Joris DeeneA newspaper may not simply publish the personal data of an unknown third party as supporting evidence in an article. The journalistic exception under Article 24 of the Act of July 30, 2018, waives the data subject’s rights, but not the legal basis requirement of Article 6 of the General Data Protection Regulation (GDPR), as ruled by the Dispute Resolution Chamber of the Data Protection Authority on August 10, 2026. In that decision She reprimanded a news outlet that, in an article about forced adoptions, had published a photo of a birth certificate on which the names of an adopted woman, her biological mother, and her adoptive parents were legible.
In short:
- On August 10, 2026, in Decision on the Merits No. 223/2026, the Dispute Resolution Chamber reprimanded the publisher for publishing the photo of the birth certificate without legal basis and without transparency.
- The key issue is the necessity test under Article 6.1(f) of the GDPR: according to the Disputes Chamber, the mother’s testimony could have been substantiated even without legible names, meaning that a less intrusive measure was available.
- A publisher who presents a document as evidence must first redact the names of third parties who have nothing to do with the debate; because the newspaper removed the photo immediately after the initial contact, the penalty in this case was limited to a reprimand without a fine.
The facts
On December 14, 2023, a Belgian newspaper with a daily readership of approximately two million published the testimony of a mother who had given birth under general anesthesia and had been sterilized during labor without her consent. Her child was subsequently adopted. The testimony was part of a journalistic investigation into the trafficking of children by church institutions and led to a spontaneous testimony in the Chamber of Representatives that same week.
Two days later, on December 16, 2023, a follow-up article was published in which experts explained whether the facts described in the testimony could constitute a criminal offense. Along with that online article, the newspaper published a photo of a copy of the adopted child’s birth certificate, next to a photo of one of the experts. The certificate served as evidence supporting the mother’s story. The photo showed the name of the child—now an adult woman—the name of her biological mother, and the names of her adoptive parents. The text was small and handwritten, but anyone who zoomed in could read it.
The woman had not requested the publication and had not been informed of it. According to her, only her immediate family members knew about the adoption; her circle of friends did not. After initial contact between her attorney and the newspaper, the photo was removed from the online article. On April 4, 2024, she nevertheless filed a complaint with the Data Protection Authority (GBA). The publisher defended itself by invoking the journalistic exception, citing legitimate interest as the legal basis, and arguing that the complainant should first have enlarged, printed, and rephotographed the photo to make the names legible.
The ruling
The Dispute Resolution Chamber considered four questions: whether the complaint still had merit, whether the journalistic exception precluded review, whether the publication had a legal basis, and whether the birth certificate contained a special category of personal data.
The Subject Matter of the Complaint and the Complainant’s Identifiability
The publisher requested that the case be dismissed because the photo had already been removed and because, in his view, the complaint had actually been filed against the Catholic Church. The Dispute Resolution Board rejected both arguments. The subject of the complaint is the lawfulness of the processing at the time of the events, not the right to erasure; the fact that the photo subsequently disappeared does not undo the publication. The Dispute Resolution Board referred in this regard to the Market Court, which ruled in the Mediahuis case that no one can derive a subjective right to a dismissal of charges from the policy on dismissals or from an alleged established decision-making practice (Brussels Court of Appeal (Marktenhof), September 3, 2025, 2025/AR/253). The fact that the complainant holds a position within the church was also irrelevant: her name appeared on the document, so she is a party to the case and has a stake in it.
The argument regarding the magnification also did not hold up. Paragraph 26 of the GDPR states that a person is identifiable when all means that can reasonably be expected to be used are taken into account. Zooming in on an online photo is one such means. The Dispute Chamber noted in this regard that making names legible does not constitute biometric processing, and that the publisher’s example of facial recognition in group photos therefore did not apply.
The journalistic exception and the legal basis under Article 6 of the GDPR
Article 85 of the GDPR requires Member States to right to data protection to bring into line with the freedom of speech, and allows them to deviate from, among other things, the principles and the rights of the data subject for journalistic purposes. Belgium did so in Article 24 of the Act of July 30, 2018 on the protection of natural persons with regard to the processing of personal data (WVP). According to that provision, processing for journalistic purposes is the collection, compilation, dissemination, or archiving of data to inform the public, using any medium, whereby the data controller undertakes to comply with journalistic ethics. Paragraph 2 of Article 24 of the WVP excludes a series of articles of the GDPR from applying to such processing, including the information obligations under Articles 13 and 14, the right of access, and the right to object.
