You are a journalist wanting to report on an issue of indisputable public interest. The issue involves people’s personal data, but it comes from publicly available sources. There could be no possible objection to your publishing that personal data as part of your story, right? Wrong – at least on the facts of the Satamedia v Finland case, on which the Grand Chamber of the ECtHR gave judgment this week.

Background

The case involved a newspaper routinely publishing the surnames and forenames of approximately 1.2 million natural persons whose annual taxable income exceeded certain thresholds (approximately 10,000 to 13,500 euros), as well as the amount of their earned and unearned income and taxable net assets. That data was published in an alphabetical list organised according to municipality and income bracket. It was lawfully obtained through Finnish access to information legislation, which is relatively unusual in providing public access to individuals’ taxation information. But – as we shall see – it was published in raw, bulk form. Big data meets personal data.

Despite that public accessibility, the scale of the newspaper’s publication of tax data raised concerns that culminated in a ruling by the Finnish Supreme Court that those publications breached data protection law. The media companies could not rely on the data protection exemption for publication ‘solely’ for the purposes of journalism, given the vast scale of data they published. Privacy rights trumped free expression rights.

The Fourth Section of the ECtHR took the same view, and the Grand Chamber has now done likewise: the right balance had been struck between the competing rights under Articles 8 (privacy) and 10 (free expression) of the ECHR. Here are the key aspects of the Grand Chamber’s reasoning.

The Grand Chamber’s reasoning

First, despite the public accessibility of this data, Article 8 rights were engaged: “where there has been compilation of data on a particular individual, processing or use of personal data or publication of the material concerned in a manner or degree beyond that normally foreseeable, private life considerations arise” (see paras 136-138). The Grand Chamber was not impressed by the submission that – given the vast volumes of data being published – each individual was rendered comparatively anonymous and thus suffered little in terms of privacy impact (see para 181).

Second, there had plainly been an interference with the Article 10 rights of the media companies. No dispute about that.

Third, however, that interference was ‘prescribed by law’: Finnish data protection law was sufficiently clear. “Moreover, the applicant companies  were media professionals and, as such, they should have been aware of the possibility that the mass collection of data and its wholesale dissemination – pertaining to about one third of Finnish taxpayers or 1.2 million people, a number 10 to 20 times greater than that covered by any other media organisation at the time – might not be considered as processing “solely” for journalistic purposes under the relevant provisions of Finnish and EU law” (para 151).

Fourth, that interference was also in pursuit of a legitimate aim, namely the protection of data protection and privacy rights.

Fifth, the crucial issue was of course whether that interference with free expression rights was ‘necessary in a democratic society’, i.e. proportionate. Here is the rub.

There were plainly important public interest issues at play here: “It is unquestionable that permitting public access to official documents, including taxation data, is designed to secure the availability of information for the purpose of enabling a debate on matters of public interest” (para 172).

But: “the existence of a public interest in providing access to, and allowing the collection of, large amounts of taxation data did not necessarily or automatically mean that there was also a public interest in disseminating en masse such raw data in unaltered form without any analytical input” (para 175).

In other words, even where the issue underlying the media reporting is of undoubted public interest, the connection between that issue and the actual data published can be broken. Bulk dumps of raw data for millions of people did not really help with any analysis or commentary about important public issues. “While the information might have enabled curious members of the public to categorise named individuals, who are not public figures, according to their economic status, this could be regarded as a manifestation of the public’s thirst for information about the private life of others and, as such, a form of sensationalism, even voyeurism” (para 177).

Overall then, the correct balance had been struck: the interference with Article 10 was justified on the grounds of protecting Article 8 rights.

So can the media publish open-source personal data?

The Satamedia judgment will raise eyebrows from a free expression perspective. But it should not be overblown. It does not tell journalists that they cannot publish personal data from public sources (or indeed from any other sources).

It merely sounds a warning not to publish personal data indiscriminately (bulk raw data about everyone and anyone should be approached with caution; big data does not sit well with personal data). Otherwise, you may stray away from the public interest issues you seek to report on. You could forfeit your ‘journalism’ protections under data protection law and dilute your free expression rights to the point where the balance tips in favour of privacy – even privacy about publicly-accessible matters.

Anya Proops made submissions on behalf of Article 19, who were an interested party supporting the media companies.

Robin Hopkins @hopkinsrobin