Digital resources in the Social Sciences and Humanities OpenEdition Our platforms OpenEdition Books OpenEdition Journals Hypotheses Calenda Libraries OpenEdition Freemium Follow us

Data protection weaponised

By Tivadar Hüttl

This article is a shortened version of the eponymous re:constitution Working Paper, which was originally published the Forum Transregionale Studien in 2024 and can be read here.

For several months, a prominent Hungarian online news portal published a series of investigative articles on high-level government corruption. These articles implicated the Secretary of State of the Ministry of Justice and the President of the Court Executive Chamber in a multi-million-euro corruption network. The articles were based on confidential documents from criminal proceedings, and included wiretap recordings, witness statements, and investigative reports, sent by an undisclosed source. At the time, the central figures were either in pre-trial detention or facing other criminal proceedings. Surprisingly, the Hungarian Data Protection Authority (DPA) sent the publisher a detailed set of questions regarding the personal data appearing in the articles, including the data source, the purpose and legal basis for processing, and whether the affected individuals had been informed. It was later revealed that the DPA’s investigation was initiated by a public interest report by an undisclosed citizen, not by the individuals concerned by the article in question. The six-month investigation, which required extensive legal work, illustrates how a proactive DPA can use data protection regulations to challenge the press’s watchdog efforts to hold public power accountable, even without explicit requests from the affected data subject.

In a similar vein, the Hungarian DPA fined Forbes EUR 5,500 and ordered it to fundamentally transform its information practices out of nowhere for failing to provide adequate prior information to the owners of the Hell energy drink company, who were featured in a ranking of the most successful family businesses. Notably, the authority took these steps without ever initiating consultation with the media sector or publishing any guidelines on the implications of the General Data Protection Regulation’s [1] (GDPR) entry into force for journalistic data processing. Another illustration of the GDPR being “weaponized” against journalists is evident in Romania. The DPA attempted to compel the Rise Project, a platform for investigative journalism, to disclose its sources under the threat of daily fines. This followed the portal’s publication of an investigation into a corruption scandal involving a high-ranking politician.[2]

These examples show how legal actions based on the GDPR have emerged across various European countries.[3] Press organizations and media companies were abruptly confronted with onerous legal obligations and a surge in law enforcement actions. Established legal provisions, traditionally consolidated in civil and criminal law jurisprudence and routinely applied in daily operations, have been superseded by GDPR-based obligations.[4] The gradual expansion of European Union (EU) data protection law has unreasonable consequences, creating imbalances in the overall regime of fundamental rights protection. It seems that data protection, when weighed against another right or interest – such as freedom of expression – very often prevails.[5] I will argue that in the absence of a consistent level of protection for the press across the EU vis-à-vis the GDPR, stronger and more coherent institutional responses are needed to restore the distorted balance between data protection and freedom of expression.

A man with dark hair in a blue shirt.
Tivadar Hüttl. Photo: Private.

The tension between data protection and freedom of expression is longstanding. While European law provides frameworks to balance these fundamental rights, it is uncertain how the new GDPR-based regime will equally protect both rights in practice. This uncertainty opens the door for individuals to exploit data protection laws through strategic litigation against public participation (SLAPP) actions to intimidate, silence, or obstruct journalistic endeavours that involve personal data. The consequences of the Regulation’s innovations as they pertain to the press remain evident. The EU bodies have yet to publish a comprehensive investigation on the subject. So far, neither the Court of Justice of European Union (CJEU) nor the European Court of Human Rights (ECtHR) has adopted new decisions specifically addressing the Regulation’s effect on journalism.

Professional journalists are crucial to the systematic and independent pursuit of truth about events and issues of societal importance. They frequently serve as critical watchdogs, distilling, contextualizing, and elucidating complex information for the public. In performing these functions, journalists handle substantial quantities of personal data, often of a highly sensitive nature. When journalists or media companies collect and disseminate information about individuals, they act as data controllers under the GDPR. Given their capacity to disseminate information widely, they possess the potential to inflict severe and possibly unwarranted harm on individuals. In such contexts, data protection laws aim to delineate the boundaries of acceptable reporting that identifies individuals.

The GDPR imposes significant responsibilities on processing personal data, which is essential to journalistic work. However, overly stringent application of the GDPR could hinder journalists’ ability to report freely and to fulfil their vital role in a democratic society. This tension necessitates nuanced legal interpretations to ensure that neither fundamental right is unduly compromised. Hence, there is a need to adopt an exemption regime.

