Tietosuojavaltuutetun toimisto (Finland) - 9970/163/2019

Tietosuojavaltuutetun toimisto (Finland) - 9970/163/2019

Authority:	Tietosuojavaltuutetun toimisto (Finland)
Jurisdiction:	Finland
Relevant Law:	Article 5(1)(a) GDPR Article 32 GDPR § 27(1) Tietosuojalaki
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	27.10.2021
Published:	28.11.2021
Fine:	None
Parties:	Sanoma Media Finland Oy
National Case Number/Name:	9970/163/2019
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Finnish English
Original Source:	Finlex (in FI) tietosuoja.fi press release (in EN)
Initial Contributor:	n/a

The Finnish DPA held that publishing of personal tax information by media outlets for journalistic purposes is protected by Finnish data protection legislation, and thus, the processing can't be objected under the GDPR.

English Summary

Facts

A person requested two media outlets owned by Sanoma Media Finland Oy to stop processing and to erase their personal tax information from the media outlets' tax information portals which were public to all readers. The company refused to follow the request, and therefore the person submitted a complaint to the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

By law, the Finnish Tax Administration (Verohallinto) is obliged to release every taxpayer's personal tax records in a limited extent for the public.

Holding

The Data Protection Ombudsman (Tietosuojavaltuutettu) found that the company was not obliged to comply with the request because the information was processed for solely journalistic purposes exempted in the § 27(1) of the Finnish Data Protection Act (Tietosuojalaki) for falling under certain provisions of the GDPR.

Thus, the processing of the personal data was not in breach of Article 5(1)(a) nor Article 32 of the GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.

Publication of tax information in media tax machines

Decision of the Data Protection Ombudsman

Case

Application of the exception provided in section 27 (1) of the Data Protection Act to the processing of personal data in connection with the tax machines of Helsingin Sanomat and Ilta-Sanomat

Data controller

Newspapers Helsingin Sanomat and Ilta-Sanomat published by Sanoma Media Finland Oy (“Sanoma”)

Applicant's claims and reasons

On 30 December 2019, the applicant, through his / her representatives, initiated proceedings in the Office of the Data Protection Officer concerning the processing of his / her personal data in tax machines published on the Internet by Sanoma Media Finland Oy (“Sanoma”), Helsingin Sanomat and Ilta-Sanomat. Despite the fact that the taxpayer had agreed to the applicant's request in the autumn of 2019 not to disclose the applicant's tax information as part of the taxpayer's mass transfer, the applicant's information had been published on the above-mentioned tax machines. The applicant has informed Sanoma that he objects to the processing of his personal data and has requested that it be deleted from the tax machines in question. The message has not agreed to the applicant's request.
According to the applicant, the following information is available for each person on the tax machine published by Helsingin Sanomat: (i) the full name of the person; (ii) Year of birth; (iii) place of residence; and (iv) income data for more than one year. In addition, information on the person's investment in relation to other taxpayers is available from the tax machine. According to the applicant, the sharing of information on social media has also been made easy.
The applicant has invoked Article 27 of the Data Protection Act (1050/2018), according to which, in order to safeguard freedom of expression and information, the processing of personal data for journalistic purposes does not apply, inter alia, Article 5 (1) (c) to (e) of the General Data Protection Regulation. Article 6 (lawfulness of processing) or Articles 15 to 22 (data subject's rights). However, if part of the personal data is also processed for non-journalistic purposes, the above-mentioned articles will apply in full to the extent that the processing is for these other purposes. The applicant has also referred to the Law on the Disclosure and Confidentiality of Tax Information (1346/1999) and stated that, despite the disclosure of certain information related to income taxation, issues such as data protection and privacy must always be assessed on a case-by-case basis. Publicity does not mean the right to publish.

Public tax machine and journalistic purpose

The applicant has referred to the Tax Exchange decision issued during the validity of the Personal Data Act (523/1999). The judgment of the Court of Justice of the European Union in Case C-73/07 states: In its decision KHO 2009: 82, the Supreme Administrative Court has separated the matter in question into two different issues: (i) the use of the delivery in the internal background register and (ii) the information that can be published. The applicant has stated that the Supreme Administrative Court considered that the so-called editorial background register should not have been published almost as such.
The applicant has considered that the present case is comparable to a tax exchange case. The applicant has further argued that the tax machines available to everyone on the internet make information available to the general public better than a single print magazine. The annual income limit of Helsingin Sanomat's tax machine is EUR 150,000, and for 2018 the tax machine will contain tax information for approximately 70,000 people. Ilta-Sanomat's tax machine, on the other hand, contains an even larger set of tax information, as its annual income limit is EUR 100,000. The applicant has considered that this is a very significant amount of data subject as well as a large amount of individual personal data. However, the applicant has emphasized that in reality the tax machines show an even larger number of earnings data, as the tax machines also indirectly indicate that the person's annual income has not reached the above-mentioned euro amounts. The applicant has stated that the tax machines in practice mean the publication of a register of background persons compiled for editorial purposes almost in its entirety and almost as such, which, according to the above-mentioned Supreme Administrative Court, does not meet the requirements for journalistic purposes.

