–

Mr Buivids, by himself,

–

the Latvian Government, by I. Kucina, G. Bambāne, E. Petrocka-Petrovska and E. Plaksins, acting as Agents,

–

the Czech Government, by M. Smolek, J. Vláčil and O. Serdula, acting as Agents,

–

the Italian Government, by G. Palmieri, acting as Agent, and by M. Russo, avvocato dello Stato,

–

the Austrian Government, by G. Eberhard, acting as Agent,

–

the Polish Government, by B. Majczyna, acting as Agent,

–

the Portuguese Government, by L. Inez Fernandes, M. Figueiredo and C. Vieira Guerra, acting as Agents,

–

the Swedish Government, by A. Falk, C. Meyer-Seitz, P. Smith, H. Shev, L. Zettergren and A. Alriksson, acting as Agents,

–

the European Commission, by D. Nardi and I. Rubene, acting as Agents,

1

This request for a preliminary ruling relates to the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), and in particular of Article 9 thereof.

2

The request has been made in proceedings between Mr Sergejs Buivids and the Datu valsts inspekcija (National Data Protection Agency, Latvia) concerning an action seeking a declaration as to the illegality of a decision of that authority, according to which Mr Buivids infringed national law by publishing a video, filmed by him, on the internet site www.youtube.com of the statement which he made in the context of administrative proceedings involving the imposition of a penalty in a station of the Latvian national police.

3

Prior to its repeal by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (OJ 2016 L 119, p. 1), Directive 95/46, which, according to Article 1 thereof, had the object of protecting the fundamental rights and freedoms of individuals, notably their right to privacy, with regard to the processing of personal data, and the elimination of obstacles to the free movement of such data, stated in recitals 2, 14, 15, 17, 27 and 37:

…

…

…

…

4

Article 2 of Directive 95/46 provided:

‘For the purposes of this Directive:

…

…’

5

Article 3 of that directive, headed ‘Scope’, provided:

‘1.   This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.

2.   This Directive shall not apply to the processing of personal data:

6

Article 7 of that directive was worded as follows:

‘Member States shall provide that personal data may be processed only if:

…

7

Article 9 of that directive provided:

‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’

8

Pursuant to Article 1 of the Fizisko personu datu aizsardzības likums (Personal Data Protection Law) of 23 March 2000 (Latvijas Vēstnesis, 2000, No 123/124; ‘the Personal Data Protection Law’), the purpose of that law is to protect the fundamental rights and freedoms of natural persons, and in particular their privacy, with regard to the processing of personal data of individuals.

9

Pursuant to Article 2(3) the Personal Data Protection Law, the term ‘personal data’ is to be taken to mean any information concerning an identified or identifiable natural person.

10

Under Article 2(4) of that law, the term ‘processing of personal data’ refers to any operation applied to personal data, including the collection, recording, insertion, storage, organisation, alteration, use, transfer, transmission and dissemination, blocking or deletion of data.

11

Article 3(1) of the Personal Data Protection Law provides that that law, without prejudice to the exceptions provided for in that provision, applies to the processing of every kind of personal data and to every natural or legal person, if:

12

Article 3(3) of that law provides that the latter does not apply to the processing of personal data carried out by natural persons for personal or domestic and family use.

13

Under Article 5 of the Personal Data Protection Law, save as otherwise provided, Articles 7 to 9, 11 and 21 of that law are not to apply when the personal data are processed for journalistic purposes in accordance with the Par presi un citiem masu informācijas līdzekļiem likums (Law on the press and other media) or for purposes of artistic or literary expression.

14

Article 8(1) of the Personal Data Protection Law provides that, when collecting personal data, the data controller is required to provide the data subject with the following information, unless that person already possesses that information:

15

Mr Buivids made a video recording in a station of the Latvian national police while he was making a statement in the context of administrative proceedings which had been brought against him.

16

Mr Buivids published the recorded video (‘the video in question’), which showed police officers going about their duties in the police station, on the internet site www.youtube.com, which is an internet site that allows users to publish, share and watch videos.

