Conference “Personal data on air” – report

On November 19, the Personal Data Protection Office hosted a conference entitled “Personal data on air – standards and limits of privacy protection in the media,” organised by the President of the Personal Data Protection Office and the Social Team of Experts to the President of the Personal Data Protection Office. One of the key conclusions of the debate was the idea of developing a code of conduct for the media industry.

Opening the conference, Deputy President of the Personal Data Protection Office Prof. Agnieszka Grzelak, emphasised that it is extremely important that such an event brings together all those who deal with social issues on a daily basis: lawyers, journalists, and experts. As she pointed out, the media is an area where the right to privacy of citizens and the right to inform them collide. Prof. Agnieszka Grzelak also pointed out that recently, the President of the Personal Data Protection Office had to intervene in serious incidents involving the disclosure of personal data in media centres, including data of minors, which was also an argument in favour of organising this debate. She also assured that the President of the Office does not intend to restrict journalistic activity, but to find a balance between the public's right to information and the right to privacy and the protection of fundamental rights.

As the Deputy President of the Personal Data Protection Office pointed out, when publishing materials in the media, it is important to consider whether all the information contained in the message is absolutely necessary. In the case of children or the elderly, this should be considered twice as carefully.

She also reminded that the Personal Data Protection Office has repeatedly pointed out that even if the name is not mentioned in the journalistic material, the description of the event, the place, the local context, and the unaltered voice may be sufficient to identify the person, which means that we are dealing with personal data subject to the protection referred to in the GDPR.

Prof. Agnieszka Grzelak also recalled that one of the recent rulings of the Supreme Administrative Court confirmed that journalism, as a specific public activity, is not subject to the provisions of the GDPR, and, in the opinion of the Supreme Administrative Court, the issue of personal data protection in the media should not be considered through administrative channels, but in common courts in the context of press law.

During the opening of the meeting, Mirosław Gumularz, Ph.D.,  chairman of the Social Team of Experts by the President of the Personal Data Protection Office, also took the floor, emphasising that the most important thing is that when we talk about data protection, we are actually talking about the protection of privacy and fundamental freedoms of citizens.

Panel 1: “Personal data in the public space: the mission of the media and the right to privacy”

During the first panel discussion, participants considered, among other things, how personal data protection is understood in the journalistic community itself.

Andrzej Rybus-Tołłoczko, the moderator of this part, noted that journalists often claim that personal data do not concern them because the GDPR does not apply to them, and this attitude immediately causes problems.

Prof. Marlena Sakowska-Baryła, a member of the Social Team of Experts to the President of the Personal Data Protection Office, stated that it is entirely possible to reconcile press activities, press law, and the GDPR. In her opinion, this would require changes to the Press Law and a change in the attitude of media representatives, who believe that since the GDPR does not apply to them, it also does not apply to all those whose knowledge the media use and about whom they report. Prof. Sakowska-Baryła pointed out that the debate on this topic has been going on for a long time and leads to clear conclusions: to date, no specific standards of conduct have been developed for the journalistic community, even though the GDPR itself is structured in such a way that it very clearly emphasises freedom of expression and reconciling it with the right to privacy (Articles 85 and 86).

However, Paweł Litwiński, Ph.D., attorney-at-law and member of the Social Team of Experts by the President of the Personal Data Protection Office, admitted that he does not entirely see a way to reconcile the Press Law and the GDPR, so he would prioritise the development of standards of conduct. However, this immediately raises the problem of establishing common standards for the entire European Union, where there are divergent attitudes towards journalism and its relationship with the GDPR. This would be all the more difficult to reconcile given that many editorial offices today operate within international media groups. He also pointed out that there are still few decisions by the Personal Data Protection Office and courts that refer to journalistic activities, and that the rules resulting from such decisions would allow procedures to be developed.

Dominik Lubasz, Ph.D., attorney-at-law and member of the Social Team of Experts to the President of the Personal Data Protection Office, emphasised that it is crucial to refer to the provisions of the GDPR, as this allows us to see that the right to freedom of expression and the right to privacy must coexist, and that it is the role of the national legislator to ensure that this correlation works. Dominik Lubasz, Ph.D., referred to Article 16(4) of the Press Law, which describes the rules for publishing personal data relating to privacy. However, in his opinion, the drawback is that journalists often use the argument of public interest when in fact this interest means satisfying public curiosity, which can be unhealthy and unjustified. He added that there is no equivalence between freedom of speech and public interest. In the opinion of Dominik Lubasz, Ph.D., journalists should prepare materials bearing in mind that the more intimate the context of the case they are presenting, the higher the threshold for justifying its presentation in the public forum should be.

Litwiński, Ph.D., admitted that social acceptance had indeed led to a lack of understanding of personal data in the media.

During the discussion, Prof. Sakowska-Baryła also raised the question of who we can actually call a journalist today, because nowadays you don't have to be employed anywhere to call yourself a journalist, for example, if you are a blogger or podcast creator. Therefore, according to the researcher from the University of Łódź, we are faced with an additional, yet fundamental dilemma of properly defining responsibility in this field.

Panel 2: “Anonymisation, image, voice – when should the media protect data?”