The right of the press to income tax information and a publication of the background register

The applicant has stated that the central task of journalistic purpose is to safeguard the exercise of freedom of expression and thus, among other things, the free formation of opinion, open public debate and public criticism of the exercise of power. In this context, the applicant referred to the above-mentioned Supreme Administrative Court ruling, which states: The applicant has considered that it is possible to assess social development, the development of income and wealth disparities and the correctness of tax policy without public identification of ordinary persons. According to the applicant, the tax machine is not a viable instrument in this respect. For example, the tax machine does not show how you earn in different industries. The tax machine does not indicate a person's occupation or even whether all earned income comes from a single job. Detailed information on middle- and low-income people is also not available for tax machines. Consequently, the applicant has questioned whether the publication of data on only the highest-income persons makes it possible to monitor the development of income and wealth disparities. However, the applicant has further questioned the fact that, in the case of low-income earners, the press may be content to assess earnings trends from statistics. The applicant has not seen any justification as to why it is necessary to publicly identify the highest income earners. The applicant has further argued that a mere comparison of median income with that of the highest earners does not really tell much about income differences. The applicant has also expressed the view that the extensive publication of tax information does not contribute to the correct performance of taxation, as it is not possible to determine on the basis of public tax information whether taxation has been provided correctly.
The applicant has expressed the view that statistics, analyzes and individual articles derived from the background register received by the press from the taxpayer contribute to the social debate in the public interest instead of the tax machines. The applicant has considered that there are no grounds for publishing the background register itself, nor, according to the applicant, is this done in connection with the coverage of any other topic of social significance. For example, in the case of reporting on crime statistics, the source material used as the basis for reporting is not published, although in principle, court documents are public, as is tax information.
The applicant does not deny that individual news items, such as those concerning the income of pharmacists or sellers of inspection posts, play an important role in enabling social development. However, the discussion on these is not due to public tax machines, but to separate articles on the subject. The applicant has expressed the view that, in accordance with data protection law, Sanoma should limit the use of the background register to its own internal use and to deliberate news and articles based on the background register.
Unlike Sanoma, the applicant has considered that an annual income of more than EUR 100 000 or EUR 150 000 does not automatically make a person an exercise of social power. The applicant has stated that, in fact, most of these persons do not exercise any social or economic power. The mere fact that the views of two magazines belonging to the same group differ from each other shows that such a limit cannot be justified. The applicant has considered the defined income limits to be artificial. Such limits show that no real assessment of a person's social significance is made. According to the applicant, social significance cannot be based solely on a person's income.
The applicant has expressed the view that the primary purpose of public tax machines is to satisfy people's curiosity. According to the applicant, journalism in the public interest does not require the large-scale publication of the personal data of almost 100,000 people, but only that the press continues to have access to the prescribed income tax information. Accordingly, the applicant has considered that the processing of personal data in tax machines is not for journalistic purposes or at least for journalistic purposes only, as required by the Data Protection Act.

Journalistic purpose and protection of privacy

The applicant has argued that the protection of privacy as a fundamental right must be taken into account when interpreting the journalistic purpose. It is a matter of reconciling two fundamental rights, freedom of expression and the protection of privacy. The applicant referred to the above-mentioned judgment of the Supreme Administrative Court, which in turn referred to the case law of the Court of Justice of the European Union and stated that "in order to strike a harmonious balance, The solution further states that more attention should be paid to the protection of privacy, as new information technologies make it possible to store and reproduce personal data.
The applicant has referred to the legal literature and case law and stated that it is quite well established that monetary matters are normally covered by private life. The protection of the privacy of an ordinary, non-political person is, in principle, extensive. According to the applicant, this is not altered by the fact that the tax information is public. Not all information contained in public documents is permitted to be published. In addition, the legal literature has found that the privacy-infringing nature of tax information is exacerbated if it can be found in an online magazine using Google or another search service within seconds.
According to the decision of the Supreme Administrative Court, in the name of freedom of expression, the protection of privacy may be restricted only to the extent strictly necessary. Of the options for exercising freedom of expression, the one that least restricts the exercise of privacy must be chosen. It has been suggested in the legal literature that, on the basis of the social significance of a case, it is generally not permissible to identify an ordinary person if a matter belonging to his or her private life can be covered without revealing his or her identity without revealing his or her identity. Consequently, the applicant has considered that the tax machine unduly restricts the protection of privacy.

Article 32 of the General Data Protection Regulation (security of processing)

The applicant has stated that even if, contrary to his reasoned position, the processing of personal data in a tax machine were considered to be for journalistic purposes only, Article 32 of the General Data Protection Regulation should apply in accordance with Article 27 of the Data Protection Act.
Taking into account the state of the art and the costs of implementation, the nature, extent, context and purposes of the processing and the risks to the rights and freedoms of natural persons varying in probability and severity, the controller and processor shall take appropriate measures to ensure an adequate level of security . In this context, the applicant has referred to recital 54 of the General Data Protection Regulation.
According to the applicant, publishing the assets of individuals in detail and in a search engine on the internet poses a significant security risk to the person in question. Because the tax machine provides accurate information about a person's place of residence and year of birth, it is easy to identify the people listed on the tax machine and, for example, find accurate address information. Thus, the tax machine unreasonably reduces the security of 100,000 people. At the same time, the tax machine also causes social harm, according to the applicant. According to the applicant, the likelihood of such damage is particularly pronounced when the person's name is unusual and rare, as in the applicant's case.
According to the applicant, the controller must have a strong duty to ensure that its actions are proportionate and that the processing of journalistic purposes does not pose a risk to data subjects. As provided in section 27 of the Data Protection Act, Article 5 (1) (a) of the General Data Protection Regulation applies to the processing of personal data only for journalistic purposes only to the extent applicable. The applicant has submitted that the maintenance of the tax machine does not comply with Article 32 of the General Data Protection Regulation. The applicant has considered that processing for journalistic purposes can also be carried out through individual news outlets with significantly less risk to data subjects' rights and freedoms. The applicant has further argued that the applicability of Article 32 of the General Data Protection Regulation to processing for journalistic purposes shows that the right to processing for journalistic purposes does not imply a direct right to publish information.

