OPINION OF ADVOCATE GENERAL
SHARPSTON
delivered on 27 September 2018(1)
Case C‑345/17
Sergejs Buivids
joined parties:
Datu valsts inspekcija
(Request for a preliminary ruling from the Augstākā tiesa (Supreme Court, Latvia))
(Reference for a preliminary ruling — Scope of application of Directive 95/46/EC — Filming and publication on internet sites of a video recording of police officers carrying out their duties in a police station — Processing personal data and freedom of expression — Article 9 of Directive 95/46)
1. This reference from the Latvijas Augstākā tiesa (Supreme Court, Latvia) concerns the filming and publication on internet sites of a video recording of police officers carrying out their duties in a police station. The referring court seeks guidance as to the scope of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (2) and the interpretation of the exemption in Article 9 thereof (‘the journalistic purposes exception’).
EU legislation
The Charter of Fundamental Rights of the European Union
2. The right to respect for an individual’s private and family life is guaranteed by Article 7 of the Charter of Fundamental Rights of the European Union (‘the Charter’). (3) In accordance with Article 8, ‘everyone has the right to the protection of personal data concerning him or her. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.’ Pursuant to Article 11, everyone has the right to freedom of expression which includes the right to receive and impart information and ideas without interference by the public authorities. (4)
3. Article 52(3) provides that in so far as the Charter contains rights which correspond to rights guaranteed by the ECHR, the meaning and scope of those rights is the same as those laid down in that convention.
Directive 95/46
4. The following aims are listed in the preamble to Directive 95/46:
‘… there should be excluded the processing of data carried out by a natural person in the exercise of activities which are exclusively personal or domestic, such as correspondence and the holding of records of addresses;
…
… given the importance of the developments under way, in the framework of the information society, of the techniques used to capture, transmit, manipulate, record, store or communicate sound and image data relating to natural persons, [Directive 95/46] should be applicable to processing involving such data;
…
… the processing of sound and image data, such as in cases of video surveillance, does not come within the scope of [Directive 95/46] if it is carried out for the purposes of public security, defence, national security or in the course of State activities relating to the area of criminal law or of other activities which do not come within the scope of [EU law];
… as far as the processing of sound and image data carried out for purposes of journalism or the purposes of literary or artistic expression is concerned, in particular in the audiovisual field, the principles of [Directive 95/46] are to apply in a restricted manner according to the provisions laid down in Article 9;
…
the processing of personal data for purposes of journalism or for purposes of literary [or] artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of [Directive 95/46] in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of information and notably the right to receive and impart information, as guaranteed in particular in Article 10 of [the ECHR]; … Member States should therefore lay down exemptions and derogations necessary for the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing …’. (5)
5. Article 1(1) of Directive 95/46 provides that Member States are to ‘protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data’.
6. The following definitions are set out in Article 2:
‘(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
…
(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data …’.
7. In accordance with Article 3, Directive 95/46 applies to:
‘(1) … the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.
(2) [Directive 95/46] shall not apply to the processing of personal data:
– in the course of an activity which falls outside the scope of [EU law], such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,
– by a natural person in the course of a purely personal or household activity’.
8. Chapter II is entitled ‘General rules on the lawfulness of the processing of personal data’. Pursuant to Article 6(1), Member States are to provide that personal data must be treated in accordance with the cumulative conditions listed therein. Included in that list is that data may only be collected for specified, explicit and legitimate purposes. (6) Article 6(2) states that the data controller must ensure compliance with the conditions in Article 6(1).
9. Article 7 sets out criteria for making data processing legitimate. These include that processing is necessary for the purposes of the legitimate interests pursued by the data controller or by the third party(ies) to whom the data are disclosed, unless such interests are overridden by the fundamental rights and freedoms of the data subject(s) protected under Article 1(1) of the directive. (7)
10. Pursuant to Article 9, which is entitled ‘Processing of personal data and freedom of expression’ (and forms part of Chapter II of Directive 95/46), ‘Member States shall provide for exemptions or derogations from the provisions of [Chapter II], Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression’.
11. Article 13 provides that Member States may adopt measures to restrict the scope of the obligations and rights provided, inter alia, in Article 6(1) when such a restriction is necessary to safeguard certain interests, such as national security, defence or public security.
