
Romania orders investigative journalists to disclose sources under GDPR - treewhistle
https://www.occrp.org/en/40-press-releases/presss-releases/8875-occrp-strongly-objects-to-romania-s-misuse-of-gdpr-to-muzzle-media?fbclid=IwAR3oyyn-S4AchYYnsQlw_jZASnHclQxLPwS66IsgF19W73WjtFXYU-FhuYM
======
elliekelly
This is particularly concerning given that GDPR specifically requires member
states, in enforcing GDPR, allow exceptions for journalism and documents/data
"in the public interest." Considering the funds at the center of these
Facebook posts went missing from EU coffers its clear the information falls
squarely within both exemptions. At least it's a civil case. The fines for
non-compliance with the request will surely add up quickly but I suspect this
will make its way through the court system and reach a just conclusion.

~~~
tzs
> This is particularly concerning given that GDPR specifically requires member
> states, in enforcing GDPR, allow exceptions for journalism and
> documents/data "in the public interest."

That may not apply, because of the clever (evil too, but also clever) way they
are doing this.

If they were asking as data subjects where the data came from (which data
subjects have a right to under Article 15 1(g)), then journalism and public
interest exceptions should apply.

But that's not what they are doing. They aren't coming in as data subjects
asking about the data held on them. They are coming in as an Article 51
supervisory authority in charge monitoring GDPR in their country. They are
claiming to be doing the tasks Article 57 assigns to the supervisory
authority, and exercising the powers Article 58 gives them for that.

Presumably, someone who the journalists wrote about alleged that the
journalists were not complying with GDPR in how they obtained and used the
data.

And so now the supervisory authority is investigating that. Article 58 gives
them power "to obtain, from the controller and the processor, access to all
personal data and to all information necessary for the performance of its
tasks". They can probably argue that in order to decide if a journalism or
public interest exception applies, they have to know where the data came from
and how it was obtained.

Assuming things are as corrupt as people have claimed, I'd expect they will go
in, and if they obtain the information on the sources, they will rule that a
journalism or public interest exception applies, and dismiss whatever sham
GDPR complaint they had someone file to set this off.

~~~
hyperpape
Your post makes it sound as if, no matter how corrupt this is, their demand is
within the letter of the law.

If so, that is a pretty nasty unintended consequence.

~~~
celticninja
Usual thing with these laws, within the letter of the law but not within the
spirit of it.

~~~
wbl
They write laws with ink not ectoplasm.

------
orbitingpluto
Well this was certainly an interesting link form the same page:

[https://www.occrp.org/en/28-ccwatch/cc-watch-
indepth/8813-a-...](https://www.occrp.org/en/28-ccwatch/cc-watch-
indepth/8813-a-scandal-a-murder-and-a-mystery-in-bulgaria)

"But the victim of the brutal rape and murder was Bulgarian television
journalist Viktoria Marinova — and her last broadcast was about the theft of
hundreds of millions of euros from European Union-funded programs in her
country.

Even those who had never heard of the so-called “GP scandal” certainly know
about it now.

In the program, which aired just six days before she was killed, Marinova
interviewed reporters from OCCRP’s Bulgarian partner, Bivol and its Romanian
partner, the RISE Project."

~~~
tin7in
This murder was most certainly not related to that report.

[https://www.independent.co.uk/news/world/europe/viktoria-
mar...](https://www.independent.co.uk/news/world/europe/viktoria-marinova-
murder-rape-bulgaria-man-kill-journalist-stade-severin-
krassimirov-a8592051.html)

~~~
Para2016
The 21 year old guy said he doesn't remember raping, robbing, or murdering her
because he "blacked out" but he says he regrets it?

You believe that? That means he doesn't have to supply a single detail of how
the rape and murder even happened. And the DNA evidence? Trivial to link to
somebody in a corrupt system. If he's going to confess he needs to provide
details, like if she was sodomized, where he hit her, etc. Plus what drugs was
he on? Either he could still test positive or they can hair test him.

------
batrat
They are one of the best journalists in Romania, of course they want to shut
it down. If this goes their way we are doomed not only because they shut down
Rise Project but the entire media.

~~~
petre
The entire non-afilliated and non-partisan media. Or what you'd otherwise call
the _free press_. The rest it's just propaganda machines in the hands of
special interests.

------
georgeburdell
Not sure if I understand. How is a data privacy law being used to get an
organization to reveal its sources? The article mentions something about the
government needing to know how data were stored, but that’s all I could see
that addressed this question.

Edit: Comments filled me in. The regulation seems to relate in part to people
having the right to know who is collecting what data on them.