Applicant's conclusions

According to the applicant, since the processing of the applicant's personal data in a tax machine does not meet the requirement of section 27 of the Data Protection Act for journalistic purposes only, the processing of personal data in question does not have the processing criteria required by Article 6 of the General Data Protection Regulation. Where the exception for journalism does not apply, Articles on the rights of the data subject of the General Data Protection Regulation, such as Articles 21 (right of objection) and 17 (right to be forgotten), as well as Article 5 (principles on the processing of personal data) and Article 6, will apply in full to the processing of personal data by tax. (lawfulness of processing). The applicant has informed Sanoma that he objects to the processing of his personal data and has requested their deletion. As Sanoma has not complied with the applicant's requests, Sanoma has, in the applicant's view, also breached the general data protection regulation on this basis.
The applicant has continued to consider that Sanoma is processing data in breach of the requirements of purposefulness, legality, reasonableness, transparency and minimization of data, which is why Sanoma has also infringed Article 5 of the General Data Protection Regulation. In addition, the applicant has considered that the processing of the personal data in question is in any case contrary to Article 32 of the General Data Protection Regulation.
According to the applicant, the criticism of Sanoma's conduct is compounded by the fact that, although the applicant has expressly requested the taxpayer not to disclose its information to the media, Sanoma has nevertheless separately verified the applicant's information and published it on its tax machines.
The applicant has considered it clear that freedom of expression and the possibility of social debate by the press can be achieved without a public, search-driven tax machine. In the applicant's view, it is equally clear that the main purpose of the tax machines is probably to satisfy the curiosity of the general public. The applicant has continued, stating that the social tax debate is read from news and articles written by the editors of Helsingin Sanomat and Ilta-Sanomat, while the tax machine is used to use the income information of neighbors, relatives and colleagues. Therefore, the applicant has considered it clear that the publication of background data obtained from the taxpayer on Sanoma's tax machines has been in breach of data protection law for the applicant.

A statement from Sanoma

The Office of the Data Protection Commissioner has asked Sanoma for clarification. Sanoma issued its report on September 15, 2020. The questions presented to Sanoma in the request for clarification and Sanoma's answers to them are presented below.
At the beginning of the study, it was stated that the primary issue in this matter was to assess the content and scope of the decision to publish media. According to the report, Helsingin Sanomat and Ilta-Sanomat always weigh up the protection between privacy and freedom of expression responsibly and with decades of experience before publishing decisions. This has also been the case here. The applicant has access to legal remedies for ex-post supervision, which, according to Sanoma, have been consistently considered to adequately protect the protection of privacy and the legal protection needs of the individual. The study states that data protection legislation does not assess the journalistic justification for the publication of material in the media.
The report emphasizes that Helsingin Sanomat and Ilta-Sanomat are independent media in their editorial work, whose publishing activities are based on independent and careful editorial consideration. The corresponding editors-in-chief of Helsingin Sanomat and Ilta-Sanomat are responsible for the magazines' own, independent publishing decisions. Helsingin Sanomat and Ilta-Sanomat are mass media whose activities are protected by the freedom of speech guaranteed by the Constitution and the prohibition of prior censorship.
1) In the light of the provisions of the General Data Protection Regulation and the Data Protection Act, how do you justify that you consider that you are processing the applicant's personal data for journalistic purposes? In particular, please comment that, according to the applicant, processing in tax machines is not for purely journalistic purposes.
The report states that two separate issues need to be distinguished: (i) the right of the media to process personal data and (ii) the right of the media to publish the journalistic content of their choice. The right of the media to process personal data is regulated by the General Data Protection Regulation ((EU) 2016/679) and the Data Protection Act (1050/2018). Instead, the right of the media to publish the journalistic content of their choice is provided for in Article 12 of the Constitution (731/1999) and in the Act on the Exercise of Freedom of Expression in the Mass Media (460/2003).
The publication of personal information as part of a journalistic article is the processing of personal information. However, the publication decision made by the media is the result of independent journalistic judgment. The report states that independent publication decisions in the media cannot be assessed on the basis of data protection law, as they concern the exercise of freedom of expression under Article 12 of the Constitution, which is prohibited by prior censorship.

Journalistic purpose

The report states that reducing freedom of the press has not been the aim of strengthening the protection of personal data in the European Union. As a result, there are significant exceptions to the General Data Protection Regulation insofar as personal data are processed for journalistic purposes. The study further states that the aim has been to ensure that the protection of personal data does not constitute a sham basis for restricting the free flow of information and allowing for prior censorship of the social debate.
In this context, reference is made to Article 85 of the General Data Protection Regulation, which obliges Member States to enact national legislation reconciling the right to the protection of personal data with the right to freedom of expression and information. In Finland, this has been implemented by section 27 of the Data Protection Act, according to which certain articles of the General Data Protection Regulation do not apply if the activity takes place for journalistic purposes. The study states that the General Data Protection Regulation and the case law of the Court of Justice of the European Union require a broad interpretation of journalism. An activity may be considered to be journalistic if its purpose is “to express information, opinions or ideas to the public by any means of communication”.
Sanoma has expressed the view that the processing of data takes place for journalistic purposes, at least if the data is processed in the media in such a way that the purpose of the processing is to produce or publish journalistic content. According to Sanoma, the requirement of journalistic purpose is intended to differentiate between data processing for the purpose of, for example, marketing, personnel management or the maintenance of customer registers. It is further stated that when personal data are processed in an editorial office in order to produce journalistic content, the purpose of the processing is journalistic. According to Sanoma, personal data has only been processed for journalistic purposes if it has been processed only for the production of journalistic content and not for marketing purposes, for example.
According to Sanoma, the legislator did not mean, on the condition of journalistic intent, that it would be possible to assess on the basis of data protection legislation what kind of journalistic content published by the media is sufficiently journalistic. Section 27 of the Data Protection Act does not provide for the possibility to assess the content of a publication decision made by the media. According to Sanoma, this would violate the prohibition of prior censorship under section 12 of the Constitution. It has further been stated that the wording was only intended to distinguish between personal data processed in the media for the purposes of journalism and personal data processed in the media for marketing purposes, for example.

