 |
||||||||||||||||
|
Stefan Walz, Data Protection Commissioner, Bremen (Germany) Relationship between freedom of information and the right to informational privacy in the emerging Information Society
19th International Conference of Data Protection Commissioners
Contents:
|
|||||||||||||||
|
Stefan Walz, Data Protection Commissioner, Bremen (Germany): Relationship between freedom of information and the right to informational privacy in the emerging Information Society
19th International Conference of Data Protection Commissioners
"So fas as information is concerned publication is the antithesis of privacy" - this was the key phrase of David Eady's speech when we discussed on the topic "freedom of expession and privacy protection" four years ago at the 15th International Data Protection Conference in Manchester. Times have changed since then very quickly: This traditional antithesis seems to be more actual then ever before. Let me simply remind you the worldwide discussion after the tragic death of the Princess of Wales on August, 31. But I will not talk about physical intrusion upon private property or "papparazzi" activities of media people and appropiate legal remedies in this respect. The concrete legislative occasion why we deal with this issue again in 1997 is the European Community's Data Protection Directive which has to be transposed into national law until October 1998. Art 9 of this Directive demands from the member states to provide for exemptions and derogations from the provisions of several chapters in favour of journalism.
I would like to begin my talk with a brief description of the international constitutional situation. The profession of journalism is built upon the "right to ... impart information..through any media.." - so far the famous sentence in Art 19 of the Universal Declaration of Human Rights, adopted shortly after World War II in 1946. Since then, several legal instruments and documents at the international level have guaranteed the freedom of the press. The European Convention on Human Rights (ECHR from 1950) states with similar wording in its Art 10 that the right to freedom of expression shall include the freedom .. to impart information and ideas without interference by public authority..". The European Union has declared its will and readiness to respect the fundamental rights laid down in the ECHR: Art F SS 2 of the Maastricht Treaty concluded in 1992 which has been taken over unchanged into the new Amsterdam Treaty expressly makes this reference. The EC Broadcasting Directive equally refers to the principle of freedom of expression. On the other hand, the international declarations and treaties contain provisions for the protection of privacy. The ECHR acknowledges a right of protection of private and family life (Art. 8). Data protection comes within the scope of the protection of private life guaranteed under this article. Art F § 2 of the Treaty on the European Union consequently refers not only, as mentioned before, to Art 10, but to Art 8 as well. Several international texts explicitly take up the tension between individual data protection rights and media freedom granting exemptions from the respective principles. Art. 10 § 2 of the ECHR permits restrictions on media freedom "for the protection of the reputation or rights of others". There is no specific mention of the restraints on speech to protect privacy rights but there can be little doubt that they have to be included in this category. The contrary solution: The UN Guidelines provide for exemptions from the minimum data protection guarantees if they are necessary to protect the rights and freedom of others which includes the media. The Explanatory Report on the CoE-Convention 108 (No. 58) allows derogations from the basic privacy principles in order to safeguard the freedom of the press. The authors of the EC Data Protection Directive 95/46/EC have chosen the same approach: Art. 9 gives the member-states the opportunity to exempt data processing for journalistic purposes from the application of several chapters of the Directive. At the national level press and broadcasting freedom are constitutional rights in many states. Usually this is not spelt out in the text of the constitutions. One exception is Art. 5 of Germany's Basic Law. But in most jurisdictions the principles of media freedom have been formulated through judicial interpretation of the provision of freedom of speech. The First Amendment in the U.S. covers freedom of speech and freedom of the press in the same sentence. In other words: For the most part these terms seem to be interchangeable. Nevertheless the difference between journalism and expression of private opinions must not be neglected in our context. I will come back to this point later (see below 6.2.3).
My starting points are two convictions: Firstly, the two fundamental rights must not be seen as inherently conflicting but in some respects supporting each other. In the absence of adequate safeguards for privacy individuals may be reluctant to express their ideas freely. Identification and profiling of users of media online services - I will deal with this point later (see below 4.2.2, 6.5) - are likely to reduce the willingness of citizens to receive and impart information. Second conviction: In our context we are not dealing with the traditional topic of state intervention in the media sector; it is not the classical function of basic rights directed against the state that is at stake. Therefore it is not useful to enter into an abstract debate on what is the rule and what the exception. One side would claim that media freedom has priority allowing only a few exceptions in the interest of the individual's privacy - one could assume that when reading some judgements of the European Court on Human Rights concerning Art. 10. The contrary position would claim the priority of - to take a term used for the first time by the German Constitutional Court - the right of informational self-determination, and then look for exemptions in favour of the press: The structure of Art. 9 seems to reflect this approach. Privacy protection and freedom of the media are two social values as well as basic rights which are globally recognized by international declarations and guaranteed expressly or implicitly by many national constitutons without any rank order. Both of them have equivalent status. To conciliate potential conflicts between two fundamental rights, legislators and lawyers have to find what a famous German constitutional lawyer called a "practical concordance": In every piece of legislation, in any concrete case of application a solution has to be found which allows one to apply one principle as far as possible without violating the other. In other words: An acceptable balance is needed between two equally protected fundamental rights. The mutual delimitations must respect the principle of proportionality.
