Instead of serving its original purpose of protecting personal data from misuse by large corporations, the General Data Protection Regulation (GDPR) has, in everyday journalistic practice, become a barrier that increasingly prevents journalists from doing their work. Research conducted by journalist Željka Godeč, published as part of a project funded by the Society for the Protection of Journalists’ Copyright (DZNAP), shows that although the GDPR was designed to protect citizens from the misuse of personal data, in Croatia it is often used as an excuse to deny access to information of public interest and to obstruct journalists’ work.
The analysis of numerous real-life journalistic cases demonstrates that state institutions, public companies and individual public officials frequently invoke the GDPR to refuse requests for information about public spending, the work of public bodies or the conduct of individuals exercising public office.
Many journalists report that they obtained the requested information only after intervention by the Information Commissioner or following court decisions. Investigative journalists, particularly those scrutinising the actions of public authorities and institutions, appear to face significantly greater obstacles than journalists who do not cover such issues.
Editors Give Up Too Easily
According to the author, there is virtually no field, from culture and sport to social affairs, healthcare and finance, in which institutions do not resort to the GDPR as a universal justification for denying journalists access to information.
The research includes testimonies from journalists working for Croatia’s leading media outlets, who warn that the GDPR is routinely used as an administrative obstacle even when the requested information does not constitute personal data within the meaning of the Regulation or when there is an unquestionable public interest in its disclosure.
Journalists also pointed out that, in some newsrooms, the GDPR has had a chilling effect on editorial support for investigative reporting. Their impression is that editors too readily abandon important stories, allowing fear of legal proceedings to outweigh the public interest and the public’s right to know, with press freedom ultimately suffering the consequences.
A particular problem is that Croatia has not fully implemented Article 85 of the GDPR, which requires EU Member States to provide exemptions and derogations for the processing of personal data for journalistic purposes. Legal experts warn that this legislative gap creates room for inconsistent and often incorrect interpretations of the Regulation.
Although public figures, and even family members of politicians, often attempt to use the Croatian Personal Data Protection Agency (AZOP) as a shield against media scrutiny, such attempts have generally been unsuccessful.
According to the Agency’s own data, significant GDPR fines in Croatia have not been imposed on journalists or media organisations. Instead, sanctions have primarily targeted organisations engaged in the large-scale processing of personal data, such as financial institutions, telecommunications companies and other major systems. This confirms that the GDPR is primarily intended to protect citizens from data misuse rather than to restrict media freedom.
The research further shows that the practice of the Croatian Personal Data Protection Agency (AZOP), as well as the case law of the European Court of Human Rights (ECtHR), consistently recognises the importance of media freedom and the public’s right to receive information concerning individuals exercising public office or managing public funds.
Particular attention is given to the ECtHR judgments in Axel Springer AG v. Germany and Magyar Helsinki Bizottság v. Hungary, which confirmed that freedom of expression includes the right to access information of public interest and that public figures must tolerate a higher degree of public scrutiny than private individuals.
Misuse Threatens Media Freedom
Željka Godeč’s research also provides practical recommendations for journalists dealing with the misuse of the GDPR, including relying on the Media Act, the Right of Access to Information Act, and appeal mechanisms before the Information Commissioner.
Experts emphasise that the right to personal data protection is not absolute and must always be balanced against the public’s right to information and freedom of expression. At the same time, the author stresses that journalists remain obliged to respect legitimate privacy interests, particularly when reporting on children, sensitive medical information, victims and witnesses in court proceedings, and information unrelated to the exercise of public office.
The study concludes that the GDPR itself does not threaten press freedom. Rather, it is its incorrect application and misuse in practice that can seriously hinder access to information of public interest.
As Godeč concludes, media freedom in a democratic society may be restricted only in exceptionally rare circumstances and under clearly defined legal conditions, such as protecting national security, territorial integrity or public order, preventing crime or disorder, safeguarding public health or morals, protecting the reputation or rights of others, preventing the disclosure of confidential information, or preserving the authority and impartiality of the judiciary. She notes that such conditions have never justified restricting journalistic work in the context examined by her research.
The GDPR should never become a tool for shrinking the space for free journalism. Journalists have both the legal right and the professional responsibility to challenge every misuse of the GDPR that obstructs their work, creates unnecessary barriers and serves to conceal information of legitimate public interest.
The full research report is available here.