OPINION OF ADVOCATE GENERAL
KOKOTT
delivered on 8 May 2008 1(1)
Case C‑73/07
Tietosuojavaltuutettu
v
Satakunnan Markkinapörssi Oy and Satamedia Oy
(Reference for a preliminary ruling from the Korkein hallinto-oikeus (Finland))
(Directive 95/46/EC – Protection of natural persons with regard to the processing of personal data – Protection of the right to privacy – Tax data on income and wealth – Freedom of expression – Media privilege)
I – Introduction
1. This case presents the Court with the task of examining the relationship between data protection and the freedom of the press and/or media freedom. When Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (2) (‘the Data Protection Directive’ or ‘the Directive’) was adopted, there was awareness of the possible conflict between those two fundamental rights and accordingly in Article 9 the Member States were required to reconcile them. In particular, the Member States were to provide for the necessary derogations from the data protection rules for the media. The question now arises of whether that derogation is to be applied to the alphabetical publication of the tax data of Finnish citizens, including details of their income and wealth, as well as making such data available for mobile telecommunication with the aid of a text-messaging service.
II – Legal context
A – Community law
2. Article 2(a), (b) and (c) of the Data Protection Directive define the central concepts of ‘personal data’, ‘processing’ and ‘data filing system’:
‘For the purposes of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
(c) “personal data filing system” (“filing system”) shall mean any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis’.
3. Building up from that, Article 3(1) regulates the scope of the Directive:
‘This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.’
4. The relationship between data protection and media and press freedom is regulated in Article 9:
‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’
5. This provision is explained in recitals 17 and 37:
‘(17) … as far as the processing of sound and image data carried out for purposes of journalism or the purposes of literary or artistic expression is concerned, in particular in the audiovisual field, the principles of the Directive are to apply in a restricted manner according to the provisions laid down in Article 9;
…
(37) … the processing of personal data for purposes of journalism or for purposes of literary of artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of information and notably the right to receive and impart information, as guaranteed in particular in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; … Member States should therefore lay down exemptions and derogations necessary for the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing, measures on the transfer of data to third countries and the power of the supervisory authority; … this should not, however, lead Member States to lay down exemptions from the measures to ensure security of processing; … at least the supervisory authority responsible for this sector should also be provided with certain ex-post powers, e.g. to publish a regular report or to refer matters to the judicial authorities’.
6. Article 17(1) regulates the security requirements for data processing:
‘Member States shall provide that the controller must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected.’
7. The other paragraphs of Article 17 regulate the application of these obligations to the processing of data by third parties on behalf of other persons.
B – National law
8. Paragraph 10(1) of the Finnish Constitution (Perustuslaki) protects the right to privacy, but Paragraph 12 protects freedom of expression and public access to information held by the authorities:
‘Everyone shall have the right to freedom of expression. Freedom of expression entails the right to express oneself and to disseminate and receive information, opinions and other communications without prior hindrance. More detailed provisions relating to the exercise of the right to freedom of expression shall be laid down by law.
Documents and other records in the possession of the authorities shall be in the public domain, unless specifically restricted by law for compelling reasons. Every person shall have the right of access to public documents and records.’
9. Under Paragraph 5(1) of the Law on the public disclosure and confidentiality of tax information (Laki verotustietojen julkisuudesta ja salassapidosta), in the annual assessment of income tax the taxpayer’s name, year of birth and municipality of domicile are tax information in the public domain. The following data are also in the public domain:
1. Earned income for the purposes of national taxation;
2. Unearned income and income from property for the purposes of national taxation;
3. Earned income for the purposes of municipal taxation;
4. Taxes on income and property, municipal taxes and the total amount of taxes and charges levied.
10. In principle, this information is provided by the authorities orally upon request, but the document may be made available for examination, for making a copy or for being listened to, or a copy or printout will be provided. The following provisions (Paragraph 16(3) of the Law on public access (Julkisuuslaki)) govern the disclosure of data from a personal data file of an authority:
‘A file containing personal data may be disclosed in the form of a printout, or those data may be disclosed in electronic form, unless provided otherwise by law, if the recipient is authorised to store and use such data by virtue of the provisions governing the protection of personal data. However, access to personal data for the purposes of direct marketing, market surveys or market research shall not be permitted unless specifically provided for by law or if the data subject has given his consent.’
11. Finland implemented the Data Protection Directive by means of the Law on personal data (Henkilötietolaki). Paragraph 2(4) and (5) contain the restrictions on the application of the law which relate to the present case:
‘(4) This law does not apply to personal data files containing, solely and in unaltered form, data that have been published by the media.
(5) Unless otherwise provided in Paragraph 17, only Paragraphs 1 to 4, 32, 39(3), 40(1) and (3), 42, 44(2), 45 to 47, 48(2), 50, and 51 of this law apply, where appropriate, to the processing of personal data for purposes of journalism or artistic or literary expression.’
12. So far as can be seen, the only one of those provisions which concerns the present case is Paragraph 32(1):
‘The controller shall carry out the technical and organisational measures necessary for protecting personal data against unauthorised access, accidental or unlawful destruction, manipulation, disclosure, transfer or other unlawful processing. The techniques available, the associated costs, the quality, quantity and age of the data, as well as the significance of the processing to the protection of privacy shall be taken into account when carrying out the measures.’
III – Facts, national proceedings and reference for a preliminary ruling
13. According to the court making the reference, Satakunnan Markkinapörssi Oy collected for its own use tax data on individuals available from the tax authorities. Using those data, it published each year what was in appearance a newspaper containing a list giving tax information concerning approximately 1.2 million natural persons.
