Mediahuis Ireland Group Limited

Summary of Inquiry The DPC has completed a complaint based inquiry into MIG’s processing of personal data in relation to a series of news reports in the print and online editions of the Irish Independent, Herald and Sunday Independent newspapers. The purpose of the inquiry was to examine if any obligations on the controller arising under Articles 5(1)(a), 5(1)(c), 5(2), 6 and 9 GDPR had been engaged and, if engaged, whether MIG infringed those obligations in publishing the personal data relating to the Complainant as contained in the relevant newspaper articles. As a preliminary issue, the DPC examined the jurisdiction of the DPC to conduct an inquiry into a media outlet in light of the exemption set out in section 43 of the Data Protection Act 2018 (‘the 2018 Act’). That section implements the requirements of Article 85 GDPR, to provide that ‘Member States shall by law reconcile the right to the protection of personal data pursuant to [GDPR] with the right to freedom of expression and information.’ The section exempts certain processing of personal information for journalistic purposes from compliance with certain provisions of the GDPR where compliance with the provision would be incompatible with the purpose of exercising the right to freedom of expression and information. The GDPR provisions to be considered include those related to the rights of data subjects, the obligations of controllers and the powers and functions of supervisory authorities.