National legislation
12. The referring court states that the aim of the Latvian legislation at issue is to protect the fundamental rights and freedoms of natural persons and, in particular, the right to privacy, as regards the processing of personal data concerning natural persons. Pursuant to paragraph 3 of Article 3 of the Fizisko personu datu aizsardzības likums (the Personal Data Protection Law), the national rules do not apply to the processing of personal data carried out by individuals for personal or domestic use and where, in addition, the personal data are not disclosed to third parties.
13. In accordance with that law, ‘personal data’ is defined as meaning any information concerning an identified or identifiable natural person. The ‘processing’ of personal data is any operation applied to personal data, including their collection, recording, insertion, storage, organisation, alteration, use, transfer, transmission and dissemination, blocking or deletion.
14. Article 5 of the Personal Data Protection Law provides for an exception to the rules laid down in that legislation when personal data are processed for journalistic purposes in accordance with the Law entitled Par presi un citiem masu informacijas lidzekliem (Law on press and other media) or for the purpose of artistic or literary expression.
Facts, procedure and the questions referred
15. Mr Buivids (the ‘data controller’ for present purposes) made a video recording inside a Latvian police station. The recording concerned a statement he made to the police in the context of administrative proceedings which had been initiated against him. (8) In that video recording, it is possible to see the police facilities and a number of police officers going about their duties. Mr Buivids’ conversation with the police officers whilst they carried out certain administrative functions was recorded: he can be heard as well as the police officers concerned and the person who accompanied him to the police station. Mr Buivids published the resulting video recording on the internet site www.youtube.com.
16. By decision dated 30 August 2013, the Data valsts inspecija (Latvian Data Protection Agency) decided that Mr Buivids had infringed the relevant national rules (Article 8(1) of the Personal Data Protection Law) because he had not informed the police officers (the data subjects) in accordance with those rules of the intended purpose of the filming. Nor did he give the Latvian Data Protection Agency any information as to the purpose of the filming and publication of the video recording on an internet site so as to demonstrate that his aim in making and publishing the film met the requirements of the relevant national rules. Consequently, the Data Protection Agency told Mr Buivids to remove the video concerned from the YouTube site and other internet sites where it was published.
17. Mr Buivids brought proceedings before the Administratīvā rajona tiesa (District Administrative Court) which dismissed his application. Mr Buivids then lodged an appeal against that decision before the Administratīvā apgabaltiesa (Regional Administrative Court, Latvia) seeking a declaration that the decision of 30 August 2013 was illegal and claiming compensation for the harm he suffered as a result. In support of his application, Mr Buivids argued that by means of his video recording he wished to bring to the attention of society something which in his opinion constituted illegal conduct on the part of the police. There is nothing in the order for reference indicating that Mr Buivids identified the acts which constituted the alleged illegal conduct.
18. Mr Buivids’ claim was dismissed by the Administratīvā apgabaltiesa (Regional Administrative Court, Latvia) for the following reasons. First, it was found as a fact that the data subjects were identifiable in Mr Buivids’ recording. Second, it was considered that Mr Buivids did not make the video recording for the purposes of journalism in accordance with the Latvian rules. By making a recording of police officers at their work place carrying out their duties and not informing those officers of the specific purpose of the processing of the personal data concerned, Mr Buivids had failed to comply with Article 5 of the Personal Data Protection Law and had infringed Article 8(1) of that law. Third, the National Data Protection Agency had asked Mr Buivids to remove the video from the internet sites on which it had been published, since he had processed the personal data in an illegal manner. That request was both legitimate and proportionate. Last, there was no evident conflict between Mr Buivids’ right to freedom of expression and the data subjects’ right to privacy, as Mr Buivids had not indicated his aim in publishing the video. Moreover, the video did not inform the public about current news; nor did it reveal any illegal conduct on the part of the police.
19. Mr Buivids lodged an appeal in cassation against that judgment with the referring court. The latter observes that Mr Buivids’ case concerns a single video recording of police officers going about their duties whilst acting as representatives of the public authorities. It is uncertain as to whether Mr Buivids’ actions fall within the scope of Directive 95/46 and whether the journalistic purposes exception in Article 9 of that directive applies to the expression of a personal opinion concerning police work and the dissemination of a video recording depicting police officers carrying out their duties on the internet site www.youtube.com. Accordingly, the referring court seeks guidance from this Court on the following questions:
‘(1) Do activities such as those at issue in the present case, that is to say, the recording, in a police station, of police officers carrying out procedural measures and publication of the video on the internet site www.youtube.com, fall within the scope of Directive 95/46?