~~~
elliekelly
The source presumably had the information lawfully and, under GDPR, owed a
duty to the subject of the information to (i) protect it from disclosure, and
(ii) notify the subject of the information in the event of a breach or
unlawful disclosure. However, GDPR does not extend that duty to
protect/disclose when the data in question is being used for journalistic
purposes. I suspect the corrupt government is just as eager to find the source
of their leak as they are to bully these journalists into silence.

This is what the demand letter requests[1]:

\- The purpose and legal basis of publishing on the Internet (Facebook) of
personal data, at the adress [https://www.facebook.com/notes/rise-
project/teleormanleaks/1...](https://www.facebook.com/notes/rise-
project/teleormanleaks/1937024593056150;)

\- The date/period of time when the said personal data was published on your
Facebook account;

\- The source from where the personal data published on Facebook was obtained;

\- The support (electronic and/or physical) where you stored the
documents/images published on Facebook;

\- If the mobile storage devices (tablet, HDD, memory stick) were/are password
protected or encrypted;

\- If you have other information/documents containing personal data of the
said people;

\- If the personal data or documents that contain personal data of the said
people were revealed in other circumstances - with the specification of these
circumstances;

\- The way in which you informed the said people, in conformity with Art.
13-14 of GDPR.

[1] [https://www.occrp.org/en/16-other/other-
articles/8876-englis...](https://www.occrp.org/en/16-other/other-
articles/8876-english-translation-of-the-letter-from-the-romanian-data-
protection-authority-to-rise-project)

edit: formatting

~~~
SilasX
Still having trouble following. They're saying that:

"If you host someone's information for public view on a website, under the
GPDR, you have to say where you got it. Therefore, if someone leaks our (the
government's) information and you're hosting it, you must say who the leaker
was."

Do I have that right?

~~~
elliekelly
Yes and no. GDPR only protects the data of natural persons, not the
government. It's difficult to follow because the natural person in this case
happens to be the leader of the ruling political party and the government's
reason for using GDPR as an enforcement tool tenuous at best.

GDPR does two important things: it gives natural persons rights over the data
collected about them[1] and creates requirements for when/how/why a company
can collect data about natural persons as well as what can be done with it
(called "processing").

GDPR requires companies get affirmative consent from individuals in order to
collect information about them and to inform them about how that information
is processed. Importantly, the definition of processing under GDPR includes
gathering, disclosing, and disseminating information.

From reading the demand letter and not knowing much else about the case it
seemed to me that the government is taking the position that the data
transaction between the source and the journalists was unlawful because the
subject owner of the data (the politician) did not consent and that whoever
provided the information (assuming they were permitted to possess the data)
did not fulfill their obligation to protect it.

If you take the journalism/politician/embezzlement piece out of the equation
the logic makes more sense. If you live in the EU and someone gets a copy of
your tax return and posts it on Facebook the government would do well to
figure out how that person got your tax return and make sure your accountant
(who rightly has a copy of your tax return) is sufficiently protecting your
personal information. Where the logic falls apart is that GDPR is expressly
not intended to apply to information collected for "journalistic purposes," as
is the case in Romania.

[1] [https://advisera.com/eugdpracademy/knowledgebase/8-data-
subj...](https://advisera.com/eugdpracademy/knowledgebase/8-data-subject-
rights-according-to-gdpr/)

~~~
DanBC
> GDPR requires companies get affirmative consent from individuals in order to
> collect information

No it doesn't.

~~~
elliekelly
You're right. That's an oversimplification. GDPR requires a "lawful
justification" to collect the information. The six justifications all speak to
consent or fulfilling legal obligations (government investigation, court
order, contract performance, etc). Consent is a critical component of GDPR,
though, as evidenced by the hundreds of GDPR consent emails that swarmed our
inboxes in May.

~~~
pgeorgi
The consent emails are evidence that people in charge were mindlessly
following some rules given by some consultants.

Not all of them were necessary, and some of them might be harmful to those
sending them down the road: if they had a valid reason before but asked,
question is what happens if the person on which data was collected rescinds
their permission? Answering "you refuse, but we have a legit reason according
to GDPR" is a recipe for bad PR at least.

------
mariusmg
Muie PSD.

Crooked, corrupted political party trying to escape from a massive corruption
scandal using GDPR. Shameful.

~~~
humanfromearth
+1, now go ahead and donate here:
[https://www.riseproject.ro/donatii/](https://www.riseproject.ro/donatii/)

------
nickpp
This is exactly what critics of GDPR feared will happen. Meanwhile, the pro-
GDPR hysteria went on until the inevitable happened.