17

After that video had been published, the National Data Protection Agency found, by decision of 30 August 2013, that Mr Buivids had infringed Article 8(1) of the Personal Data Protection Law because he had not informed the police officers, as persons concerned, in the manner laid down by that provision, of the intended purpose of the processing of personal data concerning them. It is submitted that Mr Buivids also failed to provide any information to the National Data Protection Agency as to the purpose of the recording and publication of the recorded video on an internet site such as to prove that the objective pursued was compliant with the provisions of the Personal Data Protection Law. The National Data Protection Agency therefore requested Mr Buivids to remove that video from the internet site www.youtube.com and from other websites.

18

Mr Buivids brought an action before the administratīvā rajona tiesa (District Administrative Court, Latvia) seeking a declaration that that decision of the National Data Protection Agency was unlawful and claiming compensation for the harm which he claimed to have suffered. Mr Buivids stated in his application that he had wished, by the publication of the video in question, to bring to the attention of society something which he considered to constitute unlawful conduct on the part of the police. That court dismissed the action.

19

By judgment of 11 November 2015, the Administratīvā apgabaltiesa (Regional Administrative Court, Latvia) dismissed the appeal brought by Mr Buivids against the decision of the administratīvā rajona tiesa (District Administrative Court).

20

The Administratīvā apgabaltiesa (Regional Administrative Court) based its decision on the fact that, in the video in question, it is possible to see police facilities and a number of police officers performing their duties, to hear the conversation with the police officers, which was recorded whilst they were carrying out procedural matters, and to hear the voices of the police officers, Mr Buivids and the person accompanying him.

21

Furthermore, that court held that it was not possible to determine whether Mr Buivids’ right to freedom of expression or the right to privacy of other persons had to take precedence, since Mr Buivids had not indicated his objective in publishing the video in question. Likewise, the video did not show current events relevant to society or dishonest conduct on the part of the police officers. As Mr Buivids had not recorded the video in question for journalistic purposes under the Law on the press and other media, or for purposes of artistic or literary expression, Article 5 of the Personal Data Protection Law was, in that court’s view, not applicable.

22

The Administratīvā apgabaltiesa (Regional Administrative Court) therefore concluded that Mr Buivids had infringed Article 8(1) of the Personal Data Protection Law by making a recording of police officers carrying out their duties and by not informing those officers of the specific purpose of the processing of their personal data.

23

Mr Buivids filed an appeal in cassation before the referring court, the Augstākā tiesa (Supreme Court, Latvia), against the judgment of the Administratīvā apgabaltiesa (Regional Administrative Court), invoking his right to freedom of expression.

24

Mr Buivids has stated, inter alia, that the video in question shows public officials of the Latvian national police –– namely public persons in a place accessible to the public –– who, on that ground, fall outside the scope of the Personal Data Protection Law.

25

The referring court expresses doubts, first, as to whether the act of filming police officers while they are carrying out their duties in a police station and the act of publishing that recorded video on the internet are matters which come within the scope of Directive 95/46. In that connection, although the referring court considers that Mr Buivids’ conduct does not come within the scope of the exceptions to the scope of that directive, as set out in Article 3(2) thereof, that court nevertheless emphasises that the recording at issue in the present case was made only once and that Mr Buivids filmed police officers carrying out their public duties, namely whilst they were acting as representatives of the public authorities. Referring to point 95 of the Opinion of Advocate General Bobek in the case Rīgas satiksme (C‑13/16, EU:C:2017:43), the referring court maintains that the main concern that justifies the protection of personal data is the risk involved in large-scale processing.

26

Secondly, the referring court seeks guidance on the interpretation of the concept ‘solely for journalistic purposes’ in Article 9 of Directive 95/46, and the question of whether the facts, such as those alleged against Mr Buivids, are covered by that concept.

27

In those circumstances, the Augstākā tiesa (Supreme Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

28

By its first question, the referring court asks, in essence, whether Article 3 of Directive 95/46 must be interpreted as meaning that the recording of a video of police officers in a police station, while a statement is being made, and the publication of that video on a video website, on which users can send, watch and share videos, are matters which come within the scope of that directive.

29

It should be noted that, pursuant to Article 3(1) thereof, Directive 95/46 applies to ‘the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system’.