(2) Must Directive 95/46 be interpreted as meaning that those activities may be regarded as the processing of personal data for journalistic purposes, within the meaning of Article 9 of that directive?’
20. Written observations were submitted by Mr Buivids, the Governments of Austria, the Czech Republic, Italy, Latvia, Poland and Portugal and by the European Commission. Mr Buivids, the Latvian Government and the Commission attended the hearing on 21 June 2018 together with the Swedish Government, which had not submitted written observations.
Question 1
21. By Question 1 the referring court asks whether an individual who records police officers on film, in the course of carrying out their duties, and subsequently publishes a video of that recording on an internet site, such as YouTube, falls within the scope of Directive 95/46.
22. Mr Buivids, the Czech Republic, Italy, Poland, Portugal and the Commission submit that those actions fall within the scope of Directive 95/46. Austria and Latvia argue the contrary.
23. It seems to me that activities such as those engaged in by Mr Buivids indeed fall within the scope of Directive 95/46.
24. A video recording of police officers carrying out their duties which is made on police premises falls within the wording of Article 3(1) of Directive 95/46 in so far as it constitutes the processing of personal data wholly or partly by automatic means. The Court has already ruled that in accordance with Article 2(a) of that directive, ‘personal data’ includes the image of a person recorded by a camera. (9) It follows from Article 2(b) that a video recording, in principle, constitutes the ‘processing of personal data’ in that it falls within the concept of ‘any operation or set of operations which is performed upon personal data, … such as collection, recording, … storage’. (10) The Court has previously ruled that the operation of loading personal data onto an internet page constitutes processing within the meaning of Article 2(b) of Directive 95/46. (11)
25. The publication of such a video recording on an internet site thus clearly falls within the concept of ‘processing’ personal data set out in Article 3(1) of Directive 95/46. (12)
26. My reading of Article 2(a) and (b) together with Article 3(1) is consistent with the aims of Directive 95/46 which state that the directive should apply to, inter alia, recording, storing or communicating sound and image data relating to natural persons. (13) Whilst recital 16 indicates that the scope of the directive is to be restricted as regards State processing of sound and image data ‘carried out for the purposes of public security, defence, or national security or in the course of State activities relating to the area of criminal law or of other activities which do not come within the scope of [EU law]’, it follows a contrario that the legislator considered that Directive 95/46 should otherwise cover video recordings. (14)
27. Austria takes the view that activities such as those engaged in by Mr Buivids fall outwith the scope of Directive 95/46. It submits that the order for reference states that under Latvian law, civil servants when performing their official duties fall outwith the scope of the right to privacy with respect to the processing of personal data — that is because officials carrying out their duties have to accept that they operate in the public arena and that their actions may be subject to scrutiny.
28. I do not accept that counter-argument.
29. The text of Directive 95/46 contains no express exception which excludes public officials, such as police officers, from its scope. Nor do the recitals reflect any such aim.
30. The directive is, moreover, to be construed in a manner which is consistent with fundamental rights. Civil servants are in principle protected in the same way as other individuals with regard to the right to respect for private and family life (Article 7 of the Charter) and the right to protection of personal data (Article 8 of the Charter) which emanates from the more general right to privacy. (15) Indeed, to consider otherwise could lead to adverse consequences as it would leave public officials vulnerable with respect to their rights to privacy and could hinder recruitment and retention of staff in the public sphere.
31. Moreover, as the Court has stated, the term ‘private life’ must not be interpreted restrictively and there is thus no reason of principle to justify excluding activities of a professional nature. (16)
32. Latvia submits that acts such as those carried out by Mr Buivids do not fall within the scope of Directive 95/46 for four reasons. First, it follows from a literal interpretation of Article 3(1) that, in order for Directive 95/46 to apply, the data concerned must form part of a filing system. The referring court states that Mr Buivids made a single video recording. His activities cannot therefore be described as being organised or structured to form part of a filing system. Second, Article 3(1) should be interpreted consistently with the aims of Directive 95/46 which include protecting the right to privacy. The link between that aim properly construed, and the publication of a single video recording on the internet is too tenuous. Third, the individuals in the video recording cannot be identified without significant effort. That recording does not therefore contain ‘information relating to an identified or identifiable natural person’ falling within the definition of ‘personal data’ in Article 2(a) of the directive. Finally, the present case is to be distinguished from Lindqvist: (17) in the latter, it was possible to locate personal data published on the internet by entering a name or other information into a search engine. Latvia adds that because the scope of application of the Personal Data Protection Law is wider than that of Directive 95/46, the action taken by the Data Protection Agency against Mr Buivids was nevertheless well founded.