But hey, at least now every tiny blog will dump a huge pop up every time I
visit telling me how important is my "privacy" to them.

~~~
blub
Oh, which critics were worried about journalists?

I've read most if not all the GDPR topics on HN and all the GDPR critics I've
read were basicslly worried about ad-funded businesses or an abstract concept
of freedom from government control - as in let the market decide.

So it's far fetched to now claim that everyone was worried about journalism.

Furthermore, this is clearly political power abuse. Apparently the same
organisation was raided for a "fraud" investigation. The problem's the corrupt
government, not the privacy law.

~~~
nickpp
That "abstract concept" \- well this is how it gets implemented in the real
world.

A corrupt government and an overreaching regulation (look ma, two oxymorons in
a single phrase!) and this is the price you pay for... for what? What did you
actually gain from gdpr?

~~~
blub
I believe this same government was in the news for essentially making bribes
legal, as long as they were under a specific amount... and yet you think it's
the GDPR of all things that enables their abuse?

The GDPR which mandates exceptions for journalism, by the way.

~~~
nickpp
No, GDPR _also_ enables this abuse. Because GDPR was the criticized one, not
that govt.

Criticized for enabling this, for chilling effects on European startups, for
solidifying the monopoly of huge web behemoths like Facebook and google, and
for generally creating a shitty everyday browsing excperience.

All for the absolutely ZERO benefits GDPR brought so far...

~~~
Thiez
I wouldn't say it has brought zero benefits. Many websites now offer the
possibility of rejecting tracking cookies, many companies have reconsidered
and modified how they are treating user data, and we now have the right to
request all our personal data from companies. Hopefully the situation will
improve further when a few misbehaving companies are fined.

------
raquo
Where are all the people who were saying GDPR is fine to be underspecified
because European governments are benevolent and will choose to be good even
when they don't have to?

~~~
icebraining
I don't see how this is a problem of underspecification.

~~~
mtarnovan
It is a problem with under-specification, because GDPR is supposed to be just
a guiding framework and each government should implement its own compatible
laws.

I also was afraid the Romanian government (and other autocratic governments)
will do a poor job translating the GDPR into national law.

~~~
icebraining
That's not true; the GDPR is not a Directive, but a Regulation, meaning the
actual text applies directly, it's not transposed by the national legislators.

[https://en.wikipedia.org/wiki/Regulation_(European_Union)](https://en.wikipedia.org/wiki/Regulation_\(European_Union\))

~~~
mtarnovan
That's correct, however the GDPR contains some clauses allowing each state to
pass national laws to supplement it, and I expect most states will.

------
throw2016
It's strange to see the Romanian government try to use the GPDR to harass
journalists. Governments have become increasingly shameless about going after
the press so no cover is required.

The UK government [1] has done this to multiple journalists including the
Guardian, BBC [2], Greenwald's partner famously among others under the
'terrorism act'.

The US govt [3] is liberally using subpoenas, court processes and threatening
new laws [4] to force journalists to give up sources.

[1] [https://www.theguardian.com/media/2016/mar/14/government-
ter...](https://www.theguardian.com/media/2016/mar/14/government-terrorism-
journalists-investigatory-powers-bill-snooper-charter)

[2] [https://www.independent.co.uk/news/uk/crime/police-use-
terro...](https://www.independent.co.uk/news/uk/crime/police-use-terror-
powers-to-seize-bbc-newsnight-journalists-laptop-a6712636.html)

[3] [https://pressfreedomtracker.us/blog/increasing-number-
journa...](https://pressfreedomtracker.us/blog/increasing-number-journalists-
have-recently-faced-subpoenas/)

[4] [https://www.independent.co.uk/news/world/americas/us-
politic...](https://www.independent.co.uk/news/world/americas/us-
politics/trump-leaks-jeff-sessions-media-give-up-sources-a7877421.html)

[5] [https://www.nytimes.com/2014/06/03/us/james-risen-faces-
jail...](https://www.nytimes.com/2014/06/03/us/james-risen-faces-jail-time-
for-refusing-to-identify-a-confidential-source.html)

[6]
[https://archives.cjr.org/behind_the_news/press_subpoena_sour...](https://archives.cjr.org/behind_the_news/press_subpoena_source_obama.php)

------
noarchy
Is it really a revelation that governments cannot be trusted any more than
corporations with our data? Their potential for abuse is even worse: you
cannot opt-out of using government like you can a Facebook or a Google.

~~~
ainiriand
At least you can choose the government...

------
ddmma
Fighting EU with their own tools such as GDPR. You should know also that these
guys from romanian government been involved so much with changing laws and
finding ways to avoid it until they become experts. On one hand they give
social benefits and impression that people have sallary growth in order for
government members to stay in power. Then they make their deals and cover
their traces thru laws and other ‘justice system’.