The journalistic purpose and the present case

Helsingin Sanomat and Ilta-Sanomat have considered that they have processed the applicant's data for journalistic purposes only on the following grounds: (i) the data have been used exclusively in the editorial work of the media and as part of journalistic content; (ii) where information has been collected from public authorities, the sole purpose of the data collection has been to use the information as part of editorial work and journalistic content; (iii) the processing of the data has clearly served the editorial work, as evidenced by the publication of information-based journalistic content; (iv) the data have not been used for other processing purposes, such as the direct marketing of products and services, and have not even been considered; (v) the sole purpose of the processing has been to disclose the information to the public by means of a data transmission medium (criterion of the Court of Justice of the European Union); and (vi) the concept of journalism must be interpreted broadly.
The report further emphasizes that Helsingin Sanomat and Ilta-Sanomat have processed the applicant's data only for journalistic purposes, when the data has been processed only as part of the preparation of the data-journalistic Verokone publication. As the data have been processed for journalistic purposes, certain articles of the General Data Protection Decree do not apply to the processing of data in accordance with section 27 of the Data Protection Act.

Published information and follow - up

In the present case, Helsingin Sanomat and Ilta-Sanomat have published the applicant's information on the basis of journalistic judgment. It is therefore a question of media publication decisions and the evaluation of a publication decision. The report states that this publication decision is protected by the prohibition of prior censorship pursuant to section 12 of the Constitution.
The report states that the starting point chosen in domestic law is that the protection of privacy with regard to published information is sufficient to ensure ex-post remedies, such as a complaint to the Public Speech Council or a criminal report. The report refers to various legislative documents in which the regulatory solution is characterized, inter alia, as follows:
"In the case of published material, the related needs for the protection of privacy and the legal protection of the individual may be safeguarded by other provisions, including the provisions of the Penal Code."
“Some of the information collected by the media that is to be published is not so much problematic from the point of view of data protection, because after the publication of the information, it is possible to intervene under the provisions of the Privacy Act. However, only part of the registered data will be published and will therefore be subject to ex-post control. "
“The protection of privacy in the media has traditionally been safeguarded by special regulations, including the provisions of the Criminal Code (39/1889), the Freedom of the Press Act and the Radio Liability Act (219/1971). - The above-mentioned special regulation must be considered to protect the privacy and privacy of the individual as required by the objectives of the proposed law. The proposed [personal data] law - is intended to maintain the current legal status. ”
“The harmonization of the protection of personal data and the expression of freedom of expression adopted in the Personal Data Act has worked relatively well over the last twenty years. This is also partly due to the national comprehensive and effective self-regulatory system for the media, in which journalistic activities are bound by a code of professional ethics, the Journalist's Guidelines. Compliance with the guidelines is monitored by the Public Speech Council. The provisions of the Penal Code and the Freedom of Expression Act ultimately also ensure the protection of the personal data of natural persons in publication situations. ”
According to Sanoma, the only possible way to react in the applicant's case is therefore to have recourse to an ex post facto remedy.
2) By what criteria has the applicant been selected for publication in a tax machine, given that the taxpayer has complied with the applicant's request?
The report states that the issue is the content of the journalistic publication decision made by the editorial board. It has continued that Helsingin Sanomat and Ilta-Sanomat, as the media, have no obligation to justify their independent journalistic delivery solutions to the Data Protection Commissioner. Sanoma has found it problematic from the constitutional point of view that the authority is inquiring about such a matter from the independent media. Decisions to publish media may be commented on retrospectively by the Public Speech Council and the General Court in a possible criminal case. According to Sanoma, other authorities do not have the power to require the media to justify their publication decisions.
The tax administration makes its own decisions on the basis of, among other things, the Act on the Publicity of the Activities of Public Authorities (621/1999) and the Act on the Disclosure and Confidentiality of Tax Information (1346/1999). The report states that the decision made by the Tax Administration concerns its own operations and has no effect on the journalism of Helsingin Sanomat or Ilta-Sanomat. It has continued that Helsingin Sanomat and Ilta-Sanomat are not dependent on the Tax Administration or other authorities, and their journalistic decisions do not depend on the decisions made by the authorities. In a democratic society, the media have the right to publish, for example, material classified as confidential if the editor-in-chief considers it to be journalistically justified. The publication decision can only be processed retrospectively. According to Sanoma, whether the Tax Administration has agreed to the applicant's request for mass transfers does not and must not affect the journalistic judgment of Helsingin Sanomat and Ilta-Sanomat.
The report states that the publishing activities of Helsingin Sanomat and Ilta-Sanomat are based on Article 12 of the Finnish Constitution and the Act on the Use of Freedom of Expression in the Mass Media. According to Article 12 of the Constitution, freedom of expression includes the right to express, publish and receive information without prior hindrance. According to the preamble to the Constitution, “the provision on freedom of expression, for example, provides protection against the interference of the press with the editorial work of the press even before the actual expression and publication of the message”. It has further been stated that the provision on freedom of expression in the Constitution prohibits public authorities from interfering in any prior content with published content. The provision leaves open the possibility of controlling the exercise of freedom of expression retrospectively by means of criminal and tort law, and this possibility is also strictly limited.
The Act on the Exercise of Freedom of Expression in the Mass Media contains more detailed provisions on the exercise of the freedom of expression guaranteed in the Constitution in the media. The law provides for various ex-post remedies to react to content published by the media. The report states that the possibility of prior intervention or competence in the legislation has not been established for any authority. The Finnish legal system does not recognize the possibility of prior censorship.
