Journalism as Data: GDPR Implications of Licensing News Archives to Large Language Models

Gionata Bouché; Marten Steketee

doi:10.71265/7yhpdx81

Authors

Gionata Bouché University of Amsterdam https://orcid.org/0009-0002-0225-6037
Marten Steketee University of Amsterdam https://orcid.org/0009-0007-8297-1909

DOI:

https://doi.org/10.71265/7yhpdx81

Keywords:

Generative AI, News , GDPR, lawfulness, transparency, Media

Abstract

This article explores the data protection implications under the GDPR of integrating news archives’ content into Large Language Models (LLMs). The number of commercial partnerships between AI companies and news publishers for the licensing of news archives has rapidly increased. We contend that while LLMs and their top-layer applications do offer innovative solutions for news dissemination, publishers should carefully evaluate their position under the GDPR. Comparing different technical solutions available, in particular pre-training, fine-tuning and Retrieval Augmented Generation (RAG), we analyse the relevant regulatory barriers and opportunities, focusing in particular on the distribution of processing roles, lawfulness and transparency of these deals, and the application of the special regime for journalistic processing under art 85(2) GDPR.

Downloads

Download data is not yet available.

Author Biographies

Gionata Bouché, University of Amsterdam

Gionata Bouché is a PhD candidate at the University of Amsterdam's Institute for Information Law (IViR) and at the Responsible Media Lab (REM).
Marten Steketee, University of Amsterdam

Marten Steketee is a research assistant for the AMdEx project, University of Amsterdam.

References

Ali M and others, ‘Tokenizer Choice For LLM Training: Negligible or Crucial?’ in Kevin Duh, Helena Gomez and Steven Bethard (eds), Findings of the Association for Computational Linguistics: NAACL 2024 (Association for Computational Linguistics 2024)

Allen AL, ‘Why Journalists Can’t Protect Privacy’ in Craig LaMay (ed), Journalism and the Debate over Privacy (Routledge 2003)

Anisuzzaman DM and others, ‘Fine-Tuning Large Language Models for Specialized Use Cases’ (2025) 3(1) Mayo Clinic Proceedings: Digital Health 100184

Ausloos J and Veale M, ‘Researching with Data Rights’ (2020) Technology and Regulation 136

Barendt E, ‘Balancing Freedom and Privacy: The Jurisprudence of the Strasbourg Court’ (2009) 1(1) Journal of Media Law 49

Bouché G and others, ‘LLMs as media technology: implications under article 10 ECHR’ (2026) 33 International Journal of Law and Information Technology 1

Bygrave LA and Tosoni L, ‘Article 4(7). Controller’ in Christopher Kuner and others (eds), The EU General Data Protection Regulation (GDPR) (Oxford University Press 2020)

Dalla Corte L, ‘On proportionality in the data protection jurisprudence of the CJEU’ (2022) 12(4) International Data Privacy Law 259

de Terwangne C, ‘Article 5. Principles relating to processing of personal data’ in Christopher Kuner and others (eds), The EU General Data Protection Regulation (GDPR) (Oxford University Press 2020)

de Terwangne C and Michel A, ‘Processing of personal data for “journalistic purposes”’ in Deep diving into data protection: 1979–2019: celebrating 40 years of research on privacy data protection at the CRIDS (Larcier 2021)

Erdos D, European Data Protection Regulation, Journalism, and Traditional Publishers: Balancing on a Tightrope? (Oxford University Press 2019)

Erdos D, ‘Special, Personal and Broad Expression: Exploring Freedom of Expression Norms under the General Data Protection Regulation’ (2021) 40 Yearbook of European Law 398

Eskens SJ, ‘A right to reset your user profile and more: GDPR-rights for personalized news consumers’ (2019) 9(3) International Data Privacy Law 153

Finck M, ‘Cobwebs of control: the two imaginations of the data controller in EU law’ (2021) 11(4) International Data Privacy Law 333

Gangavarapu R and others, ‘Evaluating Accuracy in Large Language Models: Benchmarking Corrective RAG vs Naive Retrieval Augmented Generation Approach’ (2025) IEEE ICAD

Gao Y and others, ‘Retrieval-Augmented Generation for Large Language Models: A Survey’ (arXiv, 27 March 2024) <http://arxiv.org/abs/2312.10997> accessed 20 August 2025

Georgieva L and Kuner C, ‘Article 9. Processing of special categories of personal data’ in Christopher Kuner and others (eds), The EU General Data Protection Regulation (GDPR) (Oxford University Press 2020)