33. I reject Latvia’s arguments as to the scope of Directive 95/46 for the following reasons.
34. I do not read the text of Article 3(1) in the same way as the Latvian Government. The wording does not state that where personal data are processed wholly or partly by automated means, such data must in addition form part of a filing system for Directive 95/46 to apply. Rather, it seems to me that Article 3(1) of Directive 95/46 applies in each of two situations: (i) to the processing of personal data wholly or partly by automatic means and (ii) to such data which are not processed automatically but that form (or are intended to form) part of a filing system.
35. Protecting the right to privacy with respect to the processing of personal data is an overriding objective of Directive 95/46. The rights of the police officers who were filmed by Mr Buivids are integral to the case at issue. As individual data subjects, they are identifiable and information relating to them was published. There is thus prima facie a clear infringement of their fundamental rights guaranteed by Articles 7 and 8 of the Charter. (18) It is immaterial whether the information published is sensitive or whether the individuals concerned were inconvenienced in any way. (19)
36. Whether the data subjects are difficult to identify is not a criterion set out in Directive 95/46 and thus cannot be used to determine whether the conditions of Article 3(1) are met. Directive 95/46 likewise does not require that the processing of personal data include information, such as a name or address, which allows an internet search to be made before an individual can claim that his data protection rights have been infringed.
37. For the sake of good order, I add that in my view Article 3(2) of Directive 95/46 does not apply here. That provision states that the directive does not apply to the processing of personal data ‘in the course of an activity which falls outside the scope of [EU law] … and in any case to processing operations concerning public security, defence, State security … and the activities of the State in areas of criminal law’. As an exception to the rules governing the scope of that directive, Article 3(2) falls to be construed narrowly. (20) All the activities listed by way of example are activities of the State or State authorities which are unrelated to the various spheres of activity of individuals. They are intended to define the scope of the exception set out, with the result that that exception applies only to those activities expressly listed or which can be classified in the same category (ejusdem generis). (21)
38. Mr Buivids’ actions were the activities of an individual expressing his private views. Clearly, therefore, they do not fall within the first indent of Article 3(2) of Directive 95/46.
39. As regards the second indent of Article 3(2) of Directive 95/46, the Court has ruled that that provision interpreted by reference to the aims expressed in recital 12 — relating to that exception — mentions correspondence and the holding of records of addresses as examples of data processing carried out by a natural person in the course of a purely personal or household activity. It follows that the latter exception must be interpreted as relating only to activities which are carried out in the course of private or family life of individuals. (22)
40. Thus, the second indent of Article 3(2) of Directive 95/46 likewise cannot apply to Mr Buivids’ activities. Publishing the video recording on the internet formed no part of his private or family life. On the contrary: publication meant that the data was made available and accessible to an unrestricted number of people.
41. I therefore conclude that activities such as the filming and recording of public officials carrying out their duties at their place of work and the subsequent publication of the video recording on the internet constitutes the processing of personal data wholly or partly by automatic means for the purposes of Article 3(1) of Directive 95/46.
Question 2
42. The referring court seeks to ascertain by Question 2 whether acts such as those carried out by Mr Buivids should be regarded as falling within the journalistic purposes exception in Article 9 of Directive 95/46.
43. The referring court states in its order for reference that if Mr Buivids had made and published his video recording for journalistic purposes in accordance with the relevant national rules, his activities would have been exempt from the conditions in Article 8 of the Personal Data Protection Law which require the data controller to inform the data subject(s) in the manner laid down of the intended purpose of a video recording.