Article 85 of the Regulation enshrines a provision known as the “journalistic exemption”, mandating that Member States must reconcile the right to personal data protection with the right to freedom of expression and information, including processing for journalistic purposes. This provision obliges the Member States to adopt exemptions or derogations from certain GDPR rules for journalistic activities, essentially allowing journalists to operate without fully adhering to all data protection obligations. The existence or non-existence of an exemption regime has a significant impact on journalism. For example, if the specific transparency rights of data subjects are not exempted, investigative journalists might be compelled to inform their subjects about ongoing investigations and provide them access to their data. This requirement could potentially compromise source protection and undermine the efficacy of investigative journalism. Absent an exemption regime, the privileges that underscore the role of the press in a democratic society cannot be effectively safeguarded. Given the current state of the rule of law in Europe, such a broad margin of appreciation may also serve as a leeway for less democratic regimes to swing the balance in favour of an extremely broad interpretation of the right to data protection, by creating barriers for the public watchdogs to operate.

The Regulation’s ambiguity regarding the scope of this exemption has led to varied interpretations and implementations across Member States.[6] While the GDPR has prompted the development of detailed, press-friendly legislation in many member states, some have implemented very narrow exemption frameworks, and in the case of Hungary, the legislator has failed to exempt journalistic activities from the application of the GDPR altogether. This fragmented distribution of responsibility helps explain why GDPR-based legal actions are so challenging to address at a pan-European level. The absence of cohesive European legal instruments is likely to yield an increase in constitutional disputes and a diversification of national regulatory approaches in the realm of data protection and journalism.

Variations in national implementation create further practical challenges for ensuring legal compliance for media outlets and journalists operating across multiple member states. Differing approaches to the scope of the exemption create legal compliance difficulties, leading to self-censorship and a less informed readership. The significant divergence in the legal environment within the EU in which media companies operate could adversely affect investment, expansion, or other business-related decisions. The same issue arises from the data subjects’ perspective. If the same piece of information is published by outlets operating in different Member States, individuals would face considerable difficulty understanding the media’s obligations with respect to the protection of their personal data. This lack of uniformity complicates the legal landscape, undermining the GDPR’s intent to provide a consistent level of data protection across the EU.

The EU’s limited competence in regulating the press partly explains the GDPR’s shortcomings in offering a more robust exemption for the media. While the European Convention on Human Rights (ECHR) framework is relevant, the ECtHR can only respond to specific circumstances in individual cases. Member states must therefore navigate both systems and align their national frameworks accordingly. In this landscape, a particularly important role falls on on supervisory authorities, which, pursuant to Article 57(1)(d) GDPR, are not merely enforcers but are required to act proactively in drawing controllers’ attention to their obligations, thereby facilitating a balanced and rights-compliant application of the Regulation in the field of journalism.

The mere existence of DPAs means that the protection of personal data is institutionally embedded and actively enforced, while press freedom typically lacks a comparable institutional counterpart. This asymmetry is further reinforced by the professional focus of DPAs, whose expertise and enforcement practice centre on data protection compliance rather than freedom of expression, which in practice can lead to prioritisation of privacy. Such a structural imbalance can be readily used by SLAPP actors and may place journalists at a disadvantage.

Some institutional arrangements seek to address this imbalance. In Lithuania, for example, supervisory powers are shared between the State Data Protection Inspectorate and the Office of the Inspector for Journalist Ethics, the latter having a specific mandate over data processing for journalistic, academic, artistic or literary purposes and cooperating with the DPA to ensure consistent application of the law. However, even broader mandates do not in themselves guarantee balanced enforcement. The Hungarian supervisory authority, for instance, formally also has a role in promoting freedom of information, yet its practice in several cases reflects a distinctly one-sided application of data protection rules where press freedom is concerned. These examples indicate that institutional design alone is insufficient; the effective protection of press freedom under the GDPR requires clear, authoritative and journalism-sensitive guidance for supervisory authorities. I argue for a more interventionist approach by the relevant actors, namely the European Data Protection Board, the CJEU and ECtHR.

