JUDGMENT OF THE COURT (Grand Chamber)
16 December 2008 (*)
(Directive 95/46/EC – Scope – Processing and flow of tax data of a personal nature – Protection of natural persons – Freedom of expression)
In Case C‑73/07,
REFERENCE for a preliminary ruling under Article 234 EC from the Korkein hallinto-oikeus (Finland), made by decision of 8 February 2007, received at the Court on 12 February 2007, in the proceedings
Tietosuojavaltuutettu
v
Satakunnan Markkinapörssi Oy,
Satamedia Oy,
THE COURT (Grand Chamber),
composed of V. Skouris, President, P. Jann, C.W.A. Timmermans, A. Rosas, K. Lenaerts and A. Ó Caoimh, Presidents of Chambers, P. Kūris, E. Juhász, G. Arestis, A. Borg Barthet, J. Klučka, U. Lõhmus and E. Levits (Rapporteur), Judges,
Advocate General: J. Kokott,
Registrar: C. Strömholm, Administrator,
having regard to the written procedure and further to the hearing on 12 February 2008,
after considering the observations submitted on behalf of:
– Satakunnan Markkinapörssi Oy and Satamedia Oy, by P. Vainio, asianajaja,
– the Finnish Government, by J. Heliskoski, acting as Agent,
– the Estonian Government, by L. Uibo, acting as Agent,
– the Portuguese Government, by L.I. Fernandes and C. Vieira Guerra, acting as Agents,
– the Swedish Government, by A. Falk and K. Petkovska, acting as Agents,
– the Commission of the European Communities, by C. Docksey and P. Aalto, acting as Agents,
after hearing the Advocate General at the sitting on 8 May 2008,
gives the following
Judgment
1 This reference for a preliminary ruling relates to the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) (‘the directive’).
2 The reference was made in proceedings between the Tietosuojavaltuutettu (Data Protection Ombudsman) and the Tietosuojalautakunta (Data Protection Board) relating to activities involving the processing of personal data undertaken by Satakunnan Markkinapörssi Oy (‘Markkinapörssi’) and Satamedia Oy (‘Satamedia’).
Legal context
Community legislation
3 As is apparent from Article 1(1) of the directive, its objective is to protect the fundamental rights and freedoms of natural persons, and, in particular, their right to privacy with respect to the processing of personal data.
4 Article 1(2) of the directive states:
‘Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1.’
5 Article 2 of the directive, entitled ‘Definitions’, provides:
‘For the purposes of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
(c)
“personal data filing system” (“filing system”) shall mean any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
…’
6 Article 3 of the directive defines its scope of application in the following manner:
‘1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.
2. This Directive shall not apply to the processing of personal data:
– in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,
– by a natural person in the course of a purely personal or household activity.’
7 The relationship between the protection of personal data and freedom of expression is governed by Article 9 of the directive, entitled ‘Processing of personal data and freedom of expression’, in the following terms:
‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’
8 In that connection, recital 37 in the preamble to the directive is worded as follows:
‘Whereas the processing of personal data for purposes of journalism or for purposes of literary or artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of [expression] and notably the right to receive and impart information, as guaranteed in particular in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; whereas Member States should therefore lay down exemptions and derogations necessary for the purpose of balance between fundamental rights as regards general measures on the legitimacy of data processing, measures on the transfer of data to third countries and the power of the supervisory authority; whereas this should not, however, lead Member States to lay down exemptions from the measures to ensure security of processing; whereas at least the supervisory authority responsible for this sector should also be provided with certain ex-post powers, e.g. to publish a regular report or to refer matters to the judicial authorities.’
9 Article 13 of the directive, entitled ‘Exemptions and restrictions’, states:
‘1. Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measure to safeguard:
(a) national security;
…’
10 Article 17 of the directive, entitled ‘Security of processing’, provides:
‘1. Member States shall provide that the controller must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected.
2. The Member States shall provide that the controller must, where processing is carried out on his behalf, choose a processor providing sufficient guarantees in respect of the technical security measures and organisational measures governing the processing to be carried out, and must ensure compliance with those measures.
