Austrian Constitutional Court overturns media privilege under data protection law - German media privilege also at risk?

In a recent ruling, the Austrian Constitutional Court (VfGH) declared the Austrian media privilege unconstitutional. But what is the purpose of media privilege and what does the Austrian decision mean for the legal situation in Germany?

Media privilege as a balance between freedom of the press and data protection

Particularly in the course of investigative research, journalists often need to collect and process (sensitive) personal data. If the GDPR was fully applicable, which only allows personal data to be processed under strict conditions - e.g., if the data subject has given his or her consent - data subjects could therefore often prevent critical reporting under the guise of data protection law. The media privilege was created to prevent this. It intends to balance freedom of the press and data protection and therefore grants certain exceptions to data protection law when processing for journalistic purposes. In this context, Article 85 GDPR allows member states to provide for certain deviations or exceptions from the rules of the GDPR.

The Austrian Constitutional Court's Decision on the Austrian Media Privilege

Under the challenged provision of Section 9 para 1 of the Austrian Data Protection Act (DSG), only a few data protection regulations apply to data processing for journalistic purposes by certain media actors. The applicability of the DSG is thereby completely excluded. With regard to the GDPR, in addition to the general provisions on scope and definitions, only the provisions on legal remedies, liability and sanctions apply. The essential substantive principles of data protection, on the other hand, such as, among others, the principle of lawfulness of data processing, the guarantee of data subject rights, such as information and disclosure rights, as well as the obligations of data controllers and commissioned data processors on technical data protection are not applicable. As a result, this represents an almost complete exemption of data processing by media companies for journalistic purposes from data protection laws.

In the view of the Austrian Constitutional Court, the media privilege in data protection is necessary in accordance with Article 85 para 2 GDPR, as otherwise there is an unresolvable conflict of journalistic work with data protection. However, the court emphasizes that any (legal) interference with the fundamental right to data protection must be "necessary" and, in this respect, a balancing of the interests of the data subjects in data protection and the freedom of speech and information of the media must take place. Article 85 para 2 GDPR speaks here of "derogations and exceptions" which the member states may provide for in the sense of a media privilege if this is "necessary" to reconcile freedom of the press and data protection. With reference to the case law of the ECJ, the Constitutional Court states that exceptions and restrictions with regard to data protection must be limited to what is absolutely necessary.

This was not implemented in a constitutional manner in the case of the quasi-complete exemption of media data processing from data protection, without additional requirements for proper data processing or data security. In the opinion of the Austrian Constitutional Court, Section 9 para 1 DSG does not meet the requirements outlined by the court as a blanket and undifferentiated exclusion of all essential data protection provisions for the media. The exceptions to data protection for the media's freedom of speech and information were to be limited to those provisions, which were incompatible with the special features of the exercise of journalistic activity. The blanket exemption of relevant journalistic activities from data protection requirements is not an implementation of the media privilege laid down in Article 85 para 2 GDPR that satisfies the balancing of data protection and freedom of expression and information.

In addition to obliging the Austrian legislature to introduce new regulations by mid-2024, the Constitutional Court proposes imposing stricter requirements on media professionals in terms of internal organization, documentation and technical security as compensation for the privilege.

The German media privilege - a fair balance?

In Germany, the equivalent of the Austrian media privilege is regulated in particular in Section 12 and Section 23 of the State Media Treaty (Medienstaatsvertrag - MStV). In addition, the respective state press laws contain corresponding regulations.

The provisions of the MStV oblige journalists to observe data secrecy, according to which personal data must not be processed for purposes other than journalistic ones. Otherwise, the principle of confidentiality and integrity applies in particular to ensure data security. In this context, data controllers must take appropriate technical and organizational measures to protect personal data, e.g., against unauthorized or unlawful processing. Great importance is attached to the security of personal data. The assertion of claims for damages by data subjects and the possible imposition of fines (Articles 82 and 83 GDPR) will be limited to violations of data secrecy and the aforementioned principles.

In this respect, the German provisions of the MStV on media privilege are significantly more differentiated than the previous Austrian provisions. Among other things, the German media privilege sets forth requirements for data security and data integrity. It also provides for a special right to information under certain conditions.

The regulations indicate that a balance has been struck between data protection and freedom of opinion and information. In view of the overriding importance of the latter, considerable restrictions on data protection are required, but this is satisfied in view of the high technical requirements and the emphasis on data secrecy. This is because these requirements for journalistic activity ensure that the media can effectively fulfill their constitutional mandate and that citizens are nevertheless protected from the risk of losing control over their data due to purpose limitation (data secrecy) and high data security requirements. In this respect, the "fundamental right to data protection" is not undermined, but rather limited to the minimum necessary in the light of freedom of expression and freedom of information within the meaning of Article 85 para 2 GDPR.

The Dresden Regional Court also reached a comparable conclusion in July 2021 (3 O 1965/20). We conducted this legal dispute on, among other things, the legal consequences and scope of the media privilege under data protection law and successfully defended our client, a national media portal, against a civil claim for immaterial damages. The court emphasized the obligation and the broad leeway of the member states to or in implementing the requirements of Article 85 para 2 GDPR to protect freedom of expression and information. The Regional Court of Dresden confirmed that the media privilege is the result of a legally compliant consideration within the meaning of Article 85 para 1 GDPR.

It can therefore be assumed that the German regulation in Sections 12 and Section 23 MStV on media privilege is constitutional.