14. The data included the surname and forename of the person concerned, together with the tax data relating to earned and unearned income and net worth to the nearest EUR 100. The data were published in regional publications (of which there were 16 in 2001). The information was arranged alphabetically by municipality and income category.
15. The lower limit for the data to be published was selected by reference to municipalities. For example, the limit in respect of earned income for Helsinki was EUR 36 000. The lower limit was less in smaller municipalities.
16. The main aim is the publication of tax data. At the same time the publication contains summaries and other articles, in addition to advertisements. In comparison with tax information, the other items take up much less space.
17. Satakunnan Markkinapörssi Oy makes a charge for the removal from the periodical of data concerning individuals. According to that company, however, removal is not conditional on payment of the charge.
18. Satakunnan Markkinapörssi Oy transferred the published personal data on a CD-ROM to Satamedia Oy, which is another company owned by the same persons.
19. The two companies agreed with another company, a mobile radiocommunications service, on the technical operation of a text-messaging service. For that purpose, Satamedia Oy transferred the data in question to the third company, which supplied text-messaging services on behalf of Satamedia Oy.
20. In the context of that service, a mobile phone user sends the message: TAX FORENAME SURNAME PLACE (for example, TAX MATTI MEIKÄLÄINEN HELSINKI) to a given number. In reply, the data on the earned income, unearned income and net worth to the nearest EUR 100 are sent to the mobile phone. In 2004, the text-messaging service also showed the data for other people with the same name and comparative data for the respective municipality. A charge is made for a successful text message. The company also removes data from the service upon request.
21. The Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) investigated the activity of Satakunnan Markkinapörssi Oy and Satamedia Oy and applied to the Data Protection Board to prohibit:
(a) Satakunnan Markkinapörssi Oy from
– collecting and recording or otherwise processing data on the taxable earnings and income from capital and the wealth of natural persons to the extent and in the manner that occurred in respect of the tax data for the year 2001, and
– disclosing the aforementioned personal data it had collected and entered on a data file allegedly for journalistic purposes to text-messaging services or for other purposes;
(b) Satamedia Oy from collecting, recording and disclosing personal data obtained from the data files held by Satakunnan Markkinapörssi Oy to text-messaging services or for other purposes.
22. The Data Protection Board dismissed this application. The action brought against this was unsuccessful at first instance. The Data Protection Ombudsman has now lodged an appeal to the Supreme Administrative Court of Finland (Korkein hallinto-oikeus).
23. As a result, the Korkein hallinto-oikeus has referred the following questions to the Court for a preliminary ruling pursuant to Article 234 EC:
‘(1) Can an activity in which data relating to the earned and unearned income and assets of natural persons are:
(a) collected from documents in the public domain held by the tax authorities and processed for publication,
(b) published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
(c) transferred onward on CD-ROM to be used for commercial purposes, and
(d) processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the earned and unearned income and assets of that person,
be regarded as the processing of personal data within the meaning of Article 3(1) of [the Directive]?
(2) Is [the Directive] to be interpreted as meaning that the various activities listed in Question 1(a) to (d) can be regarded as the processing of personal data carried out solely for journalistic purposes within the meaning of Article 9 of the Directive, having regard to the fact that data on over one million taxpayers have been collected from information which is in the public domain under national legislation on the right of public access to information? Does the fact that publication of those data is the principal aim of the operation have any bearing on the assessment in this case?
(3) Is Article 17 of [the Directive] to be interpreted in conjunction with the principles and purpose of the Directive as precluding the publication of data collected for journalistic purposes and its onward transfer for commercial purposes?
(4) Is [the Directive] to be interpreted as meaning that personal data files containing, solely and in unaltered form, material that has already been published in the media fall altogether outside its scope?’
24. Satakunnan Markkinapörssi Oy and Satamedia Oy jointly, Estonia, Portugal, Finland, Sweden and the Commission have lodged pleadings. In addition, the Finnish Data Protection Ombudsman took part in the hearing of 12 February 2008, while Portugal was not represented.
25. The President of the Court dismissed an application by the European Data Protection Supervisor for leave to intervene in the procedure because intervention in preliminary ruling proceedings is not possible and the Supervisor is not mentioned as a party in Article 23 of the Statute of the Court of Justice. (3)
IV – Legal assessment
26. The issue in the main proceedings is whether the dissemination of tax data by Satakunnan Markkinapörssi Oy and Satamedia Oy is inconsistent with data protection. Accordingly the national court’s first question is whether and to what extent the operation involving the tax data in question falls within the scope of the Data Protection Directive.
27. Under Paragraph 2(5) of the Finnish Law on personal data, only specific data protection provisions apply to the processing of personal data for journalistic purposes. Paragraph 32(1), which transposes the requirements concerning security in processing laid down by Article 17 of the Data Protection Directive, appears to be the only restriction on processing. The third question relates to the interpretation of that provision.
28. In addition, with its second question the national court seeks another starting point for the application of data protection rules, namely the interpretation of Article 9 of the Data Protection Directive, which requires the Member States to reconcile freedom of expression with the right to privacy. This is to be done by means of derogations from the data protection rules where personal data are used solely for journalistic purposes or the purpose of artistic or literary expression. Therefore the question before the Court is whether and, if so, to what extent journalistic purposes can be recognised in the present case.
29. The fourth question seeks to determine whether a further Finnish derogation from the data protection rules, namely the exception for the processing of published data under Paragraph 2(4) of the Law on personal data, is compatible with Community law.