30

The concept of ‘personal data’ within the meaning of that provision encompasses, according to the definition in Article 2(a) of that directive, ‘any information relating to an identified or identifiable natural person’. An identifiable person is ‘one who can be identified, directly or indirectly, in particular by reference to … one or more factors specific to his physical … identity’.

31

According to the case-law of the Court, the image of a person recorded by a camera constitutes ‘personal data’ within the meaning of Article 2(a) of Directive 95/46 inasmuch as it makes it possible to identify the person concerned (see, to that effect, judgment of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraph 22).

32

In the present case, it is apparent from the order for reference that it is possible to see and hear the police officers in the video in question, with the result that it must be held that those recorded images of persons constitute personal data within the meaning of Article 2(a) of Directive 95/46.

33

As regards the concept of the ‘processing of personal data’, this is defined in Article 2(b) of Directive 95/46 as ‘any operation or set of operations which is performed upon personal data … such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction’.

34

In the context of a video-surveillance system, the Court has held that a video recording of persons which is stored on a continuous recording device — the hard disk drive of that system — constitutes, pursuant to Article 2(b) and Article 3(1) of Directive 95/46, the automatic processing of personal data (see, to that effect, judgment of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraphs 23 and 25).

35

At the hearing before the Court of Justice, Mr Buivids stated that he had used a digital photo camera to record the video in question. This is a video recording of persons which is stored on a continuous recording device, namely the memory of that camera. Thus, such a recording constitutes a processing of personal data by automatic means within the meaning of Article 3(1) of that directive.

36

In that connection, the fact that such a recording was made on only one occasion has no bearing on the issue of whether that operation comes within the scope of Directive 95/46. As is apparent from the wording of Article 2(b) of that directive, read in conjunction with Article 3(1) thereof, that directive applies to ‘any operation’ which constitutes the processing of personal data within the meaning of those provisions.

37

The Court has held that the operation of loading personal data onto an internet page must be regarded as constituting such processing (see, to that effect, judgments of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 25, and of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 26).

38

In that connection, the Court has also specified that placing information on an internet page entails the operation of loading that page onto a server and the operations necessary to make that page accessible to people who are connected to the internet. Such operations are performed, at least in part, automatically (see, to that effect, judgment of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 26).

39

Thus, it must be held that the act of publishing a video recording, such as the video in question, which contains personal data, on a video website on which users can send, watch and share videos, constitutes processing of those data wholly or partly by automatic means, within the meaning of Article 2(b) and Article 3(1) of Directive 95/46.

40

Furthermore, in accordance with Article 3(2) of Directive 95/46, the latter does not apply to two types of processing of personal data. The first of these is the processing of data for the exercise of an activity which falls outside the scope of EU law, such as those provided for by Titles V and VI of the Treaty on European Union, in its version prior to the entry into force of the Treaty of Lisbon, and in any event processing operations which concern public security, defence, State security and the activities of the State in areas of criminal law. Secondly, that provision excludes the processing of personal data by a natural person in the course of a purely personal or household activity.

41

In so far as they render inapplicable the system of protection of personal data provided for in Directive 95/46 and thus deviate from the objective underlying it, namely to ensure the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data, such as the right to respect for private and family life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’), the exceptions provided for in Article 3(2) of that directive must be interpreted strictly (see, to that effect, judgments of 27 September 2017, Puškár, C‑73/16, EU:C:2017:725, paragraph 38, and of 10 July 2018, Jehovan todistajat, C‑25/17, EU:C:2018:551, paragraph 37).

42

With regard to the main proceedings, it is apparent from the information submitted to the Court that, first, the recording and publication of the video in question cannot be regarded as a processing of personal data in the exercise of an activity which falls outside the scope of EU law, nor can it be understood as a processing operation which concerns public security, defence, State security and the activities of the State in areas of criminal law, within the meaning of the first indent of Article 3(2) of Directive 95/46. In that regard, the Court has held that the activities which are mentioned by way of example in that article are, in any event, activities of the State or of State authorities unrelated to the fields of activity of individuals (see, to that effect, judgment of 27 September 2017, Puškár, C‑73/16, EU:C:2017:725, paragraph 36 and the case-law cited).