The European Data Protection Board (EDPB) is well suited to guide the application of data protection laws by Member States’ data protection authorities to prevent SLAPP enforcement.[7] A guideline from the EDPB on the journalism-friendly application of the Regulation by DPAs, along with best practices for implementing and interpreting the journalistic exemption in a manner compatible with human rights, is urgently needed. The last relevant guideline issued by the predecessor of the EDPB dates back to 1997.[8] The Board should provide guidance to media companies on adopting online data protection policies that comply with the proactive interest test. It would be beneficial if the EDPB developed these guidelines in cooperation with other professional organizations to channel aspects of the modern press’s operation.[9] Regrettably, the EDPB’s published work plan does not include the renewal of this outdated guideline.[10] The EDPB has recently initiated consultation on its draft Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, a legal basis which, according to prevailing practice in several Member States, frequently underpins journalistic data processing. (The public consultation on the draft closed on 20 November 2024, and the final version has not yet been published.[11]) Notably, however, the draft guideline does not address the specificities of journalistic data processing at all.

The EDPB should also address how to approach the press and media companies in DPA procedures, recognizing them as a critical sector in data processing. DPAs are independent, non-majoritarian bodies, not influenced by the executive branch, and their role in supervising compliance is unique compared to other areas of law, particularly concerning fundamental rights. Their independence stems directly from the Treaties, rather than delegated powers from governmental bodies.[12] Independence, however, does not imply that DPAs can misuse their powers to drastically alter media law under the guise of data protection: DPAs shall not become “slappers” themselves by adopting fundamentalist positions.

Media actors, from large conglomerates to individual bloggers, deserve consistent and predictable regulation across national borders. This consistency is crucial due to the rapid technological advancements in the press’s use of personal data. DPAs must lead by clearly communicating expected outcomes and behaviours, understanding the technological, commercial, and political contexts, and providing forward-thinking, practical, and strategic guidance.[13] High priority should be given to providing clear information, guidance, and advice to help organizations fulfil their responsibilities—a priority neglected by the Hungarian DPA. Constructive engagement, focusing on leadership, dialogue, and support, is more effective than relying solely on punitive measures and inadvertently becoming an avenue for SLAPPs. DPAs should employ punitive enforcement measures when necessary, especially only if previous warnings have been ignored, posing a real risk to individuals. Sanctions should be restricted to deliberate, wilful, seriously negligent, repeated, or severe non-compliance.

The CJEU could also play a crucial role in bridging the regulatory gap between freedom of press and the GDPR. Although Article 85 delegates the competence to reconcile the two fundamental rights to the Member States, the rule of law deficit at the EU level arguably necessitates active intervention by the Court.[14] For instance, clarifying the legal basis for data processing by the media necessitates careful judicial interpretation, particularly regarding processing required for tasks carried out in the public interest. A detailed legal rationale in this context would significantly enhance the jurisprudence on the interplay between data protection and journalistic freedoms, offering clearer guidelines for future cases involving conflicts between privacy rights and the public interest.

Fortunately, in the foreseeable future, the ECtHR will promulgate guidance concerning the SLAPP-like application of the GDPR when it decides on the Forbes case mentioned in the introduction. (The case has been communicated in January 2026.[15]) The case presents a significant opportunity for the Court to articulate the criteria for addressing the tensions between novel data protection obligations under the Regulation, the requirements stemming from Article 85 GDPR, and how these relate to the State’s positive obligation to ensure institutional protection of freedom of the press. The Court should engage more deeply with the structural tension between data subjects’ rights under the GDPR and the exercise of press freedom, and to provide principled guidance on how these competing considerations are to be reconciled in practice. In doing so, the Court could offer much-needed orientation not only to national courts, but also to supervisory authorities as the primary actors in enforcing data protection law, clarifying the limits of their intervention where journalistic activities and public interest reporting are at stake.

Harmonizing the GDPR with the functioning of the press is a complex, multi-faceted issue. It requires appropriate legislation, the application of law grounded in fundamental rights, research and constructive professional discourse. At this point, irrespective of the national legislation enacted to satisfy the requirements of Article 85, an authoritative legal interpretation must be established necessary to mitigate the potential for SLAPPs — whether it derives from the jurisprudence of ECtHR or that of the CJEU, guidance by the EDPB or from the Regulation itself. Surely, legal practitioners specializing in the confluence of media law and data protection are anticipated to experience exciting times and increased workload in the forthcoming years.


Notes

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

[2] Dollores Benezic, “Romania May Be Using GDPR to Intimidate Journalists”, https://www.liberties.eu/en/stories/politicians-in-romania-use-gdpr-to-intimidate-journalists/16173 [accessed: 09.08.2024].