A – The first question – Processing of personal data
30. First of all, the national court asks whether the scope of the Data Protection Directive extends to various activities of Satakunnan Markkinapörssi Oy and Satamedia Oy.
31. The national court and the parties correctly agree that the publication of tax data and making them available in the form of a text-messaging service are to be regarded as the processing of personal data within the meaning of Article 2(a) and (b) of the Data Protection Directive.
32. The data in question are personal data as the information on income, wealth and taxes are associated with identified persons. Both publication and making available as a text-messaging service require different operations within the meaning of Article 2(b) of the Data Protection Directive, for example, collection, recording, organisation, storage and disclosure by transmission, dissemination or otherwise making available.
33. In addition, for the Data Protection Directive to apply, Article 3(1) requires the processing of personal data wholly or partly by automatic means, or the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system. A filing system is any structured set of personal data which are accessible according to specific criteria.
34. It is probable that the operations referred to by the national court are carried out at least partly by automatic means, in any case leaving aside disclosure by CD-ROM. However, the automation of disclosure requires no further explanation because the publication of tax data on paper constitutes a filing system and disclosure in the form of a text-messaging service presupposes the consultation of a filing system. Consequently all the abovementioned activities, including disclosure of data by means of CD-ROM, involve the processing of personal data which form part of, or are intended to form part of, a filing system.
35. Consequently the reply to the first question must be that an operation is to be regarded as the processing of personal data within the meaning of Article 3(1) of the Data Protection Directive if the data of natural persons relating to their earned income, income from capital and wealth, as described in the reference for a preliminary ruling, are:
(a) collected from documents in the public domain held by the tax authorities and processed for publication,
(b) published alphabetically in a printed publication by income bracket and municipality in the form of extensive lists,
(c) disclosed onward on CD-ROM to be used for commercial purposes, or
(d) processed for the purposes of a text-messaging service whereby mobile phone users can, by indicating an individual’s name and home municipality and texting to a given number, receive in reply data on the earned income, income from capital and wealth of the individual indicated.
B – The second question – The exception for journalistic activities
36. The second question from the national court is whether the operations to which the main proceedings relate can be regarded as the processing of personal data solely for journalistic purposes within the meaning of Article 9 of the Data Protection Directive. Article 9 is the legal basis for the formulation by the Member States of the so-called press or media privilege. (4) This means that the Member States provide for exemptions and derogations from Chapters II, IV and VI of the Data Protection Directive for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if that is necessary in order to reconcile the right to privacy with the rules governing freedom of expression. Consequently the issue in the second question is the scope of that exemption.
The relevant fundamental rights
37. The interpretation of Article 9 of the Data Protection Directive must be guided by the fundamental rights which are to be reconciled by the application of that provision. In doing so, the Community Courts must take into account the case-law of the European Court of Human Rights in particular. (5)
38. Community law guarantees the fundamental right of freedom of expression embodied in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), signed in Rome on 4 November 1950. (6) This is recognised in Article 11 of the Charter of Fundamental Rights of the European Union (‘the Charter’), proclaimed in Nice on 7 December 2000. (7) In accordance with the case-law of the Court of Justice (8) and the Protocol on the system of public broadcasting in the Member States, (9) in particular the freedom and pluralism of the media are respected in accordance with Article 11(2) of the Charter.
39. Freedom of expression is not confined to the expression of opinions but expressly includes, pursuant to the second sentence of Article 10(1) of the ECHR and the first sentence of Article 11(1) of the Charter, freedom to receive and impart information and ideas in the sense of freedom of communication. The European Court of Human Rights has consistently held that freedom of expression is applicable not only to information or ideas that are favourably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb the State or any sector of the population. (10) Freedom of expression protects the transmission of information and the expression of opinion even for commercial purposes. (11)
40. The fundamental right to respect for private life is laid down in Article 8 of the ECHR and is recognised in Article 7 of the Charter. Furthermore, Article 8 of the Charter expressly proclaims the right to the protection of personal data. (12) The communication of personal data to a third party infringes the right of the persons concerned to respect for private life, whatever the subsequent use of the information thus communicated, and constitutes interference within the meaning of Article 8 of the ECHR. (13)
41. The right to respect for private life is not purely a defence against arbitrary interference by public authorities, but also creates positive obligations on the part of the State. (14) Therefore the Community has, by means of the Data Protection Directive, extended data protection to processing by individuals. To that effect, the European Court of Human Rights has also pointed out, in a case concerning the use of photographs involving the private life of a prominent person, that increased vigilance is necessary to contend with new communication technologies which make it possible to store and reproduce personal data. (15)
42. The restriction of both fundamental rights is in principle permissible, subject to comparable conditions. It must be laid down by law, it must conform with one or more of the legitimate aims of Article 8 or Article 10 of the ECHR and it must be necessary in a democratic society, that is to say, an imperative need may justify interference if it is in reasonable proportion to the legitimate aim in question. (16)
43. Strict application of the data protection rules could substantially limit freedom of expression. Investigative journalism would to a large extent be ruled out if the media could process and publish personal data only with the consent of, or in conformity with information provided by, the person concerned. On the other hand, it is obvious that the media may violate the right of individuals to respect for their private life. (17) Consequently a balance must be found.
44. This situation of conflict between different fundamental rights and also between data protection and other general interests is characteristic of the interpretation of the Data Protection Directive. (18) As a result, the relevant provisions of the Directive are formulated in relatively general terms. They allow the Member States the necessary margin of discretion in adopting implementation measures which can be adjusted to the various conceivable situations. (19) In that context, the Member States must respect the position with regard to the fundamental rights concerned and reconcile them.
