Nik Williams is the journalist protection advisor for the Coalition for Women in Journalism and a reader director for the Ferret. He coordinated the inaugural year of the Media Freedom Rapid Response at European Centre for Press and Media Freedom.
In Lithuanian, the term “hot feet,” or karštos pėdos, originates from an era in which detectives used to track people down by following their footprints, tracing hot trails to obtain any information a person of interest may hold.
Repurposed for the digital age, Karštos Pėdos is now the name of a publicly accessible database housing information regarding potential conflicts of interest, supporting journalists and civil society in Lithuania to connect the dots between public funds, influential politicians and business leaders. Since its launch, however, it has also drawn the attention and ire of the country’s State Data Protection Inspectorate (SDPI) — a supervisory authority safeguarding “the human right to personal data protection.”
Yet this ongoing clash is only the tip of the iceberg when it comes to the many attempts across Europe to restrict transparency and threaten journalists, activists, academics and campaigners into silence using Strategic Litigation Against Public Participation lawsuits (SLAPPs). And the shiniest new tool in this legal sandbox is the General Data Protection Regulation (GDPR).
Even though Karštos Pėdos only visualizes publicly accessible information, the SDPI has alleged that it has been violating the GDPR. And though the law itself states that countries must provide exemptions for “journalistic purposes,” this runs into the slippery question of what constitutes journalism.
Co-funded by the European Commission and implemented by Media4Change and the Investigative Journalism Center Siena, the platform itself does not produce or commission journalistic reporting, but it does present data that can form the basis for it, making an undeniable impact on the media environment. Yet the SDPI told me, “the activity of the journalist or other people sharing personal data publicly does not necessarily mean that it falls under the journalistic exemption.”
Fortunately, the country’s Office of the Inspector of Journalistic Ethics — responsible for the “processing of personal data by the media for the purpose of providing information to the public” — disagrees, and confirmed over the summer that Karštos Pėdos is considered a journalistic activity in the context of GDPR.
Yet still, the situation has continued to escalate: The platform now awaits the results of a hearing on a hefty fine to be announced later this month, and the situation has unearthed an underlying lack of trust in the whole process.
Neringa Jurčiukonytė, the CEO of Media4Change, puts this fear more bluntly: “GDPR is used as a cover for hiding or even removing information, and such actions restrict not only the rights of journalists but also the right of the general public to know about the activities of state institutions, politicians and civil servants.”
And if her statement seems extreme, Lithuania need not look much farther for cautionary tales: In 2019 in Bulgaria, a reform was proposed to the country’s Personal Data Protection Act, seeking to establish a checklist that media outlets must satisfy to secure journalistic exemption. Thankfully, being evaluated on criteria that included responding to “the impact that the disclosure of the personal data or the publishing of the data would have on the data subject’s privacy and reputation,” as well as the potential fine of €20 million, eventually set off alarms and was found unconstitutional.
Though they don’t define a specific legal power, SLAPPs can be read as an exercise in outcome-oriented thinking, with a goal to stifle critical reporting or public participation irrespective of the tool used. And for years, defamation was the most common driver for SLAPPs, but it no longer holds sole dominion. The publisher of the Croatian online media outlet Index.hr and its journalists, for example, have been targeted with 65 legal actions, three of which relate to GDPR, anti-discrimination and copyright claims.
Similar legal action in Hungary also forced Forbes from newsstands in 2020, after it included one of the owners of Hungarian energy drink company Hell Energy in its list of the 50 richest Hungarians. According to the International Press Institute, “Hell Energy’s suit does not challenge the truthfulness of the information,” but in this case, GDPR and a weakened and captured judiciary was sufficient.
For far too long Maltese journalists and transparency campaigners have also wrestled with a media landscape forever distorted by SLAPP actions. Assassinated investigative journalist Daphne Caruana Galizia was sued for the first time in 1994, and 67 defamation lawsuits were filed against her during her professional life.
While Caruana Galizia was never personally threatened with a GDPR lawsuit, the foundation that bears her name now has been. In 2020, the foundation received two letters from a law firm representing two businessmen mentioned in articles published on Caruana Galizia’s personal blog. They demanded the deindexing, removal and modification of the articles published in 2015, as they contained “outdated and distorted” information. The request was reiterated in 2021, this time alleging defamation.
Sometimes, simply mentioning a name can even be enough. Like in December 2020, when MaltaToday received a legal letter on behalf of Farnoush Farsiar, demanding the removal of an article from the outlet’s website. The reason? That the publication of her name amounted to the unlawful processing of her personal data.
In a jurisdiction so malleable to financial influence, bringing GDPR action against MaltaToday must have appeared an obvious next step, though its likelihood of success was perhaps limited. However, speaking to Caruana Galizia’s sister Corinne Vella, it becomes clear that while GDPR threats may be relatively new, the playbook is certainly not.
Threats do not need to make it to court to disrupt reporting and public participation. And even if they do, the process begins a long time before that. Just like the defamation threats that plagued Maltese journalists, they drain resources and confidence, encourage the need for legal representation and intimidate those speaking out, making them question the risk of publication.
And Vella raises an important point: Like defamation, GDPR is a balance of rights issue, and like any such balance, the outcome is always imperfect. In the digital age, the right to privacy and attempts by which we can take control of our data are vitally important. But this cannot come at the expense of transparency, accountability or media freedom.
Paired with the challenges highlighted by the ongoing tug-of-war between the SDPI and Karštos Pėdos, all these examples underscore a complexity that must be faced head on by both national governments and the European Commission — sooner rather than later.
If we do nothing, the trail may run cold.
