In its ruling of 14 December 2022, the Austrian Constitutional Court annulled Section 9 (1) of the Data Protection Act (Datenschutzgesetz 2000 - DSG) as unconstitutional. According to the so-called media privilege, media companies and their employees have so far been largely exempt from the provisions of data protection law when carrying out their journalistic activities. This put those affected in the unpleasant situation of the data protection authority declaring itself incompetent in such cases. Although the Constitutional Court recognised the important role of the media as a "public watchdog", it ruled clearly in favour of data protection. The legislator now has time until mid-2024 to create a balanced new regulation.

Initial situation and preliminary proceedings

The initiative to review the law came from the Federal Administrative Court as a result of two complaints:

In the first case, a data subject had previously complained to the data protection authority because a media company had published an uncensored picture of his business card on its website, on which his employer was recognisable. The media company invoked the media privilege and requested that the complaint be rejected. The data protection authority granted this request and declared itself not competent because the complainant's data had been processed in the context of journalistic articles or journalistic reporting.

In the second case, several persons complained to the data protection authority against the reporting of a publishing house and a broadcasting company about a data leak in the E-mail inbox of the persons concerned. In this case, too, the data protection authority decided that it was not competent due to the media privilege.

In both cases, the data subjects appealed to the Federal Administrative Court, which then applied to the Constitutional Court for the repeal of Section 9 of the Data Protection Act.

Which journalistic activities are covered by the media privilege?

The term journalistic activity within the meaning of the GDPR is to be interpreted broadly according to the case law of the European Court of Justice, whereby journalistic activities that are not profit-oriented also fall under this term. However, "journalistic activity" within the meaning of the media privilege under Section 9 of the Data Protection Act only concerns media companies and their employees.

This difference is important because in matters of media law, the ordinary courts are generally competent. However, since the data protection law including the media privilege came into force later, it was previously disputed whether the data protection authority may decide in data protection matters with a media connection or whether this is reserved for the ordinary courts. In this regard, the Supreme Court has ruled that the ordinary courts may, in principle, decide on injunctive relief directly on the basis of Section 1 (1) of the Data Protection Act. However, it has not yet made an unambiguous clarification regarding the competence of courts and authorities in media-related date protection cases. This currently results in a certain degree of uncertainty when data subjects seek legal protection in cases of possible data protection violations by media companies.

Why the media privilege violates data protection

According to Section 1 (1) of the Data Protection Act, "everyone has the right to confidentiality of personal data concerning him or her", insofar as there is an interest worthy of protection, "in particular with regard to respect for his or her private and family life". According to Art 85 (2) of the GDPR, member states may provide for derogations and exceptions to the fundamental right to data protection, insofar as these are necessary in the interest of freedom of expression and freedom of information.

With regard to freedom of the media, the Constitutional Court recognised the role of the media, which play a central role in a democratic society as a "public watchdog", and referred to the case law of the European Court of Human Rights. It would disproportionately hinder or even make impossible any journalistic activity if all provisions of data protection law were to be applied without restriction to data processing for journalistic purposes by media companies and media services.

On the other hand, the absolute exclusion of data protection law for data processing for journalistic purposes is contrary to the requirements of the GDPR, according to which the national legislator must properly balance the interest in protecting personal data with the interest of journalistically active media companies.

Thus, if the media privilege categorically favours the right to freedom of expression and freedom of information over the fundamental right to data protection, this regulation contradicts the fundamental right to data protection under Section 1 of the Data Protection Act and the case law of the Constitutional Court.

Practical consequences of the decision

The abolition of the media privilege will not come into force until the end of 30 June 2024. Until then, the legislator has time to create a more balanced new law that takes into ac-count data protection interests in relation to media freedom. In doing so, it faces a challenging but solvable task.

The media privilege has been controversial for years. With its abolition, the Constitutional Court has complied with a demand that has been made frequently for a long time. It is noteworthy that the initiative for the law review proceedings came from the Federal Administrative Court, which expressed a different legal opinion than the Supreme Court with regard to the consequences of the media privilege.

The new regulation of data protection with regard to media companies must in no way lead to censorship in journalism. However, it could restrict future reporting in individual cases more than before. The question of whether a media report violates data protection interests is not always easy to answer. It is very unlikely that employees of media companies will be able to make this assessment in all cases.

It would therefore make sense to have a regulation that makes it as easy as possible for media companies to make this assessment based on certain criteria. Legislators should also improve access to authorities for those affected and close the legal protection gap that currently exists. Whatever the details of the new regulation will be, one thing is already certain: media companies will have to continue to deal intensively with data protection.