Gillespie B, ‘The Case for Using Informed Consent in Journalism’ in Lada Trifonova Price and others (eds), The Routledge Companion to Journalism Ethics (Routledge 2021)

Hu EJ and others, ‘LoRA: Low-Rank Adaptation of Large Language Models’ (arXiv, 16 October 2021) <http://arxiv.org/abs/2106.09685> accessed 25 August 2025

Kamath U and others, ‘Retrieval-Augmented Generation’ in Uday Kamath and others (eds), Large Language Models: A Deep Dive: Bridging Theory and Practice (Springer Nature Switzerland 2024)

Kotschy W, ‘Article 6. Lawfulness of processing’ in Christopher Kuner and others (eds), The EU General Data Protection Regulation (GDPR) (Oxford University Press 2020)

Kranenborg H, ‘Article 85 Processing and freedom of expression and information’ in Christopher Kuner and others (eds), The EU General Data Protection Regulation (GDPR): A Commentary (Oxford University Press 2020)

Kuru T, ‘Lawfulness of the mass processing of publicly accessible online data to train large language models’ (2024) 14(4) International Data Privacy Law 326

Lewis P and others, ‘Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks’, Advances in Neural Information Processing Systems (Curran Associates Inc 2020)

Li J and others, ‘Enhancing LLM Factual Accuracy with RAG to Counter Hallucinations: A Case Study on Domain-Specific Queries in Private Knowledge-Bases’ (arXiv, 15 March 2024) <https://arxiv.org/abs/2403.10446> accessed 7 January 2026

Liu D and Demberg V, ‘RST-LoRA: A Discourse-Aware Low-Rank Adaptation for Long Document Abstractive Summarization’ in Kevin Duh, Helena Gomez and Steven Bethard (eds), Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) (Association for Computational Linguistics 2024)

Meszaros J and Ho C, ‘AI research and data protection: Can the same rules apply for commercial and academic research under the GDPR?’ (2021) 41 Computer Law & Security Review

Millard C and others, ‘At this rate, everyone will be a [joint] controller of personal data’ (2019) 9(4) International Data Privacy Law 217

Nolte H, Finck M and Meding K, ‘Machine Learners Should Acknowledge the Legal Implications of Large Language Models as Personal Data’ (arXiv, 3 March 2025) <https://arxiv.org/abs/2503.01630> accessed 7 January 2026

Polčák R, ‘Article 12. Transparent information, communication and modalities for the exercise of the rights of the data subjects’ in Christopher Kuner and others (eds), The EU General Data Protection Regulation (GDPR) (Oxford University Press 2020)

Quattrociocchi W and others, ‘Epistemological Fault Lines Between Human and Artificial Intelligence’ (arXiv, 22 December 2025) <https://arxiv.org/abs/2512.19466> accessed 24 March 2026

Radford A and others, ‘Language Models Are Unsupervised Multitask Learners’ (2019) <https://api.semanticscholar.org/CorpusID:160025533> accessed 20 July 2026

Rossi A and Lenzini G, ‘Transparency by-design in data-informed research: a collection of information design-patterns’ (2020) 37 Computer Law and Security Review

Ruschemeier H, ‘Generative AI and Data Protection’ (2025) 1 Cambridge Forum on AI: Law and Governance 6

Taekema S and van der Burg W, ‘Legal Philosophy as an Enrichment of Doctrinal Research Part I: Introducing Three Philosophical Methods’ (2020) Law and Method

van Mill and Quintais, ‘A Matter of (Joint) control? Virtual assistants and the general data protection regulation’ (2022) Computer Law & Security Review

Vaswani A and others, ‘Attention Is All You Need’ (arXiv, 2 August 2023) <http://arxiv.org/abs/1706.03762> accessed 8 May 2025

Vieira I and others, ‘How Much Data Is Enough Data? Fine-Tuning Large Language Models for In-House Translation: Performance Evaluation Across Multiple Dataset Sizes’ in Rebecca Knowles, Akiko Eriguchi and Shivali Goel (eds), Proceedings of the 16th Conference of the Association for Machine Translation in the Americas (Volume 1: Research Track) (Association for Machine Translation in the Americas 2024)

Xion A and others, ‘The Landscape of Memorisation in LLMs: Mechanisms, Measurement, and Mitigation’ (arXiv, 8 July 2025) <https://arxiv.org/abs/2507.05578> accessed 7 January 2026

Xu X and others, ‘Unlearning Isn’t Deletion: Investigating Reversibility of Machine Unlearning in LLMs’ (arXiv, 22 May 2025) <https://arxiv.org/abs/2505.16831> accessed 7 January 2026