Navigating the fine line: the complex reconciliation of data protection and freedom of expression in criminal conviction and offences data

News portals and unconventional channels like social media often reveal excessive personal data ^[1] of individuals involved in criminal proceedings. For instance, media coverage of Madeleine McCann’s disappearance revealed intimate details about a suspect, including unverified allegations (Bubola, 2023). Similarly, Julian Assange’s espionage trial saw extensive media scrutiny of his personal relationships and health (BBC News, 2024; Psaropoulos, 2024). Social media further amplifies such invasions of privacy. During the Christchurch mosque shootings, Facebook live-streamed the attack, exposing personal data of victims to a global audience (Marsh and Mulholland, 2019). After the Boston Marathon bombing, social media users misidentified suspects, publicising the personal data of innocent individuals and causing harassment (BBC News, 2013).

These instances highlight how media entities (often referred to as controllers ^[2]) process ^[3] personal data while exercising their right to freedom of expression. Such data, including names, addresses and family details of suspects, accused or convicted individuals (data subjects ^[4]), often interfere with their right to data protection. This creates a legal tension, as the European Union (EU) recognizes both data protection and freedom of expression as fundamental human rights (Faisal, 2021, p. 1). Both rights are equally enforceable by the courts (Etienne, 2012; Georgieva, 2020). Journalistic freedom is vital for democratic societies, allowing journalism to serve as a public watchdog and influence public opinion on criminal matters (Erdos, 2016; Council of Europe, 2018b; European Court of Human Rights, 2018b; Rucz, 2022). However, individuals must also be protected from data misuse, which can lead to privacy violations, discrimination and reputational harm (Buckley, 2020, p. 99; Etienne, 2012; Georgieva, 2020). Therefore, legal mechanisms must balance these rights effectively to ensure their coexistence.

The General Data Protection Regulation (GDPR) (REGULATION (EU), 2016 / 679) is the EU’s landmark data protection framework, with Article 85 addressing the reconciliation of these competing rights. The article allows data controllers to process personal data, including crime-related information, for journalistic purposes by exempting them from most GDPR provisions (the journalistic exemption). This provision aims to uphold media freedom while safeguarding personal data (Reventlow, 2020, p. 34). However, it also entrusts Member States with the responsibility of balancing data protection laws with freedom of expression (Feiler et al., 2018, p. 17). This delegation has led to varied national approaches, resulting in legal uncertainty and complicating compliance for organisations handling cross-border data, thereby undermining GDPR’s goal of harmonised data protection laws and the single market’s smooth functioning (Recital 3, REGULATION (EU), 2016 / 679).

A notable example of this legal uncertainty is the referral of case C-199 / 24, Garrapatica, by the Attunda District Court to the Court of Justice of the European Union (CJEU). This case seeks clarity on whether Member States may introduce additional laws affecting journalistic exemptions, highlighting inconsistencies in reconciling data protection and freedom of expression (Butler, 2024). Member States have taken divergent stances, with some adopting broad exemptions and others imposing strict limitations (Bitiukova, 2020, p. 19). These discrepancies underscore the need for greater legal alignment to ensure a uniform application of rights across the EU.

This study addresses how the rights are reconciled under Article 85 GDPR in a harmonised way across the EU when controllers process personal data related to criminal convictions and offences. Using a doctrinal research method, it analyses legal texts, particularly the GDPR and relevant case law (Hutchinson, 2018, p. 14). This method enables an in-depth examination of legal frameworks, judicial interpretations and principles such as proportionality, necessity and the balancing of rights. Additionally, a comparative method helped identify gaps and trends (Samuel, 2018, p. 143) in the evolving intersection of data protection and freedom of expression. The study assesses relevant case law based on its significance to data privacy, public interest and journalistic exemptions concerning criminal conviction and offence data. These cases are analysed for their alignment with legal principles, helping to establish how these rights are balanced.

This method offers strong legal analysis but lacks empirical interviews, limiting real-world insights. However, it effectively examines the GDPR’s balance between data protection and freedom of expression through legal provisions and judicial interpretations.

The article begins with a literature review (Section 2), followed by a framework for the journalistic exemption in processing criminal conviction and offence data (Section 3). Section 4 explores the exemption under the GDPR, while Section 5 analyses CJEU and the European Court of Human Rights (ECtHR) case law reconciling these rights. Sections 6 and 7 present the discussion and conclusion, summarising key findings and contributing to the broader discourse on balancing data protection and freedom of expression.