…’
National legislation
11 Paragraph 10(1) of the Constitution (Perustuslaki (731/1999)) of 11 June 1999 states:
‘The right to privacy, honour and the inviolability of the home of every person shall be guaranteed. More detailed provisions on the protection of personal data shall be laid down by law.’
12 Paragraph 12 of the Constitution provides:
‘Everyone shall have the right to freedom of expression. Freedom of expression entails the right to express oneself and to disseminate and receive information, opinions and other communications without prior hindrance. More detailed provisions relating to the exercise of the right to freedom of expression shall be laid down by law. …’
Documents and other records in the possession of the authorities shall be in the public domain, unless specifically restricted by law for compelling reasons. Every person shall have the right of access to public documents and records.’
13 The Law on personal data (Henkilötietolaki (523/1999)) of 22 April 1999, which transposed the directive into national law, applies to the processing of those data (Paragraph 2(1)), apart from personal data files which contain solely, and in unaltered form, material that has been published in the media (Paragraph 2(4)). It applies only in part to the processing of personal data for journalistic purposes and for the purpose of artistic or literary expression (Paragraph 2(5)).
14 Paragraph 32 of the Law on personal data provides that the controller is to take all technical and organisational measures necessary in order to protect personal data against unauthorised access to those data, and their accidental or unlawful destruction, alteration, disclosure or transfer, together with any other unlawful processing of those data.
15 The Law on public access in relation to official activities (Laki viranomaisten toiminnan julkisuudesta (621/1999)) of 21 May 1999 also governs access to information.
16 Paragraph 1(1) of the Law on public access in relation to official activities states that the general principle is that documents covered by that law are to be in the public domain.
17 Paragraph 9 of that law provides that every person is to have the right of access to a public document held by the public authorities.
18 Paragraph 16(1) of that law lays down the detailed rules governing access to a document of that kind. It provides that the public authorities are to explain the contents of the document orally, make the document available in their offices where it may be studied, copied or listened to, or issue a copy or a print-out of the document concerned.
19 Paragraph 16(3) of that law specifies the circumstances in which data in files containing personal data kept by the public authorities may be disclosed:
‘A file containing personal data may be disclosed in the form of a print-out, or those data may be disclosed in electronic form, unless provided otherwise by law, if the recipient is authorised to store and use such data by virtue of the provisions governing the protection of personal data. However, access to personal data for the purposes of direct marketing, market surveys or market research shall not be permitted unless specifically provided for by law or if the data subject has given his consent.’
20 The national court states that the provisions of the Law on the public disclosure and confidentiality of tax information (Laki verotustietojen julkisuudesta ja salassapidosta (1346/1999)) of 30 December 1999 are to prevail over those of the Law on personal data and the Law on public access in relation to official activities.
21 Paragraph 2 of the Law on the public disclosure and confidentiality of tax information provides that the provisions of the Law on public access in relation to official activities and the Law on personal data are to apply to documents and information relating to tax matters, save as may be otherwise provided in a legislative measure.
22 Paragraph 3 of the Law on the public disclosure and confidentiality of tax information states:
‘Information relating to tax matters shall be in the public domain in accordance with the detailed rules laid down in this law.
Every person shall have the right to obtain access to a document relating to tax matters which is in the public domain and held by the tax authorities, in accordance with the detailed rules laid down in the Law on public access in relation to official activities, subject to the exceptions laid down in this law.’
23 Paragraph 5(1) of the Law on the public disclosure and confidentiality of tax information provides that details of the taxpayer’s name, his date of birth and his municipality of residence, as set out in his annual tax return, are to be in the public domain. The following information is also in the public domain:
‘1. Earned income for the purposes of national taxation;
2. Unearned income and income from property for the purposes of national taxation;
3. Earned income for the purposes of municipal taxation;
4. Taxes on income and property, municipal taxes and the total amount of taxes and charges levied.
…’
24 Lastly, Paragraph 8 of Chapter 24 of the Criminal Code (Rikoslaki), in the version brought into force by Law 531/2000, imposes penalties in respect of the disclosure of information which infringes an individual’s right to privacy. Under those provisions, it is an offence to disseminate, through the media or otherwise, any information, innuendo or images relating to the private life of another person where to do so would be liable to cause harm or suffering to the person concerned or to bring that person into disrepute.
