> This is particularly concerning given that GDPR specifically requires member states, in enforcing GDPR, allow exceptions for journalism and documents/data "in the public interest."
That may not apply, because of the clever (evil too, but also clever) way they are doing this.
If they were asking as data subjects where the data came from (which data subjects have a right to under Article 15 1(g)), then journalism and public interest exceptions should apply.
But that's not what they are doing. They aren't coming in as data subjects asking about the data held on them. They are coming in as an Article 51 supervisory authority in charge monitoring GDPR in their country. They are claiming to be doing the tasks Article 57 assigns to the supervisory authority, and exercising the powers Article 58 gives them for that.
Presumably, someone who the journalists wrote about alleged that the journalists were not complying with GDPR in how they obtained and used the data.
And so now the supervisory authority is investigating that. Article 58 gives them power "to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks". They can probably argue that in order to decide if a journalism or public interest exception applies, they have to know where the data came from and how it was obtained.
Assuming things are as corrupt as people have claimed, I'd expect they will go in, and if they obtain the information on the sources, they will rule that a journalism or public interest exception applies, and dismiss whatever sham GDPR complaint they had someone file to set this off.