44. In that respect I observe that the Member States must, when transposing directives such as Directive 95/46, take care to ensure that national rules are interpreted in a way that allows a fair balance to be struck between the various fundamental rights protected by the EU legal order. Further, when implementing national measures transposing directives, the authorities and courts of the Member States must not only interpret their national law in a manner consistent with those directives but also make sure that they do not rely on an interpretation of national rules which would be in conflict with those fundamental rights or with the other general principles of EU law, such as the principle of proportionality. (23)
45. The Court has already stated that Article 9 must be interpreted in the light of the aims pursued by Directive 95/46 and the system it establishes. (24) Article 1 makes clear that those objectives include permitting the free flow of personal data as well as protection of the fundamental rights and freedoms of individuals, particularly the right to privacy with respect to the processing of personal data. Article 9 of the directive indicates how those two objectives are to be reconciled. The obligation to achieve the necessary balance rests with the Member States. (25)
46. The legislative history of Directive 95/46 indicates that the journalistic purposes exemption is to be applied restrictively. The wording now to be found in Article 9 of Directive 95/46 was not in the Commission’s original proposal. (26) It was inserted almost five years after that proposal was made as a result of amendments suggested by the European Parliament in order to clarify that Member States should provide for exemptions or derogations only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression. (27)
47. Article 9 can be divided into two limbs. In accordance with the first limb, Member States are instructed to provide for exemptions or derogations from, inter alia, the general rules on the lawfulness of the processing of personal data, such as those laid down in Articles 6 and 7 of that directive. The second limb emphasises that such exemptions or derogations may be afforded for the processing of personal data carried out solely for journalistic purposes only in so far as is necessary to reconcile the right to privacy with the rules governing freedom of expression. (28)
48. The Court has already made clear that within the context of the right to freedom of expression the term ‘journalistic purposes’ should be interpreted broadly; (29) and has set out a number of criteria to be taken into account. First, journalism is not restricted to media undertakings: rather, it applies to every person engaged in that activity. Second, whether the journalism at issue generates a profit is not a determining consideration. Third, methods of communication change and evolve: thus, whether data are processed and transmitted by conventional, even old fashioned means (such as on paper or by radio waves) or whether the processing is by a more modern method (such as uploading data onto the internet), is not determinative. Last, in the light of those criteria, actions may be classified as ‘journalistic activities’ if their objective is the disclosure to the public of information, opinions or ideas. (30)
49. Do the activities of an individual such as those in which Mr Buivids engaged fall within the concept of ‘journalistic purposes’ as set out in Article 9 of Directive 95/46?
50. Mr Buivids, supported by the Portuguese and Swedish Governments, argues that his actions are capable of falling within the scope of Article 9 and that he is exempt from the provisions of Chapter II of that directive. The Czech Republic and Poland counter that Article 9 does not apply here. Austria, Italy and the Commission submit that the assessment as to whether the journalistic purposes exception applies is ultimately for the national court. Latvia maintains that although Mr Buivids’ actions do not fall within the scope of Directive 95/46, the relevant national rules do apply.
51. The objectives of the disclosure at issue here are clearly questions of fact which are not for this Court. That said, in interpreting Article 9 of Directive 95/46 the Court should provide the referring court with the necessary framework to make that assessment. The case-law of the European Court of Human Rights (‘the Strasbourg Court’) interpreting the corresponding provisions of the ECHR (Articles 8 and 10) provides some helpful points of reference.
52. Thus, in interpreting Article 10 of the ECHR the Strasbourg Court has ruled that ‘user-generated expressive activity on the internet provides an unprecedented platform for the exercise of freedom of expression’ and that publishing news and comments on an internet site is journalistic activity. (31) That Court has repeatedly recognised the vital role of the media in facilitating and fostering the public’s right to receive and impart information and ideas. (32) It has also acknowledged that the function of creating various ‘platforms for public debate is not limited to the [conventional] press … Given the important role played by the internet in enhancing the public’s access to news and facilitating the dissemination of information … the function of bloggers and popular users of the social media may be also assimilated to [the role] of “public watchdogs” in so far as the protection afforded by Article 10 [of the ECHR] is concerned’. (33)
53. It therefore seems to me to be clear that an individual who engages in what has been dubbed ‘citizens’ journalism’ by gathering and disseminating information in order to disclose to the public information, opinions or ideas may be considered to be processing personal data for journalistic purposes within the meaning of Article 9. (34)
54. It follows that I disagree with the views expressed by the Czech Republic and Portugal in so far as they argue that journalism always necessarily connotes a degree of formalism and professional procedures or control. Even if that may generically have been true in the past, the advance of technology and changing social habits now make it impossible to confine the concept of journalism to that of a regulated profession. (35)
55. However, it by no means follows that any disclosure of information relating to an identifiable person made by an individual publishing material on the internet qualifies as journalism and thus falls within the exception provided for by Article 9 of Directive 95/46. That provision is categorical that the journalistic purposes exemption only applies to the extent necessary to reconcile the right to privacy with the rules governing freedom of expression; and that the processing of data taking place must be solely for journalistic purposes.