The evolution of EU data protection law reflects efforts to balance freedom of expression and data protection rights (Kranenborg, 2020, p. 1205). The GDPR, introduced in 2016 to replace the 1995 Data Protection Directive (DPD), aimed to harmonise data protection across Member States while addressing digital-era challenges (Cunha and Monteleone, 2021, p. 244). While both frameworks include journalistic exemptions, the GDPR introduced stronger mechanisms to manage modern journalism, particularly in online and platform-based environments (Bayer et al., 2021; Brimblecombe and Fenwick, 2022).

The rise of social media and user-generated content (Sharma, 2020, p. 23,26) has broadened journalistic activities beyond traditional media (Buckley, 2020; European Court of Human Rights, 2021; Parcu and Rossi, 2021; Korpisaari, 2022), complicating the legal landscape, especially regarding personal data related to criminal convictions (Faisal, 2024). While Article 10 of the GDPR restricts the processing of such data to official authorities or legally authorised instances, Article 85 grants journalistic exemptions, which risk misuse due to inconsistent interpretations across Member States (Erdos, 2015; Bayer et al., 2021).

Member States’ interpretations of Article 85 vary due to cultural and legal differences, undermining GDPR harmonisation (Kranenborg, 2020, p. 1205; Reventlow, 2020; Bayer et al., 2021). Some countries like Italy, Austria and Bulgaria, apply narrow exemptions focused on professional journalism (Erdos, 2016, p. 179). Italy limits exemptions to certified journalists within their duties (Case of Biancardi v. Italy, 2022; Section 136(1)(b)-(c), Personal Data Protection Code, 2021), while Austria follows a similar approach (Bitiukova, 2020, p. 19). Bulgaria initially imposed strict media requirements for data processing, later overturned as unconstitutional for restricting freedom of expression (American Chamber of Commerce Bulgaria, 2020).

Conversely, Finland, Sweden and Norway adopted broader exemptions, excluding many media activities from GDPR rules (Erdos, 2016, p. 179). Finland’s Data Protection Act grants extensive journalistic exemption (Data Protection Act, 2018), while Sweden permits anyone with a government-issued publishing licence to process personal data outside GDPR constraints, and concerns over privacy rights (Herlin-Karnell, 2021, p. 73). Sweden’s Garrapatica case illustrates this issue, allowing the Lexbase database to process crime-related data without GDPR compliance (Butler, 2024).

Diverging interpretations result in inconsistencies, with rights being applied differently across jurisdictions (Davis, 2024, p. 73), creating risks that the rights may interfere with each other unjustifiably (Erdos, 2016; Bitiukova, 2023). A broad interpretation of journalistic exemptions risks abuse by individuals falsely claiming journalistic status to evade data protection laws (Hüttl, 2024, p. 21). Conversely, an overly restrictive approach may suppress investigative journalism and limit public access to critical information (Hüttl, 2024, p. 20).

Achieving a balanced and proportionate approach remains essential to protect both data privacy and press freedom (European Union Agency for Fundamental Rights and Council of Europe, 2018, p. 54). The GDPR (Recital 4, REGULATION (EU), 2016 / 679) and the CJEU emphasise proportionality, requiring case-by-case assessments to ensure restrictions are necessary and contextually appropriate (Court of Justice of the European Union, 2014b, 2016). This principle is particularly relevant in high-profile cases when public interest initially outweighs privacy concerns but shifts over time (Brimblecombe and Phillipson, 2018, p. 5).

Despite advancements, significant gaps remain in providing clear guidelines for balancing these rights, especially in digital media and user-generated content (Cunha and Monteleone, 2021; Davenport, 2022). Scholars critique the CJEU for their limited success in harmonising Member States’ practices (Kranenborg, 2020, p. 1205), though CJEU and the ECtHR case law offer valuable principles for balancing data protection with freedom of expression (Psychogiopoulou, 2022, p. 158). These principles are crucial in clarifying Article 85’s application and ensuring alignment with EU law.

This study fills a research gap at the intersection of digital media practices and legal frameworks governing data protection and journalistic freedoms. While prior research has examined disparities in Article 85’s implementation, limited attention has been given to their application in platform-based journalism and evolving digital contexts. By analysing the dynamic balance between data protection rights and freedom of expression in cases involving criminal conviction data, this research provides insights into overcoming harmonisation challenges and achieving context-specific solutions.