In order to follow this line of reasoning I would like to answer the following
three questions:
4.1 Journalistic methods of working versus privacy principlesTo the first question referring to the gap between investigation and publication methods of the media and data protection principles. Two of the basic principles of data protection legislation are the necessity to obtain the data subject's consent and the obligation to inform the concerned person on the quantity and purpose of the processing and use of his/her data. Traditional journalistic methods of working such as covert investigations or the confidentiality of the sources of information are not in conformity with these reqirements. The collection and publication of data on health, sexual behaviour etc. - not only of politicians, but often of ordinary people - by media people does not correspond to the need for stronger protection of sensitive data explicitly provided for in the majority of national data protection laws and incorporated in the EC-Directive (Art. 8). Journalists are storing data "in stock" because they often do not know in advance whether they really will use the collected information for writing an article on the planned topic or for another publication. This contradicts the privacy protection principle not to store more data and for a longer period than are relevant for specified purposes. This list of examples illustrating contradictions between the professional behaviour of journalists and fundamental principles of data protection could be extended without difficulty. 4.2 Changes in the media "landscape" - new risks for privacy
Second question: Let me try to summarize briefly the main developments in the area of print and broadcast media in the nineties and the new challenges to the protection of privacy they entail. The social and technical main streams can be subsumed under the key words digitalization, convergence, multimedia, interactivity, privatization, commercialization and globalization. The new risks can be defined as uncontrollable proliferation, manipulation, profiling, long-term storage and secondary use. 4.2.1 Digitalization and convergence - towards global proliferationMedia "become multimedia" due to the digitalization of data processing and communication. Increasingly the traditional separation of the different categories of mass media is being eliminated. Printed press, broadcasting and online-publishing merge into one another and are simultaneously run by big media conglomerates. The press "goes electronic". Convergence means for the user that formerly different technologies and media gradually appear like merely different functions of a uniform information sphere. Interactivity is introduced where readers, listeners and viewers were used to passively receive and consume information. A recent survey of the US situation counted more than one hundred electronic newspapers and magazines ("eZines"). They can neither be bought in a shop nor be delivered to the private mail-box because they only exist in electronic form. Many printed newspapers nowadays offer online versions via service providers and/or the Internet. Radio and TV stations have videotext and (video-) on-demand services in addition to their broadcast programme. Internet television is being prepared. Communication systems like Digital Audio and Digital Video Broadcasting make the convergence of individual data transfer and mass media easier. The fight between the two fundamental technical options for the future, i.e. between TV-compatible PCs on the one hand and TV sets with computer functions on the other is well under way and not yet decided. Thus, the same news is diffused in the newspaper, on CD-ROMs, by radio- or TV-stations and the online service frequently run by the same media company or joint-venture corporation (for ex. MSNBC linking Microsoft and NBC). Many more people than before read and see news or reports harmful to reputations or containing false information. This "proliferation-effect" is increased when journalistic contents are made available on the Internet which is more and more the case. In that case news for which the attention formerly was restricted to listeners and viewers at the local or regional scale - for ex. published by local newspapers - is becoming accessible worldwide. Proliferation of information then takes place at the global level.To sum up: "Multimedia" and the Internet allow the access to any available information independent of place and time. 4.2.2 Digitalized media data bases - profiling and long-term storageIn connection with these structural changes publishers are establishing computerized data banks, digitalized media archives and computer-aided radio studios: They allow the user to match informations more effectively, to search information far back into the past, to produce biographic profiles, to process images etc.. Therefore the journalist using paper and pencil will be history in a few years. Typing on the manual of his/her notebook, sending or receiving texts via the telecommunication network, checking news in the electronic archive, storing drafts or the full text of the article in his/her PC or the publisher's computer system will the be integral part of normal professional life. This automation of information storage is leading to what I call - perhaps rather slogan-like - the "eternity-effect". "The computer stores it all", but does never forget. Readers or viewers often do not remember for a very long time either correct or wrong information printed or broadcasted only once. But when these data are kept in easily accessible electronic archives facts or allegations once published potentially will never be forgotten. The "right to be forgotten" which can be found in quite a lot of national laws for ex. concerning conviction registers cannot be realized any more . 