Media Privilege on a Corporate Blog: The Boundary Between Journalism and Advertising

A corporate blog does not fall under the media privilege merely because it publishes regular articles. Section 9 of the Austrian Data Protection Act requires an assessment of the specific processing, the role of the business and the journalistic purpose of the particular publication. A report containing personal data must therefore be assessed separately from newsletter distribution, campaign management and other commercial advertising.

This article is aimed at businesses that publish case reports, interviews, specialist articles or company news about identifiable people. It explains how the media role under Section 9(1) DSG differs from other journalistic processing under Section 9(1a) DSG and which processing connected with advertising or mixed content may fall outside these special rules.

Section 9 DSG appears in the part of the Act dealing with freedom of expression and freedom of information. It therefore sets special rules for particular processing. It is not a general exemption for every data field that appears on a website, blog or social media channel. The specific processing operation remains the starting point.

The business must first identify which data is processed and why. Research about a person, editorial work on an interview, publication of an article, an invitation to a newsletter and click analysis can occur in sequence. They do not therefore have the same purpose. A single content or marketing file cannot replace this distinction.

The privacy governance framework should include a short purpose and role assessment for these cases. This makes it possible to show which data belongs to the editorial article and which processing starts only through promotion or reach measurement.

Section 9(1) DSG covers processing by media owners, publishers, media employees and employees of a media business or media service within the meaning of the Austrian Media Act. It also names other persons who contribute journalistically under a contract to the content of a medium or the communications of a media service. The processing must serve the journalistic purposes of that media business or media service.

For a business with a blog, the roles should therefore be described specifically. Who selects the topics? Who conducts interviews? Who edits names, photographs or other details? Who publishes the article? Is there editorial responsibility or is the page only a sales page with promotional language? These facts belong in the classification.

The label “corporate blog” does not answer the media question. Regular publication of individual specialist texts is not sufficient either. The more a publication is directed at information, context or opinion, the more carefully the business should document editorial selection and editing. The commercial background of the business remains a relevant fact in the overall assessment.

Section 9(1a) DSG covers journalistic processing that does not fall under paragraph 1. It adopts specific measures from paragraph 1, including protection of editorial confidentiality, special treatment of information duties and the non-application of Article 56 GDPR and Chapter VII GDPR. The distinction between paragraph 1 and paragraph 1a should therefore be recorded.

Under certain conditions the provision permits processing that reveals political opinions or religious or philosophical beliefs for the exercise of freedom of expression and information. The processing must be necessary and proportionate for protecting legitimate interests. The final sentence of Article 10 GDPR remains unaffected.

The data protection questions do not disappear under paragraph 1a. Rights concerning unpublished data may be restricted in an individual case to protect freedom of expression and information. Published data is subject to particular rules. The business should record whether an item has already been published and which specific balancing exercise supports a restriction.

A blog article can inform readers while also referring to the company’s services. This combination does not make the whole operation journalistic automatically. The decisive question is which part of the processing needs the personal data. An interview may be published editorially. Adding the interviewed person to an advertising campaign serves a separate purpose.

The distinction is particularly clear for newsletter addresses, audience segments, retargeting identifiers and advertising platforms. These data serve contact or advertising delivery. They should not be covered merely by classifying the related article as editorial or by using a general reference to freedom of the press or information.

The same applies to mixed landing pages. An editorial story, a contact form, an analytics tool and a personalised advertising signal can appear at the same URL. The business needs a technical and legal allocation of each processing step. The overview of marketing, cookies and tracking develops the assessment of advertising purposes, choices and evidence.

Every item of personal data in an editorial publication should have a traceable connection to information or the formation of opinion. A name, professional role, photograph, quotation, location and case description can create different risks. Before publication the editorial team should identify which details are actually needed and whether a less intrusive presentation is sufficient.

The business should distinguish facts from editorial assessment. This helps when approving interviews, incident reports or articles about disputes. Information from an internal customer database cannot be published merely because it is available for a campaign or success story. Publication requires a separate review of the purpose and the actual presentation.

The review should be documented particularly carefully for special categories of personal data and data about criminal convictions. Section 9(1) DSG expressly mentions these categories in the context of journalistic purposes. This is not a blanket permission for every publication. Necessity, purpose and the other statutory limits remain decisive.

Section 9(1) DSG contains several specific measures. Articles 13 and 14 GDPR and Article 21(1) GDPR are not applicable in the situations covered by the provision. The right of access has special requirements for certain publications. Articles 16 to 18 GDPR are not applicable in the statutory situations. A statement that “the GDPR does not apply to a blog” would therefore be wrong.

For published personal data, the publication itself can be central. Data that have not yet been published are subject to different limits. When handling access, rectification, erasure or restriction requests, the business must review the particular request, the affected publication and the impact on freedom of expression and information.

The special rule also does not automatically cover every processing operation connected with the article. Newsletter distribution, suppression lists, analytics tags and audience selection for advertising remain separate operations. The review of new processing operations shows how purpose, risk and evidence can be kept distinct.

Each article containing personal data should have a short editorial file. It can record the article, publication date, data categories, source, editorial purpose, responsible function and approval. For interviews or case reports the file can also contain consents, source checks, correction requests and the decision on how the person is presented where relevant to the operation.

The media role should be described separately. Record whether and why Section 9(1) DSG may apply or whether the processing falls under paragraph 1a. If the classification is open, the file should state the facts and the points that still require clarification. A standard formula for every corporate article is not sufficient evidence.

Advertising and analytics need their own records. Capture newsletters, CRM segmentation, pixels, advertising platforms, recipients, data sources, retention or suppression rules and the consent or objection process. This separation shows which processing is justified by an editorial purpose and which serves a commercial purpose.

“The word blog is enough”: A blog is a technical or editorial format. It does not replace the review of the media role, journalistic contribution and purpose.

“Every company article is journalism”: Specialist information can contain journalistic elements. A pure service description or sales request is not automatically editorial processing.

“A privilege covers the entire URL”: Publication, contact, analytics and advertising can appear on one page. Each operation needs its own classification.

“Section 9 removes all rights”: The provision contains specific measures and proportionality limits. It does not permit an undifferentiated refusal of data subject rights.

“Editorial classification replaces data minimisation”: A journalistic purpose does not automatically justify every detail about an identifiable person.

Start with the individual article and mark every item of personal data. Then describe the editorial purpose, source, editorial role and publication decision. Assess whether Section 9(1) DSG can connect the operation with a media business or media service or whether other journalistic processing under paragraph 1a is the relevant basis.

Next record all downstream operations. Is the person added to a newsletter? Is the article used for retargeting? Are clicks, profiles or enquiries connected with it? These steps must be documented separately. For each step, data, purpose, recipients and information for data subjects should remain traceable.

If editorial information and advertising are closely combined, publication should follow a targeted review. Secure the sources, editorial decision and technical separation of campaigns. In the event of a request or dispute, the business must be able to explain which part of the operation was journalistic and which part served a commercial purpose.

We assess the specific article, personal data, media role and journalistic purpose under Section 9 DSG with you. We separate editorial work, newsletters, advertising, tracking and other promotion into traceable processing steps. Contact us with the draft, editorial process or existing privacy documentation so that the open classification can be addressed directly.