WORKSHOP

SUMMARY

WORKSHOP • 16 JUNE 2016

IMPLEMENTATION OF THE GDPR: THE RIGHT TO FREEDOM OF EXPRESSION AND PERSONAL DATA PROTECTION

by Lina Jasmontaite, Brussels Privacy Hub, LSTS, VUB

SUMMARY

On 16 June 2016 the Brussels Privacy Hub hosted the third workshop within the BPH Workshops Series on the Implementation of the GDPR. The workshop took place at the Institute of European Studies, the Vrije Universiteit Brussel. The workshop examined the impact of the GDPR provisions on the right to freedom of expression. In particular, the participants considered situations in which fundamental rights to personal data protection and freedom of expression may be in conflict. It is uncertain who will and should perform the balancing of rights in these situations (e.g., the legislator or data controllers on a case-by-case basis). Reflecting on the extent to which the  General Data Protection Regulation (GDPR) improves the regulatory regime set forth by Data Protection Directive, workshop participants were mostly concerned about the following two issues:

Lack of legal certainty: While the GDPR on several occasions refers to the right to freedom of expression, the GDPR provides no specific guidance on how to reconcile data protection with free expression in situations. According to Article 85, Member States may adopt domestic laws providing derogations from the EU data protection rules in situations where processing of personal data is performed for journalistic purposes or the purpose of academic, artistic or literary expression. This means that the GDPR brings minimum harmonisation as far as the reconciliation of rights to data protection with free expression are concerned. In practice, this would mean that in each particular situation, domestic regulatory frameworks should be considered and consulted.

Balancing of rights on case-by-case basis: Article 17, governing the right to erasure (‘right to be forgotten’) has provoked a transatlantic debate on the scope of fundamental right to privacy, data protection and freedom of expression. Article 17 clearly demonstrates that the right to the protection of personal data is not an absolute right. In particular,  section 3(a) foresees that the exercise of the right to erasure can be limited if this is necessary for the exercise the right to freedom of expression and information. Furthermore, Article 17(2) GDPR, obliges controllers to be proactive and take measures to inform third parties who process the data for which an erasure request was made by a data subject (e.g., in cases where removal of links, a copy or replication of the personal data is requested).

It can be concluded the GDPR spirit respects all fundamental rights and requires balancing of fundamental rights on case-by-case basis. To carry out a balancing exercise, domestic laws governing the freedom of expression and the right to the protection of personal data will have to be consulted. This gives little reassurance for controllers about the compatibility of their actions with the GDPR, yet it is commonly agreed that the principle of proportionality should be at the core of the processing of personal data that is ‘designed to serve mankind’ (Recital 4).

For more information about upcoming BPH events, please visit the BPH website or contact us at info@brusselsprivacyhub.org.