The GDPR’s journalistic exemption provides a structured mechanism for reconciling data protection rights with the public’s right to information.

Article 85 mandates the Member States to reconcile these rights by enacting laws that allow exemptions or derogations for certain activities, such as journalistic purposes, and academic, artistic or literary expression (Article 85, REGULATION (EU), 2016 / 679). For practicality, this article focuses solely on journalistic exemptions, as addressing all exemptions in a single piece is unfeasible.

The journalistic exemption primarily concerns the processing of personal data in the pursuit of journalism. The phrase “if necessary” in Article 85(2) indicates that these exemptions are not automatic but must be applied only when there is a conflict between data protection rights and freedom of expression (Article 11(1)(b), Council of Europe, 2018a; American Chamber of Commerce Bulgaria, 2020) For example, conflicts are less likely when individuals voluntarily open themselves up to public scrutiny, as with public figures or emergency responders, but when conflicts arise, the law requires a balancing of interests.

Importantly, Article 85 does not give Member States unchecked discretion to provide exemptions. The law emphasises that derogations should only be granted when necessary to reconcile conflicting rights (Feiler, Forgó and Weigl, 2018, p. 300). This ensures that the reconciliation process is not arbitrary but based on concrete, justifiable reasons, particularly when data processing is carried out for journalistic purposes.

Further, these exemptions apply to various provisions of the GDPR, including principles, data subject rights and the powers of supervisory authority (SA) or data protection authority (DPA) (Feiler et al., 2018, p. 300).

Given this context, it is essential to examine how the journalistic exemption applies to the processing of criminal conviction and offences data. Criminal convictions refer to data related to actual criminal judgements or determinations by competent authorities (European Court of Human Rights, 2011a). Offences, on the other hand, are any data concerning criminal activities as defined by Member States’ penal codes (Court of Justice of the European Union, 2012, para. 37). When such data pertains to a natural person, it becomes personal criminal conviction and offence data, encompassing information about the accused, victims, suspects and others involved in criminal proceedings (Council of Europe, 2018b, pp. 25–27).

The GDPR’s protection extends to personal data related to criminal convictions and offences unless an exemption like journalistic purposes applies. For example, the CJEU’s ruling in the Endemol Shine Finland case clarified that even oral disclosures of personal data about criminal convictions and offences, whether related to ongoing or completed proceedings, fall under GDPR protections unless exempted for journalistic purposes (Court of Justice of the European Union, 2024, para. 59).

In summary, the journalistic exemption in GDPR offers a critical tool for processing personal data related to convicts and offenders, particularly when the public’s right to information outweighs individual privacy concerns. This exemption ensures that the media can report on criminal justice matters while maintaining a balance with the data protection rights of the involved individuals. As case law continues to evolve, the scope of this exemption extends beyond traditional journalistic activities to include a broader range of communicative and expressive purposes, shaping how criminal data can be handled within the broader context of data protection laws.

Since ensuring reconciliation depends on the condition that controllers process data for journalistic purposes, it is crucial to understand the precise activities involving criminal conviction and offence data that fall under the journalistic exemption. The subsequent section delves deeper into the nuances of this exemption.

This section argues that the journalistic exemption allows anyone to process personal criminal conviction and offences data.

Although the GDPR lacks a unified definition of the journalistic exemption, it emphasises its broad application (Feiler, Forgó and Weigl, 2018, p. 300), encompassing activities in the audiovisual field, news archives and press libraries (Recital 153, REGULATION (EU), 2016 / 679). This expansive scope underscores the importance of safeguarding free expression, enabling the collection, use and dissemination of personal data across various platforms, including social media, rating websites, search engines and even political campaigns (Erdos, 2015, p. 151). The historical evolution of the exemption is significant in this regard: the GDPR broadens the framework established under the repealed DPD (EU Directive 95 / 46) by removing the term “solely” from its focus on journalistic, and other purposes (Kranenborg, 2020, p. 1209). This shift reflects the GDPR’s intent in accommodating a wider array of data processing activities that support free expression beyond traditional journalism (Korpisaari, 2022, p. 66).

