Journalists and the Protection of Personal Information Act (POPI)

In Finland, information about individuals' taxable income and assets is publicly available. In the Satamedia case, two companies processed this information. The one company published a magazine which contained the tax information. The other company provided an SMS service which allowed a member of the public to send someone's name to the service in order to obtain information about their taxable income and assets. These companies were taken to task by the data protection authorities in Finland.

The case has a complicated history. In short, Finland's Personal Data Act protects personal information. At the same time, it also provided an exception for information that is processed for journalistic persons. However, the courts found that the companies' use of the information was not for journalistic purposes. The magazine company merely published large volumes of data without commenting it or placing it in context as journalists would do. Consequently, they were ordered to stop.

Image via 123RF

The companies then approached the ECHR on the basis that their rights to freedom of expression had been violated. In Europe, the European Data Protection Directive and Data Protection Convention provide the principles that European member states must adopt in their own local data protection legislation. Finland's Personal Data Act follows these principles. However, it also provides an exception for the processing of data for purposes of journalism. Article 10 of the European Convention of the Protection of Human Rights and Fundamental Freedoms also guarantees the right to freedom of expression. In balancing individuals' rights to privacy against journalists' freedom of expression, the ECHR agreed with the Finnish courts that the individuals' rights in this case were more important than the companies' publishing of the tax information. The ECHR's reasoning was based on the specific manner in which the companies were publishing the information. In particular, it pointed out that the publishing was not journalistic activity and was not in the public interest.

POPI follows the European principles. It states that the act will not apply to the processing of personal information solely for journalistic purposes. However, this exception only applies to the extent that the right to privacy must be balanced with the right to freedom of expression. The journalist's processing of the personal information must also be in the public interest. POPI's provisions will also in general be excluded from operation if the journalist is bound by a code of ethics (e.g. the Press Code). But, this will only be the case if such code meet's POPI's requirements.

This might leave a slight gap in POPI's protection of individuals' personal information. While POPI provides that a journalist's processing of information will be governed by the relevant code of ethics, this will only be the case if the journalist is bound by such a code. If it turns out that the journalist is not bound by the code, the journalist's processing might be unregulated if the journalist relies on the public interest exception. Despite this possible issue, it makes sense to provide exclusions for journalists so that they can do their jobs. However, they will need to avoid abuse of the exclusions and the courts will in some cases have to decide whether journalists overstepped the mark.