February 25, 2019

The defendant, Sergejs Buivids, made a video recording inside a Latvian police station whilst he was there giving a statement in connection with administrative proceedings that had been initiated against him. The video showed the police facilities and a number of police officers going about their duties. Mr Buivids then published the video on YouTube.

In August 2013, the Latvian Data Protection Agency (LDPA) found that Mr Buivids had infringed Latvian data protection laws because he had not informed the police officers or the LDPA of his intention in making the film. The LDPA ordered Mr Buivids to remove the video from YouTube and other websites on which it had been published.

Mr Buivids issued proceedings in the Latvian courts seeking a declaration that the LDPA’s decision was illegal and claiming compensation for the harm he had suffered as a result. He argued that he had wished to publicise illegal conduct on the part of the police, but did not identify it.

The matter eventually ended up at the Latvian Supreme Court, which referred two questions to the CJEU:

1. whether Mr Buivids’s actions of recording and publishing the video fell within the scope of the Directive; and
2. whether Mr Buivids’s actions fell within the “journalistic purposes” exception in Article 9, which provides that Member States shall provide for exemptions or derogations from provisions of the Directive for the processing of personal data carried out solely for journalistic purposes “only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression”.

The CJEU noted that, according to case law, the image of a person recorded by a camera constitutes “personal data” within the meaning of Article 2(a) of the Directive if it makes it possible to identify the person concerned. In this case, the police officers in the video could be seen and heard and were therefore identifiable.

As for the processing of personal data, the CJEU noted that in the context of a video-surveillance system, case law shows that a video recording of people stored on a continuous recording device constitutes automatic processing of personal data under Articles 2(b) and 3(1). Here, Mr Buivids had used a digital camera, which the CJEU said was a continuous recording device.

Case law also shows that the operation of loading personal data onto an internet page constitutes processing, as Articles 2(b) and 3(1) apply to “any operation” that constitutes the processing of personal data wholly or partly “by automatic means”.

Further, the exceptions provided for in Article 3(2) must be interpreted strictly. In this case, the recording and publication of the video could not be regarded as falling outside the scope of EU law, nor could it be understood as a processing operation that concerned public security or was a matter of State defence under Article 3(2).

In addition, since Mr Buivids published the video on a video sharing website, without restricting access to it, thereby permitting access to personal data to an indefinite number of people, the processing of personal data did not come within the context of purely personal or household activities.

Further, there is no express exception in the Directive excluding the processing of personal data of public officials, and case law shows that the fact that information is provided as part of a professional activity does not mean that it cannot be characterised as “personal data”. Therefore, Mr Buivids’s actions came within the scope of the Directive.

As for the journalistic purposes exception, the CJEU noted that the exemptions and derogations set out in Article 9 apply not only to media undertakings, but also to every person engaged in journalism. The fact that Mr Buivids was not a professional journalist did not mean that his activities were not journalistic.

According to case law, “journalistic activities” are those that have as their purpose the disclosure to the public of information, opinions or ideas, irrespective of the medium used to transmit them.

The CJEU said that it was for the referring court to determine whether “journalistic activities” applied here, but the CJEU could still provide guidance.

The CJEU said that account must be taken of the evolution and proliferation of methods of communication and the dissemination of information. Case law has found that the medium used to transmit the processed data, whether it be traditional or over the internet, is not determinative as to whether the activity is undertaken “solely for journalistic purposes”.

The question for the Latvian court was whether the sole purpose of the recording and publication of the video was the disclosure to the public of information, opinions or ideas. To that end, it should take into account Mr Buivids’s argument that the video was published online to draw attention to alleged police malpractice, which he claimed occurred while he was making his statement. However, establishing malpractice was not a condition for the applicability of Article 9.

As for balancing the fundamental rights of the right to privacy and the right to freedom of expression, the Latvian courts should consider the case law of the European Court of Human Rights, which sets out the relevant criteria that should be considered. This includes contribution to a debate of public interest, the degree of notoriety of the person affected, the subject of the news report, the prior conduct of the person concerned, the content, form and consequences of the publication, and the manner and circumstances in which the information was obtained and its veracity. Similarly, any measures taken to mitigate the extent of the interference with the right to privacy must be taken into account.

In this case, the CJEU said, it was possible that the recording and publication of the video, which took place without the persons concerned being informed, amounted to interference with their right to privacy.

If the sole objective of the recording and publication of the video was the disclosure to the public of information, opinions or ideas, the Latvian court should then determine whether the exemptions or derogations under Article 9 were necessary to reconcile the right to privacy with freedom of expression, and whether those exemptions and derogations were applied insofar as was “strictly necessary”. (C-345/7 Sergejs Buivids EU:C:2019:122 (14 February 2019) — to access the judgment in full, go to the curia search form, type in the case number and follow the link).