Also be aware also on the multisystem universe called ‘parallel state’.. that
guy Dragnea, dosen’t have any limits!

------
shaki-dora
Because I have frequently seen conspiracy theories regarding George Soros even
on HN, I want to take this opportunity to point out that the organisation
reporting this is sponsored by him, via his Open Society Foundation.

It's also fairly representative of their projects. In the way that, having
been marginally involved with some of the work they do in Eastern Europe, I
went looking for information on their sponsors with the specific expectation
of finding the OSF among them.

~~~
chimen
Your comment adds nothing to this discussion. Soros was NOT mentioned in this
post or thread.

------
resters
For some reason HN turned against WikiLeaks over the past few years, but this
kind of thing is why Wikileaks is a good idea. Governments should not have the
option of forcing journalists to do anything.

~~~
ohashi
For some reason, reason being it turned into a Russian propaganda outlet.

~~~
Tomte
And disseminating anti-semitic propaganda on their Twitter account.

~~~
resters
It's not clear who posted that and it's a small blip in the overall stellar
reputation of WL's journalism.

------
ezoe
Seriously, If you want to be a journalist reporting about own government
corruption. Storing the data inside the local country is the worst option.

Why nobody thought about that?

~~~
pudo
OCCRP tech here. The data exists in at least four different legal regimes.
This is a legal issue, and whatever supporting technical work can be done has
been done.

~~~
forapurpose
> OCCRP tech here.

Thanks for your hard work! It would be great if you could share more in this
discussion.

> The data exists in at least four different legal regimes.

Doesn't redundancy have a negative effect in this scenario? I would think four
legal regimes would very approximately quadruple exposure. If they can't get
you in one regime, they'll get you in another.

------
exabrial
Predictable outcome from an over-reaching law :/ Definitely some good parts to
it, but it went way beyond what it needed to.

And I'm tired of clicking cookie popups. I literally do not care.

~~~
scrollaway
s/law/government/. You do realize that corrupt governments abusing good laws
is daily life in Romania?

I mean, you're in the US, so you should definitely know what that's like.

~~~
kodablah
> I mean, you're in the US, so you should definitely know what that's like.

Whataboutism aside, most definitely, hence the opposition to such "good" laws
in the first place. The perspective of taking the good-with-the-bad status quo
compared to the alternatives is rooted in rational precedence.

~~~
blub
The way it looks, many laws are being torn apart in the US, including
environmental protection, etc.

It's gonna be every man for himself, except that some of those "men" are
corporations which will flatten the rest of you like cockroaches. Unless
you're some CxO or something?

~~~
adventured
> many laws are being torn apart in the US

> It's gonna be every man for himself, except that some of those "men" are
> corporations which will flatten the rest of you like cockroaches.

Absurd hysteria, and then some.

The US economy is more regulated today than it was in the 1980s and 1990s,
when it comes to both the environment and corporations in general. Even the
banks are all under the direct control and supervision of the Federal Reserve
now.

Somehow it must have been a miracle people survived the 1980s and 1990s. It
was back in those mad max days, when anarchy ruled the day, and corporations
just massacred people at will.

Back in reality, very little has changed in the last two years, other than the
hysteria has increased dramatically. Even the vaunted regulatory cuts have
been miniscule in scale, less than 0.1% of Federal regulations have been cut;
mostly all that has occured is a slow down in regulatory accumulation. Trump
has been flat-out lying about regulatory reductions.

Environmental regulations - and a narrow subset at that, almost entirely
focused on energy - have been rolled back about four years so far, to Obama's
second term.

I'm skeptical a President + party controlled House and Senate have ever done
less than what Trump & Co. have done in the last two years. The sole major
change under this administration has been the corporate tax cut.

------
mattio
If a government is doing this, it doesn't belong in the EU at all.

edit: the 'subjects' of the government however do need them in the EU, so
hopefully the EU can protect those citizens against their own government?

~~~
vixen99
Turkey?

------
anticensor
I can assure this will not happen in Bulgaria and in Turkey (which is not an
EU member but has a similar data protection law), because disclosed sources
might reveal possible sources and uncover state corruption, to the point of
invalidating a whole election.

~~~
buboard
turkey is not in the EU

~~~
anticensor
Turkey is not in the EU, but it has a similar enough data protection law
(KVKK), and unlike GDPR, this also covers the government operators (they
cannot make 'we have different interests' excuse here); and unlike former EU
DPD, we have strict data protection officer requirements (actually even
stricter than GDPR by having a central track record of DPOs).