56. Where, then, should the line be drawn?
57. Here, I recall that Article 9 of Directive 95/46 places the obligation to strike the correct balance between the two competing fundamental rights — protection of privacy and freedom of expression — squarely upon the Member States. However, this Court can and should provide the necessary guidance to ensure the correct and uniform application, subject to review by the national courts, of the principles laid down by the EU legislator. I suggest that the following approach may be of assistance.
58. First, in any particular case the national court should examine whether the data processed conveyed substantive material such as to constitute ‘a disclosure of information, opinions or ideas to the public’ within the test laid down in Satakunnan Markkinapörssi and Satamedia. (36) The order for reference here contains insufficient material for this Court to discern whether Mr Buivids’ video satisfied that test and it is for the national courts to make the necessary additional findings of fact. (37) Absent that requisite substantive content, the video would in any event not be covered by the journalistic purposes exemption in Article 9 of the directive.
59. Second, the national court should determine whether the processing of data in question was carried out solely for journalistic purposes. The order for reference states that Mr Buivids did not indicate his aim in making and publishing the video recording. However, it was suggested during the hearing before this Court that he may have wished to expose police malpractice (a classic objective of good, public-spirited journalism). It is again for the national court, as sole judge of fact, to determine both whether that was Mr Buivids’ purpose and whether it was his sole purpose. The presence of other elements (such as a belief in an intrinsic right to film and publish videos of the police merely because they are public officials, or simple voyeurism) would mean that the criterion of ‘solely for journalistic purposes’ was not satisfied. Accordingly, the Article 9 exemption would not apply.
60. Third, the national court will have to grapple with the requirement that exemptions under Article 9 from the normal requirements of the directive protecting personal data are permissible ‘only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression’ (emphasis added). The Court’s settled case-law emphasises that derogations and limitations to the right to protection of personal data guaranteed under Article 8 of the Charter must apply only in so far as is strictly necessary and must be construed narrowly. (38)
61. There is no equivalent provision to Article 8 of the Charter (protection of personal data) in the ECHR. In its case-law the Strasbourg Court has assimilated that fundamental right to the right to respect for private and family life guaranteed by Article 8 of the ECHR, treating it as a more specific expression of the right to privacy in respect of the processing of personal data. (39) Thus, that court’s rulings on balancing Articles 8 and 10 of the ECHR provide a framework within which to reconcile the fundamental rights to privacy of personal data and freedom of expression: the task imposed by Article 9 of Directive 95/46.
62. In relation to the balancing exercise which national authorities (and subsequently national courts) must conduct in order to reconcile those two rights, the Strasbourg Court has ruled that as a matter of principle the rights under Articles 8 and 10 of the ECHR deserve equal respect. (40) The relevant steps have thus far been defined as: (i) examining the contribution to a debate of public interest; (ii) assessing the degree of notoriety of the person affected; (iii) considering the subject of the report; (iv) examining the prior conduct of the person concerned; (v) looking at the content, form and consequences of the publication and (vi) taking account of the circumstances in which the information was obtained.
63. In ascertaining whether a publication disclosing elements of private life also concerned a question of public interest, that Court has taken into account the importance of the question for the public and the nature of the information disclosed. Furthermore, public interest ordinarily relates to matters which affect the public to such an extent that it may legitimately take an interest in them, which attract its attention or which concern it to a significant degree, especially in that they affect the well-being of citizens or the life of the community. (41) The Strasbourg Court has ruled that the risk of harm posed by content and communications on the internet to the exercise and enjoyment of human rights and freedoms, particularly the right to respect for private life, is certainly higher than that posed by the press publishing using more old fashioned technology such as print media. (42)
64. In the present case, the information laid before the Court in the order for reference is sketchy. The referring court states that Mr Buivids’ video recording does not show any current news or illegal conduct on the part of the police; and does not suggest that any of the police officers identified in the video are public figures in their own right. No information is given as to the prior conduct of any of the persons concerned. The subject matter of the video appears solely to be that Mr Buivids was on police premises in connection with administrative proceedings that concerned him. Mr Buivids made his video recording openly but did not inform the data subjects (the police officers) of the specific purpose of the filming. At the hearing, he confirmed that he did not have their express consent, either to the filming or to the subsequent publication on the internet.