The report states that Helsingin Sanomat and Ilta-Sanomat are independent media whose independent editorial decisions are not binding on the authorities' decisions on the publication or non-publication of tax information. Although the media is not obliged to justify their publication decisions, the report lists some factors that influenced journalistic judgment:
The applicant belongs to a wealthy Finnish family of owners. In terms of his wealth and status, he is one of those whose tax information has a journalistic interest from the point of view of the transparency of social debate and communication. According to the practice of the Public Speech Council, significant income or substantial wealth reduces the protection of privacy when the information disclosed relates to his or her financial condition.
The applicant is not an ordinary middle-income Finn, but earns 27 times the average wage earner. This makes the applicant part of the socio-economic elite, which is why he plays a significant role in society. Significant capital gains further indicate that the applicant is also likely to have power over the companies from which it receives capital gains.
The publication of tax data makes it possible to assess the structure and fairness of taxation. Tax information is related to the societal debate on income distribution, the financing of the welfare state, and the incentive to work and entrepreneurship. In Finland, the publication of tax information is generally considered to fall within the scope of freedom of information.
The publication of tax machine articles about individuals allows ordinary readers to make observations about society based on individuals ’tax data. Individual tax information is the only way to understand exactly how policy decisions affect income and taxes locally as well as nationally.
An increase or decrease in an individual’s income provides an indication of how their activities in society affect their personal income.
In addition to media editorials, readers can also make observations about individuals ’tax information related to our society that the editorials would not be able to produce for the public without the interaction of data journalism.
3) In his complaint to the Office of the Data Protection Officer, the applicant has considered that Sanoma has published a background information register. Have you published a background information register? If you think you are not, how do you justify your view? If you consider that you are, how do you justify the publication of background information?
According to the report, Helsingin Sanomat and Ilta-Sanomat have not published a background information register. The editorial background material in the tax machine database of both Helsingin Sanomat and Ilta-Sanomat is considerably wider than the material selected for publication. Helsingin Sanomat and Ilta-Sanomat publish only a small part of the material submitted by the tax authorities, and the material to be published is selected on the basis of journalistic discretion. The report states that this alone is sufficient to show that Helsingin Sanomat and Ilta-Sanomat have not published a so-called background information register.
The report further states that the editorial background database of Helsingin Sanomat's tax machine contains tens of thousands of persons whose tax information is not published - before the editorial criteria for publication may be met in one year. Helsingin Sanomat will also stop publishing a person's information if the person no longer belongs to the group whose information Helsingin Sanomat has considered justified from the point of view of social discussion. The editorial journalistic decision on the income limit is based on the fact that it corresponds to the median income of a total of about six ordinary Finnish recipients. In practice, according to the report, people who earn so much exercise such significant financial power that the publication of information is editorially justified.
Ilta-Sanomat's editorial staff, on the other hand, has determined, based on editorial consideration, that an individual's information will be published in a tax machine if he or she has earned EUR 100,000 (during the previous year). About 1.2% of income recipients are such persons. Ilta-Sanomat's editorial decision on the income limit is based on the fact that, according to Ilta-Sanomat, people who earn so much play a significant role in society. The study further states that these people are able to exercise the kind of social and economic power that justifies the publication of tax information as part of the public debate on an open democratic society. The publication of tax data also shows how much people in the upper income groups pay taxes and finance the Finnish welfare society.
The study states that both Helsingin Sanomat and Ilta-Sanomat select a small fraction of public tax information for journalistic publication. The publication is preceded by editorial work, in which the information is evaluated, analyzed and processed in the necessary ways for publication. According to the report, the activity has nothing to do with the publication of the background register.
The study further continues that the publication of an editorial background register would be permissible in itself if there were journalistic grounds for it. According to the study, such a register could be, for example, material on the income level of Members of Parliament, in which case the publication of the entire register would be journalistically justified. However, it is often stated in the report that the editorial register held by the media does not, in its entirety, exceed the publication threshold according to the journalistic assessment made in the editorial office and is not published as such.
4) You have stated to the applicant that the editorial processing and publication of tax information performed by Helsingin Sanomat and Ilta-Sanomat differs materially from the operations and processing of tax information performed by the Satakunta Market Exchange. How do you substantiate this claim?
In the case referred to above, Satakunnan Markkinapörssi Oy had published tax information for approximately 1.2 million people in the annual Veropörssi magazines. The lower limit for the information to be published was defined for each municipality. The income limits above which the income of individuals was published in Veropörssi magazines were very low. For example, in the case of Helsinki, the limit chosen for earned income was 36,000 euros, in smaller municipalities the lower limit was even lower. It was also possible to purchase tax information via the SMS service.
In the decision, the Supreme Administrative Court did not assess the media's right to publish the information, but whether the personal data had been processed as required by data protection law. According to the assessment of the Supreme Administrative Court, Satakunnan Markkinapörssi Oy's operations had been in breach of data protection legislation for two reasons:
The processing of personal data in Satakunnan Markkinapörssi Oy's editorial background register would in itself have complied with data protection legislation. However, the extent to which the same information was subsequently processed in the Tax Exchange was made contrary to data protection law.