The dispute in the main proceedings and the questions referred
25 For several years, Markkinapörssi has collected public data from the Finnish tax authorities for the purposes of publishing extracts from those data in the regional editions of the Veropörssi newspaper each year.
26 The information contained in those publications comprises the surname and given name of approximately 1.2 million natural persons whose income exceeds certain thresholds as well as the amount, to the nearest EUR 100, of their earned and unearned income and details relating to wealth tax levied on them. That information is set out in the form of an alphabetical list and organised according to municipality and income bracket.
27 According to the order for reference, the Veropörssi newspaper carries a statement that the personal data disclosed may be removed on request and without charge.
28 While that newspaper also contains articles, summaries and advertisements, its main purpose is to publish personal tax information.
29 Markkinapörssi transferred personal data published in the Veropörssi newspaper, in the form of CD-ROM discs, to Satamedia, which is owned by the same shareholders, with a view to those data being disseminated by a text-messaging system. In that connection, those companies signed an agreement with a mobile telephony company which put in place, on Satamedia’s behalf, a text-messaging service allowing mobile telephone users to receive information published in the Veropörssi newspaper on their telephone, for a charge of approximately EUR 2. Personal data are removed from that service on request.
30 The Tietosuojavaltuutettu and the Tietosuojalautakunta, who are the Finnish authorities responsible for data protection, supervise the processing of personal data and have the regulatory powers laid down in the Law on personal data.
31 Following complaints from individuals alleging infringement of their right to privacy, on 10 March 2004, the Tietosuojavaltuutettu responsible for investigating the activities of Markkinapörssi and Satamedia requested the Tietosuojalautakunta to prohibit the latter from carrying on the personal data processing activities at issue.
32 That request having been rejected by the Tietosuojalautakunta, the Tietosuojavaltuutettu brought proceedings before the Helsingin hallinto-oikeus (Administrative Court, Helsinki), which also rejected his application. The Tietosuojavaltuutettu then brought an appeal before the Korkein hallinto-oikeus (Supreme Administrative Court).
33 The national court emphasises that the appeal brought by the Tietosuojavaltuutettu does not concern the transfer of information by the Finnish authorities. It also states that the public nature of the tax data in question is not at issue. On the other hand, it has concerns as regards the subsequent processing of those data.
34 In those circumstances, it decided to stay the proceedings and to refer the following questions to the Court for a preliminary ruling:
‘(1) Can an activity in which data relating to the earned and unearned income and assets of natural persons are:
(a) collected from documents in the public domain held by the tax authorities and processed for publication,
(b) published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
(c) transferred onward on CD-ROM to be used for commercial purposes, and
(d) processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the earned and unearned income and assets of that person,
be regarded as the processing of personal data within the meaning of Article 3(1) of [the directive]?
(2) Is [the directive] to be interpreted as meaning that the various activities listed in Question 1(a) to (d) can be regarded as the processing of personal data carried out solely for journalistic purposes within the meaning of Article 9 of the directive, having regard to the fact that data on over one million taxpayers have been collected from information which is in the public domain under national legislation on the right of public access to information? Does the fact that publication of those data is the principal aim of the operation have any bearing on the assessment in this case?
(3) Is Article 17 of [the directive] to be interpreted in conjunction with the principles and purpose of the directive as precluding the publication of data collected for journalistic purposes and its onward transfer for commercial purposes?
(4) Is [the directive] to be interpreted as meaning that personal data files containing, solely and in unaltered form, material that has already been published in the media fall altogether outside its scope?’
The questions referred
The first question
35 It must be held that the data to which this question relates, which comprise the surname and given name of certain natural persons whose income exceeds certain thresholds as well as the amount, to the nearest EUR 100, of their earned and unearned income, constitute personal data within the meaning of Article 2(a) of the directive, since they constitute ‘information relating to an identified or identifiable natural person’ (see also Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 64).
36 It is sufficient to hold, next, that it is clear from the wording itself of the definition set out in Article 2(b) of the directive that the activity to which the question relates involves the ‘processing of personal data’ within the meaning of that provision.