65. It is clear that by publishing his video recording on an internet site Mr Buivids infringed the data subjects’ fundamental right to privacy. He did not take any steps to mitigate the extent of that infringement — for example, by blurring or obscuring their faces or disguising their voices before publishing the video.
66. On the basis of the limited information available to this Court, it seems to me likely that the criteria earlier identified for assessing whether, in a particular case, the right to freedom of information should prevail over the right to privacy and to protection of personal data were not satisfied. I emphasise, however, that it is for the national court to complete the process of finding the necessary facts and, on that basis, to make a definitive assessment in the present case.
67. For the sake of completeness I should also address an argument raised by the Czech Republic that Mr Buivids’ data processing activities are rendered lawful by Article 7(f) of Directive 95/46. That provision sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful, (43) provided that they also first comply with the principles relating to data quality set out in Article 6 of the directive.
68. Pursuant to Article 7(f), processing meets the condition of legitimacy where it is necessary for the purposes of the legitimate interests of the data controller (here, Mr Buivids) or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests of fundamental rights and freedoms of the data subject which are protected under Article 1(1) of Directive 95/46. That examination requires a balancing of the opposing rights and interests. (44)
69. It seems to me that the approach adopted by the Court when interpreting Article 7(e) of Directive 95/46 in conjunction with Article 6(1)(b) applies equally here. (45) Thus, Article 7(f) should be read together with Article 6(1)(b) of that directive.
70. The order for reference states that the first instance court found that Mr Buivids did not inform the data subjects of the specific purpose of making the video recording. In view of that finding, it seems likely that at least two of the cumulative conditions in Article 6(1)(b) — that the data are ‘collected for specified, explicit and legitimate purposes’ — were not fulfilled.
71. It follows that Article 7(f) of Directive 95/46 cannot apply here.
72. Finally, I emphasise that there may of course be particular circumstances where the only way in which investigative journalism can uncover serious wrongdoing is by having recourse to some kind of covert operation. Such a situation will be characterised by a high degree of public interest in allowing investigation and publication (thus necessarily involving data processing). It will nevertheless require careful scrutiny to arrive at an appropriate balance between the competing fundamental rights at play. I do not explore that delicate issue further here, because on the basis of the facts in the Court’s possession I am of the view that it clearly does not arise in the present case.
73. I conclude that where an individual who is not a journalist by profession makes video recordings which he publishes on an internet site, those video recordings are capable of falling within the term ‘journalistic purposes’ within the meaning of Article 9 of Directive 95/46 if it is established that those activities were carried out solely for such purposes. In accordance with that provision it is for the national authorities, subject to review by the national courts, to examine and to reconcile the fundamental right to privacy with respect to the processing of personal data of the data subject(s) and the fundamental right to freedom of expression of the data controller. In carrying out that balancing exercise those authorities should have regard to (i) whether the disclosed material contributes to a debate of public interest; (ii) the degree of notoriety of the person(s) affected; (iii) the subject of the report; (iv) the prior conduct of the person concerned; (v) the content, form and consequences of the publication at issue; and (vi) the circumstances in which the information was obtained.
Conclusion
74. In the light of all the foregoing considerations, I am of the opinion that the Court should answer the questions posed by the Latvijas Augstākā tiesa (Supreme Court, Latvia) as follows:
– Activities such as the filming and recording of public officials carrying out their duties at their place of work and the subsequent publication of the video recording on the internet constitutes the processing of personal data wholly or partly by automatic means for the purposes of Article 3(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
– Where an individual who is not a journalist by profession makes video recordings which he publishes on an internet site, those video recordings are capable of falling within the term ‘journalistic purposes’ within the meaning of Article 9 of Directive 95/46 if it is established that those activities are carried out solely for such purposes.
– In any particular case, pursuant to Article 9 of Directive 95/46 it is for the national authorities, subject to review by the national courts, to examine and to reconcile the fundamental right to privacy with respect to the processing of personal data of the data subject(s) and the fundamental right to freedom of expression of the data controller. In carrying out that balancing exercise those authorities should have regard to (i) whether the disclosed material contributes to a debate of public interest; (ii) the degree of notoriety of the person(s) affected; (iii) the subject of the report; (iv) the prior conduct of the person concerned; (v) the content, form and consequences of the publication at issue; and (vi) the circumstances in which the information was obtained.