journalistic, others not. Further, just because the publishing of some information about a person may be characterised as having a journalistic purpose does not mean that all of the information published on the website about that person may be so characterised. Publishing information of ‘purely private character’, the Court opined, would normally not be capable of such characterisation without it being placed within a broader journalistic context. Again, though, the Court found all of the personal information published on the website in dispute to be embraced by journalistic purposes.

This finding was not affected by the fact that some of the information denigrated personal reputation. Pointing to the case law of the ECtHR, the Court stated that journalism, as part of the right to freedom of expression, includes the right to communicate information and opinions which ‘mortify, shock or disturb’.

As for the reference to ‘exclusively’ in s 7 of the PDA (‘solely’ in art 9 of the Directive), the Court held that this is intended to clarify that data processing by journalists and the mass media for other than ‘editorial’ purposes — for example for the purposes of invoicing, direct marketing or production of consumer profiles — is not encompassed by the exemption. On this point, the Court drew support from Recommendation 1/97 of the Data Protection Working Party (established under art 29 of the Directive).[6] The Court was unable to find support for construing ‘exclusively’ such that publishing activity which has a journalistic purpose but which also involves spreading derogatory information about persons may be penalised under the data protection legislation.

At the same time, the Court noted that its judgment did not exempt the defendant from possible prosecution for defamation under other legislation.

Implications of judgment

The judgment narrows the scope of the PDA by construing broadly the concept of ‘journalistic purposes’. Indeed, the judgment goes a long way towards vapourising the concept, at least as it is ordinarily understood. Any distinction between journalism and propaganda is largely obliterated. Yet vapourisation is not complete. The judgment can be read as delimiting the journalism concept to the publication of information concerning ‘societal questions that are of larger significance for the general public’, at least when the information denigrates personal reputation. Hence, publication of information about relatively trivial matters would probably fail to fall within the concept. As the Court intimates, this will normally be the case with information of a purely private character.

Nevertheless, at a broader level, the judgment contributes to a development in which case by case balancing of the interests in privacy and personal integrity on the one hand and freedom of expression on the other, is removed from the purview of data protection law (and data protection authorities) and reserved for other legal arenas, particularly that of defamation law. This is a development which legislators have initiated by including wide exemptions for journalistic activity in the text of data protection legislation.

The judgment has significant implications for administrative practice pursuant to the PDA. The line taken by the Court is at odds with the way in which the Swedish Data Inspection Board has previously construed and applied the journalism exemption.[7]

The significance of the judgment outside Sweden is less easy to ascertain. However, there can be little doubt that it accords with art 9 of the EC Directive. Article 9 leaves EU/EEA Member States extensive discretion in how they are to balance freedom of expression with data protection interests — a point noted in the judgment. It is particularly noteworthy that, in implementing art 9, the Norwegian legislation expressly broadens the scope of the journalism exemption to encompass data processing for ‘opinion forming’ purposes.[8]

There can also be little doubt that, with one possible exception, the judgment accords with case law of the ECtHR. The qualification arises in relation to dicta on the scope of ECHR art 8, which provides, in summary, for the right to respect for private life. The Swedish Court held that, ‘in principle’, information relating to a person’s ‘public life’ falls outside the protective scope of the provision. While the Court was cognisant of the difficulties in determining what belongs within the area of private life, its dicta risks underplaying the readiness of the ECtHR to construe the notion of ‘private life’ broadly. The Court in Strasbourg has stressed that the right to respect for private life gives some protection for interpersonal relationships both inside and outside the domestic realm.[9]

Finally, the Swedish judgment could have implications for Australia. Much uncertainty surrounds the scope of the journalism exemption in s 7B(4) of the federal Privacy Act 1988. Section 7B(4) exempts from the scope of the legislation an act or practice of a media organisation if it is carried out (a) ‘in the course of journalism’; and (b) concurrently with the organisation publicly committing itself to observe published written standards that ‘deal with privacy in the context of the activities of a media organisation’. The term ‘media organisation’ is defined (see s 6(1)),[10] but not the term ‘journalism’.

While the Swedish judgment is neither binding nor of great weight for Australian courts, it would likely be taken into some account by the latter in construing s 7B(4) because of the paucity of relevant case law.