37 Consequently, the answer to the first question must be that Article 3(1) of the directive is to be interpreted as meaning that an activity in which data on the earned and unearned income and the assets of natural persons are:
– collected from documents in the public domain held by the tax authorities and processed for publication,
– published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
– transferred onward on CD-ROM to be used for commercial purposes, and
– processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the earned and unearned income and assets of that person,
must be considered as the ‘processing of personal data’ within the meaning of that provision.
The fourth question
38 By its fourth question, which should be examined next, the national court asks, in essence, whether activities involving the processing of personal data such as those referred to at points (c) and (d) of the first question and relating to personal data files which contain solely, and in unaltered form, material that has already been published in the media, fall within the scope of application of the directive.
39 By virtue of Article 3(2) of the directive, the directive does not apply to the processing of personal data in two situations.
40 The first situation involves the processing of personal data undertaken in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and, in any case, to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law.
41 Those activities, which are mentioned by way of example in the first indent of Article 3(2) are, in any event, activities of the State or of State authorities unrelated to the fields of activity of individuals. They are intended to define the scope of the exception provided for there, with the result that that exception applies only to the activities which are expressly listed there or which can be classified in the same category (ejusdem generis) (see Case C-101/01 Lindqvist [2003] ECR I-12971, paragraphs 43 and 44).
42 Activities involving the processing of personal data of the kind referred to at points (c) and (d) of the first question concern the activities of private companies. Those activities do not fall in any way within a framework established by the public authorities that relates to public security. Consequently, such activities cannot be assimilated to those covered by Article 3(2) of the directive (see, to that effect, Joined Cases C-317/04 and C-318/04 Parliament v Council [2006] ECR I‑4721, paragraph 58).
43 As regards the second situation, which is covered by the second indent of that provision, recital 12 in the preamble to the directive – relating to that exception – mentions as examples of data processing carried out by a natural person in the course of a purely personal or household activity, correspondence and the holding of records of addresses.
44 It follows that the latter exception must be interpreted as relating only to activities which are carried out in the course of private or family life of individuals (see Lindqvist, paragraph 47). That clearly does not apply to the activities of Markkinapörssi and Satamedia, the purpose of which is to make the data collected accessible to an unrestricted number of people.
45 It must therefore be held that activities involving the processing of personal data of the kind referred to at points (c) and (d) of the first question are not covered by any of the situations referred to in Article 3(2) of the directive.
46 Moreover, it should be pointed out that the directive does not lay down any further limitation of its scope of application.
47 In that regard, the Advocate General observes at point 125 of her Opinion that Article 13 of the directive permits derogations from its provisions only in certain cases, which do not extend to the provisions of Article 3.
48 Lastly, it must be held that a general derogation from the application of the directive in respect of published information would largely deprive the directive of its effect. It would be sufficient for the Member States to publish data in order for those data to cease to enjoy the protection afforded by the directive.
49 The answer to the fourth question should therefore be that activities involving the processing of personal data such as those referred to at points (c) and (d) of the first question and relating to personal data files which contain solely, and in unaltered form, material that has already been published in the media, fall within the scope of application of the directive.
The second question
50 By its second question, the national court asks, in essence, whether Article 9 of the directive should be interpreted as meaning that the activities referred to at points (a) to (d) of the first question, relating to data from documents which are in the public domain under national legislation, must be considered as activities involving the processing of personal data carried out solely for journalistic purposes. The national court states that it seeks clarification as to whether the fact that the principal aim of those activities is the publication of the data in question is relevant to the determination of that issue.
51 It must be observed, as a preliminary point, that, according to settled case-law, the provisions of a directive must be interpreted in the light of the aims pursued by the directive and the system it establishes (see, to that effect, Case C-265/07 Caffaro [2008] ECR I-0000, paragraph 14).
52 In that regard, it is not in dispute that, as is apparent from Article 1 of the directive, its objective is that the Member States should, while permitting the free flow of personal data, protect the fundamental rights and freedoms of natural persons and, in particular, their right to privacy, with respect to the processing of personal data.
53 That objective cannot, however, be pursued without having regard to the fact that those fundamental rights must, to some degree, be reconciled with the fundamental right to freedom of expression.