43

Secondly, since Mr Buivids published the video in question on a video website on which users can send, watch and share videos, without restricting access to that video, thereby permitting access to personal data to an indefinite number of people, the processing of personal data at issue in the main proceedings does not come within the context of purely personal or household activities (see, by analogy, judgments of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 47; of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 44; of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraphs 31 and 33; and of 10 July 2018, Jehovan todistajat, C‑25/17, EU:C:2018:551, paragraph 42).

44

Moreover, the act of recording a video of police officers in the performance of their duties is not capable of excluding such a type of processing of personal data from coming within the scope of Directive 95/46.

45

As the Advocate General observes in point 29 of her Opinion, that directive contains no express exception which excludes the processing of personal data of public officials from its scope.

46

Furthermore, it is apparent from the Court’s case-law that the fact that information is provided as part of a professional activity does not mean that it cannot be characterised as ‘personal data’ (see, to that effect, judgment of 16 July 2015, ClientEarth and PAN Europe v EFSA, C‑615/13 P, EU:C:2015:489, paragraph 30 and the case-law cited).

47

In the light of the foregoing, the answer to the first question is that Article 3 of Directive 95/46 must be interpreted as meaning that the recording of a video of police officers in a police station, while a statement is being made, and the publication of that video on a video website, on which users can send, watch and share videos, are matters which come within the scope of that directive.

48

By its second question, the referring court asks, in essence, whether Article 9 of Directive 95/46 must be interpreted as meaning that factual circumstances such as those of the main proceedings, that is to say, the recording of a video of police officers in a police station, while a statement is being made, and the publication of that recorded video on a video website, on which users can send, watch and share videos, constitute processing of personal data for journalistic purposes, within the meaning of that provision.

49

It must be observed, as a preliminary point, that, according to settled case-law of the Court, the provisions of a directive must be interpreted in the light of the aims pursued by the directive and the system which it establishes (judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 51 and the case-law cited).

50

In that regard, it is apparent from Article 1 of Directive 95/46 that its objective is that the Member States should, while permitting the free flow of personal data, protect the fundamental rights and freedoms of natural persons and, in particular, their right to privacy, with respect to the processing of personal data. That objective cannot, however, be pursued without having regard to the fact that those fundamental rights must, to some degree, be reconciled with the fundamental right to freedom of expression. Recital 37 of Directive 95/46 makes it clear that Article 9 seeks to reconcile two fundamental rights: the protection of privacy and freedom of expression. This is a task for the Member States (see, to that effect, judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraphs 52 to 54).

51

The Court has already held that, in order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly (see, to that effect, judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 56).

52

Thus, it is apparent from the legislative history of Directive 95/46 that the exemptions and derogations provided for in Article 9 of that directive apply not only to media undertakings but also to every person engaged in journalism (see, to that effect, judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 58).

53

It follows from the Court’s case-law that ‘journalistic activities’ are those which have as their purpose the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them (see, to that effect, judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 61).

54

Although it is for the referring court to determine whether, in the present case, the processing of personal data by Mr Buivids serves that objective, the fact remains that the Court may provide the referring court with the elements of interpretation which are necessary for its assessment.

55

Thus, having regard to the case-law of the Court cited in paragraphs 52 and 53 of the present judgment, the fact that Mr Buivids is not a professional journalist does not appear to be capable of excluding the possibility that the recording of the video in question and its publication on a video website, on which users can send, watch and share videos, may come within the scope of that provision.

56

In particular, the fact that Mr Buivids uploaded the recorded video online on such an internet site, in this case www.youtube.com, cannot in itself preclude the classification of that processing of personal data as having been carried out ‘solely for journalistic purposes’, within the meaning of Article 9 of Directive 95/46.

57

Account must be taken of the evolution and proliferation of methods of communication and the dissemination of information. Thus, the Court has already held that the medium which is used to transmit the processed data, whether it be classic in nature, such as paper or radio waves, or electronic, such as the internet, is not determinative as to whether an activity is undertaken ‘solely for journalistic purposes’ (see, to that effect, judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 60).

