European Commission: Media and Journalists Fall Under GDPR’s “Right to be Forgotten

The European Commission has responded to Robert Szustkowski’s initiative to extend the “right to be forgotten” to media organisations as personal data controllers. In a letter from the Head of the Data Protection Unit in the Directorate-General for Justice and Consumers, the Commission outlines its position on Szustkowski’s proposal and explains the existing legal framework.

In June 2024, Szustkowski called for the extension of Article 17 of the General Data Protection Regulation (GDPR), which grants the “right to be forgotten,” to the media. He argued that individuals should have the right to remove digital content based on false, undocumented, or defamatory information. Szustkowski cited his own experience, highlighting numerous defamatory articles published by Polish media, even after favourable court rulings.

The European Commission’s Response

The Commission explained that the GDPR applies to media organisations and journalists as controllers of personal data. Under Article 17, individuals can request the deletion of personal data that has been unlawfully processed or where legal obligations require it. This includes cases where personal data has been made public, and controllers must take reasonable steps to ensure its deletion across platforms.

However, the Commission emphasised that the right to data protection is not absolute and must be balanced against other fundamental rights, such as freedom of expression and the public’s right to information. Article 85 of the GDPR requires EU Member States to balance these rights – it is up to national authorities to decide on individual cases of alleged infringements of the GDPR. In Poland, this is the responsibility of the Office for Personal Data Protection (UODO). The UODO ensures compliance with data protection laws, including the right to compensation for damages resulting from breaches of the GDPR.

Media and the Right to be Forgotten

The Commission recognized that media outlets are subject to the GDPR, but it clarified that defamation and slander fall under national civil or criminal law. Szustkowski’s proposal seeks to extend the right to be forgotten to cases where individuals have already received favourable court rulings on defamation or personal rights violations. His aim is to streamline the process for removing defamatory content and avoid repetitive legal battles. It may also help facilitate the amicable, out-of-court settlement of disputes.

Responding to Szustkowski’s request for clear guidelines on media responsibilities, the Commission pointed to the European Data Protection Board (EDPB), which is tasked with ensuring consistent GDPR enforcement across the EU. The EDPB issues guidelines on various topics, including the deletion of links of personal data from publicly accessible services.

In conclusion, while the GDPR provides mechanisms for data deletion, balancing this with media freedoms remains a key challenge. National bodies, like Poland’s UODO, play a crucial role in ensuring this balance.