Judgements from the CJEU and the ECtHR play a pivotal role in interpreting the journalistic exemption under the GDPR. While the ECtHR is not an EU court, its case law significantly influences the EU legal system due to the EU’s accession to the European Convention on Human Rights (ECHR), making its principles an integral part of EU law (Article 6(2–3), European Union, 2002). Furthermore, the Charter of Fundamental Rights of the European Union requires that rights within the EU be interpreted consistently with the Convention (Article 52(3), Official Journal of the European Union, 2016). These judgements provide a cohesive foundation for understanding the functional approach to the journalistic exemption, emphasising the objectives behind processing personal criminal conviction and offences data.

The European courts provided a ‘functional approach’ of interpretation to journalistic expression, supporting the argument that the journalistic exemption allows anyone to process criminal conviction and offences data. The functional approach moves away from examining journalistic activities, instead focusing on the objective behind the processing of data (Korpisaari, 2022). In the cases of Satamedia and Buivids, the CJEU ruled that journalistic activities aim to disclose information, opinions or ideas to the public, regardless of the medium used, provided that the purpose serve the public’s right to receive information contributing to the public’s interest (Court of Justice of the European Union, 2008; Court of Justice of the European Union, 2019). For example, uploading a video of a police officer performing duties on YouTube is lawful if its objective is to inform the public, and the public has a general interest in knowing the information (Court of Justice of the European Union, 2019). The Article 29 Working Party (WP29), now replaced by the European Data Protection Board (EDPB), the EU body responsible for ensuring consistent application of the GDPR also endorses this approach (European Commission, 1997).

Under this functional approach, “public” refers not to an unlimited audience, but to the body politic with a legitimate interest in receiving the information (Erdos, 2015, p. 152). In contrast, discrete, private purposes fall outside the scope of the journalistic exemption (Erdos, 2015, p. 138). For instance, in Satamedia, the large-scale publication of tax data was excluded from journalistic purposes, despite being initially published in that context (European Court of Human Rights, 2017, para. 22). Similarly, non-editorial activities (Council of Europe, 2018b, p. 34), household data processing (Court of Justice of the European Union, 2003) and search engine functions do not qualify for the exemption (Court of Justice of the European Union, 2014; Erdos, 2015; Miadzvetskaya and Van Calster, 2020b).

Thus, this interpretation helps journalistic exemption to extend beyond traditional media organisations (Brimblecombe and Fenwick, 2022; Court of Justice of the European Union, 2008), allowing anyone, including non-media actors such as bloggers and social media users, to process criminal conviction and offences data for journalistic purposes (Council of Europe, 2018b, p. 7). This approach balances the broad interpretation of free expression while preventing misuse of exemptions, ensuring data protection and the reconciliation of both rights.

Reconciling the rights is a nuanced and dynamic process, particularly when it involves data related to criminal convictions and offences. This balance is governed by principles such as proportionality, necessity and context-specific judgment, ensuring an adaptable and fair resolution in each case. The CJEU and the ECtHR play pivotal roles in shaping this reconciliation framework, emphasising the need for careful consideration of both rights to maintain their functionality.

The terms “reconciling” and “balancing” are often used interchangeably in legal discourse (Alexy, 2010; Kranenborg, 2020). Both describe a rational approach to resolving conflicts between fundamental rights, as outlined in the EU legal framework (Alexy, 2003, 2010). Article 85 of the GDPR reflects this balancing mechanism by prioritising the public’s collective interest and the right to information over individual privacy in cases involving journalistic objectives. This does not render data protection rights ineffective, as the inviolable core of data protection rights remains intact, as courts and DPAs are empowered to intervene if data privacy concerns outweigh the public’s interest in disclosure (European Council, 2000; Ojanen, 2016). Thus, this mechanism seeks to optimise the simultaneous application of both rights under the EU Charter (Alexy, 2000, p. 297).

When balancing conflicting rights, the EU Charter of Fundamental Rights requires adherence to the principle of proportionality (Article 52(1), Official Journal of the European Union, 2016). This principle establishes two key conditions:

1. Necessity: Any limitation on fundamental rights must be strictly necessary. For instance, courts assess whether disclosing information, opinions or ideas to the public is strictly necessary (Court of Justice of the European Union, 2014b; ,Court of Justice of the European Union, 2016; Court of Justice of the European Union, 2019).

2. The objective of protecting others’ rights: Limitations must also aim to protect the rights of others – in this case, individuals’ rights to personal data protection (Article 52(1), Official Journal of the European Union, 2016).

