EU Media Freedom Act: EDPS calls for better protection for all journalists and a ban on highly advanced military-grade spyware

In its Opinion published today, the EDPS welcomes the objectives pursued in the proposed EU Media Freedom Act to protect media freedom, independence and pluralism across the EU. Media freedom is a precondition for the functioning of media services in the EU’s internal market and, more importantly, a key enabler for the rule of law and democratic accountability in the EU.

Nevertheless, the EDPS is concerned that the measures envisaged to protect journalists, their sources, and media service providers included in the proposed EU Media Freedom Act may not be effective in practice. In this respect, the EDPS’ recommendations are twofold. Firstly, to clarify that any journalist would benefit from the protection offered by the proposed Media Freedom Act. Secondly, to further define and restrict the possibility to waive the protection of journalistic sources and communications, particularly the exceptions related to the prohibition of intercepting communications using spyware or other forms of surveillance of media service providers.

Wojciech Wiewiórowski, EDPS, said: “While I fully support the objective of the Proposal, which aims to guarantee media freedom and pluralism, I am concerned that the proposed measures envisaged to prevent the deployment of highly advanced military-grade spyware, such as “Pegasus”, “Predator” or similar, are not sufficient to effectively protect the EU’s fundamental rights and freedoms, including media freedom. Exceptions to develop or deploy this type of spyware should be extremely limited and defined with great precision, as well as being complemented by robust data protection safeguards, such as those suggested in the EDPS Preliminary remarks on modern spyware.”

The EDPS also recommends that the proposed Media Freedom Act includes measures guaranteeing the independence of EU Member States’ authorities and bodies tasked with reviewing breaches of the protection of journalistic sources and communications. In addition, an explicit legal basis for cooperation between the relevant EU supervisory authorities, including EU data protection authorities, according to their respective competences, should be included in the proposed Regulation.

While understanding and supporting the obligation included in the proposed Regulation to make some media service providers’ personal data publicly available to achieve transparency and for matters of public interest, the EDPS points out the potential interference with the fundamental rights to privacy and data protection that publishing this information may entail. Therefore, the EDPS recommends listing explicitly in the proposed Regulation the public interest purposes for which certain information will be made public, as well as the categories of personal data to be made public in light of these purposes.