Austria

[AT] Media privilege in data protection re-regulated in Austria

IRIS 2024-7:1/18

Krisztina Rozgonyi

Institute for Comparative Media and Communication Studies (CMC) of the Austrian Academy of Sciences (ÖAW) and the University of Klagenfurt (AAU)

On 12 June 2024, the National Council of Austria adopted a federal law amending the Data Protection Act. The new rules, which entered into force on 1 July 2024, aim to reorganise and differentiate the so-called media privilege in data protection.

The revision became necessary following a decision by the Constitutional Court (VfGH), which ruled that a previous ruling – the blanket exemption for the media on the basis of Article 85 of the GDPR – was unconstitutional. According to the VfGH, data processing for journalistic purposes should not be exempted from the provisions of the GDPR as a matter of principle, as this "media privilege" violates the fundamental right to data protection. A careful balancing of the competing rights was to be found.

According to the new amendments, editorial secrecy and the protection of journalistic sources remain protected. Investigative journalism should not be undermined for data protection reasons, and the media's "watchdog function" is guaranteed. The protection of personal data should be safeguarded by general obligations, in particular, the processing principles under the GDPR, the obligations of the controller in data processing, and the obligations with regard to data security. Data controllers – journalists – subject to the media privilege will not be obliged to disclose information to the data subjects according to editorial secrecy provisions. Meanwhile, they will be authorised to process personal data, including the special categories of personal data included in Article 9 (1) GDPR and those related to criminal convictions, offences or related security measures of the data subject. Several other provisions of the GDPR – i.e. Articles 13, 14, 15, 16, 17, 18 and 21 – are also aligned with the objective of the “media privilege”.

The scope of the protection for journalistic activities extends to the processing of personal data by media owners, publishers, media employees, and employees of a media company or media service, as well as by other persons who contribute journalistically to the editorial or the content of communications of a media service on a contractual basis (e.g. guest commentators).

Meanwhile, the new Freedom of Information Act in Austria (See IRIS 2024-3:1/16) will intersect, from September 2025, with the newly re-regulated media privilege. On the one hand, state transparency is becoming the rule, and secrecy is the exception, which is to strengthen the position of the media and journalists vis-à-vis public bodies. At the same time, if such public data also contains personal data, they will be obliged to consider more carefully how to process such data. In essence, a very differentiated, case-by-case legal analysis will be necessary in considering data protection measures in the future.