By adhering to these principles, the reconciliation of rights under GDPR ensures neither freedom of expression nor data protection is unduly compromised.

For analysing the component, the CJEU adopted six interconnected criteria in the Buivids case initially outlined by the ECtHR in several judgements such as Satakunnan Markkinapörssi v. Finland, M.L. v. Germany, and Hurbain v. Belgium.

The processing must contribute to a broader public discourse. This principle examines the purpose of journalistic activities, specifically whether they serve the public’s general interest. According to case law, processing personal data for journalism must align with a legitimate public interest in the subject. For instance, sharing personal information related to criminal activities online does not meet journalistic standards if it fails to serve the public’s right to know (European Court of Human Rights, 2018b; Court of Justice of the European Union, 2019). Therefore, any journalistic activity that infringes on an individual’s privacy must first demonstrate that it serves the public interest (European Court of Human Rights, 2022a, para. 61).

The ECtHR has provided guidelines on what constitutes public interest. Examples include coverage of heinous or shocking crimes (Case of Egeland and Hanseid v. Norway, 2009, para. 58), legal proceedings related to tax evasion (Case of Verlagsgruppe News GmbH v. Austria (No. 2), 2007, para. 37), government policies, or even sensitive matters like a priest’s homosexual activity (Case of M.L. v. Slovakia, 2022 b, para. 50). Other examples include sports events (Case of Verlagsgruppe News GmbH v. Austria (No. 2), 2007, para. 28) and cases of corruption (Case of Fuchsmann v. Germany, 2018a, para. 36). When public interest is established, the ECtHR has ruled that journalists may disclose full names and details of past incidents (Case of M.L. AND W.W. v. Germany, 2018b, para. 98).

On the other hand, the court has emphasised that rumours, gossip or fabricated news do not serve the public interest, and therefore fall outside the protections afforded to journalistic activities (Case of Axel Springer ag v. Germany, 2012; Council of Europe, 2018).

Ultimately, the scope of what qualifies as public interest is not fixed and depends heavily on context. If an activity genuinely serves the public interest, limitations on free expression are generally unjustified; however, if it does not, those limitations are warranted.

Personality traits of the concerned data subject. This principle examines whether the data subject is a public or private figure, influencing the level of privacy they are entitled to. Public figures, such as politicians, voluntarily enter the public sphere, thereby reducing their privacy rights (Case of Lingens v. Austria, 1986, para. 42). Public figures may also include managers of major international enterprises (Case of Nikowitz and Verlagsgruppe News GmbH v. Austria, 2007, para. 36), media personalities, or individuals linked to prominent politicians, and the public has a legitimate interest in their private lives (Case of M.L. AND W.W. v. Germany, 2018 b, para. 104). However, individuals who did not voluntarily seek public attention, such as royalty, may retain privacy protection (Case of Von Hannover vs Germany, 2004, para. 69).

Private figures can become public through controversial actions, which may reduce their data privacy rights (Council of Europe, 2018b, p. 14). High-profile trials often make judges, lawyers and witnesses public figures, thus subjecting them to less privacy protection. Public interest may outweigh private interests in such cases, as noted in Google Spain v. AEPD. However, private individuals enjoy greater protection, as public interest in them is usually lower.

Time can reduce the public’s interest in past events, like revealing someone’s name 20 years later may contribute to data privacy detriment by not allowing convicted individuals to reintegrate into society (Case of Khelili v. Switzerland, 2011, para. 122). Usually, notoriety decreases with time, making former public figures less recognisable (Case of M.L. AND W.W. v. Germany, 2018 b; Zeller et al., 2019). Consequently, if the data subject has significant public prominence, public interest may outweigh their privacy rights, and vice versa.

Prior conduct of the data subject with the media. This principle explores the relationship between a data subject and the media. Media outlets may have an interest in reporting about individuals (Case of Fuchsmann v. Germany, 2018a, para. 49), while data subjects might also seek media attention. For example, holding press conferences can have different privacy implications for the data subject. The more actively a person seeks media exposure, the fewer privacy rights they retain (Case of Hurbain v. Belgium, 2021, para. 112).