4.2.3 Commercialization and secondary useDigitalization and convergence take place on the background of a dramatic commercialization in the media-sector. Let us take broadcasting as example: Broadcasting, which used to be studied only in cultural and political terms and was operated by public institutions, is being privatized and becoming a matter of competition in a liberalized media market. The EC has consequently included broadcasting within the provision on the freedom of (commercial) services (art. 55 et seq. EC Treaty). If communication processes traditionally have been divided into a political-cultural and a commercial circuit, information services now are a combined carrier for both interests. Editorial information is juxtaposed to advertising. What matters in our context is the increased risk of secondary use detrimental to the reader or veiwer. To establish electronic press data banks or digitalized media archives and to keep them up-to-date is expensive. What seems to be more logic than to open these data bases for non-journalistic purposes? Information once collected for journalistic use and under the special privileges of the press or media law is later offered as "business information" service to clients with financial, commercial or private interests. Commercial motives are also incentives for the exploitation of transactional data. As I mentioned before, more and more media are moving on from unilateral dissemination to interactive service facilities for the consumer. The impact for privacy is important and can be simply illustrated: Who buys a newspaper in a shop remains anonymous. But whoever accesses the online newspaper using networks leaves electronic data trails such as connection and billing data. More generally: Individual electronic access offers the opportunity and the means to compile and combine the electronic trails of individuals. The media service are tempted to establish user-profiles for marketing or other commercial purposes. To know the hits and pageviews of individual users is of great value for direct marketing, for the placement of advertisements etc. The potential loss of anonymity is considerable and gives rise to concern. 4.2.4 Converging technologies - combined risksAll the effects I have listed increase the risk to the right of privacy of those citizens mentioned in or affected by press/media publications. Again, this is not only problematic when incorrect or incomplete data are disseminated. Similar concerns arise when correct but harmful information is involved. The negative effects are combined when value judgments, allegations based on rumours, defamatory statements, reports about convictions long after the sentence has been served are published in multimedial forms, usable for surveillance, credit information or other purposes related to civil life and accessible world-wide. Fierce competition within the media sector intensifies these dangers. We have found in years that the fight for more readers, listeners and viewers has led to spectacular intrusions into the private lives not only of prominent, but of ordinary people too. Professional ethics risk being less and less respected in large parts of the media. To sum up: Electronic publishing by the mass-media in an entirely commercial framework changes the traditional triangular relationship between media, reader/viewer and persons being object of publications completely. The key question is how to prevent this development being detrimental to privacy.
To what extent and in which respect do we have to adapt the existing national legal frameworks to the new factual situation of the mass media characterised by the secular trends of digitalized automation, globalization and increased commercialization in order to safeguard the citizens' privacy rights? Before trying to answer this question let me start with a few sentences on the role and function of the mass media which should never be questioned and remain untouched by any discussion about law reforms. The freedom of the print and broadcast media is an essential component of freedom of expression and information. Not only privacy protection but also media freedom is a substantial element of the individual's self-determination in a democratic society. For these reasons media freedom is - as I pointed out at the beginning - guaranteed as a fundamental right and value in most of the national constitutions as well as in international and European conventions and declarations. All provisions or measures that risk making prior censorship possible have to be strictly rejected. Journalists must have the chance to publish preliminary information not yet judicially provable. Data protection must not be used as a pretext for administrations and companies to withhold relevant information to the media. To sum up: Restrictions of and interventions into journalistic work, in this context the collection, use and publication of (personal) data, can only be accepted if they can claim to protect other fundamental rights and values. They must approprate and at the same time limited to achieving the goal of obtaining a fair compromise between press and privacy. This is the key idea of the concept of "practical concordance" I referred to at the beginning.