The second argument concerned the SMS service. The Supreme Administrative Court held that the SMS service was not responsible for delivering a message to the public within the meaning of the Freedom of Expression Act. In that law, the public is defined as a random set of recipients, whereas in the SMS service the message was delivered only to the person who ordered the information.
The report states that neither of the above situations is present in the present case. Helsingin Sanomat and Ilta-Sanomat have published tax information in a selective, deliberate and decisive manner more narrowly and to a completely different extent than Satakunnan Markkinapörssi Oy. The report further continues that Satakunnan Markkinapörssi Oy did not use any journalistic discretion in the selection of published tax information as to which of the tax information is such that its publication is socially justified. The main purpose was to publish the tax information as it was in the Tax Exchange.
The report states that Helsingin Sanomat and Ilta-Sanomat, on the other hand, use journalistic judgment as to which information is justified for publication. The tax machine and the information published in the tax machine are the result of both journalistic preparation and journalistic deliberation, demarcation and decision-making. Helsingin Sanomat and Ilta-Sanomat publish only a fraction of the material they receive from the tax authorities, and the publication is journalistically weighed in the editorial staff. The lower limit for tax information published by Helsingin Sanomat is EUR 150,000 per year, and for Ilta-Sanomat the lower limit is EUR 100,000. The report shows that this is a significant difference from the case of the Tax Exchange.
The report provides an illustration of the difference between the operations of Helsingin Sanomat and Ilta-Sanomat in relation to the case of the Tax Exchange. The example uses the 2018 tax data as a reference. According to Statistics Finland, in 2018, 4,724,000 people received taxable income. When the income limit on the Tax Exchange was EUR 36,000, the newspaper would have published data on 1,879,000 taxpayers based on 2018 data, ie 40% of all tax data. Based on Ilta-Sanomat's income limit of EUR 100,000, tax data for 92,000 people would have been published in 2018, which corresponds to approximately 1.9% of taxpayers. Based on Helsingin Sanomat's income limit of EUR 150,000, tax data for 31,000 people would have been published, which corresponds to approximately 0.7% of taxpayers.
According to the Supreme Administrative Court, when the scope of the published tax information was problematic in the operations of Satakunnan Markkinapörssi Oy, it is obvious from this report that the operations of Helsingin Sanomat and Ilta-Sanomat differ significantly from it. Helsingin Sanomat and Ilta-Sanomat publish journalistic content based on tax information in a way that, according to the report, is specifically acceptable based on the decision of the Supreme Administrative Court.
The report continues that the tax machine journalism of Helsingin Sanomat and Ilta-Sanomat as a whole cannot be compared to the case of Satakunnan Markkinapörssi Oy in terms of its quality, handling and context. The operations of Helsingin Sanomat and Ilta-Sanomat are a subtype of journalism called data journalism. For tax machine-type publications, data journalists collect and combine data selected on a journalistic basis. Data sets are edited and presented in a way that creates interaction with the public and serves societal debate. Other journalistic content can also be created around the data.
In addition, the study states that the data journalism tools and methods used by Helsingin Sanomat and Ilta-Sanomat offer new opportunities for publishing socially important information. According to Sanoma, this aspect was missing in the case of Satakunnan Markkinapörssi Oy.
Finally, it has been stated that the publications of Helsingin Sanomat and Ilta-Sanomat are a carefully and analytically produced entity based on journalistic judgment, with a special focus on serving the social debate.
5) How do you justify your refusal to delete the applicant's data from the tax machines?
6) How do you justify the negative answer that the applicant has objected to the processing of his / her personal data in tax machines?
The report states that the tax machines are the journalistic content of Helsingin Sanomat and Ilta-Sanomat. According to paragraph 2 of the Journalist's Guidelines, decisions on the content of the communication must be made on journalistic grounds, and under no circumstances may the decision-making power over the content be delegated to third parties. The report states that Helsingin Sanomat and Ilta-Sanomat would act contrary to the Journalist's instructions if they transferred the decision-making power regarding the publication of information to the applicant in a situation where there is a journalistic reason for publishing the information.
The Finnish legal system does not feel the right to restrict or prevent journalistic publication decisions in the media. The report states that Helsingin Sanomat and Ilta-Sanomat, based on their journalistic judgment, have assessed that the publication of the information is justified from the point of view of the social debate. It is only possible to react to an independent publication decision by the media using ex-post legal remedies.
According to Article 27 (1) of the Data Protection Act, Articles 17 (right to be forgotten) and 21 (right to object) do not apply to the processing of personal data of an applicant when the personal data of the applicant have been processed for journalistic purposes. It is further submitted that neither Helsingin Sanomat nor Ilta-Sanomat has an obligation under data protection legislation to delete the applicant's tax information from the tax machines, nor does it have an obligation to comply with the applicant's request to object to the processing of the information.
Helsingin Sanomat and Ilta-Sanomat do not, in principle, delete information related to editorial material from their printed or online publications or archives. According to Sanoma, the deletion of published information on the grounds that it is not, in the subjective opinion of individuals, topical or necessary would lead to an unjustified restriction on the operating conditions of the media. The report goes on to say that deleting would also be a matter of retrospective alteration of the editorial content of the media, virtually lacking in history.
Helsingin Sanomat and Ilta-Sanomat have stated that they have no obligation under data protection regulations or any other legislation to delete the applicant's tax information from the tax machines or to comply with the applicant's request to object to the processing of the information. Helsingin Sanomat and Ilta-Sanomat have stated that they have published the applicant's tax information on the basis of independent editorial consideration as part of its editorial content. According to Sanoma, there are no compelling and journalistically or socially sustainable grounds for deleting the applicant's tax information. Helsingin Sanomat and Ilta-Sanomat have also referred to paragraph 2 of the Journalist's instructions, which emphasizes the non-transferability of editorial decision-making power. According to Sanoma, the operation of a free and independent press would not be possible if individuals could choose what information about them is published for journalistic purposes. Decisions on the content of the communication must be made on an editorial basis, and this decision-making power may not be outsourced under any circumstances.

