The decision analyzes the delicate balance between freedom of expression for journalistic purposes and the right to data protection, specifying that the publication of a nominative document is lawful only if it is strictly necessary for informing the public, which is not the case when less intrusive alternatives such as anonymization are possible.

Facts and Context

The Belgian Data Protection Authority (DPA) today published a decision issuing a reprimand against a press organization for breaches related to the online publication of a non-anonymized birth certificate.

The case originated from a complaint by a person whose birth certificate was published on December 16, 2023, illustrating a press article about potentially illegal adoptions, thereby publicly revealing their adoption.

Reasons for the Decision

• Lawfulness obligation of processing (Article 5(1)(a) of the GDPR and Article 6 of the GDPR): The authority examined the legal basis of legitimate interest invoked by the defendant under Article 6(1)(f) of the GDPR. While recognizing that informing the public within a societal debate constitutes a legitimate interest, it concluded that the necessity condition was not met. The publication of the identifiable birth certificate was not indispensable to achieve the journalistic objective, which could have been accomplished by less intrusive means, such as effective anonymization of the document. Furthermore, the authority found the balancing of interests deficient, as the defendant did not properly consider the serious impact on the complainant's private life and wrongly equated their interests with those of the Catholic Church.

• Data minimization obligation (Article 5(1)(c) of the GDPR): Directly linked to the lack of necessity, the authority considered that the data minimization principle was violated. By publishing a legible image of the birth certificate, the data controller processed personal data (names of the complainant, their biological mother, and adoptive parents) that were not adequate, relevant, and limited to what was necessary for the pursued journalistic purpose.

• Application of the journalistic exception (Article 85 of the GDPR): The authority acknowledged that the processing was carried out for journalistic purposes. However, it recalled that the exception provided by Article 85 of the GDPR and transposed into Belgian law is not absolute. It requires a balance between the right to data protection and freedom of expression. This balance, which must respect journalistic ethics, does not allow derogation from the fundamental principles of the GDPR, notably the lawfulness of processing, when the publication of identifying data is not strictly necessary.

Authority's Decision

Consequently, the authority issued a reprimand against the press organization, pursuant to Article 58(2)(b) of the GDPR.

Moreover, the authority ordered the publication of its decision on its website, after anonymization.

Lessons Learned

This decision reminds that:

• The journalistic exception provided in Article 85 of the GDPR is not absolute and requires a rigorous balancing between freedom of expression and the right to data protection, taking into account professional ethics.
• The publication of identifiable personal data for journalistic purposes based on legitimate interest must meet a strict necessity criterion; if the public information objective can be achieved by less intrusive means (anonymization, blurring), the publication of unmodified data is unlawful.
• The fact that a document containing personal data is published in a small size does not constitute sufficient protection if a simple enlargement (zoom) by the reader makes it legible.
• When balancing interests under Article 6(1)(f) of the GDPR, the analysis must focus on the fundamental rights and interests of the data subject, without attributing to them intentions or affiliations that are not theirs.