Opinions - Everyone’s got one, but does data protection law apply to them?

Something that the Data Protection Commission (DPC) comes across from time to time are disputes over ‘opinions’ about a person that have been recorded or used in some way.

People can have strong views over whether opinions are fair or correct, and they can involve issues such as freedom of expression and confidentiality – so disputes in these cases can become both contentious and complicated. Therefore, in this blog post we’ll aim to cover some of the basic issues which can arise where opinions come into contact with data protection law.

Are Opinions about Someone Personal Data?

Personal data can be any information about or ‘relating to’ someone where that person is identified or ‘identifiable’. The types of opinions which normally come to the attention of the DPC are opinions about a specific person. In many cases, the person is either identified in the opinion or can be identified through context or using further information, so the opinion may in fact contain their personal data. Opinions can also contain personal data about the person whose opinion is recorded, where the opinion is recorded in a way which relates to them, and they are identified or identifiable.

Further, depending on how you define them, opinions could either be entirely subjective (personal preferences or impressions, e.g. “I think the individual looked angry that morning”) or alternatively somebody’s opinion or belief about an objective fact (a sincerely held belief that could be either correct or incorrect, e.g. “I believe the individual is a compulsive liar”). The definition of personal data is wide, and the nature of a particular opinion will determine whether data protection law applies and if or how individuals’ rights might be exercised regarding that opinion.

Data protection law won’t apply in all cases where opinions are involved, as it only applies to personal data which is recorded or processed through ‘automated means’ (i.e. on a computer or electronic device) or a manual filing system. For example, if someone merely voices an unpleasant or untrue opinion about someone else, and it hasn’t been written down or recorded, then – although unwelcome – the comment won’t fall into the realm of data protection law.

Similarly, there are other limits to the reach of data protection law, such as the ‘household/personal exemption’ – which means that it doesn’t cover cases where opinions are made or recorded for someone’s ‘purely personal or household’ activities, with no connection to a professional or commercial activity. So, if you write mean things about your family in your private diary, that’s not going to cause data protection issues, but data protection may be involved if a comment was recorded or published on a medium which falls outside this exemption (such as a public comment on a social media site or commercial publication).

What about Journalism and Freedom of Expression?

Data protection is just one of the many rights and freedoms protected under EU and Irish law, and it must respect and be balanced with other rights and freedoms, such as freedom of expression, including journalistic, academic, artistic and or literary expression. In cases where multiple rights or freedoms collide, there has to be a balance which protects people’s personal data, but also interprets the notion of freedom of expression and journalism broadly.

One example of the interaction of these rights and freedoms is that the Irish Data Protection Act 2018 provides a partial exemption from some of the obligations of data protection law where personal data is used for the purpose of exercising the right to freedom of expression, including for journalistic, academic, artistic or literary purposes, where the exemption is necessary to effectively exercise those freedoms.

In practice this means that data protection law may not assist someone who is upset at an opinion being expressed about them in a newspaper article or other media – as the publisher may be able to rely on a ‘journalistic exemption’ which allows for publication of the personal data in question. The idea behind this is that a free press plays an important role in society and that society would not benefit from restricting the ability of news outlets to publish opinions about identifiable individuals when reporting matters in the public interest.

It is worth noting that there may be other legal avenues, aside from data protection, available to individuals who are aggrieved at an expression of opinion about them appearing in the news. If somebody expresses an opinion about you which is offensive, untrue, or you consider harassment, you may want to seek legal advice about what alternative steps you could take.

Are there Different Rules for Confidential Opinions?

Whilst opinions might generally be subject to data protection law, where they contain personal data, and the various rights and obligations that involves, there are special rules regarding certain ‘confidential’ opinions. The Data Protection Act 2018 sets out some rules limiting the exercise of an person’s data protection rights regarding opinions about them which are given ‘in confidence’ or on the understanding that they will be treated as confidential, to a recipient who has a ‘legitimate interest’ in receiving the information.

This means that people may not be able to exercise their data protection rights, such as access or erasure, against the recipient or holder of an opinion about them where it was made or given to them confidentially. The exercise of data protection rights with regard to opinions will be discussed in more detail below.

How Do Rights such as Access or Erasure Apply to Opinions?

Opinions, where they constitute or contain personal data, may be subject to the exercise of data protection rights, such as access, rectification, or erasure. All rights, including the very broad right to access your information, can be limited in certain cases, such as where the household exemption applies, or other rights such as freedom of expression are involved (as discussed above). For example, the right to erasure or ‘right to be forgotten’, does not apply where the recording or use of that opinion is necessary for exercising the right of freedom of expression.

However, some rights, like rectification or erasure, only apply where certain conditions are met. For rectification, the personal data must actually be ‘incomplete’ or ‘inaccurate’, and for erasure there must be a reason justifying the request for erasure – it is not an automatic right.

Opinions and Rectification

It is often difficult to demonstrate that personal data in the form of an opinion is inaccurate as a matter of fact, such as to give rise to a right of rectification. Where it is the case that you simply do not agree with an opinion about you expressed in a document, it would be difficult for the DPC (as the supervisory authority) to decide which disputed versions of events (e.g. a record of a dispute in work, in which opinions about identifiable individuals are recorded) is correct, in the absence of definitive evidence proving the matter either way.

Where an opinion is recorded clearly as an opinion, such as the recording of a participant’s attitude in someone’s notes of a meeting, then rectification may not be necessary or may simply involve the addition of a clarification, as the notes could still be a correct record of what the note-taker’s opinion was at the time it was made. The appropriate step could be to make a note of any subsequent revision of that opinion or information which disputes or disproves it. The appropriate response to a request will depend on the context of the case, and where an ‘opinion’ is very close to a statement of fact in the way it is recorded, it may indeed be necessary to ‘rectify’ and substitute the correct information.

Opinions and Erasure

If you’re looking for an opinion to be erased under the right to erasure, or ‘right to be forgotten’, you should try to identify at the outset on which ground or justification you are requesting erasure, such as where the personal data are is longer necessary for the purpose they were collected for, the data has been unlawfully processed, or there is a legal obligation to erase the data. The right to erasure will not automatically apply just because the personal data constitutes an opinion about you, even if it is a negative or untrue one.