Applicant 's reply

The applicant is given the opportunity to respond. The applicant lodged its defense on 27 November 2020.
In its defense, the applicant has initially stated that freedom of expression and the prohibition of prior censorship do not mean that the data protection legislation does not apply to the activities of the newspapers in question and Sanoma Media Finland Oy. The applicant has emphasized that the media is also obliged to comply with data protection law and that this obligation can only be waived within the limits of the exceptions expressly provided for in the law.
The applicant has also referred to a previous point concerning the coordination of the various fundamental rights. The applicant has also emphasized that privacy is a constitutionally protected right. The applicant has further stated that privacy may be restricted only to the extent necessary to exercise freedom of expression. The applicant has also referred to the above-mentioned decision of the Supreme Administrative Court, the Tax Exchange, which states that exceptions and limitations must be implemented within the limits of what is strictly necessary. The applicant has stated that the explanation provided in the case does not give the applicant any grounds to change the view previously expressed.

Data protection law and publishing

Contrary to what Sanoma has submitted, the applicant has also submitted the processing of personal data within the meaning of the data protection legislation, and thus the general data protection regulation and the Data Protection Act also apply to this activity. In this context, the applicant has referred to the definition of the processing of personal data in Article 4 (2) of the General Data Protection Regulation. The applicant has stated that the definition of the processing of personal data is very broad and has also been extended from the definition under the previous Personal Data Directive. The applicant has further stated that the processing of personal data covers practically all possible measures against personal data.
Furthermore, contrary to Sanoma's submissions, independent publication decisions are also assessed in accordance with data protection legislation. According to the applicant, the application of the law on the exercise of freedom of expression in the mass media does not in any way preclude the application of data protection legislation.

Pre-censorship

The applicant submits that the present case does not concern ex ante censorship but the compliance of Sanoma with data protection law. The applicant has argued that no communication could be interfered with if the prohibition on prior censorship were interpreted as broadly as Sanoma had interpreted in this case. For example, the Tax Exchange case would also be pre-censored, as it has been found in practice that similar listings will also be in breach of the Personal Data Act in the coming years. The applicant has continued that, in fact, no authority prevented Satakunnan Markkinapörssi Oy and Satamedia Oy from publishing similar lists in the future.
It is further stated in the defense that, if Sanoma's conduct in the present case were to be considered to be in breach of data protection law, this would not in itself prevent Sanoma from continuing to publish tax information on tax machines or even prevent the applicant from continuing to publish it. According to the applicant, the consequences of publishing activities would always be dealt with separately afterwards.
The applicant has further referred to the Tax Exchange ruling and stated that there was no question of prior censorship. That decision states as follows: '[t] he preliminary work on the amendment to the Personal Data Act prior to the Personal Data Act (HE 311/1993 vp) shows, inter alia, that the right to freely publish information also requires that the data be freely collected and stored in advance. Restricting the processing of personal data at this stage, ie before publication, could in practice mean that it is determined in advance what is allowed to be published. Such an outcome would be contrary to the fundamental right to freedom of expression. ' The applicant further went on to state that the Supreme Administrative Court did not consider that there was a question of prior censorship when assessing the lawfulness of the publication after the publication of the information. According to the applicant, such an interpretation would not even be possible, since in that case there would be virtually no interference with the activities of the press.
In the present case, the applicant's information has already been published and is already being processed. Therefore, according to the applicant, the situation is similar to the Tax Exchange case. In the present case, the applicant considers that the publication of the background register in question on such a large scale and almost as such on Sanoma's tax machines is contrary to data protection law.

Journalistic purpose

In its defense, the applicant refers to recital 153 of the General Data Protection Regulation, which states that the concept of journalism must be interpreted broadly. However, the applicant has argued that the scope of the concept of journalism is more related to the nature of the content produced by the actors. In that regard, the applicant refers to a debate within the European Union which, according to the applicant, focused on extending the concept of journalism to new forms of communication, that is to say, it was not limited to traditional media players and press houses. This will ensure that democracy and information are effectively implemented in countries where the mainstream media may be under state control or otherwise biased.
The applicant referred to Sanoma's explanation in the case, in which Sanoma referred to the judgment of the Court of Justice of the European Union in Case C-345/15 Buivids and paragraph 51. That paragraph states that 'in order to take account of the importance of related concepts, including the concept of journalism, must be interpreted broadly ’. However, the applicant points out that the solution in question continues as follows in paragraphs 52 and 53:
'It is therefore clear from the travaux préparatoires for Directive 95/46 that the exceptions and freedoms provided for in Article 9 of the directive apply not only to the media but also to all persons engaged in journalism'.
'It is clear from the case-law of the Court of Justice that' journalistic activities 'are those aimed at expressing information, opinions or ideas to the public by any means of communication'.
In fact, according to the applicant, the focus of those solutions has been on assessing which actors can be considered journalistic.
The applicant has emphasized that the question is whether the processing of data in a tax machine is for journalistic purposes. In addition, the applicant has emphasized the wording of section 27 of the Data Protection Act, which includes the attribute “only”. Although the above-mentioned paragraph does not directly define what is “sufficiently journalistic,” the paragraph places a clear additional requirement for consideration.
The applicant has further referred to a report in the case which states that the journalistic purpose is certain to be fulfilled when the data are processed in such a way that the purpose of the processing is to produce or publish journalistic content. However, the applicant has emphasized that this is not sufficient for the exception provided for in section 27 of the Data Protection Act to apply. According to the applicant, the data must in fact also be processed for journalistic purposes only.
The applicant has further emphasized the distinction between the processing of the press background register and the content to be published. The applicant does not deny that the internal processing of tax data by the press, i.e. the so-called background register, fulfills the requirement of processing for journalistic purposes only. On the contrary, the applicant has argued that such background work for deliberate news articles is undeniably journalistic and is for journalistic purposes only. However, the applicant has considered that tax information is not processed for journalistic purposes only when the listing received from the taxpayer is published to this extent on tax machines.
In this connection, the applicant has referred to the preliminary work of the Data Protection Act:
“Between 2008 and 2017, some 200 cases have been pending in the Office of the Data Protection Supervisor concerning the coordination of the expression of freedom of expression and the protection of personal data. In recent years, a significant proportion of citizens' complaints about the above have been related to the publication of personal data online and in various media. Some of the cases have been initiated because the Data Protection Supervisor has considered that the processing of personal data in question does not fall within the scope of section 2 (5) of the Personal Data Act. An example of this is the so-called Tax Exchange case related to the publication of tax information (KHO 2009: 82), in which the Supreme Administrative Court requested a preliminary ruling from the Court of Justice in 2007.
In its judgment CJ 2009: 82 on the basis of the Court's preliminary ruling in Case C-73/07, the Supreme Administrative Court stated that the starting point for assessing the limitation of the scope of section 2 (5) of the Personal Data Act is whether expressing ideas to the public. The assessment must take into account the extent to which the activity can be seen as contributing to a socially interesting debate rather than seeking to satisfy the curiosity of individuals in isolation from the social debate.
According to the solution, however, the processing of personal data for editorial purposes cannot be considered as processing in which the personal register established for editorial purposes is published on a large scale, almost in its entirety and almost as such, albeit in different parts and municipalities. Since the publication of the registered information to that extent was tantamount to the publication of a so-called background register compiled by the entire company concerned for editorial purposes, it was not merely a matter of expressing information, opinions or ideas. In a democratic society, the necessary, open and socially interesting debate, or the control of the exercise of social power and the freedom of criticism, do not require individuals to disclose personal data identified to the extent of the solution to that extent. The Grand Chamber of the European Court of Human Rights ruled on 27 June 2017. "
The applicant has referred to his earlier statement in the case and stated that he still considers that the primary purpose of tax machines is to satisfy people's curiosity. The applicant has considered that the explanation provided by Sanoma in the case does not give grounds to assess the matter differently in general or in this case.
The applicant referred to the advertising of Ilta-Sanomat's tax machine, which contained the words '[t] he difference may be useful if, for example, he wants to check the salaries of colleagues in a particular sector by comparing them'. However, the applicant has emphasized that the tax machines do not state in which sector or from which the income from the tax machine was obtained. Consequently, the applicant has considered that such a wage comparison cannot in fact be reliably made on the basis of the tax machine.