During this panel, guests attempted to organise issues related to the anonymisation of images shown in press materials. The moderator of this part of the event, Karol Witowski, Director of the Department of Social Communication and spokesperson of the Personal Data Protection Office, explained that the aim of the discussion was to develop a course of action in this area that would be useful for all media creators.

Monika Krasińska, Director of the Law and New Technologies Department, drew attention to the understanding of the concept of anonymisation and the fact that it should be distinguished from pseudonymisation. Anonymisation assumes the exclusion of any possibility of reverse disclosure of data about the data subject; it is an irreversible process.

She also stated that there are very different processes related to data protection in the journalistic community. According to the expert, the definition of a data controller, for example, is perceived differently in this community. The rules of conduct for journalists and editors should come from the controller. These rules are included in the GDPR as a basis for action, as well as in the Press Law, and it is the controller who should apply them and inform the journalistic community about them, as these rules are beneficial to everyone. Monika Krasińska believes that the overriding goal should be to develop clear methods of conduct for journalists and editors.

Edyta Krześniak, a journalist and television reporter, also took part in the discussion. She emphasised that personal data protection in the Polish media does not exist and is rather a case of “whitewashing of reality.” This is due, among other things, to the fact that even the voice of the subject of the report, which has been altered in the recording, can be verified and reproduced in its original form using appropriate computer software. However, as Edyta Krześniak noted, due to a lack of knowledge among journalists and editors, virtually everything is subject to anonymisation, and in recent years, entire crowds of people or dogs have even been blurred in video recordings.

Witold Tabaka, a journalist from Telewizja Polska, added that today there are even artificial intelligence solutions that allow the creation of artificial images in recordings to protect the data of people giving statements on television programs, but it must be remembered that these are dangerous solutions, because journalists themselves want to fight against so-called deepfakes. According to Witold Tabaka, there is also a problem with the use of images of minors, as it is never entirely clear what their guardians' consent to the use of their image refers to. According to the journalist, excessive anonymisation is also controversial in the media, as it can lead to the stigmatisation of a specific person, even though they often do not even have the status of a suspect.

Referring to this issue, Edyta Krześniak pointed out that absurd situations arise in journalism because consent to use an image is often obtained just in case and involves signing numerous documents, which results from a lack of detailed knowledge about personal data protection.

Summarising the issues raised, Monika Krasińska drew attention to the need for ethics and efficient management in the media and called for the creation of a common standard, i.e., a code of conduct for the media world, which would serve as a guide for everyone who adheres to the code. The Personal Data Protection Office expert explained that codes of this kind are always the best solution for any industry that needs a better understanding of what personal data protection is. In this regard, Monika Krasińska also offered the support of the Personal Data Protection Office, which verifies and approves codes of conduct.

Panel 3: “Securing data carriers in the media”

The closing discussion of the conference aimed to clarify the technical aspects of data protection in journalism.

Marcin Tomkiel, Liquidator of Polish Radio Białystok, noted that recording devices, which are the least secure in terms of data access, pose a problem in editorial offices.

During the conversation, the topic of data archiving in media centres also proved to be important.

Mateusz Jakubik, cybersecurity specialist and compliance officer at Bonnier Business Polska, said that it is extremely difficult to build archives of journalistic materials due to the ambiguity of publication description procedures, the need to reduce redundant data, and attempts to balance what data may be useful years later, because after a long time, a recording may turn out to be necessary to reconstruct history from the past. The multitude of data storage media and the obligation to transfer records to more modern media also cause enormous chaos.

Arwid Mednis, Ph.D., attorney-at-law from the University of Warsaw and member of the Social Team of Experts by the President of the Personal Data Protection Office, who moderated the discussion, asked about the working model of contemporary journalists.

As Kamil Wojtarek, Deputy Data Protection Officer at Telewizja Polska SA, pointed out, this issue concerns security, and it is difficult to imagine that in a large media centre a journalist could use private equipment, a laptop, or a phone just because they prefer to work as a freelancer for multiple clients. The channel for transmitting information between the editorial office and the journalist must always be secured without exception.

In his turn, Tomasz Izydorczyk, attorney-at-law and member of Social Team of Experts by the President of the Personal Data Protection Office, assured that technology is not problematic, as the issue of resources is crucial; e.g., the proposed code of conduct for journalists should stipulate that the editorial office provides the equipment to the journalist and that it is fully secured – although today it is possible to imagine shared administration, it is difficult to organize and extremely risky. According to Tomasz Izydorczyk, archivists must also know everything about cataloging and tagging systems, etc., and there is a lack of expertise and financial resources in this area.

During the debate, attention was drawn to the issue of risk analysis carried out in the media. In this context, the panellists unanimously pointed out that only large media centres can afford such analysis; in smaller ones, it is often not carried out, which again touches upon the issue of management culture in journalistic environments, discussed earlier during the meeting.

In conclusion, Arwid Mednis, Ph.D., asked whether journalists today are rewarded for quality and reliability or for clickability.

This dilemma, according to conference participants, could serve as a starting point for further initiatives devoted to data protection in the mass media.

The event was held under the honorary patronage of the Ministry of Justice and the Ministry of Culture and National Heritage.