In the US at least, case law.

Libel and slander laws break the citizenry up into three categories: private figures, public figures and limited-purpose public figures. A private figure is someone you wouldn't know about because they've done nothing newsworthy. A public figure is someone who has an occupation that puts them in the public eye - politicians, celebrities, journalists, professional athletes and the like are all public figures under the law. A limited-purpose public figure is where things get a little itchy particularly with the Internet - a limited-purpose public figure is a private individual who has done something newsworthy and therefore can be reasonably covered and investigated by journalists without running afoul of libel and slander laws. That "chocolate rain" dude is a limited-purpose public figure. The guy who took an Instagram shot with the Egyptian hijacker.

Gawker has pissed off journalists and citizens alike by determining that their news coverage defines limited-purpose public figures - like that CFO you never heard of that they outted as gay because... they're Gawker. Reddit, for their part, issued a missive from their legal team after Gawker outted violentacrez, basically informing every moderator on their site that simply by being a moderator, they became limited-purpose public figures and that Reddit wouldn't lift a finger to protect them in future instances where their actions as moderators brought them into the public eye.

I'm not sure what case law elsewhere in the world is, but as far as I know most countries basically dance around these same issues. It mostly boils down to "you can't write stuff about a large group of citizens just because you happen to have information on them." If they've broken the law, sure - but that's not the argument here. The argument is that they've been creative (legally creative) with their taxes.

It's like the Ashley Madison leak - nobody broke the law there, so when the data leaked, it launched a half-billion dollar class action lawsuit. SZ isn't stupid. They know that they get to keep leaking so long as they keep acting like journalists, rather than tabloid scumbags. That means public figures only.