In cases involving multiple publications, prior conduct usually includes all actions preceding the latest report, creating stronger bonds between the data subject and the media. For instance, in one case, data subjects frequently communicated with the press concerning the reopening of a case, and regularly shared updates, contributing to public debate. These recurring actions did not reduce the publisher’s interest over time (Case of M.L. AND W.W. v. Germany, 2018 b, paras 106–107). Thus, the more a data subject is associated with media interests, the weaker their claim to personal data protection becomes, and vice versa.

Approach to acquiring information and its accuracy. This principle focuses on ensuring that news is reliable and accurate, as required by journalistic ethics (Case of Axel Springer ag v. Germany, 2012, para. 93). Information must be lawfully disclosed (Hurbain v. Belgium, para. 113), and controllers must verify it before publication to avoid harming reputations or violating rights (Case of Fuchsmann v. Germany, 2018a, para. 43). In Mosley v. UK, for instance, a newspaper unlawfully published false Nazi-related allegations (European Court of Human Rights, 2011b). However, controllers can rely on public documents, official reports and statements from credible sources like law enforcement agencies (Case of Fuchsmann v. Germany, 2018a, para. 45) or a public prosecutor’s office (Axel Springer ag v. Germany, 2012, para. 105) without needing independent research (Case of Bladet Tromsø and Stensaas v. Norway, 1999, para. 35).

Verified information may allow for some exaggeration or provocation to make stories more engaging, as long as they do not mislead (Council of Europe, 2018b, p. 7). In contrast, publishing fabricated or false information violates journalistic duties and causes harm (M.L. v. Slovakia, para. 12).

Ultimately, publishing unverified or false information can restrict the exercise of free expression rights, and vice versa.

Content, form and consequences of publication. This principle examines how the communication of information affects data protection rights, focusing on content, form and consequences. The content of a publication impacts privacy, as different types of information can have varying effects on data subjects. For example, reporting an assault differs significantly from reporting a murder or rape (Hurbain v. Belgium, 2021, para. 116). Again, revealing excessive personal information, such as a celebrity’s home address, violates privacy rights (Case of Alkaya v. Turkey - 42811/06, 2012). The form of publication, including the method and scope (e.g. internet vs print), also matters, with online dissemination having a broader impact (Sergejs Buivids v. National Data Protection Agency, 2019, para. 57). Even the accessibility of archived articles (free vs paid) influences privacy (Hurbain v. Belgium, 2021, para. 118). However, courts cannot dictate reporting techniques (Council of Europe, 2018b, p. 7).

The consequences of publication must also be assessed, as the impact of disclosing minor crimes like speeding differs from more serious offences. If a person’s name can be easily searched and linked to an article, as happened in the Hurbain v. Belgium, 2021 case, then the consequences can be more severe. Public confusion between suspects, witnesses and convicts further complicates matters. Publishing emotional photographs of unknown individuals during a crime violates privacy and responsible journalism standards (Egeland and Hanseid v. Norway, 2009, para. 52). Thus, depending on the privacy impact, the right to free expression may be restricted or allowed.

Impact on the right to freedom of expression and information. This principle evaluates the impact of limiting the right to freedom of expression, which is central to the European legal system as it fosters democratic opinion formation (Case of Egeland and Hanseid v. Norway, 2009, para. 15). The right enables people to disseminate and receive personal information, including knowledge of criminal activities, essential for maintaining the integrity of digital archives as educational resources (Case of Hurbain v. Belgium, 2021, para. 100). Any modification to these archives undermines information integrity (Case of Hurbain v. Belgium, 2021, para. 98), and European laws do not require the media to review their archives regularly (Case of Hurbain v. Belgium, 2021, para. 134). Censorship or restrictions must not have a “chilling effect” ^[5] on free expression (Case of Hurbain v. Belgium, 2021, para. 60), and judges must carefully assess the impact of any sanctions.

The principle of proportionality ensures a balanced approach in reconciling conflicting rights, such as data protection and freedom of expression. By addressing necessity and public interest, courts provide a framework for evaluating whether disclosures are justified. This groundwork transitions seamlessly into the next sub-section, which explores the second condition – respecting data subjects’ protection rights – further advancing the discourse on balancing these fundamental rights.

The publicity interests discussed above reveal the opposite and interconnected principles at play such as privacy interests, private figure, disconnection with media, and so forth. These principles provide controllers with the opportunity to protect data subjects’ right to have their data protected. Table 1 illustrates equivalent versions of the principles that need to be considered to reconcile the rights. Based on an analysis of those principles, the enforcers may determine which interests prevail in a particular context. While publicity interests emphasise the public’s right to access information, especially regarding criminal convictions, privacy interests prioritise an individual’s right to control personal data and protect their identity from unnecessary exposure. These two sets of principles often collide, as information deemed important for public awareness can infringe upon personal privacy, particularly when dealing with outdated or minor convictions. Thus, the balancing of these competing interests is crucial.