45. In addition, according to the Court, it is for the authorities and courts of the Member States not only to interpret their national law in a manner consistent with the Data Protection Directive, but also to make sure they do not rely on an interpretation of it which would be in conflict with the fundamental rights protected by the Community legal order or with the other general principles of Community law. (20)
The national court’s right of assessment
46. In contrast to the requirements for the domestic courts and authorities, the Court of Justice is very cautious with regard to determining the scope of data protection and weighing up conflicting fundamental rights. In Promusicae, the Court merely designated the two fundamental rights and left the national court to strike a fair balance between them. (21) In Österreichischer Rundfunk and Others, the Court took a similar approach, (22) but also gave the national court some guidance. (23)
47. The Court shows the same caution in other situations of conflicting rights. In Familiapress, the issue was the conflict between the free movement of goods and a domestic prohibition of prize competitions in periodicals. In that judgment, the Court made an express decision on the need for certain rules, (24) but in general left the national courts to determine whether that prohibition was proportionate to the maintenance of press diversity and whether that objective could not be achieved by less restrictive means. (25)
48. In cases of conflict between the freedom to provide services and human dignity, and between the free movement of goods and ideas on the protection of children and young persons, the Court has gone even further in recognising that in the Member States there may be differing, but equally legitimate, views on what restrictions on fundamental freedoms for the protection of public interests and, in particular, fundamental rights are proportionate. (26)
49. On the other hand, the Court has also pointed out that it is called on to provide answers of use to the national courts. In particular, it may provide guidance, based on the file in the main proceedings and on the written and oral observations which have been submitted to it, in order to enable the national court to give judgment in the particular case before it. (27) Such guidance normally relates to problems of proportionality.
50. In the present case, the Court should rather follow the cautious line. It falls to the Community Courts to put conflicting fundamental rights into concrete terms above all where the focus is on cross-border activities. If there are indications of adverse effects on Union citizens engaged in cross-border activities, a particularly thorough examination is necessary. This is shown by the judgments on trade union activities with reference to cross-border services (28) or to the relocation of a business undertaking (29) and on attacks by protesting farmers on lorries carrying fruit. (30)
51. The Schmidberger case (31) is not an example of the opposite. It concerned interference with goods vehicles between Germany and Italy by a permitted demonstration on the Austrian Brenner motorway. Although in that case the Court acknowledged the wide discretion of the national authorities in striking a balance between the free movement of goods and the freedom of expression and freedom of demonstration, (32) it discussed in relative detail the outcome of striking such balance (33) before finding that there was no breach of Community law.
52. On the other hand, where the Data Protection Directive is to be applied, the protection of cross-border activities is the exception. The Directive is based on Article 95 EC and thus serves the establishment of the internal market. However, it covers not only cross-border data processing but also purely domestic operations. Unlike Advocate General Tizzano, (34) the Court did not call into question the wide-ranging scope of the Directive because, if it were confined to situations with cross-border elements, that would make the limits of its field of application uncertain and it would depend on fortuitous circumstances. (35)
53. However, it must be concluded from the broad scope of the Data Protection Directive, which already reaches almost beyond the establishment of the internal market, that the Court, when striking a balance between conflicting fundamental rights in the context of the Directive, should in principle allow the Member States and their courts a broad discretion within which their own traditions and social values can be applied.
54. That is the background against which Article 9 of the Data Protection Directive is to be interpreted.
The scope of Article 9 of the Data Protection Directive
55. Under Article 9 of the Data Protection Directive, the Member States are to provide for derogations from the data protection provisions for the processing of personal data carried out solely for journalistic purposes or the purpose of literary or artistic expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.
56. Satakunnan Markkinapörssi Oy, Satamedia Oy and Finland wish to extend the scope of Article 9 of the Data Protection Directive to cover the entire protected area of freedom of expression. According to that interpretation, Article 9 would, in accordance with its aim, cover all conceivable conflicts between freedom of expression and data protection. At the same time, the Member States would be given the greatest possible freedom to reconcile data protection and freedom of expression.
57. However, there is no basis for that interpretation in the wording of Article 9 of the Data Protection Directive, which not only requires data protection and freedom of expression to be reconciled, but also describes certain aims for the purpose of which the Member States may derogate from almost all the requirements of the Data Protection Directive. The concepts of journalistic purposes or the purpose of literary or artistic expression, which are used in that context, would be left with no function of their own besides the concept of freedom of expression if, taken together, they were equated with freedom of expression.
58. The starting point for the interpretation of Article 9 of the Data Protection Directive should rather be that exceptions to a general principle must be interpreted strictly (36) in order not to undermine the general principle unduly. In the present case, there would be a risk of encroaching on the fundamental right to privacy if Article 9 were interpreted too broadly.
59. The need for restrictive interpretation is clear from Article 9 of the Data Protection Directive in so far as it relates only to the processing of personal data which is carried out solely for the specified purposes. In addition, exemptions and derogations are allowed only if they are necessary to reconcile the fundamental rights in question.
60. As the Commission in particular points out, the wide range of the exception allowed under Article 9 also indicates that the conditions for applying it should be interpreted restrictively. Whereas other exceptions under the Data Protection Directive provide for derogations only from specific provisions, Article 9 makes it possible to suspend almost all the requirements of the Directive.
