The question has to be split into two separate activities: producing news and collecting data from readers. The two are not assessed under the same regime.
Two Separate Activities
| Activity | Example | Assessment |
|---|---|---|
| News production | A person's name, image or information appearing in a story | This is where the journalism exemption debate arises |
| Reader data processing | Membership, comments, newsletter subscriptions, cookies, contact forms | No exemption debate - the general data protection obligations apply |
The Reader Side: The Duty Is Clear
A news site is a business that collects data from its readers. The minimum tools expected on that side:
- Showing a privacy notice on the forms where data is collected
- A cookie management tool and the storing of preferences
- Recording and answering data subject requests
- Being able to export and delete comment and subscription data
- Keeping access logs limited to a reasonable period
- Keeping a data processing inventory
We cover this in the reader data guide and the cookie side in the cookie consent guide.
The News Side: The Limit Is Contested
We cover the subject in the journalism exemption guide and the personal data in news guide.
The Firm Limits in Press Legislation
Independently of the exemption debate, Press Law No. 5187 directly punishes the disclosure of identity in certain cases. Art. 21 punishes publications disclosing, or leading to the recognition of, identities in these cases:
- Of the persons concerned, in reports on sexual relations between persons prohibited from marrying under the Civil Code
- Of victims, in reports on the offences listed in the article
- Of offenders or victims under eighteen
The penalty starts from a higher base for regional periodicals, national periodicals and internet news sites.
The Right of Reply and Correction
For an untrue publication about a person, Art. 14 of Law No. 5187 comes into play: the correction and reply text sent by the person harmed within two months of publication is published by the responsible editor without any correction or addition, within three days in daily periodicals and within one day at the latest on internet news sites, on the page and in the columns where the relevant publication appeared, with a URL link provided, and in the same point size.
The Practical Distinction
| Question | Which regime |
|---|---|
| Must consent be obtained for a newsletter subscription? | Data protection + electronic commerce |
| Must a privacy notice be shown on a comment form? | Data protection |
| Must cookie preferences be asked? | Data protection |
| May a person's name be written in a story? | The journalism exemption debate + Law No. 5187 Art. 21 |
| May a suspect's photograph be published? | Personality rights + Law No. 5187 Art. 21 |
| May a child's face be shown? | Law No. 5187 Art. 21 |
We cover those last two in the suspect photograph guide and the child identification guide.
Summary
- The privacy notice duty applies without argument to a news site processing reader data.
- On the news production side the scope of the journalism exemption is nuanced and must be assessed from the official text of the Law.
- The identity disclosure prohibitions in Art. 21 of Law No. 5187 apply in every case.