If a web portal writes anything about a person in a news story, article or other format, it is a matter of publishing personal data. Personal data is considered to be all the data that directly or by combination allows to identify the identity of a person. Personal data is the person’s full name or personal identification number but also, given the context, a description of the person’s place of residence, age and position. As a rule, personal data is any data about a person that can be used to identify that person.

Since 2019, a new Personal Data Protection Act is in force in Estonia, which regulates among other the processing of personal data for journalistic purposes. In general, publication of personal data is permitted only with the consent of the data subject, whereas Article 4 makes an important exception to this. According to the provision, personal data can be processed without the consent of the person involved, if:

• it is done for journalistic purposes;
• there is public interest for this;
• it is done in accordance with the principles of journalism ethics;
• it does not unduly impair the subject’s rights.

If such conditions exist, it can be assumed that the publication has published the data legally. This is also the case if the data has been disclosed without the person’s knowledge or even against the will.

Data must be processed purposefully and to the minimum necessary extent. However, considering the general principles of data processing and the legal requirements is not only relevant when publishing articles, but must also be followed when keeping them available. This is indicated by the explanatory letter of the Personal Data Protection Act, which states that “checking the timeliness and relevance of data is also important”, and the principle has also been confirmed in judicial practice.

How long can personal data be published? For example, can a web news published in 1996 continue to be maintained? What about the news button published 5 years ago about Peter from Bonneville driving a vehicle under the influence of alcohol?

One of the main arguments for requesting the removal of data in outdated articles can be the lack of public interest. Public interest can be due to an event or a specific person (public figure). In the context of personal data protection, public interest means that the public must have a “substantial interest in knowing who the particular person is who is referred to in the media”. Such interest may be due to, for example, the commission of a serious crime, appointment to a position of interest to the public, a person’s political activities or simply a person’s reputation. In judicial practice, it has been found that public interest is not justified only by private interest or thirst for sensation. The courts have also established that the press could not assume the public’s interest in individuals when covering, for example, the activities of so-called serial complainants.

At the same time, a person should not forever surrender to the threshold of news and public interest, but at a certain moment the right may be forgotten to consider the information needs of fellow citizens. It can be assumed that in the case of persons unknown to the public, public interest will decrease over time. For example, after 10 years, it may not matter that it was Jane Eyre who exceeded the speed limit on Midsummer’s Day. If it is no longer important to the public who is involved in the event being covered, the publication of personal information is no longer justified and the person can demand that the publication remove their personal information from the relevant news story.

Recently, the administrative court resolved a case where the applicant wanted to replace his name with his initials in an article published more than 20 years ago. The disputed article attributed the commission of an offense to the applicant, which is why the previous coverage disturbed the applicant’s work and private life until now.

The Administrative Court stated that one of the measures of public interest is the time criterion. If the basis for the processing of personal data without the consent of the subject was the reporting of the commission of an offense by the person, the need to name the person in the article by his full name may disappear over time. Since the public interest did not lie in the person (not a public figure or a repeat offender) and the event at that time no longer raises discussion in society, the court found that such continued publication of data potentially harms the subject more than promised.

The use of a person’s name when reporting on the commission of an act years ago may have been justified at that time because, among other, the purpose of reporting the story was to warn the society. However, if the person does not commit new crimes and has been rehabilitated, the data should be deleted from the publication at the person’s request.

A person may have a “right to be forgotten” even if the information contained in old news may be too damaging to the subject. For example, in situations where the published information inhibits a person’s future career choices, disrupts family life or causes negative attention from strangers in public places, even though the article no longer has news value.

The Belgian Court of Cassation has considered, for example, a situation where a publication archived a news story online about a person causing a traffic accident from more than 20 years ago as an excessive violation of rights. The court established that re-archiving an article on the Internet represents re-disclosure and may excessively harm a person’s rights.

If the person considers that the publication of personal data is no longer lawful, he or she can demand from the publisher of the data the name be replaced by initials or pseudonym in the article, personal description be omitted from the article, any photo of the person be removed, the information found in search engines be limited or the coverage be completely deleted. If the publisher does not agree with the request, you can protect your rights by filing a complaint with the Data Protection Inspectorate. It should be remembered that the Data Protection Inspectorate does not decide to withdraw the article from sale, does not assign compensation, does not oblige the publisher to apologize or refute the data. It is necessary to apply to a civil court to submit claims to this effect. At the same time, filing a complaint with the Data Protection Inspectorate is often the fastest option with the lowest cost to request the removal of personal data from an expired article.

Aldo Vassar
Attorney-at-law of Law Firm LINDEBERG

Grete Pall
Lawyer of Law Firm LINDEBERG