61. A literal interpretation of the term ‘journalistic purposes’ cannot be met with the objection that it would lead to encroachment on the freedom of expression as a result of data protection requirements which are too restrictive. The Member States need not reconcile freedom of expression and the right to privacy solely in the context of Article 9 of the Data Protection Directive. They may also rely on other provisions since the Directive as a whole leaves the Member States with the necessary discretion to define transposition measures which may be adapted to the various situations possible. (37)
62. In the sphere of the private expression of opinion, the Member States are particularly free as, under the second indent of Article 3(2), the Data Protection Directive does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity. (38)
63. In addition, under Article 7(f) of the Directive, processing is permissible if it is necessary for the purposes of the legitimate interests pursued by the controller, or the Member State concerned may, under Article 13(1)(g), provide for exceptions to certain rules for the protection of the rights and freedoms of other persons. (39) In particular, the requirements concerning the permissibility of data processing under Article 7 and the processing of sensitive data under Article 8 are applicable in those cases, and the data protection supervisory authorities may oversee the processing of the data.
64. To sum up, therefore, the scope of Article 9 of the Data Protection Directive must be determined by reference to the concepts of journalistic, literary or artistic purposes, which have a meaning of their own that is not identical with the protected area of freedom of expression.
The concept of journalistic purposes
65. The concept of journalistic purposes refers to the activity of the mass media, particularly the press and audiovisual media. The origin of the Data Protection Directive shows that journalistic purposes are not confined to the activity of institutionalised media. As the Commission initially proposed an exception for press organs and audiovisual media, (40) the term ‘journalistic purposes’ resulted from several succeeding drafts which broadened the scope of the exception for media undertakings and extended it to all persons engaging in journalistic activity. (41)
66. To give further definition to the concept of journalistic purposes, account should be taken of the task of the media in a democratic society, as formulated by the European Court of Human Rights in its case-law on the restriction of the freedom of expression. Any restriction on the freedom of expression in a democratic society is conditional on such restriction being necessary. If the media are affected, it must be borne in mind that a free press plays a vital part in the functioning of a democratic society, particularly as a ‘public watchdog’. Therefore it has a duty to impart information and ideas on all matters of public interest. (42)
67. As the issue is the communication of information and ideas, the question is not whether the data disseminated are processed or commented upon by editors, contrary to the views held in some quarters. The mere fact of making raw data available may contribute to public debate and therefore be of public interest. Furthermore, the selection of the disseminated data is in itself an expression of a subjective evaluation of the person disseminating them. The fact of selection implies at least a belief that the data are of interest to the recipient.
68. As the Swedish Government in particular maintains, the dissemination of personal data pursues journalistic purposes if it aims to impart information and ideas on matters of public interest.
Information and ideas on matters of public interest
69. Now it is necessary to ascertain what is meant by the imparting of information and ideas on matters of public interest. This phrase describes acts by way of exercising the freedom of expression, the restriction of which requires particularly weighty justification.
70. In that connection, the Swedish Government refers to a statement it made when adopting the Data Protection Directive. According to the statement, journalistic purposes depend, not on the information imparted, that is to say, the subject-matter, but on the nature of the communication. It is right to say that it is not incumbent on State authorities to lay down the matters of public interest with which the media may deal. Therefore examination of the subject-matter is a sensitive issue.
71. The nature and context of the information are relevant in order to distinguish cases where, although information or ideas on matters of public interest are communicated, the communication is not addressed to the public, for example, private political debate.
72. However, differentiation solely on the basis of the form of communication is no longer sufficient to identify journalistic purposes. At one time journalism was confined to media which were (relatively) clearly recognisable as such, namely the press, radio and television. Modern means of communication such as the internet and mobile telecommunications services are used just as much for the communication of information on matters of public interest as for purely private purposes. Consequently, although the type of communication is an important factor in determining whether journalistic purposes are being pursued, the subject-matter should not be disregarded either.
73. Public interest arises in any case where the information communicated relates to a public debate which is actually being conducted. (43) There are also topics which are by nature matters of public interest, for example, public hearings within the meaning of Article 6(1) of the ECHR, (44) the public interest in the transparency of political life (45) and information on the ideas and attitudes, as well as the conduct, of prominent politicians. (46)
74. On the other hand, it is doubtful whether information on matters of public interest is being communicated where details of an individual’s private life are disseminated which have no connection with a public function of the person concerned, particularly where their sole purpose is to satisfy the curiosity of a particular readership regarding an individual’s private life and they cannot be deemed to contribute to any debate of general interest to society despite that individual being known to the public. (47) What is particularly important for this borderline of public interest is whether the person concerned has a legitimate expectation of respect for his or her private life. (48)
75. The Fressoz and Roire (49)case affords a good illustration of the relevant considerations. This concerned the conviction of two journalists who published confidential documents from a tax file in order to substantiate their information concerning the income of a company director. Such publication was in principle punishable under domestic law.
76. In response, the European Court of Human Rights stressed that the information related to a public debate concerning pay which had been started by an industrial dispute in the company concerned. (50) Furthermore, information on tax assessments and taxes paid was not strictly confidential under domestic law. (51) On the contrary, details of remuneration in major companies were regularly published (52) and, according to domestic case-law, did not concern the private life of the persons involved. (53)
77. Consequently information and ideas relate to a matter of public interest where they link up with a public debate which is actually taking place or where they concern questions which, according to domestic law and social values, are by nature public issues, but not where details of an individual’s private life are disseminated which have no connection with a public function of the person concerned, particularly where there is a legitimate expectation of respect for private life.
78. However, it must be added that State authorities, including the courts, cannot ascertain exactly where there are journalistic purposes. It is hardly possible to determine in advance what information relates to matters of public interest and, in the final analysis, it is at least partly up to the media to create public interest in the first place by the communication of information. If they fail to do so, they can hardly be blamed in retrospect. But even ex ante it is not in principle the task of State authorities to predict what will be of no public interest in the future. That would be a first step on the path to censorship. Consequently whether the dissemination of information and ideas affects matters of public interest can only be established if such dissemination is overt.