I am sure that there is a strong consensus between media and privacy protection representatives about this evaluation which underlines the utmost importance of free mass media for democracy. The "other side of the coin", i.e. the legal consequences that have to be drawn in favour of data protection in the new social and technical environment of the Internet age, will be - as I suppose - more controversial. It is my conviction that, in order to achieve this goal, the traditional legal framework applicable to the mass media has to be based on a mixture of traditional legal instruments and some new conceptual ideas which I would like to outline briefly. 6.1 On-line versus off-line - equivalent protection standard and privacy enhancing technologiesMy first principle: The data protection standard in the media sector should be equivalent off-line and on-line, at least as much as possible. The citizen should keep the maximum of his/her privacy status which he/she has in the traditional media structure, even when the media company communicates or publishes via electronic means. The "privacy status" includes all relevant provisions and case law interpretations even if they are not part of the data protection law in the narrow sense. The reader or viewer should have no privacy disadvantages from the fact that newspapers and TV stations "go online", use telecommunication networks and offer interactive services. This does not mean that the traditional press/media legislation and the civil or penal law sanctions applying to the media are superfluous in the Internet age. On the contrary: They are even more important to help citizens protect their reputation and private life against defamatory, uncorrect or otherwise harmful publications. But nevertheless, in order to maintain the existing level of privacy protection the legal remedies conceived and suitable for the printed press and the classical radio/TV have to be adapted to the new electronic environment. The old press laws were conceived and enacted in a period definitely bygone. In the era of multimedia they are no longer sufficient. Their scope has to be extended to non-printed publications and/or the legislation has to be amended enacting special new on-line provisions. The need for extension applies also to the individual rights. A good example is the traditional right of reply: When newspapers are offering online access to their pages, the potential harmful effect for the concerned person is increased. In order to equilibrate this additional risk the legislator should prescribe that the text of the reply has to be stored together with and compulsorily added to the original article every time when a user is reading it online on the screen. Besides new legal solutions privacy enhancing technologies (PETs) play an important role for achieving a high protection level for interactive online communication of listerners and viewers with the media. The German Länder reacted first in order to preserve the right of uncontrolled communication:in the sector of mass media. The new Interstate Treaty on Mediaservices, which came into force on August 1, 1997, requests providers of media services such as pay-per-view, videotext video-on-demand and electronic newspapers to offer anonymous access and billing procedures. This provision is aimed at preventing user-profiles and illegitimate secondary use. It is up to international agreements (for ex. European Convention on Transfrontier Television), supranational (for ex. EC ISDN Directive) and/or national legislators to make the principles of "data avoidance" and strict purpose limititation for transactional and billing data obligatory. 6.2 The "media privilege" and its limitsThe legislators' traditional approach to cope with privacy consequences of journalistic methods of working was to intervene retroactively, i.e. after the publication, with the means of press law, civil law and penal law. The right to reply, to claim damages etc. were provided for. Only the publication of information was conceived as potentially intruding into someone's privacy. Before the new data protection laws came into force from the end of the seventies onwards, no need was felt to consider the risks caused by the collection and use of personal data by the media independent from publication. In the computer age the collection, storage and use of personal data as such cause risks to the privacy of citizens. The misuse of data does not depend from the communication or publication of data. "Any data, once collected, may be subject to use, sooner or later, and any data subject to use may be misused. Personal details are powerful things, they can be used as weapons." (Arpenes). That is the core motive for data protection legislation throughout the world, and it applies to all data processing entities in the public as well as in the private sector. Media enterprises in this respect are no exception. 6.2.1 Exclusiveness of the journalistic purposeThe specific legal prerogatives of the media in data protection law - what we call in Germany the "media-privilege" - reflect the balance between privacy and freedom of expression. "Pragmatic concordance" consequently means that this special treatment can only be justified if and as long as the particularly journalistic purpose of the data processing is exclusive. In other words: Exemptions from the requirements of lawfulness, individual rights and oversight mechanisms as basic elements of data protection legislation are only legitimate insofar they are unrenounceable for the journalistic work. This is exactly the approach of Art. 9 of the EC Directive. But there is a margin of interpretation left by Art. 9 of the Directive for national legislative solutions.
The consequences are logical. Firstly, all of the data processing activities
carried out by newspaper publishers, media service providers or broadcasting
companies which do not fulfill journalistic purposes have to comply
with the general laws. They are subject to the ordinary restrictions
imposed by the law of telecommunication, data protection, electronic commerce
or online-services.
Second example: Data subjects should be entitled after the publication to the usual individual data protection rights as there are the right of access, the right of rectification and deletion of personal data stored in media data bases as far as these informations were used for the publication. This contributes to diminuish the "multimedia"-related risks of uncontrolled proliferation, profiling and long-term storage mentioned before. It is difficult to imagine how these retroactive legal means could infringe upon the work of journalists under the condition that the information sources remain confidential. 6.2.2 Non-editorial data
Once more: Not included into the special media regime are data processed for
administrative or commercial purposes such as employee data and data kept in
sales and advertising departments (suscribers, advertisement clients etc.).