[3] For further details on these proceedings, visit: International Press Institute, https://ipi.media/croatia-wave-of-abusive-legal-actions-against-index-hr/; Mapping Media Freedom, https://www.mapmf.org/alert/23595; European Federation of Journalists, https://europeanjournalists.org/blog/2022/01/27/lithuania-state-data-protection-inspectorate-sdpi-must-not-obstruct-journalistic-activity/; Access Now, https://www.accessnow.org/wp-content/uploads/2020/05/Two-Years-Under-GDPR.pdf; Observatorio Balcani e Baucoso Transeuropahttps://www.balcanicaucaso.org/eng/Areas/Greece/Weaponizing-GDPR-How-EU-data-protection-threatens-press-freedom-in-Greece-224735, [accessed: 08.12.2024].

[4] The author does not intend to provide a comprehensive overview of legal cases arising from the GDPR. However, those interested in exploring valuable legal cases can refer to the websites gdphub.org or https://fom.coe.int/en/alerte [accessed 08.12.2024].

[5] Maja Brkan, “The Unstoppable Expansion of the EU Fundamental Right to Data Protection: Little Shop of Horrors”, MAASTRICHT Journal of European and Comparative Law, 23/5, 2016, 812–841, 816, https://doi.org/10.1177/1023263X1602300505.

[6] For detailed analysis on the journalistic exemption, see: Natalija Bitiukova, “Journalistic Exemption Under European Data Protection Law”, Policy Paper, Vilnius Institute for Policy Analysis, 2020, 1–43, 6–8; https://vilniusinstitute.lt/wp-content/uploads/2020/02/VIPA_Bitiukova_2020_v5_LTsum_f.pdf.

[7] GDPR, Article 64.

[8] Bitiukova, “Journalistic Exemption Under European Data Protection Law” 29; Melinda Rucz, “SLAPPed by the GDPR: protecting public interest journalism in the face of GDPR-based strategic litigation against public participation”, Journal of Media Law, 14/2, 403, 383, https://doi.org/10.1080/17577632.2022.2129614.

[9] Establishing professional collaboration between the EDPB and the European Board for Media Services, established under the EMFA, would be highly advantageous.

[10] https://www.edpb.europa.eu/system/files/2026-02/edpb_work-programme_2026-2027_en.pdf [accessed: 04.04.2026].

[11] https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2024/guidelines-12024-processing-personal-data-based_en [accessed: 09.08.2024].

[12] Hielke Hijmans, (2016). The European Union as a constitutional guardian of internet privacy and data protection, Doctoral thesis, University of Amsterdam, Digital Academic Repository, 2016, 1–543, 287, 308 and 320, available:http://hdl.handle.net/11245/1.511969.

[13] Centre for Information Policy Leadership (CIPL), “Regulating for Results Strategies and Priorities for Leadership and Engagement A Discussion Paper”, 25 September 2017; 1–56, 20, 22, 30, available: https://www.informationpolicycentre.com/uploads/5/7/1/0/57104281/cipl_final_draft_regulating_for_results_-_strategies_and_priorities_for_leadership_and_engagement.pdf [accessed: 09.08.2024].

[14] In the Forbes case, the Hungarian Curia (Supreme Court) dismissed the request to initiate a preliminary ruling procedure regarding the issue of the legal basis, asserting that the question of law falls within the competence of the Member States.

[15] https://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-248472%22]} [accessed: 09.08.2024].


About the Author

Tivadar Hüttl is an attorney-at-law, with his primary practice at HMP Legal Association. He is providing legal representation in high profile constitutional law cases before Hungarian national courts and the Constitutional Court of Hungary. He also represents clients before international judicial bodies such as the European Court of Human Rights, Court of Justice of the European Union and the UN Committee on the Rights of Persons with Disabilities. He represents several media companies in GDPR related legal procedures.


Citation: Tivadar Hüttl, Data protection weaponised, in: TRAFO – Blog for Transregional Research, 21.05.2026, https://trafo.hypotheses.org/65398

Forum Transregionale Studien
Forum Transregionale Studien
The Berlin-based Forum Transregionale Studien promotes the internationalization of research in the humanities and social sciences. It provides scope for… Read more

OpenEdition suggests that you cite this post as follows:
Forum Transregionale Studien (May 21, 2026). Data protection weaponised. TRAFO – Blog for Transregional Research. Retrieved June 14, 2026 from https://doi.org/10.58079/1694w


You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.