Stronger privacy laws have closed off once-routine data sources, complicated public-interest reporting, and increased legal risk. Journalists still have pathways forward, by documenting public-interest tests, minimizing data use, and strengthening security, but the burden has shifted heavily onto reporters and editors. Understanding the evolving rules is now an essential skill for investigative teams.
Why this matters
Investigative journalism depends on data that often contains personal information, leaked records, court filings, open databases, and digital traces. Over the past decade, sweeping privacy regimes like Europe’s GDPR, California’s CCPA/CPRA, and Brazil’s LGPD have given individuals more control over their data. While these frameworks advance important protections, they also make it harder for journalists to access and use information in the public interest. The tension lies in ensuring accountability without silencing watchdog reporting.
The new reporting terrain
- Europe (GDPR). The GDPR acknowledges journalism but leaves the details to national governments under Article 85. The result: a fragmented system where a cross-border collaboration may be lawful in one country but risky in another.
-
- Overview: Verfassungsblog explain it on the “journalistic exemption” and national divergences (verfassu ngsblog.de).
- Policy analysis on crime reporting tensions and the need for harmonization (policyreview.info).
- United Kingdom. The “special purposes” exemption protects public-interest reporting, but it is narrow. Journalists must show they acted responsibly, followed security standards, and genuinely weighed privacy against the public’s right to know (ICO guidance; ICO Draft Journalism Code).
- United States. A patchwork of state laws is emerging. California’s rules carve out journalism in some areas (CPPA FAQs), but Colorado’s do not (Colorado Freedom of Information Coalition). Ambiguity here is dangerous, it can chill data-driven reporting before stories are even pitched.
- Brazil. In contrast, the LGPD provides one of the clearest safeguards, exempting data use for journalistic purposes (LGPD Article 4). For investigative reporters across Latin America, this is a rare bright spot.
Where journalists feel the squeeze
- Scraping and open-source research. What was once routine fact-checking now lives in a legal gray zone. In Europe, scraping public pages can collide with database and privacy rights; in the U.S., it’s being tested in court against corporate terms of service. The hiQ v. LinkedIn case shows how fragile protections are (9th Circuit opinion PDF; IAPP analysis).
- Working with data brokers. Reporters have long purchased datasets to uncover hidden patterns. But regulators are now cracking down, especially on sensitive data like location histories. In 2024, the U.S. FTC banned broker X-Mode/Outlogic from selling precise location data (FTC case page).
- Freedom of information requests. Officials increasingly cite privacy law to redact or withhold public records, even when the data concerns public officials. Courts like the European Court of Human Rights have reaffirmed that strong public-interest reporting deserves protection (Axel Springer AG v. Germany – Columbia Global Freedom of Expression summary; HUDOC ruling).
- The right to be forgotten. Demands to erase or de-index content are rising. Articles often remain online, but stripped of names, limiting their visibility, and undermining the permanence of investigative work (Verfassungsblog analysis; Media Defence background).
How reporters can adapt
- Run public-interest tests. Treat them as standard practice: spell out what harm you are exposing, why the data is necessary, and how you’ve minimized intrusion.
- Practice data minimization. Collect only what the story needs. Protect raw files, encrypt them, and restrict access.
- Treat scraping like source handling. Document your process, preserve evidence, and seek legal review before going undercover or bypassing barriers.
- Vet vendors carefully. Demand assurances from any data provider about legality and provenance. Assume that sensitive datasets, like precise location, are high-risk.
- Prepare for pushback. Have responses ready to explain why a story is of the public interest and why removal requests cannot be honored.
- Strategize FOI requests. Ask for structured, anonymized data where possible, but push back firmly when public officials’ privacy is used to shield accountability.
The bottom line
Privacy laws are not going away, nor should they. But their uneven design places a growing weight on investigative reporters. Journalists must now be part legal strategist, part security officer, and part advocate for their own right to report. In this new environment, watchdog journalism survives only if reporters learn to navigate the rules, and if newsrooms make documenting public interest as central to the craft as fact-checking and source protection.