As The European Database Directive Pressures American Lawmakers, Will The Privacy Tail Wag The First Amendment Dog?

To what extent should the government interfere with the private sector in order to protect rights of privacy in the private sector? That question will be discussed in 1998 as the United States addresses pressures from the European Union to increase government regulation of private databases for the sake of privacy. To the extent that the resulting regulatory structure may also hamper or abridge the right of the media to investigate government activity and other matters of public interest and to disseminate news, the European directive may impose substantial strains on well-established First Amendment policies and principles.

In 1995, the European Union issued its Data Protection Directive, which requires EU nations to adopt statutes regulating the processing of personal data within the EU and states, in Article 25, that "personal" information may be transmitted outside of the EU only to those nations that provide an appropriate degree of protection for the privacy rights of the individuals who are the subject of that information.1 Some EU officials have suggested that countries will not be considered in compliance without comprehensive privacy legislation regulating the processing of data by the private sector. Absent such compliance by the United States, the EU may prohibit data transfers between the EU and the United States. The deadline for compliance is October 1998.

According to the Data Directive, "personal data" is defined broadly to include "any information relating to an identified or identifiable natural person."2 An identifiable person is one who "can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity."3 The Data Directive allows personal data to be processed only if the data subject has unambiguously given his or her consent or processing is necessary for compliance with certain duties, obligations, or "legitimate interests" of the processing party.4 The Directive also prohibits any processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, or relating to health or sex life unless the data subject legally consents; national employment law permits such processing; the vital interests of the data subject make it necessary; processing is done by a foundation, association, or other nonprofit entity with a political, philosophical, religious or trade-union aim; or the data is manifestly made public by the data subject or is necessary for the establishment, exercise, or defense of legal claims.5 Finally, in a seemingly grudging concession, Article 9 allows EU member states to provide for exemptions that would permit the processing of personal data "solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression."6

The dangers to the media of such a regime are quite apparent...