EU data protection rules abused to censor media

Known as the General Data Protection Regulation or GDPR, the EU rules have been commended for protecting privacy rights, but also with promises of hefty penalties for violations by big techs firms and others.

But some national authorities have also used it to intimidate and censor media. Among them was the head of Slovakia's data protection authority, Soňa Pőtheová.

Last December, she suggested a possible €10m fine against a Czech investigative outlet called Investigace.cz unless they revealed their anonymous sources.

"Pőtheová clearly abused her power and harassed journalists," said Beata Balogova, editor-in-chief of Slovakia's largest independent newspaper Sme, in an email on Monday (25 May).

Investigace.cz had obtained a video featuring Marian Kočner, the suspected mastermind behind the murder of journalist Ján Kuciak. The video shows Kočner installing a camera inside the office of Slovakia's former general prosecutor Dobroslav Trnka.

Pőtheová was told by the Slovak parliament in April to step down over the affair.

But Balogova said Pőtheová should never have been given the job in the first place, due to her previous work history with Kočner.

"The case of Pőtheová shows how the former government massively underestimated the issue of data protection and its potential abuse," said Balogova.

Several politicians in Slovakia have also gone after the Sme newspaper itself, claiming their own personal data protection rights have been violated.

The newspaper had reported about their connections with Kočner, and published parts of conversations over the applications Threema or Viber.

Access Now, an international NGO, drew similar conclusions.

In a report out on Monday, it said some public authorities are misusing the law to stifle journalism and undermine the work of civil society.

Estelle Massé, a senior policy analyst at the Access Now, signalled out Slovakia's Pőtheová as one of the most alarming cases when it comes to GDPR.

She said the European Commission needs to take action to make sure authorities do not abuse the data protection rules.

"If actions are not taken to address and eliminate such behaviour, press freedom and the right to data protection are at risks as the GDPR could ultimately be perceived as a tool for oppression despite the fact that it is precisely the opposite," said Massé, in an email.

Slovakia is not alone.

In 2018, Romania's data protection authority threatened journalists with a €20m fine unless they revealed their sources.

The reporters had uncovered links between Liviu Dragnea, the president of the ruling Social Democratic Party and a Romanian company involved in large-scale fraud.

Romania's data protection authority claimed forcing journalists to reveal their sources "is not likely to violate the professional secrecy of journalists" because the source of their leak was a suitcase.

Meanwhile in Hungary, the GDPR was used to force the local publisher of Forbes magazine to recall from newsstands an issue featuring a list of Hungary's wealthiest people.

The Committee to Protect Journalists, a New York-based NGO, said the EU data law must not be used as a tool to target reporters.

"If EU legislation is being misused to support those who would wish to censor, then resolving those loopholes needs to be given high priority," said Tom Gibson, the NGO's representative in Europe, in an emailed statement.

For its part, the European Commission notes that Article 85 of the GDPR states that EU states need to "provide for exemptions or derogations" when such data is processed "for journalistic purposes".