58

That said, as observed, in essence, by the Advocate General in point 55 of her Opinion, the view cannot be taken that all information published on the internet, involving personal data, comes under the concept of ‘journalistic activities’ and thus benefits from the exemptions or derogations provided for in Article 9 of Directive 95/46.

59

In the present case, it is for the referring court to determine whether it appears from the video in question that the sole purpose of the recording and publication of the video was the disclosure to the public of information, opinions or ideas (see, to that effect, judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 62).

60

To that end, the referring court may, in particular, take into consideration the fact that, according to Mr Buivids, the video in question was published on an internet site to draw to the attention of society alleged police malpractice which, he claims, occurred while he was making his statement.

61

It should be noted, however, that the establishment of such malpractice is not a condition for the applicability of Article 9 of Directive 95/46.

62

By contrast, should it transpire that the recording and publication of the video were not intended solely to disclose information, opinions or ideas to the public, it cannot be held that the processing of the personal data at issue was carried out ‘solely for journalistic purposes’.

63

It should be noted that the exemptions and derogations in Article 9 of Directive 95/46 must be applied only where they are necessary in order to reconcile two fundamental rights, namely the right to privacy and the right to freedom of expression (see, to that effect, judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 55).

64

Thus, in order to achieve a balance between those two fundamental rights, the protection of the fundamental right to privacy requires that the derogations and limitations in relation to the protection of data provided for in Chapters II, IV and VI of Directive 95/46 must apply only in so far as is strictly necessary (see, to that effect, judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 56).

65

It should be noted that Article 7 of the Charter, concerning the right to respect for private and family life, contains rights which correspond to those guaranteed by Article 8(1) of the Convention for the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950, (‘the ECHR’) and that, in accordance with Article 52(3) of the Charter, Article 7 thereof is thus to be given the same meaning and the same scope as Article 8(1) ECHR, as interpreted by the case-law of the European Court of Human Rights (judgment of 17 December 2015, WebMindLicenses, C‑419/14, EU:C:2015:832, paragraph 70). The same is true of Article 11 of the Charter and Article 10 ECHR (see, to that effect, judgment of 4 May 2016, Philip Morris Brands and Others, C‑547/14, EU:C:2016:325, paragraph 147).

66

In that connection, it is apparent from that case-law that, in order to balance the right to privacy and the right to freedom of expression, the European Court of Human Rights has laid down a number of relevant criteria which must be taken into account, inter alia, contribution to a debate of public interest, the degree of notoriety of the person affected, the subject of the news report, the prior conduct of the person concerned, the content, form and consequences of the publication, and the manner and circumstances in which the information was obtained and its veracity (see, to that effect, judgment of the ECtHR of 27 June 2017, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, CE:ECHR:2017:0627JUD000093113, § 165) Similarly, the possibility for the controller to adopt measures to mitigate the extent of the interference with the right to privacy must be taken into account.

67

In the present case, it is apparent from the documents submitted to the Court that it cannot be ruled out that the recording and publication of the video in question, which took place without the persons concerned being informed of the recording and its purposes, constitutes an interference with the fundamental right to privacy of those persons, namely the police officers featured in that video.

68

If it should transpire that the sole objective of the recording and publication of the video in question was the disclosure to the public of information, opinions or ideas, it is for the referring court to determine whether the exemptions or derogations provided for in Article 9 of Directive 95/46 are necessary in order to reconcile the right to privacy with the rules governing freedom of expression, and whether those exemptions and derogations are applied only in so far as is strictly necessary.

69

In the light of the foregoing considerations, the answer to the second question is that Article 9 of Directive 95/46 must be interpreted as meaning that factual circumstances such as those of the case in the main proceedings, that is to say, the video recording of police officers in a police station, while a statement is being made, and the publication of that recorded video on a video website, on which users can send, watch and share videos, may constitute a processing of personal data solely for journalistic purposes, within the meaning of that provision, in so far as it is apparent from that video that the sole object of that recording and publication thereof is the disclosure of information, opinions or ideas to the public, this being a matter which it is for the referring court to determine.

70

Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Second Chamber) hereby rules: