In Finland, the details of taxes paid by individuals are made publicly available. The Finnish company, Satakunnan Markkinapörssi Oy (“Markkinapörssi”), collects public data from the Finnish tax authorities for the purpose of publishing extracts from this data in the regional newspaper each year. The information contained in these publications comprise the name (first name and surname) of approximately 1.2 million individuals whose income exceed certain thresholds, as well as the amount to the nearest 100 EUR, of their earned and unearned income. The publications also contain details relating to the wealth tax levied on these persons. Such information is set out in the form of an alphabetical list, and is organised according to municipality and income bracket. The newspaper’s main purpose is to publish personal tax information.
Markkinapörssi transferred the personal data published in the newspaper on CD-ROM discs, to Satamedia Oy (“Satamedia”), which is owned by the same shareholders. The information was provided for this data to be disseminated by a text-messaging system. These companies signed an agreement with a mobile telephony company which put in place, on Satamedia’s behalf, a text-messaging service allowing mobile telephone users to receive information published in the newspaper on their telephone, for a charge of approximately 2 EUR. Personal data can be removed from the service on request.
Following complaints from individuals alleging infringement of their right to privacy, the Finnish Data Protection Ombudsman responsible for investigating the activities of Markkinapörssi and Satamedia requested an order to prohibit Satamedia from processing personal data in this way. The Data Protection Ombudsman brought the request for an order before the Supreme Administrative Court, which in turn, asked the European Court of Justice (“ECJ”) to rule on the interpretation of the Data Protection Directive (95/46/EC) (the “Directive”).
The Supreme Administrative Court asked the ECJ whether the activities described above can be regarded as ‘processing personal data’ within the meaning of Article 3(1) of the Directive, and whether the Directive should be interpreted in such a way that personal data files containing, solely and in unaltered form, material that has already been published in the media, fall outside of its scope.
The most interesting question raised by the Supreme Administrative Court was whether these activities could be regarded as ‘processing personal data’ carried out solely for journalistic purposes within the meaning of Article 9 of the Directive.
The ECJ ruled in its judgment (Case C-73/07) that the data in question should be regarded as ‘personal data’ within the meaning of Article 2(a) of the Directive, since the data constitute information relating to an identified or identifiable natural person.
As to the Directive’s scope, the ECJ referred to Article 3(2) which defines the scope of the Directive, and stated that processing personal data on data files which contain material that has already been published in the media, falls within the scope of the application of the Directive.
In response to the question of whether these activities can be regarded as processing personal data carried out solely for journalistic purposes the court sought to balance various rights. The ECJ said that the objective of the Directive is that Member States should, while permitting the free flow of personal data, protect the fundamental rights and freedoms of natural persons and in particular their right to privacy, when processing personal data. The ECJ continued by stating that the objective of the Directive cannot be pursued without taking into account the fact that such fundamental rights must be reconciled with the fundamental right to freedom of expression to some degree.
In order to reconcile these two fundamental rights, Member States are required to provide a number of derogations or limitations in relation to the protection of data and, therefore, in relation to the fundamental right to privacy. The ECJ’s view was that these derogations must be made solely for journalistic purposes or the purpose of artistic or literary expression insofar as it is apparent that they are necessary in order to reconcile the right to privacy with freedom of expression.
The ECJ said that, in order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret concepts connected to that freedom such as journalism broadly. Secondly, the ECJ stated that the protection of the fundamental right to privacy requires that the derogations and limitations in relation to the protection of data must apply only where strictly necessary.
The ECJ ruled that activities, such as those involved in the main proceedings, (relating to data from documents which are in the public domain under national legislation), may be classified as ‘journalistic activities’ if their object is disclosure of information, opinion or ideas to the public, irrespective of the medium which is used to transmit them. They are not limited to media undertakings and may be undertaken for profit-making purposes.
The ECJ said, as an answer to the Finnish Supreme Administrative Court, that if the sole object of the activities is to disclose information, opinions or ideas to the public, then these activities should be regarded as processing personal data carried out solely for journalistic purposes. The Supreme Administrative Court must now determine whether this is the case.