Moreover, insofar as the judgment correctly interprets the ECHR (in light of the case law of the ECtHR) — which I think it does — the line taken in the Swedish judgment is likely to be reflected in interpretation of the equivalent provisions in the International Covenant on Civil and Political Rights (ICCPR),[11] to which Australia is party.[12] The Privacy Act 1988 is aimed partially at fulfiling Australia’s commitments under the ICCPR, as the preamble to the Act makes clear. The Human Rights Committee, which is charged with overseeing implementation of the ICCPR,[13] has traditionally been swayed considerably by the case law of the Strasbourg Court.[14] While the opinions of the Committee are not binding under international law, they carry a great deal of weight otherwise and are generally regarded as providing authoritative guidance on the scope of the Covenant’s provisions.[15] v

Lee Bygrave, Research Fellow, Norwegian Research Centre for Computers and Law.

---

[1] Case B 293-00, judgment of 12 June 2001 available (in Swedish) at <www.bankrattsforeningen.org.se/hddomslut.html>.

[2] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ No L 281, 23 November 1995, 31).

[3] Personuppgiftslagen (1998:204). Section 33 of the Act prohibits the transfer of personal data to a ‘third country’ (that is, a country outside the European Union or European Economic Area) unless the country has an adequate level of data protection. Compare arts 25–26 of the EC Directive.

[4] See also Recitals 17 and 37 in the preamble to the Directive. Of these, Recital 37 is the most instructive. It reads:

Whereas the processing of personal data for purposes of journalism or for purposes of literary of artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of information and notably the right to receive and impart information, as guaranteed in particular in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; whereas Member States should therefore lay down exemptions and derogations necessary for the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing, measures on the transfer of data to third countries and the power of the supervisory authority; whereas this should not, however, lead Member States to lay down exemptions from the measures to ensure security of processing; whereas at least the supervisory authority responsible for this sector should also be provided with certain ex-post powers, e.g. to publish a regular report or to refer matters to the judicial authorities.

[5] Adopted 4 November 1950, in force 3 September 1953.

[6] The text of the recommendation, adopted on 25 February 1997, can be found at <europa.eu.int/comm/internal_market/en/dataprot/wpdocs/wp1en.htm>. At p 8 of the recommendation, the Working Party states:

Derogations and exemptions may cover only data processing for journalistic (editorial) purposes including electronic publishing. Any other form of data processing by journalists or the media is subject to the ordinary rules of the directive. This distinction is particularly relevant in relation to electronic publishing. Processing of subscribers data for billing purposes or processing for Direct Marketing purposes (including processing of data on media use for profiling purposes) fall under the ordinary data protection regime.

[7] For an overview, see P Seipel ‘Sweden’ in P Blume (ed) Nordic Data Protection DJØF Publishing Copenhagen 2001 pp 115, 133–137.

[8] See Personal Data Act 2000 (Lov om Behandling av Personopplysninger av 14 April 2000 nr 31) s 7.

[9] See especially Niemitz v Germany (1992) Series A, No 251-B, § 29.

[10] A ‘media organisation’ is ‘an organ-isation whose activities consist of or include the collection, preparation for dissemination or dissemination of the following material for the purpose of making it available to the public: (a) material having the character of news, current affairs, information or a documentary; (b) material consisting of commentary or opinion on, or analysis of, news, current affairs, information or a documentary.’

[11] Adopted 16 December 1966, in force 23 March 1976.

[12] These provisions are arts 17 (right to privacy) and 19 (right to freedom of expression).

[13] For a detailed description of the Committee and its operations, see D McGoldrick The Human Rights Committee: Its Role in the Development of the Inter-national Covenant on Civil and Political Rights Clarendon Press, Oxford 1991.

[14] See generally JG Merrills, The Development of International Law by the European Court of Human Rights (2nd ed) Manchester University Press 1993 p 16 and references cited therein.

[15] McGoldrick, above note 13 pp 151-152 and references cited therein; M Nowak UN Covenant on Civil and Political Rights: CCPR Commentary Engel, Kehlam Rhein/Strasbourg/Arlington 1993 xix.