According to the Disputes Chamber, there was no question that the publication was journalistic in nature. However, Article 6 of the GDPR is not included in the list set forth in Article 24, § 2 of the WVP. The requirement for a legal basis therefore remains fully applicable, and the Dispute Chamber retains the authority to assess it, albeit with restraint. Because the complaint did not concern a request for erasure, the Dispute Chamber found that the journalistic exception was not relevant to the issue at hand.
The Assessment of Legitimate Interest
The legitimate interest referred to in Article 6.1(f) of the GDPR is the legal basis that permits processing when it is necessary for a legitimate interest of the controller, unless the interests or fundamental rights of the data subject take precedence. The publisher relied exclusively on that basis. The Court of Justice requires three cumulative conditions for this, as it stated in its judgment Rīgas satiksme (ECJ, May 4, 2017, C-13/16): a legitimate interest, the necessity of the processing for that interest, and a balancing of interests that favors the data controller.
The first condition was met. The press’s role as a public watchdog and in informing the public about a matter of public interest constitutes a legitimate interest. The Dispute Chamber did clarify, however, that the biological mother was not the data controller: she was interviewed and photographed with the certificate, but the decision to publish the photo was a journalistic choice made solely by the publisher. Therefore, the publisher’s own interest is what counts, not that of the mother.
Things went wrong with the necessity test. The Court of Justice interprets that test in conjunction with the principle of data minimization, as it did in the judgment Meta Platforms v. Bundeskartellamt (ECJ, July 4, 2023, C-252/21): The data controller must determine whether the same purpose cannot be achieved just as effectively by less intrusive means. The Dispute Resolution Chamber found that, while the publisher had reproduced the handwritten text in an extremely small font, it had not rendered it illegible. The fact that, according to its own defense, the newspaper did not intend to identify the complainant, and that the complainant is not a public figure, proved, in the Dispute Chamber’s view, precisely that the legible names were not necessary for the journalistic purpose. Furthermore, the photo was published only two days after the testimony, by which time it had already led to action plans.
The assessment also went against the publisher. The publisher had equated the complainant’s interests with those of the Catholic Church and had failed to acknowledge her personal and social interests. The Dispute Resolution Board pointed out that an adoption known only to immediate family is a private matter, and that the publication drew the complainant into a public debate as a victim—a debate in which she did not wish to participate— and that, having no connection to the newspaper, she could not reasonably have expected her adoption certificate to appear online. That the publication as a whole contributed to the public debate on church adoptions, as the European Court of Human Rights defines that concept in its judgment Satakunnan Markkinapörssi and Satamedia v. Finland (ECHR (Grand Chamber) June 27, 2017, 931/13), was not sufficient to justify the photograph itself.
Fairness and Transparency, and Special Categories of Data
The publisher argued that he was not required to inform the complainant because Article 24 of the WVP supersedes Article 14 of the GDPR. The Dispute Resolution Chamber responded that Articles 5.1(a) and 12.1 of the GDPR, which embody the principles of fairness and transparency, are not included in that list. The lack of prior information was taken into account in the balancing of interests and, according to the Dispute Resolution Chamber, also constituted a separate violation of Article 5.1(a) of the GDPR.
The publisher was correct on one point. Names on a birth certificate do not, in and of themselves, allow one to determine a person’s ethnic origin; therefore, the photo did not contain a special category of personal data within the meaning of Article 9 of the GDPR.
The sanction
Pursuant to Article 100, § 1, 5° of the Act of 3 December 2017 establishing the Data Protection Authority The Disputes Chamber opted for a reprimand, the lightest sanction after a warning. It took into account the removal of the photo after the initial contact, the delicate balance between data protection and freedom of the press, and the difference between a journalist who, in good faith, believed the text was illegible and a publisher who literally prints names in an article. A fine, which the complainant had requested, was not imposed. The decision may be appealed to the Marktenhof within thirty days; it is not currently known whether an appeal has been filed.
Legal analysis and interpretation
Why the journalistic exception does not provide a legal basis
The newspaper argued that a journalistic publication falls outside the scope of the GBA as soon as Article 24 of the WVP applies. That argument does not hold up, and this is due to the text of the law itself. Article 24, § 2 of the WVP lists which provisions of the GDPR do not apply to journalistic processing, and Article 6 is not included in that list. SCHRAM writes in the same vein that the press has two legal bases available for its processing: consent and legitimate interest, and that the freedom of expression under Article 10 of the European Convention on Human Rights (ECHR) is the interest that the journalist invokes in that second basis (F. SCHRAM, Privacy & Personal Data: Handbook, Brussels, Politeia, 2023, 904). The journalistic exception therefore does not alter the question of whether there must be a legal basis, but it does affect the substance of the assessment made under Article 6.1.f) of the GDPR.
