By decision of November 15, 2019 the Constitutional Court (CC) declared unconstitutional the provision governing the processing of personal data for journalistic purposes and for the purposes of academic, artistic or literary expression (Article 25h of the Personal Data Protection Act – PDPA). The text was adopted within the option provided by Regulation 2016/679 (GDPR) for Member States to align the right to protection of personal data with the right to freedom of expression and information.
The decision of the CC put an end to the turbulent history of the provision. Initially, the provision was widely criticized by the media and journalistic organizations, then the President vetoed changes to the act because of it, and in March 2019 the CC was seised by 55 members of parliament with an appeal to declare it unconstitutional.
The primary reason for the controversy was the criteria introduced for assessing the balance between freedom of expression and the right to information and the right to protection of personal data, in which those seeking to declare the provision unconstitutional saw a potential threat of legal censorship on freedom of expression.
In its decision, the CC refers to European legislation, international human rights instruments and the case law of the Court of Justice of the European Union (ECJ) and the European Court of Human Rights (ECHR). The CC has repeatedly emphasized that it follows the principles of “balance of interests” and proportionality which are agreed and adopted at European level.
CC finds the provision of the PDPA unconstitutional for the following primary reasons:
- The CC accentuates that the balancing of the various rights, in this case the protection of personal data and the right to freedom of expression and information, has to be carried out through a rational and pragmatic approach, taking into account the specific circumstances of each individual case; therefore the introduction of criteria into a general legal rule creates a risk to the proper balancing of interests and is contrary to the practice of the ECJ and the ECHR to make an objective assessment;
- According to the CC, the provision does not meet the requirements for comprehensibility, precision, unambiguity and clarity, as it does not clearly define to its addressees what is inadmissible. The CC criticizes several criteria in particular which make it impossible for the media/journalists to align their behavior with the law and to apply the so-called “journalistic exemption” allowing them to process personal data under specific conditions. The decision of the CC also states that the ambiguity of the criteria gives the law enforcement bodies unpredictable power.
- According to the CC, the provision runs counter to the GDPR spirit and reason, since the Regulation seeks to allow Member States to introduce exemptions and derogations to the general rules that balance the protection of personal data and the right to freedom of expression and information, rather than to allow them to adopt rules that are “burdensome to the media/journalists”. The CC expressly emphasizes that such interpretation of the GDPR by the Bulgarian legislature “makes it extremely difficult to further limit state interference in terms of freedom of expression of the media/journalists”, and that the provision would distort the balance between fundamental rights to the detriment of the right to expression and information;
- Last but not least, the CC considers the provision disproportionate to the objective it pursues as it excessively restricts the right to freedom of expression and information; The CC assumes that the provision impedes the attainment of the objectives of journalistic activity and the function of the media, as it may lead to self-censorship motivated by an attempt to comply with unclear criteria. In addition, the CC accentuates that the measure is unnecessary because there is a much less restrictive and well-established alternative – to improve self-discipline in the media industry, including by adopting codes of conduct drafted jointly by media organizations and CPDP, as is the practice in democracies and what is explicitly provided for in the GDPR.
In conclusion, the CC announced the provision of 25h, Para 2 PDPA as unconstitutional due to unpredictability, legal uncertainty and limitation of the right to freedom of expression and information disproportionate to the objective pursued in the context of journalistic expression.
We have yet to see whether the lawmaker will try to formulate a new legal rule to strike a balance between the right to protection of personal data and the right to freedom of expression and information, or similar to the recommendations in the decision of the CC – the balance will be sought through self-regulation of the media industry – e.g. through codes of conduct. The full text of the decision is available only in Bulgarian here.