Sole purpose
79. Even if processing is for journalistic purposes, Article 9 of the Data Protection Directive is not necessarily applicable. The processing of the personal data in question must be solely for journalistic purposes.
80. The use of the word ‘solely’ in Article 9 serves as a reminder of the specific purpose of data processing which is laid down in general terms in Article 6(b) of the Data Protection Directive. According to this, personal data may not in principle be further processed in a way incompatible with the purposes for which they were collected. Consequently the Article 9 exception can apply only to processing operations which serve journalistic purposes alone. If there are other purposes at the same time which are not to be recognised as journalistic, the media privilege will not be applicable.
81. However, the precise purpose cannot depend on whether processing involves the direct communication of such information, for example, in the case of publication of such data. As Satakunnan Markkinapörssi Oy and Satamedia Oy contend, journalistic purposes are also pursued in the preparation of a publication. (54)
82. Processing solely for journalistic purposes is not ruled out either where, in addition to the communication of information and ideas on matters of public interest, commercial aims are also pursued. (55) As a rule, journalistic purposes go hand in hand with the aim of at least covering the costs of journalistic activity and, if possible, also making a profit. Commercial success is the prerequisite of professional journalism, at least in so far as it is carried on independently of the support and influence of others, such as the State. Consequently earning money by communicating information and ideas on matters of public interest is a permissible element in journalistic purposes.
83. This must be distinguished from commercial activities which do not involve the communication of information and ideas on matters of public interest, even if the profits gained are intended to finance journalistic activities. These do not differ from activities of the same kind, the profit from which is not intended for journalistic purposes. In that situation, allowing the media privilege could breach the principle of equal treatment and distort competition. (56)
84. Consequently only in exceptional cases would the dissemination of advertisements in the media be likely to involve solely the communication of information and ideas on matters of public interest, (57) that is to say, serve solely journalistic purposes, even if the income earned is a prerequisite of media activity.
85. In any particular case, it is difficult to classify activities as being for journalistic purposes and it requires an appraisal of the objective in question. It cannot depend on the objective stated by those responsible for the data processing as those subjective aims cannot be verified. Rather, the purpose of the data processing must be based on objective factors. (58)
Application to the present case
86. In an individual case, whether certain information is in the public domain and whether there is a legitimate expectation of respect for private life depend very much on the position in the relevant domestic law, social values and existing public issues. In principle, it is not the task of the Court, but of the competent authorities of the Member States, to examine those factors. If such questions are referred to the Court by national courts, it should only give guidance on the circumstances to be taken into account.
87. In the present case, the nature of the processed information, the different forms of data dissemination and the possibility of erasing a person’s own data are of particular interest.
88. All processing operations concern personal tax data. In Community law, there are no provisions for the confidential treatment of such data, but some Member States regard them as confidential. Consequently in those States the persons concerned rightly expect that confidentiality to be respected in principle. Likewise in the Court’s opinion information on income should in principle be disclosed only if that is necessary for an overriding purpose. (59)
89. However, evidently the European Court of Human Rights does not infer the confidential treatment of tax information necessarily from Article 8 of the ECHR. (60) Therefore it could be a permissible, that is to say, legitimate, interference in the fundamental Community right to privacy if such data in the hands of the tax authorities in Finland are by law accessible to the public. As that is the legal situation, it must also be presumed that Finnish citizens have no legitimate expectation with regard to the confidential treatment of their tax information.
90. The information is disclosed in two ways. On the one hand, it is published as a complete list in the external form of a newspaper and, on the other, individual taxpayers’ data can be retrieved in the form of a text-messaging service.
91. The publication of the list is, according to its form, directed at communicating information of public interest. The general public is offered a complete collection of data. Prima facie, that form of publication does not take individual interests into account.
92. It is more difficult to judge whether, from the viewpoint of content also, that form of communication meets a public interest. On the one hand, the public may be interested in obtaining a comprehensive survey of taxation and the tax and wealth situation of fellow citizens. There may also be a specific public interest in obtaining such information in relation to particular public figures.
93. On the other hand, there are also grounds for presuming that interest in such data is broadly of a private nature. Personal curiosity on the part of neighbours and acquaintances may be in evidence. Even commercial interests cannot be ruled out. Information on the income and wealth of individuals can be used in trade or commerce, for example, for targeted advertising or for assessing the financial capability or the creditworthiness of customers.
94. In the case of the text-messaging service, the last-mentioned factors are much more in evidence because, by virtue of its form, it is used to obtain information only where there is a specific interest in the figures for a particular person. It seems unlikely that such interest is normally of a public nature. On the contrary, consultation is likely to be connected with matters of public interest only in exceptional cases.
95. However, public interest cannot be ruled out altogether in the case of information transmission by way of telecommunications. The transmission of information by telecommunications services is increasingly supplementing traditional forms of transmission by means of the press and the mass media. Consequently whether information and ideas on matters of private or public interest are transmitted in that form is a question requiring particularly careful consideration.
96. Finally, the Portuguese Government submits that, if Satakunnan Markkinapörssi Oy makes a charge for deleting taxpayers from the data-processing system, no journalistic purposes are involved. This argument would have to be accepted if Satakunnan Markkinapörssi Oy were seeking to make a profit from the charges as there would be no profit precisely from transmitting information and ideas on matters of public interest. If, on the other hand, the charge is simply to cover expenses, that does not in itself rule out journalistic purposes, irrespective of whether such charges are lawful.
