At Free Press Alliance, we defend free, independent journalism committed to human rights. In a global context marked by authoritarianism, digital surveillance, and the abusive use of personal data, the protection of privacy has become a central challenge for the practice of journalism.
Data protection laws can be used both as tools to safeguard rights and, in some contexts, as mechanisms of indirect censorship against the press. For this reason, journalists and newsrooms must understand this legal framework, recognize its limitations, and know how to invoke the exceptions that protect freedom of expression and the right to information.
This guide provides a practical, critical, and public interest–oriented overview of data protection and privacy laws, with a particular focus on high-risk contexts, investigative journalism, and source protection.
-
What are data protection laws?
Data protection laws regulate how personal information is collected, stored, processed, and shared. Their purpose is to guarantee rights such as:
- The right to privacy.
- Control over personal data.
- Protection against abuse, leaks, or misuse.
Personal data
Personal data refers to any information that identifies or can identify a person, such as:
- Name, address, email.
- Identification numbers.
- Location data.
- Biometric or genetic information.
- Political opinions, religious beliefs, or health status.
-
Main legal frameworks relevant to journalists
General Data Protection Regulation (European Union)
The GDPR is one of the strictest data protection frameworks in the world. It applies to any processing of personal data of individuals in the EU.
Key points for journalists:
- It recognizes a journalistic exemption to protect freedom of expression and information.
- It requires data processing to be necessary and proportionate.
- It provides special protection for sensitive data.
Organic Law on Data Protection and Guarantee of Digital Rights (Spain)
This law complements the GDPR and includes specific provisions on:
- Data processing for journalistic purposes.
- The right to be forgotten and digital archives.
- Use of images and personal data on social media.
Other relevant laws
- California Consumer Privacy Act (CCPA).
- UK Data Protection Act (UK GDPR).
- National data protection laws in Latin America, Africa, and Asia, with varying levels of protection.
-
Journalistic exemption: what it is and what it is not
Most data protection laws recognize journalism as a public interest activity. They therefore allow exceptions when:
- The information is relevant to public debate.
- The data processing is proportionate to the journalistic purpose.
- Basic ethical principles are respected.
The exemption does not cover:
- Morbid curiosity
- Defamation
- Unnecessary publication of sensitive data
-
Sensitive data: special precautions
Sensitive data includes:
- Health information
- Sexual orientation
- Gender identity
- Political opinions
- Ethnic or racial origin
Best practices:
- Always assess the public interest
- Minimize identifying details
- Avoid revictimization
- Obtain consent whenever possible
-
Images, audio, and video
Before publishing, ask yourself:
- Is the person a public figure?
- Was the content obtained in a public space?
- Is there a security risk for the person involved?
Pay special attention to:
- Minors
- Victims of violence
- People in contexts of protest or repression
-
Sources, leaks, and data protection
- Protecting the identity of sources is an ethical obligation and, in many countries, a legal one.
- The storage of leaked data must be secure.
- Avoid sharing original documents with visible metadata.
Recommended tools:
- Disk encryption
- Secure document submission platforms
- Metadata removal tools
-
Right to be forgotten and journalistic archives
Requests for deletion or de-indexing should be assessed considering:
- Historical relevance
- Current public interest
- The role of the person involved
Not all requests should be accepted. Journalism has documentary and social values.
-
Common legal risks for journalists
- Lawsuits for privacy violations
- Administrative sanctions
- Indirect censorship through strategic lawsuits (SLAPPs)
Recommendations:
- Seek legal advice when possible
- Document editorial decisions
- Apply consistent criteria
-
Quick checklist before publishing
- Is the personal data necessary for the story?
- Is there a clear public interest?
- Have I minimized potential harm?
- Am I complying with ethical principles?
- Is the information adequately protected?
Conclusion
For Free Press Alliance, defending press freedom also means defending the right to privacy and data protection. These rights are not opposed, but complementary when understood through a lens of public interest, proportionality, and journalistic ethics.
Knowing and applying data protection laws allows journalists and media outlets to reduce legal risks, protect their sources, and resist attempts at covert censorship through regulatory frameworks. In authoritarian contexts or situations of democratic backsliding, this knowledge is a key tool of resistance.
Strong, independent, and responsible journalism requires clear legal frameworks, but also informed professionals capable of defending their work against political, economic, and legal pressure. This guide seeks to contribute to that goal.