Request for a preliminary ruling from the Korkein hallinto-oikeus (Finland) lodged on 19 January 2017 — Tietosuojavaltuutettu v Jehovah’s Witnesses — Religious Community
(Case C-25/17)
Language of the case: Finnish
Referring court
Korkein hallinto-oikeus
Parties to the main proceedings
Applicant: Tietosuojavaltuutettu
Defendant: Jehovah’s Witnesses — Religious Community
Questions referred
1. Are the exceptions to the material scope laid down in Article 3(2), second subparagraph, of the Data Protection Directive 1 to be interpreted as meaning that the collection and other processing of personal data carried out by the members of a religious community in connection with door-to-door evangelical work fall outside the scope of that directive? When assessing the applicability of the directive, what significance is to be given to the fact that, on one hand, the evangelical work in connection with which the data is collected is organised by a religious community and its congregations and, on the other, that that data collection is part of the personal religious practice of members of a religious community?
2. Is the definition of personal data filing system in Article 2(c) of the Data Protection Directive, taking account of recitals 26 and 27 thereto, to be interpreted as meaning that, taken as a whole, the manual collection of personal data (name and address and other information and characteristics of a person) carried out in connection with door to door evangelical work
(a) does not constitute a personal data filing system on the ground that card indexes, directories or other comparable search methods are not expressly included in the definition laid down in the Finnish Law on personal data? or
(b) constitutes such a data filing system on the ground that, taking account of the intended use, the information required for later use may in fact be extracted from those data easily and at reasonable cost as required by the Finnish Law on personal data?
3. Is the phrase ‘alone or jointly with others determines the purposes and means of the processing of personal data’ in Article 2(d) of the Data Protection Directive to be interpreted as meaning that a religious community which organises the activity in connection with which personal data is collected (inter alia by dividing up the areas in which the activity is carried out among members involved in evangelical work, supervising the work of those members and maintaining a list of individuals who do not wish to receive visits from evangelists) may be regarded as a controller, on account of the processing of personal data carried out by its members, even though the religious community claims that only the individual members carrying out evangelical work have access to the data collected.
4. Is Article 2(d) to be interpreted as meaning that in order for a religious community to be considered a controller other specific actions are required, such as giving instructions or written guidelines governing the collection of data, or is it sufficient that that religious community is regarded as having de facto control of the activities of its members?
It is necessary to answer Questions 3 and 4 only if, on the basis of the answers to Questions 1 and 2, the directive is applicable. It is necessary to answer Question 4 only if, on the basis of Question 3, the application of Article 2(d) of the Directive to the Religious Community cannot be excluded.
____________1 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).