This principle seems to be simple and convincing but media representatives
sometimes question it by pointing to potential overlaps between
editorial and non-editorial activities:
6.2.3 Journalism versus expression of private opinionsIn an Internet environment the scope of the media freedom as well as of the "media-privilege" risks becoming blurred. The Internet gives everybody having access to the network the opportunity to release texts from his PC at home or in his office and to express his opinions to a potentially worldwide audience. It is self-evident that not everybody can declare himself to be a journalist in order to profit from the exemptions from the general data protection legislation. To be able to use the same technical communication infrastructure as the mass media obviously cannot justify a legal equivalence. There must be a clear distinction between net users disseminating information or expressing their private opinions in news or chat groups and people working in a professional context, i.a. working in or for media companies or institutions which fulfill their social function of influencing and contributing to the public debate. In other words: The addressees of exceptions as well as of the data subjects' individual rights must be clearly identifiable. This demarcation seems to be easy when the criteria of membership in professional organisations and/or of an adequate professional infrastructure (for ex. editorial office, studio, production facilities) are fulfilled. The borderline may be more difficult to draw when someone offers via network informations and texts to the highest bidding customer who can belong to the media sector or be interested for commercial or business reasons. For that purpose he/she runs a computerized data base in the office or at home. The answer in these cases is negative because the decisive factor to define the journalistic character is the clear and exclusive orientation of the data processing towards mass communication.The journalist working on a freelance basis is therefore entitled to profit from the media privilege. 6.3 Converging technologies - converging lawsThe traditional separation between press law for the printed press and legislation for the other mass media such as TV and radio are becoming more and more out-dated due to the above-mentioned development towards the digitalization of information storage and communication (multimedia) and to integrated media corporations. It is impossible to clearly distinguish between press law and broadcasting law when their technical infrastructure is to a large extent identical. It is difficult to justify why electronic publishing of printed newspaper articles on the one hand and videotext information repeating broadcast TV news on the other or the respective data banks containing the relevant informations should be treated differently in legal terms. I predict that technical integration in the media sector will lead in the future to a more uniform legal approach. As far as data protection provisions and rights are applicable, they should cover the different kinds of mass media as generally as possible. A uniform legislative concept is the best way to ensure that privacy protection is guaranteed irrespective of the traditional and increasingly blurred distinctions between print, broadcast and online mass media. This does not necessarily mean to unify the codifications. What is important is that even if the division into sectoral laws is maintained the aspects related to mutlimedia are simutaneously regulated. This is the legislatory direction currently being followed in Germany. In a broader framework this coherent concept of "multimedia law" could be conceived as part of an overall body of "information law" which studies the communication processes in a society as a whole and integrates telecommunications law, media law, copyright law, data protection law and the variety of provisions in general laws relating to the processing and disseminating of personal and non-personal data. But I do not have the time to develop this idea here and now. 6.4 Professional ethics versus binding legislationProfessional ethics demanding respect for the private sphere of individuals and self-control bodies monitoring compliance with these standards are common in quite a lot of countries. Art. 9 of the EC Directive requests that existing self-regulation rules and mechanisms have to be taken into account when the need for additional or modified legislation is examined. Obviously that requires that the scope of these internal rules is extended to electronic forms of publication. Press codes traditionally are restricted to print media. I do not have enough time to examine in detail the role of self-regulation within a uniform legal framework for journalistic activities in the multimedia era. But it is certain that internal journalistic codes of conduct have not in the past prevented dramatic cases of excess, of intrusion into the intimate life and the private sphere. The rise of the "yellow press" has not increased trust in the ability of media people to provide within their own professional framework for the necessary safeguards for respect of the individual data protection rights of the citizens. Codes of conduct without effective oversight mechanism, without effective rights of redress for concerned persons and without covering the whole media sector are not protective enough to replace or compensate compulsory legislation.
The dilemma how to preserve basic human rights faced with their vulnerability will certainly increase in the coming multimedia age. Reflections on how the freedoms of expression, of speech and of the press are to be balanced against the right to privacy will continue. Comparative constitutional analysis and empirical research are needed. Many if not all democratic states will have to reassess the legislative framework for the application of data protection law to the media. The issue concerns in particular the EC member states which have to implement Art. 9 of the Directive in their national legislations. The purpose of my talk was to present a few incentives for the future debate. | |||||||||||||||