97. However, the fact that an individual can have data relating to himself or herself erased raises the question of whether there actually is a public interest in a comprehensive list of tax data. The erasure of individual tax records without reason would then in principle be contrary to the public interest, if any. If the reader expects a comprehensive list, erasure would be almost misleading because the impression would be given that that person pays little or no tax.
98. The national courts must decide how to evaluate conclusively those objective factors in the social environment in Finland, if necessary, after further clarification of the factual situation.
Striking a balance between freedom of expression and the right to privacy
99. If Article 9 of the Data Protection Directive is prima facie applicable, it does not immediately follow that the processing of personal data in question is to be exempted from data protection. Rather, derogations are permissible only if they are shown to be necessary in order to reconcile the right to privacy with the rules governing freedom of expression.
100. Accordingly it would be possible to agree with Estonia and the Commission in doubting whether the Finnish implementation of Article 9 fulfils the requirements of Community law. In spite of the flexibility of the rules of the Data Protection Directive, (61) it seems on an overall view somewhat one-sided to exclude data protection almost entirely in relation to data processing for journalism. Therefore under Community law it may be necessary to subject journalistic activities to stricter data protection obligations than was done in Paragraph 2(5) of the Finnish Law on personal data.
101. However, these considerations are not relevant for a reply to the second question from the national court. In the main proceedings, an application has been made to order Satakunnan Markkinapörssi Oy and Satamedia Oy to refrain from certain data-processing operations. That order cannot be based directly on the Data Protection Directive. A directive may not of itself impose obligations on an individual and cannot therefore be relied upon as such against an individual. (62)
102. In contrast, the Commission proposes, with reference to Paragraph 2(4) of the Finnish Law on personal data, that national restrictions of data protection should be set aside on account of violation of the right to privacy. The Commission finds support in the Mangold judgment, where the Court regarded the principle of non-discrimination on grounds of age laid down in Directive 2000/78 (63) as a general principle of Community law and concluded that the national courts should set aside any contrary provision of national law. (64)
103. I have already rejected that approach in another case. (65) To have recourse to a general principle of law instead of a directive which cannot be relied upon directly as against an individual, when that general principle is much less clear and certain, would circumvent the directive’s aim of harmonisation, raise concerns as to its aim of legal certainty and undermine the prohibition on giving effect, directly as against individuals, to provisions of directives which have not been implemented. Advocates General Mazák and Ruiz-Jarabo Colomer also fear that the direct application of general legal principles in addition to directives would undermine the latter in their effect, call into question the attribution of powers and create legal uncertainty. (66)
104. These are precisely the consequences that would arise in the present case. The obligations of individuals concerning data protection are based on national rules which implement the Data Protection Directive. The Commission’s approach, on the other hand, amounts to creating obligations which are contrary to the national rules. This is not consistent with legal certainty. It would also undermine the attempt by the Data Protection Directive to entrust the Member States with striking a balance between data protection and freedom of expression.
105. Consequently in the present case it is immaterial whether Finland has correctly implemented Article 9 of the Data Protection Directive. The national court must determine whether there is a basis in national law for the orders which have been applied for against Satakunnan Markkinapörssi Oy and Satamedia Oy. For that purpose, the national court must so far as possible interpret its national law in the light of the wording and the purpose of the Data Protection Directive (67) and in accordance with fundamental Community rights (68) in order to achieve the result laid down in the Directive. The obligation of conforming interpretation is at the same time limited by the principle of legal certainty. This precludes an interpretation of national law contra legem. (69)
The reply to the second question
106. To sum up, therefore, the reply to the second question must be that the processing of personal data serves journalistic purposes within the meaning of Article 9 of the Data Protection Directive when it aims to communicate information and ideas on matters of public interest. Whether and, if so, to what extent the processing of the tax data which are the subject of the main proceedings serves journalistic purposes must be determined by the national court in the light of all the available objective information.
C – The third question – Article 17 of the Data Protection Directive
107. The third question from the national court is whether Article 17 of the Data Protection Directive, in conjunction with the principles and purpose of the Directive, is to be interpreted as meaning that the publication of data collected for journalistic purposes and its onward disclosure for processing for commercial purposes are contrary to that provision.
108. Article 17(1) of the Data Protection Directive regulates data-processing security. It states that the Member States are to provide that the controller must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing. Those measures must, having regard to the state of the art and the cost of their implementation, ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected.
109. Article 17(1) of the Data Protection Directive was implemented by Paragraph 32(1) of the Finnish Law on personal data, which is one of the few data protection provisions that relates also to the processing of personal data for journalistic purposes. The point of interest for the present case is that unauthorised and unlawful processing is to be prohibited. If those terms are to be understood as meaning that the processor must ensure that all the requirements of the Data Protection Directive are complied with, those requirements would also apply, notwithstanding the media privilege under Article 9 of the Directive, even where personal data are processed for journalistic purposes.
110. However, this interpretation of Article 17(1) of the Data Protection Directive would not be consistent with the system of rules of the Directive. It would normally lead to unnecessary duplication of the requirements and, in the present case, would circumvent the manifest intention of the Finnish legislature to implement Article 9 of the Directive by exempting processing for journalistic purposes from those requirements.
111. Article 17(1) of the Data Protection Directive is to be correctly understood, in conformity with its heading ‘Security of processing’ and the explanatory statement for the Commission’s proposal, (70) as involving protection against external influences, particularly illegal access by third parties. This is indicated by the reference to the state of the art in the second sentence of Article 17(1). This is logical only in relation to technical security measures. Which processing operations are lawful has nothing to do with the state of the art.
