The right to protection of personal data is not an absolute right, but must be balanced against other fundamental rights, in accordance with the principle of proportionality [Tile CO.01]. The right to informational self-determination “must be balanced against the freedom to gather, process and use information for one’s own purposes, including for changing purposes” [BVerfG, Order of 6 November 2019 - 1 BvR 16/13 -, para. 87].

This multidimensionality of fundamental rights is insufficiently recognised by the GDPR as a whole. Among the rights and freedoms of natural persons that the GDPR seeks to protect, the fundamental rights of the controller are hardly explicitly taken into account.

Therefore, the fundamental rights of the Charter of Fundamental Rights must be used directly for the interpretation of the term "rights and freedoms". If the controller processes personal data in the exercise of his artistic freedom, he can rely on Art. 13 CFR:

“The arts and scientific research shall be free of constraint”.

In Germany, artistic freedom is guaranteed by Art. 5 III 1 GG.

Example: A person who takes photographs of passers-by on the street may be exercising his or her freedom of art (aka “streetphotography”).

The GDPR almost completely ignores the fact that the processing of personal data may be necessary for the exercise of artistic freedom. Art. 85 GDPR leaves the balance between data protection and data processing “for artistic or literary expression” largely to the law of the member states (cf. furthermore EC 153 of the GDPR). As far as can be seen, Germany has not yet made use of this regulatory mandate. Whether §§ 22, 23 of the German Kunsturhebergesetz, which regulate the publication of photographs, contain such provisions is disputed.

In the absence of rules in the GDPR that are adequate for fundamental rights, the principle of proportionality (Art. 52 I CFR) must be applied in order to weigh the rights of the data subject against the right of the controller to artistic freedom (see Practical Concordance, Tile P.04). Cf. furthermore Art. 1 II GDPR and especially Rec. 4 (2) GDPR:

“The right to the protection of personal data is not an absolute right; it must be […] balanced against other fundamental rights, in accordance with the principle of proportionality.” [see also Tile CO.01].