~~~
buboard
sure but the kicker here is that romania's government is using the EU as an
appeal to "higher power" to justify its actions, while Erdogan can't do that.

------
temporallobe
Hey Europe, that’s bot how journalism works. Without the basic protections of
journalists, you don’t have journalism, you have state-controlled propganda.

~~~
hanspeter
Please don't equate Romania with the rest of Europe. If this story holds truth
there will soon be talk in the remaining Europe to show Romania the door out
of EU.

You should also know that many countries in Europe has less corruption than
USA.
[https://en.m.wikipedia.org/wiki/Corruption_Perceptions_Index](https://en.m.wikipedia.org/wiki/Corruption_Perceptions_Index)

~~~
mtarnovan
> If this story holds truth there will soon be talk in the remaining Europe to
> show Romania the door out of EU

Are you serious? That's the last thing the EU wants. Strictly speaking it's
not even possible (legally) to force a state to leave the EU.

~~~
hanspeter
I did not say EU. I said Europe. The behaviour from Romainian politicians is
grossly unacceptable and inconceivable in most European nations. National
politicians throughout Europe will talk about a EU without "bad apples" as
they have in many other cases.

~~~
mtarnovan
> to show Romania the door out of EU

> I did not say EU

Really?

Also, you want to punish a whole country for some corrupt politicians?

------
logfromblammo
Did someone forget to stake Ceaushescu's body and pin it down with a big rock?

Is all the old repression and corruption coming back, now that the latest
leaders are too young to remember what had to be done to reduce it, just a
little bit?

~~~
petre
It isn't coming back, it was there all along, and they're not leaders, they
are members of one or several organised crime syndicates disguised as
political parties.

------
i_phish_cats
I work in email security and the WHOIS information we relied on to find out
domains bulk-registered by spammers/phishers has essentially gone dark because
of GDPR.

------
justinclift
The url should probably have the embedded tracking link removed.
"?fbclid=IwAR3oyyn-S4AchYYnsQlw_jZASnHclQxLPwS66IsgF19W73WjtFXYU-FhuYM"

------
anonytrary
Wouldn't this just incentivize people to stop sharing information?

------
kasey_junk
Well that didn’t take long.

------
ElBarto
They are trying it on.

The journalists should not cave.

~~~
RealityVoid
Rise officially said they will not cave. Rise Project has exceptional
investigative journalism and are very serious about their job.

~~~
ElBarto
Good to hear.

------
graphememes
It's almost like there were a lot of people warning about legal ramifications
of GDPR and nobody listened.

Same thing with the meme law

------
ilikechairs
you can't pass regulations requiring governments to protect personal data then
get mad when a government goes to protect personal data. Who that data is
about, whether a high-profile politician or an average joe, doesn't matter.

Either everyone is protected from third parties gathering data on them, or
nobody is. Can't have it both ways.

~~~
JumpCrisscross
> _Can 't have it both ways_

Yes one can. One can simply exempt the law's application to certain people,
_e.g._ the fourth estate. GDPR does that. The problem, here, is the government
is judge, jury and executioner.

~~~
abtinf
Who decides which organizations are part of the fourth estate? Is the NYT part
of it? Bloggers? CNN? Breitbart? The Daily Stormer?

~~~
JumpCrisscross
> _Who decides which organizations are part of the fourth estate?_

In the United States, given our Constitution enumerates certain freedoms for
the press, there is a rich corpus of case law drawing this delineation. I am
not sure if such a corpus exists in the EU, and am fairly certain it does not
exist in every one of the EU's twenty-eight member states.

~~~
wbl
What delineation? It doesn't exist. Anyone can say "fuck the President". There
is no extra special secret first amendment for journalists.

~~~
JumpCrisscross
> _What delineation? It doesn 't exist._

The First Amendment says "Congress shall make no law...abridging the freedom
of speech, or of the press..." [1]. The comma is the delineation. In case law,
the exploration of this delineation has produced definitions with precedent
[2].

More practically, the linked-to article explores "whether the 'institutional
press' is entitled to greater freedom from governmental regulations or
restrictions than are non-press individuals, groups, or associations,"
concluding "the speech and press clauses may be analyzed under an umbrella
'expression' standard, with little, if any, hazard of missing significant
doctrinal differences." (TL; DR There is a line, but it does not appear to
matter much.)

[1]
[https://law.justia.com/constitution/us/amendment-01/06-diffe...](https://law.justia.com/constitution/us/amendment-01/06-difference-
between-speech-and-press.html)

[2]
[https://en.wikipedia.org/wiki/Freedom_of_the_press_in_the_Un...](https://en.wikipedia.org/wiki/Freedom_of_the_press_in_the_United_States)