112. Therefore the legality of data processing is not regulated by Article 17(1). It is dealt with in the other relevant rules of the Data Protection Directive.
113. Possibly the interest of the national court also arises from the fact that Article 17(2) to (4) of the Data Protection Directive address data security where processing is carried out on behalf of another person, that is to say, where data are disclosed by the controller to a third party. In the present case, data are disclosed by Satakunnan Markkinapörssi Oy to Satamedia Oy. However, there are no material requirements under Article 17 for such disclosure. The rules for processing on behalf of another person are intended only to ensure that the requirements of Article 17(1) concerning security in processing are complied with also where processing is carried out on behalf of another person.
114. In accordance with the proposal of most of the parties, therefore, the reply to the third question must be that Article 17 of the Data Protection Directive contains no rule as to whether data collected for journalistic purposes may be published and disclosed for processing for commercial purposes.
D – The fourth question – Processing of published data
115. The fourth question from the national court seeks to establish whether the Data Protection Directive can be interpreted as meaning that personal data files containing solely material that has been published in the media fall altogether outside its scope.
116. The background to that question is Paragraph 2(4) of the Finnish Law on personal data, which provides that the law does not apply to personal data files containing solely data published by the media as such.
117. As Estonia, Portugal and the Commission correctly point out, the Data Protection Directive contains no comparable provision. On the contrary, recitals 12 and 26 expressly state that the principles of protection must apply to any information concerning an identified or identifiable person.
118. A general exception for published information would in particular render the purpose of data processing under Article 6(1)(b) of the Directive meaningless. Data could be used further for any purpose whatever after publication, irrespective of the purposes for which they were originally collected.
119. Finland, on the other hand, considers that the processing of published personal data is justified by the freedom of expression. Contrary to the Finnish submission, however, the fact that disclosure in the form of a text-messaging service also falls within the scope of the freedom of expression cannot be cited in support of that view. This consideration is of interest for examining Sweden’s argument that the abovementioned service meets the requirements of Article 9 of the Data Protection Directive and the corresponding Finnish provisions and is therefore covered by the media privilege.
120. However, the processing of published personal data is, in Finnish law, not subject to the requirements of Article 9 of the Directive at all. Consequently this gives rise to the question whether the freedom of expression extends to the unrestricted processing of such data.
121. Under Article 10(1) of the ECHR, the freedom of expression includes freedom to receive and impart information and ideas without interference by public authority. In so far as the processing of published personal data is necessary for that purpose, it falls within the scope of the freedom of expression. However, that freedom can and must be limited if the processing of data is precluded by the right to privacy. Consequently a general privilege in favour of such processing operations is out of the question. The question in each case is rather, which fundamental right is preponderant.
122. In the case of published information which is, by definition, generally known, it should as a rule be presumed that the right to the protection of privacy is of less weight. However, the right to privacy may preclude the perpetuation and intensification of interference by means of the further processing of information, for instance, in the case of erroneous information, libel or information concerning intimate matters.
123. Exceptions to the requirements of the Data Protection Directive may also be based on Article 13. In that connection, protection of the rights and freedoms of others under Article 13(1)(g) comes into consideration. It would be conceivable that the freedom of expression in Finland includes the right to disclose published information without further restrictions by data protection. It must also be borne in mind that the processing of published information affects the right to privacy less than the processing of confidential information. To that extent, the Member States certainly have a broad margin of discretion.
124. However, the margin of discretion cannot lead to the legitimation of manifestly disproportionate interference in the right to privacy by exceptions to data protection. For example, the further processing of personal information which is proved to be false cannot be justified by the fact that it has been published.
125. In addition, Article 13 of the Data Protection Directive does not permit derogations from all the provisions of the Directive. The derogations are limited to the fundamental requirements of Article 6(1) concerning data processing and the right to information under Articles 10, 11(1) and 12, as well as the publicising of data-processing operations under Article 21.
126. Therefore the reply to the fourth question must be that personal data files containing only media-published material as such fall within the scope of the Data Protection Directive.
127. However, with regard to the fourth question, it must be remembered that the Data Protection Directive alone cannot create obligations of Satakunnan Markkinapörssi Oy and Satamedia Oy. For that, a basis is necessary in national law, which must be interpreted in conformity with the Directive, but not contra legem. (71)
V – Conclusion
128. I therefore propose that the Court should reply to the request for a preliminary ruling as follows:
(1) An operation is to be regarded as the processing of personal data within the meaning of Article 3(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data if the data of natural persons relating to their earned income, income from capital and wealth, as described in the reference for a preliminary ruling, are:
(a) collected from documents in the public domain held by the tax authorities and processed for publication,
(b) published alphabetically in a printed publication by income bracket and municipality in the form of extensive lists,
(c) disclosed onward on CD-ROM to be used for commercial purposes, or
(d) processed for the purposes of a text-messaging service whereby mobile phone users can, by indicating an individual’s name and home municipality and texting to a given number, receive in reply data on the earned income, income from capital and wealth of the individual indicated.
(2) The processing of personal data serves journalistic purposes within the meaning of Article 9 of Directive 95/46 within the meaning of that provision when it aims to communicate information and ideas on matters of public interest. Whether and, if so, to what extent the processing of the tax data which are the subject of the main proceedings serves journalistic purposes must be determined by the national court in the light of all the available objective information.
(3) Article 17 of Directive 95/46 contains no rule as to whether data collected for journalistic purposes may be published and disclosed for processing for commercial purposes.
(4) Personal data files containing only media-published material as such fall within the scope of Directive 95/46.