Case C-101/01
Criminal proceedings
against
Bodil Lindqvist
(Reference for a preliminary ruling from the Göta hovrätt (Sweden))
«(Directive 95/46/EC – Scope – Publication of personal data on the internet – Place of publication – Definition of transfer of personal data to third countries – Freedom of expression – Compatibility with Directive 95/46 of greater protection for personal data under the national legislation of a Member State)»
|
Opinion of Advocate General Tizzano delivered on 19 September 2002 |
|
|
|
|
|
|
|
|
Judgment of the Court, 6 November 2003 |
|
|
|
|
|
|
|
Summary of the Judgment
- 1..
- Approximation of laws – Directive 95/46 – Scope – Definition of processing of personal data wholly or partly by automatic means – Act of referring, on an internet page, to various persons and identifying them by name or by other means – Included – Exceptions – Activities of the State or of State authorities unrelated to the fields of activity of individuals – Activities carried out in the course of private or family life of individuals – Processing of personal data consisting in publication on the internet in the exercise of charitable or religious activities – Not included
(Directive 95/46 of the European Parliament and of the Council, Art. 3(1) and Art. 2, first and second indents)
- 2..
- Approximation of laws – Directive 95/46 – Scope – Definition of personal data concerning health – Reference to foot injury resulting in part-time sick leave – Included
(Directive 95/46 of the European Parliament and of the Council, Art. 8(1))
- 3..
- Approximation of laws – Directive 95/46 – Transfer of personal data to a third country – Definition – Loading of data on an internet page accessible to those with the technical means to access it, including those in third countries – Not included
(Directive of the European Parliament and of the Council 95/46, Art. 25)
- 4..
- Approximation of laws – Directive 95/46 – Respect for fundamental rights – Freedom of expression – Obligation of national authorities responsible for applying national legislation implementing the directive to ensure a fair
balance between the rights and interests in question
(European Convention for Human Rights, Art. 10; Directive of the European Parliament and of the Council 95/46)
- 5..
- Approximation of laws – Directive 95/46 – National legislation for the protection of personal data – Need for consistency with provisions of directive and its objective – Possibility of a Member State's extending its scope to areas not included in the scope of the directive – Limits
(Directive 95/46 of the Parliament and of the Council)
- 1.
The act of referring, on an internet page, to various persons and identifying them by name or by other means, for instance
by giving their telephone number or information regarding their working conditions and hobbies, constitutes
the processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of Directive 95/46 on the protection of individuals with regard to the processing of personal
data and on the free movement of such data. Such processing of personal data in the exercise of charitable or religious activity
is not covered by any of the exceptions in paragraph 2 of that article. The first exception, provided for by the first indent of paragraph 2, concerns the processing of personal data in the course
of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty
on European Union, and in any case processing operations concerning public security, defence, State security (including the
economic well-being of the State when the processing operation relates to State security matters) and the activities of the
State in areas of criminal law. The activities mentioned by way of example in that provision are, in any event, activities
of the State or of State authorities unrelated to the fields of activity of individuals and intended to define the scope of
the exception provided for there, with the result that that exception applies only to the activities which are expressly listed
there or which can be classified in the same category. Charitable or religious activities cannot be considered equivalent
to the activities listed in that provision and are thus not covered by that exception. The second exception, provided for
by the second indent of paragraph 2, relates only to activities which are carried out in the course of private or family life
of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet
so that those data are made accessible to an indefinite number of people. see paras 27, 38, 43-48, operative part 1-2
- 2.
Reference to the fact that an individual has injured her foot and is on half-time on medical grounds constitutes personal
data concerning health within the meaning of Article 8(1) of Directive 95/46 on the protection of individuals with regard
to the processing of personal data and on the free movement of such data. In the light of the purpose of the directive, the
expression
data concerning health used in that provision must be given a wide interpretation so as to include information concerning all aspects, both physical
and mental, of the health of an individual. see paras 50-51, operative part 3
- 3.
There is no
transfer [of data] to a third country within the meaning of Article 25 of Directive 95/46 on the protection of individuals with regard to the processing of personal
data and on the free movement of such data where an individual in a Member State loads personal data onto an internet page
which is stored on an internet site on which the page can be consulted and which is hosted by a natural or legal person who
is established in that State or in another Member State, thereby making those data accessible to anyone who connects to the
internet, including people in a third country. Given, first, the state of development of the internet at the time Directive 95/46 was drawn up and, second, the absence of
criteria applicable to use of the internet in Chapter IV in which Article 25 appears, and which is intended to allow the Member
States to monitor transfers of personal data to third countries and to prohibit such transfer where they do not offer an adequate
level of protection, one cannot presume that the Community legislature intended the expression
transfer [of data] to a third country to cover the loading, by an individual in Mrs Lindqvist's position, of data onto an internet page, even if those data are
thereby made accessible to persons in third countries with the technical means to access them. see paras 63-64, 68, 71, operative part 4
- 4.
The provisions of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the
free movement of such data do not, in themselves, bring about a restriction which conflicts with the general principle of
freedom of expression or other freedoms and rights, which are applicable within the European Union and are enshrined inter
alia in Article 10 of the European Convention for the Protection of Human Rights. It is for the national authorities and courts
responsible for applying the national legislation implementing Directive 95/46 to ensure a fair balance between the rights
and interests in question, including the fundamental rights protected by the Community legal order. see para. 90, operative part 5
- 5.
Measures taken by the Member States to ensure the protection of personal data must be consistent both with the provisions
of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement
of such data and with its objective of maintaining a balance between freedom of movement of personal data and the protection
of private life. However, nothing prevents a Member State from extending the scope of the national legislation implementing
the provisions of Directive 95/46 to areas not included in the scope thereof provided that no other provision of Community
law precludes it. see para. 99, operative part 6