The Court of Justice recently confirmed that the journalistic exception is not a free pass. In its ruling Legal Newsdesk Sweden (ECJ, July 9, 2026, C-199/24) ruled that a Member State may not deprive the individual concerned of his or her legal remedies by classifying an activity as falling under the freedom of expression; we discussed that judgment earlier in Does the journalistic exception to the GDPR apply to the online publication of criminal convictions? Decision 223/2026 is consistent with this approach: while the journalistic nature of the publication is undisputed, the legal basis is still being reviewed.
The dissenting opinion: Is the GBA once again circumventing the duty to disclose information through Article 5?
On one point, the publisher had a stronger argument than the decision suggests. Article 24, § 2 of the WVP expressly excludes Articles 13 and 14 of the GDPR. The explanatory memorandum to the Act of July 30, 2018 explains why: any mechanism that would allow for prior review of journalistic content had to be eliminated, because Article 25 of the Constitution prohibits censorship and a journalist can only be held accountable after the fact. Notifying a data subject in advance that her birth certificate will be published is precisely such a mechanism: anyone who knows about it can go to the judge in summary proceedings. Nevertheless, the Disputes Chamber finds a separate violation of Article 5.1.a) of the GDPR because the complainant was not informed in advance. Thus, the general principle of transparency threatens to introduce what the legislature deliberately excluded through Articles 13 and 14.
That criticism carries significant weight with respect to the individual violation, but less so with respect to the balancing of interests. Recital 47 of the GDPR requires that the data subject’s reasonable expectations be taken into account in the balancing test under Article 6(1)(f), and the legislature has not excluded that consideration. The fact that an unknown third party could not have expected her deed to appear online is therefore a valid factor in the balancing test, regardless of whether the newspaper should have notified her. The Dispute Resolution Chamber could have distinguished more clearly between the two lines of reasoning: the lack of prior information as a factor in the balancing test is defensible; treating the same circumstance as an independent violation of the principle of transparency is difficult to reconcile with the legislature’s choice. The Dispute Chamber itself refers to its earlier Decision No. 45/2024, in which it raised questions about the compatibility of Article 24, § 2 of the WVP with Article 85 of the AVG. However, that doubt concerns the scope of the exception, and as long as the legislature does not amend the provision, it remains in effect as written.
Who decides what constitutes essential journalism?
The Dispute Resolution Chamber states twice that it must exercise restraint when assessing the necessity of journalistic processing, and refers in this regard to the role of the Press Council, of which the code Article 23 provides that journalists must not infringe upon privacy any further than is required by the public interest in the reporting. The court then assessed for itself whether the evidence was necessary and concluded that an anonymized document would have sufficed. The Court of Justice had instructed the national court in its judgment Satamedia (ECJ, December 16, 2008, C-73/07) has already mandated that, in the context of journalistic reporting, a balance be struck between these two fundamental rights, and the European Court of Human Rights provided a list of criteria for this purpose in its judgment in Satakunnan Markkinapörssi and Satamedia v. Finland: the contribution to a debate of public interest, the public profile of the person concerned, the subject matter, the content and form of the publication, and the manner in which the information was obtained.
The decision applies those criteria, but the result remains that an administrative regulator is deciding on an editorial choice. The publisher had argued that the mother had already testified once in 2014 without supporting evidence and that no one believed her at the time. That argument concerns the credibility of the testimony, and the Dispute Resolution Chamber does not address its substance; it merely states that the testimony had already led to action plans. A judge hearing the case under the freedom of the press If a court were to assess this in light of Article 10 of the ECHR, it would likely give more consideration to the question of whether a newspaper is permitted to publish a document to support a disputed story. The Dispute Resolution Chamber’s response is nonetheless defensible, for one simple reason: it was not the publication of the document itself that was condemned, but the publication of the legible names of third parties. A document with redacted names proves the birth, the adoption, and the date just as well. The decision of whether or not to publish a document remains with the editorial staff; the decision to reveal the identity of an unknown third party does not.
A workaround for Article 9 that the law does not require
The Dispute Chamber conducted a thorough examination of whether names on a birth certificate reveal ethnic origin and concluded that they do not. That analysis was legally unnecessary. Article 24, § 2 of the WVP excludes Article 9 of the GDPR for journalistic processing, meaning that even a birth certificate that might contain a special category of data is not subject to the processing prohibition for the press. The outcome remains unchanged, but this detour illustrates how the decision treats the journalistic exception: as a regime that affects only the right to erasure, even though it also concerns the principles and special categories of data. For a publisher defending itself in a future case, this is a useful insight: the exception extends further than the decision suggests, but leaves Article 6 untouched.
