The UJF has been assessing the impact on journalism of the EU’s new General data Protection Regulation, which takes effect this week. The regulation covers data protection and privacy for all individuals in the EU and EEA. The regulation has more implications concerning the way business operations are run, not journalistic practices. It doesn’t give anyone the right to interfere in journalists’ work. Its aim is to give people more control over their personal data and streamline regulations for international business across the EU. The regulation particularly focuses on business dealings that handle personal data to ensure that it is not processed or made available publicly without consent. According to the EU, “The changes will give people more control over their personal data and make it easier to access it. They are designed to make sure that people's personal information is protected – no matter where it is sent, processed or stored – even outside the EU, as may often be the case on the internet.” What are the implications for journalists and the press? A number of editorial offices have been approached by people who have appeared in press items and who want previously published material altered or deleted. But the UJF points out that the new regulation does not grant the public new rights that would impact the press. “The data protection regulation doesn’t give anyone the right to interfere in journalists’ work. No one can, for instance, get their name removed from a story by citing the regulation,” says UJF lawyer Hannu Hallamaa. There are broad exceptions concerning the press, for instance on the individual’s right to be forgotten. The EU states that “freedom of expression, as well as historical and scientific research are safeguarded. For example, no politician will be able to have their earlier remarks deleted from the web. This will thus allow, inter alia, news websites to continue operating on the basis of the same principles.” “People will still not be entitled to get information from newsrooms about whether newsroons have information about them or about why such information has been collected,” says Hallamaa. “And they can’t demand that newsrooms stop dealing with information about them and removing it from the system.” The regulation has more implications concerning the way business operations are run, not journalistic practices. Publishers have to be aware of new rules concerning the processing of data concerning clients and customers. For journalists in employment, the employer is responsible for observing the guidelines concerning data protection regulation. Freelancers, on the other hand, being entrepreneurs need to bone up on the regulation and ensure that aspects of their networking and marketing comply with data protection stipulations. These may apply to freelancers when they collect information online concerning partners and collaborators - business information is not considered as personal data, but employee data is. It also applies to freelancers sending out newsletters and marketing messages to their clients and customers, and when they collect their website visitor information. When personal data is being processed for journalistic purposes, journalists are largely exempt from the regulation’s stipulations. They do not have to minimise information, or correct information that they my have about someone, and there is no limit the information stored or archived. There is also no limit on the normal legitimate processing of information, even that of a sensitive nature. This means that people who may be the subject of investigative journalism are not entitled to be informed about the work underway, cannot prevent the handling of personal information, and cannot demand such information once a story is published. Rather, the regulation concerns all processing of personal data relating to business operations and for commercial purposes, including registers of clients. In such cases, freelancers need to notify clients of the existence of such information.