Figure 1 illustrates the balancing of principles related to the right to free expression. This figure strengthens the article’s argument for case-by-case assessments based on temporal and contextual factors. The left side depicts a scenario in which journalistic purposes justify prioritising publicity interests, even when the individual is a private figure. Conversely, the right side shows when privacy interests prevail, despite the data subject being a public figure, due to the absence of journalistic exemptions. These principles are normative, not quantified; a single factor may shift the balance. This balancing is fact-based and determined case-by-case (Court of Justice of the European Union, 2019, para. 69). Even when public interest is at stake, inaccurate information grants data subjects the right to invoke data protection.

The graph in Figure 2 presents a dynamic model of proportionality, reinforcing the need for a careful, context-driven legal approach. It illustrates the shifting balance between privacy and publicity interests over four-time points. It uses six colour-coded lines to represent different scenarios regarding these interests. The two primary focuses are:

1. Publicity interests emphasise the public's right to know, prioritising freedom of expression and information.

2. Privacy interests highlight the individual's right to control personal data and prioritise data protection.

In the line-by-line analysis provided in Figure 2, the graph’s lines reflect how these interests fluctuate as circumstances change, showcasing the dynamic nature of their reconciliation.

The blue line indicates the balance point (the fine line) between privacy and publicity interests, highlighting the nuanced decision-making required by courts and controllers. This balance is context-dependent, as seen in the Buivids case, in which the purpose of publication and individual context are crucial.

The purple line represents scenarios in which publicity interests prevail consistently, often involving serious crimes with lasting societal relevance, as in M.L. and W.W. v. Germany. In contrast, the light blue line indicates cases in which privacy always prevails, typically involving private individuals with minor convictions, consistent with GDPR provisions and rulings like in Google Spain v. AEPD.

At Time 1, the orange line peaks, showing that publicity interests dominate, particularly in high-profile cases. However, this line declines sharply over time, reflecting a reduced public interest and an increasing recognition of individuals’ privacy rights, especially as they reintegrate into society. Again, publicity interests outweigh privacy interests at time 4 due to new developments in the context allowing controllers to process personal data related to crime for journalistic purposes, as happened in the M.L. AND W.W. v. Germany case.

The green line rises at Time 2, indicating a resurgence of publicity interests due to new developments, as illustrated in the ECtHR’s Egeland and Hanseid v. Norway case. The red line drops sharply after Time 3, marking a shift to when privacy begins to take precedence, supported by cases like Hurbain v. Belgium, which underscore the diminishing public interest over time.

Overall, the graph illustrates the dynamic interplay of privacy and publicity interests, with legal frameworks emphasising proportionality and necessity. As public interest wanes, privacy increasingly prevails, reinforcing the importance of individual data protection under GDPR. Enforcers must carefully balance these rights to ensure neither right is unduly compromised, reflecting a complex reconciliation of freedom of expression and data protection.

Building on the case law analysis, the following discussion broadens the focus to explore the policy implications of these legal frameworks, offering recommendations for harmonising data protection and freedom of expression across the EU.

The reconciliation of freedom of expression and data protection rights, especially concerning criminal conviction data, remains a complex and evolving challenge. This study explores how legal frameworks, notably the GDPR, address this balance. The findings underscore that reconciling these often-conflicting rights requires a nuanced, context-specific approach, emphasising proportionality, necessity and case-by-case assessments.

A central finding of this article is the significant role of Article 85 of the GDPR, which seeks to align the public’s right to information with data protection rights. This article provides a legal foundation for journalistic activities while ensuring privacy rights are respected. However, the application of journalistic purposes within the GDPR is problematic. Overly broad interpretations, particularly in the digital age where platforms blur the line between journalism and other forms of expression, can lead to the misuse of personal data. This concern is especially pertinent regarding vulnerable individuals with criminal convictions, whose data is sometimes exploited for political or sensational purposes (Harder, 2012; Cautrès, 2019; BBC Bitesize, 2024). Such misuse risks violating privacy rights and causing lasting harm, particularly for those with minor or outdated convictions. Conversely, overly restricting journalistic exemptions could limit the public’s right to be informed about how justice is being served and how crimes are addressed.