Specifically, what does this mean?
For publishers, editorial staff, and journalists. The journalistic exception protects the investigation, the sources, and the publication itself, but not the decision to reveal the identity of an unknown third party who adds nothing to the story. Anyone wishing to present a document as evidence must redact the names, addresses, and numbers of third parties in advance and document in the editorial file why a particular piece of information had to remain legible. A small image is not sufficient: an online photo can always be enlarged, and the defense that identification was never the intention backfired against the newspaper in this case. The witness who provides the document does not bear the responsibility; that lies with the publisher. The GBA’s policy on dismissing cases offers no certainty: removing a photo after a complaint limits the penalty but does not remedy the violation.
For anyone who finds their information in a newspaper article. You do not have to be a public figure to have a legitimate interest in filing a complaint, and you do not need to have the publication removed first in order to file a complaint with the GBA. The complaint concerns the publication as it was, not what is still online today. However, you do not file a claim for damages with the GBA; the civil court has jurisdiction over that, as we explained in Can the data protection authority dismiss a complaint because legal proceedings are already underway? Please note that the court broadly protects freedom of the press when the publication itself contributes to a debate of public interest, as the Antwerp Court of Appeals ruled in the case we discussed in May a journalist share your personal data for a news article? The decisive factor is whether your identity was necessary for that debate. If you are unsure whether a publication about you exceeds the bounds of legitimate interest, that necessity test is the first thing we will examine for you—if necessary, together with a lawyer specializing in GDPR who coordinates the complaint filed with the GBA and the claim brought before the court.
For those who provide testimony supported by documents. Anyone who provides a journalist with a document, letter, or medical record remains the data subject and does not become the data controller. The decision places the responsibility for what happens to the document with the editorial staff. This does not prevent you from requesting that the names of third parties be redacted, especially when the document also identifies family members who did not request publication.
Frequently asked questions (FAQ)
Can a newspaper publish my personal information without my consent?
Yes, in many cases. The press does not need to ask for your consent and may invoke the legitimate interest under Article 6.1(f) of the GDPR, which encompasses freedom of expression and the role of public watchdog. However, the publication must be necessary for journalistic purposes and must pass the balancing test against your interests. According to the Dispute Resolution Chamber, a name that adds nothing to a story about someone else does not meet that standard.
Does the GDPR actually apply to journalists in Belgium?
Yes, but with exceptions. Article 24 of the Act of July 30, 2018, exempts journalistic data processing from a number of provisions, including the obligations to provide information, the right of access, the right to rectification, the right to object, and the prohibition on the processing of special categories of data. The requirement for a legal basis, the principle of data minimization, and supervision by the GBA remain in effect.
Can I still file a complaint if the newspaper has already removed the publication?
Yes. The Dispute Resolution Chamber ruled that the subject matter of the complaint is the lawfulness of the publication at the time of the events. The fact that the photo was subsequently taken offline does not negate the infringement, although it may be taken into account when determining the sanction. In this case, the prompt removal was one of the factors that led to a reprimand rather than a fine.
Does a journalist have to notify me in advance that my personal information will be published?
No, the law does not impose that obligation: Article 24 of the WVP excludes the information obligations under Articles 13 and 14 of the GDPR for journalistic processing. In its balancing of interests, the Dispute Resolution Chamber does take into account that an uninformed third party could not reasonably have expected the publication. Whether the lack of notice also constitutes an independent violation of the principle of transparency, as the Dispute Resolution Chamber held in this case, is open to debate.
Conclusion
In Belgium, a news outlet that publishes a document as evidence must redact the names of third parties who do not contribute to the story. The journalistic exception under Article 24 of the WVP overrides the rights of the data subject, but the requirement for a legal basis and the necessity test under Article 6.1.f) of the GDPR remain fully applicable. That is the essence of Decision 223/2026 of the Dispute Chamber, which reprimanded the publisher without imposing a fine, and which leaves the issue of prior notification open to debate.
ICT Rechtswijzer is the knowledge platform of the Intellectual Property, IT Law, AI Law, Data Protection, and Media Law department at Everest Advocaten, led by Joris Deene, Esq. Our attorneys assist publishers and editorial teams in ensuring that publications comply with the GDPR and journalistic ethics, and represent individuals who find their personal data in a news article—from filing a complaint with the Dutch Data Protection Authority (GBA) to pursuing a claim in court.
Dutch
English