Data Protection Laws and Freedom of Expression: Liechtenstein
Constitutional/Primary Law Background - see also ECHR
Article 40 of the contemporary Liechtenstein Constitution (1921 as revised 2011) prohibits censorship except in respect of public performances and exhibitions and guarantees the right to free expression of opinion and communication or ideas within the limits of law and morality. There is no express constitutional rights to data protection of even privacy as such, but Article 32 does guarantee the immunity of the home and the inviolability of letters and written matter. These are in principle limited to Liechstenstein citizens as thy are included in a chapter on the general rights and obligations of citizens, with article 31(3) providing that the rights of aliens are determined by treaties or, in their absence, on the basis of reciprocity.
The first relevant provisions trace back to the 1862 Constitution stated that the freedom to convey thoughts by means of the press was guaranteed by a special law (s. 8) and provided that searches of domicile were only permitted where unavoidable and when showing a written order from a competent court (s. 12). The original 1921 Constitution included the same provisions as cited in the previous paragraph.
First-Generation Statutory Law
Liechtenstein did not adopt a first-generation data protection legislation.
|
Second Generation Statutory Law
Liechtenstein adopted data Data Protection Act 2002 (and the associated Data Protection Ordinance 2002).
Special Expression Derogation
The Liechtenstein law set out very limited explicit derogations in favour of journalism, particularly the periodically published media. As regards the reactive transparency (subject access), the law set out allowed for a refusal, restriction or deferral of information provisions if the ‘personal data provides information as to its source’, ‘access to drafts of publications would have to be granted’, ‘the public’s freedom to form an opinion would be compromise’ or if the file ‘is being used exclusively as a personal work aid’ by an individual journalist as opposed to a wider group within a media organization (Data Protection Act 2002, art. 13).No specific exemptions at all were set out for other forms of special expression such as literature and art.However, the law did set out an overarching disproportionate effort limitation on the proactive transparency rules which, in contrast to Directive 95/46, was in principle applicable even where information was directly collected from data subjects (Ibid, art. 5(4)).The Data Protection Ordinance set out an exemption from the requirement to notify the DPA of processing where “files are used exclusively for publication in the editorially-controlled section of a periodically-published media organ and their data is not disclosed to third parties without the knowledge of the data subjects” or “such files are being used by journalists exclusively as a personal work aid” (Data Protection Ordinance 2002, art. 4).The Ordinance also explicitly stated that if data was made available to the general public on the territory of the EEA “by way of automated information and communication services with the purpose of informing the public, this shall not be considered to a cross-border data flow” (Ibid, art. 5).
Broad Expression Derogation
No specific provisions were adopted (although see above as regards the gloss on the meaning of cross-border data flow in the Data Protection Ordinance).
Personal Exemption
The law provided for an exemption for data that was processed by a natural person exclusively for personal data but with the explicit requirement that no data was disclosed to a third party (Ibid, art. 2(3)(a)).
Knowledge Facilitation Framework
No exemption was provided from the transparency rules (although as noted above the disproportionate effort limitation was generally extended also to direct collection from the data subject), the sensitive data regime or the requirement to notify processing with the DPA.The private sector was not absolved from having to comply with any of data quality principles. Public authorities, in contrast, were exempted from the compatibility principle and the requirement of an ordinary legal basis for processing where personal data was processed for ‘the purposes of research, planning, and statistics’, provided that (i) such data were anonymized as soon as the objective of data processing allowed it; (ii) the recipient only passed on the data to a third party with the consent of the controller; and (iii) the results of the data processing were published in a form that did not allow the identification of the data subject (Data Protection Act 2002, art. 26(1)).No general exemption was set out from the legitimating ground condition. However, art. 17(2)(e) of the Act provided that ordinary personal data could be processed for ‘non-personal purposes, and in particular in the context of research, planning or statistics, and publishes the results in such a manner that the identity or the data subjects cannot be established’. No exemption from provided from general criteria restricting the transfer of personal data outside the EEA (Ibid, art. 8).However, whilst DPA authorisation was generally required unless the legislation offering adequate protection remained applicable, the Ordinance lifted this requirement ‘for the transmission of files for purposes not relating to the data subjects, in particular for the purposes of research, planning, and statistics, provided that the form in which the results are published do not allow the identification of the data subject’ (Data Protection Ordinance 2002, art. 8(1)).
|
Third-Generation Statutory Law
Liechtenstein adopted Data Protection Act and Data Protection Ordinance.
Special Expression Derogation
Liechtenstein only sets out a journalistic derogation in relation to subject access. This enables ‘media professionals’ to limit or refuse access when the data is ‘used exclusively as a personal working tool’ or as regards the ‘editorial part of a periodical medium’. Also where the data would provide information as to its source, access to drafts of publication would have to be granted to avoid compromising the public’s freedom to form an opinion. This results in a permissive public interest derogation from this one provision. Otherwise, the default GDPR is set out to apply in full. Importantly, only ‘media professionals’ benefit from this statutory special expression derogation (Data Protection Act, art. 25). Highly unusually in a third-generation instrument, the Liechtenstein special expression derogation is less permissive than the Knowledge Facilitation Framework.
Broad Expression Derogation
No specific provisions were adopted.
Personal Exemption – see GDPR, art. 2(2)(c)
Article 28 permits the processing of personal data without consent where required for personal, family or genealogical research and the maintenance and publication of family chronicles and biographies including sensitive data specified in Article 9 GDPR so long as the interests of the controller outweigh those of the data subject are and the controller takes appropriate and specific measures to safeguard these latter interests. Reference is given to an indicative listing of such measures in article 21(2). Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Liechtenstein sets out derogations from the sensitive personal data rules and subject access, and various data subject rights for both scientific or historical research and for statistical purposes (art. 27) and for archival purposes in the public interest (art. 29). Therefore, uniquely amongst those States that have legislated in both areas, Liechtenstein appears to treat special expression such as journalism less favourably than ordinary knowledge facilitation purposes such as scientific research. The sensitive data derogation is subject to the requirement that the interests of controllers outweigh that of the data subject, that the processing is necessary and if (i) the data are publicly accessible, (ii) the data are pseudonmymised and the controller cannot lawfully identify any data subject or (iii) getting consent is impossible or involves disproportionate effort due to a lack of reachability (art. 27(1)-(2); art. 29(1)-(2))). The access and subject control rights derogations generally depends on these rights rendering impossible or at least seriously impairing the purposes and such limits being necessary (art. 27(4); art. 29(6). In the case of subject access it is further stated that exemption can apply if compliance would be a disproportionate effort (art. 27(4); art. 29(4)) Special provisions apply to archiving and the right to rectification which is entirely excluded but subject to the requirement that the data subject has a right to add their version to files if they dispute the accuracy of personal data (art. 29(5). In the research and statistics area, an overarching requirement stipulates that data must be (pseudo)anonymised as soon as the research purposes allow unless this conflicts with the legitimate interests of the subject, that attribution information is stored separately and only combined to the extent required by the purpose and that publication of personal data only take place with consent or if indispensable for the presentation of research findings (art. 27(5)-(6)). This largely mirrors the requirements set down in article 89(1) GDPR itself.
|