54 Article 9 of the directive refers to such a reconciliation. As is apparent, in particular, from recital 37 in the preamble to the directive, the object of Article 9 is to reconcile two fundamental rights: the protection of privacy and freedom of expression. The obligation to do so lies on the Member States.
55 In order to reconcile those two ‘fundamental rights’ for the purposes of the directive, the Member States are required to provide for a number of derogations or limitations in relation to the protection of data and, therefore, in relation to the fundamental right to privacy, specified in Chapters II, IV and VI of the directive. Those derogations must be made solely for journalistic purposes or the purpose of artistic or literary expression, which fall within the scope of the fundamental right to freedom of expression, in so far as it is apparent that they are necessary in order to reconcile the right to privacy with the rules governing freedom of expression.
56 In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary, first, to interpret notions relating to that freedom, such as journalism, broadly. Secondly, and in order to achieve a balance between the two fundamental rights, the protection of the fundamental right to privacy requires that the derogations and limitations in relation to the protection of data provided for in the chapters of the directive referred to above must apply only in so far as is strictly necessary.
57 In that context, the following points are relevant.
58 First, as the Advocate General pointed out at point 65 of her Opinion and as is apparent from the legislative history of the directive, the exemptions and derogations provided for in Article 9 of the directive apply not only to media undertakings but also to every person engaged in journalism.
59 Secondly, the fact that the publication of data within the public domain is done for profit-making purposes does not, prima facie, preclude such publication being considered as an activity undertaken ‘solely for journalistic purposes’. As Markkinapörssi and Satamedia state in their observations and as the Advocate General noted at point 82 of her Opinion, every undertaking will seek to generate a profit from its activities. A degree of commercial success may even be essential to professional journalistic activity.
60 Thirdly, account must be taken of the evolution and proliferation of methods of communication and the dissemination of information. As was mentioned by the Swedish Government in particular, the medium which is used to transmit the processed data, whether it be classic in nature, such as paper or radio waves, or electronic, such as the internet, is not determinative as to whether an activity is undertaken ‘solely for journalistic purposes’.
61 It follows from all of the above that activities such as those involved in the main proceedings, relating to data from documents which are in the public domain under national legislation, may be classified as ‘journalistic activities’ if their object is the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them. They are not limited to media undertakings and may be undertaken for profit-making purposes.
62 The answer to the second question should therefore be that Article 9 of the directive is to be interpreted as meaning that the activities referred to at points (a) to (d) of the first question, relating to data from documents which are in the public domain under national legislation, must be considered as activities involving the processing of personal data carried out ‘solely for journalistic purposes’, within the meaning of that provision, if the sole object of those activities is the disclosure to the public of information, opinions or ideas. Whether that is the case is a matter for the national court to determine.
The third question
63 By its third question, the national court asks, in essence, whether Article 17 of the directive should be interpreted as meaning that it precludes the publication of data which have been collected for journalistic purposes and their onward transfer for commercial purposes.
64 Having regard to the answer given to the second question, there is no need to reply to this question.
Costs
65 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:
1. Article 3(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data is to be interpreted as meaning that an activity in which data on the earned and unearned income and the assets of natural persons are:
– collected from documents in the public domain held by the tax authorities and processed for publication,
– published alphabetically in printed form by income bracket and municipality in the form of comprehensive lists,
– transferred onward on CD-ROM to be used for commercial purposes, and
– processed for the purposes of a text-messaging service whereby mobile telephone users can, by sending a text message containing details of an individual’s name and municipality of residence to a given number, receive in reply information concerning the earned and unearned income and assets of that person,
must be considered as the ‘processing of personal data’ within the meaning of that provision.
2. Article 9 of Directive 95/46 is to be interpreted as meaning that the activities referred to at points (a) to (d) of the first question, relating to data from documents which are in the public domain under national legislation, must be considered as activities involving the processing of personal data carried out ‘solely for journalistic purposes’, within the meaning of that provision, if the sole object of those activities is the disclosure to the public of information, opinions or ideas. Whether that is the case is a matter for the national court to determine.
3. Activities involving the processing of personal data such as those referred to at points (c) and (d) of the first question and relating to personal data files which contain solely, and in unaltered form, material that has already been published in the media, fall within the scope of application of Directive 95/46.
[Signatures]