Proportionality is pivotal in balancing freedom of expression with data protection. Restrictions on fundamental rights must be both necessary and proportionate to their aims, ensuring that neither freedom of expression nor data protection is disproportionately compromised. The CJEU reinforces this principle through case law, emphasising that the journalistic exemption under Article 85 is not absolute and requires careful consideration of the specific circumstances. This case-by-case approach ensures that freedom of expression is preserved without undermining data privacy.

The evolving and dynamic nature of this balance is particularly evident in high-profile cases where the public’s interest in criminal convictions may resurface over time. Initially, publicity interests may dominate, especially in cases involving serious crimes. However, as time passes and the individual’s reintegration into society becomes more important, privacy concerns typically gain prominence. The study illustrates this dynamic, highlighting that the weight of privacy and publicity interests shifts according to the context and temporal factors. This indicates that the balance between privacy and publicity is not static, and the relative importance of each can change over time.

The right to be forgotten, a fundamental aspect of GDPR, plays an essential role in reinforcing data protection rights, particularly in cases involving outdated or minor convictions. When past offences lose societal relevance, privacy interests generally outweigh the public’s right to access such data (Brimblecombe and Phillipson, 2018, p. 5). However, the application of the right to be forgotten is fraught with challenges. Determining when the public interest no longer justifies the retention of personal data is a complex task, and distinguishing between legitimate public interest and unnecessary harm to privacy can often be unclear.

The study highlights best practices for balancing data protection and freedom of expression in the EU. It emphasises the need for clearer definitions of journalistic purposes in the GDPR, as online expression increasingly blurs traditional boundaries. A standardized interpretation across Member States could help prevent data misuse, especially for vulnerable individuals. Additionally, uniform proportionality assessments would ensure justified and balanced restrictions, promoting legal consistency.

The right to be forgotten should be systematically applied, particularly in cases involving outdated or minor criminal convictions, with EU-wide guidelines to protect privacy while minimising societal consequences. As digital media evolves, EU legislation must remain adaptable to ensure responsible data dissemination while safeguarding individual rights.

While these best practices support a more consistent framework, the study has limitations. Case-specific analyses restrict broader applicability, and the focus on European legal frameworks limits generalisability to non-EU jurisdictions. Additionally, the emphasis on journalistic exemptions overlooks other forms of expression, such as academic, artistic or literary activities.

Overall, the study contributes valuable insights into reconciling data protection with freedom of expression, helping shape future regulatory efforts and ensuring fairness in legal frameworks.

This article has examined the intricate relationship between data protection rights and freedom of expression, particularly concerning criminal conviction data under the GDPR. The findings emphasise the crucial role of proportionality, necessity and case-by-case assessment in reconciling these competing rights. While the journalistic exemption under Article 85 of the GDPR provides a framework for safeguarding the public’s right to information, its application must be carefully considered to avoid the misuse of personal data and protect individuals’ privacy.

The study highlights the evolving nature of these tensions, especially as digital media transforms how personal data is disseminated. It advocates for harmonised legal frameworks across the EU to ensure consistency in balancing individual privacy with the public’s right to information. As digital media continues to evolve, further research is needed to explore the intersection of new media formats, academic, artistic, and literary freedoms, and data protection. This would deepen our understanding of how to balance these interests effectively in the digital era.

This research was predominantly funded by the Eino Jutikkala Fund of the Finnish Academy of Science and Letters (grant 0222799–7), whose support was instrumental in advancing the study. Additionally, the University of Helsinki’s Generation AI project (grant 01331393) provided supplementary funding to facilitate the finalisation of the article. The author wishes to express gratitude to Päivi Korpisaari, Professor of Communication Law; Tuomas Ojanen, Professor of Constitutional Law; Toomas Kotkas, Professor of Public Law; and Susanna Lindroos-Hovinheimo, Professor of Public Law, all from the Faculty of Law at the University of Helsinki, for their insightful feedback during a research seminar in public law. Special thanks are also extended to the internal language revision services and reviewers for their valuable assistance.

Funding: Helsingin Yliopisto No. 01331393; Suomalainen Tiedeakatemia No. 0222799–7.

Declaration: The author reports there are no competing interests to declare.