On the publication of the background register

The applicant has referred to a statement submitted by Sanoma in the case, which states that the case does not concern the publication of a background register, but material published on the basis of journalistic discretion. However, the applicant claims that Sanoma has not substantiated this claim in any way. For example, the message has not stated what information has not been published. Given the extent of the information content of the tax machines and the fact that the taxpayer provides the press with information on all persons who have earned at least EUR 100,000, it is challenging to understand what information Sanoma has failed to publish.
In any event, the applicant maintains that it is clear that, even if Sanoma did not disclose some of the information, it would publish on its tax machines a significant amount and almost as such of the information it had received from the taxpayer. Thus, according to the applicant, it has no legal significance whether Sanoma holds an even larger amount of information, as the publication of the background register alone to this extent and thus mechanically does not, in the applicant's view, comply with data protection law. In the applicant's view, this does not meet the conditions for processing for journalistic purposes only.

Available remedies

The applicant referred to a report in the case which stated that the starting point chosen in domestic law was that the protection of privacy with regard to published information was sufficient to ensure ex-post legal remedies, such as a complaint to the Public Speech Council or a criminal report.
The applicant has complained about this precisely on the basis of data protection law. The data protection legislation provides for data subjects' own remedies, which, according to the applicant, may also be to some extent preliminary. In addition, the applicant has stated that it is specifically seeking an ex post facto remedy in this case, as the applicant's information has already been published and is being processed. In his complaint, the applicant has exercised his right to lodge a complaint with the Supervisory Authority under Article 77 of the General Data Protection Regulation. The applicant has considered that the processing of his personal data violates the general data protection regulation, and Sanoma has not rectified its procedure despite the applicant's request.

On the powers of the Data Protection Ombudsman and the selection of the applicant for the tax machine

Contrary to Sanoma's view, the Data Protection Ombudsman is competent to assess the processing of the applicant's data in Sanoma's tax machines. The processing of the applicant's data in tax machines is the processing of personal data within the meaning of data protection legislation. The National Data Protection Supervisor is the national supervisory authority within the meaning of the General Data Protection Regulation.
For the sake of clarity, the applicant has further stated that the EDPS is competent in this case, even if, contrary to the applicant's view, the processing in tax machines is considered to have taken place for journalistic purposes only. The exceptions provided for in section 27 of the Data Protection Act do not apply to the entire data protection legislation, but only to the articles of the general data protection decree explicitly mentioned in the article in question. The applicant has further stated that in other respects the data protection law is also applicable to processing for journalistic purposes only.
The fact that the applicant is a shareholder in a private limited company does not, in his view, make him a socially significant person. The applicant has hoped that the opposite argument would be substantiated by some concrete example, that is, an example of what kind of power a person completely out of politics can even exercise. According to the applicant, such an ambiguous reference is not sufficient to justify a significant restriction on the privacy of more than 100,000 Finns.
The applicant has further argued that the argument that, for example, by looking at the applicant's tax information, an outsider could understand how policy decisions affect revenue and taxes locally and nationally is quite interesting. However, according to the applicant, the tax machines say practically nothing about the applicant's background, such as membership in the “wealthy family” or which company the applicant owns. Thus, in the applicant's view, it is impossible to draw such conclusions and observations from the tax machine data.
The applicant has also questioned how an increase or decrease in his or her income may indicate how his or her activities in society affect his or her personal income. The applicant has emphasized that he is in no way politically active and does not otherwise function in a different way from an ordinary person in society. Furthermore, the applicant has stated that the tax machine does not provide any such information on the applicant's social activities, so that such conclusions cannot be drawn from the tax machine.
The applicant has referred to a report issued in the case, in which Sanoma has stated that in Finland the publication of tax information has been established as falling within the scope of freedom of information. In this connection, Sanoma has mentioned an interview published in Aamulehti by Professor of Administrative Law Olli Mäenpää. However, according to the applicant, this interview focused on whether the taxpayer had grounds for not disclosing the information of certain persons as part of the mass request lists in the press. The applicant has further stated that in this context a distinction must be made between the right of the press to register in the background and what the press has the right to publish.

A comparison between the present case and the Tax Exchange case

The applicant has referred to a statement in the case in which Sanoma has stated that the present case differs from the number of information to be published in the Tax Exchange case.
The applicant has emphasized that the second key difference is that, unlike in the Tax Exchange case, Sanoma's tax machines are available on the Internet and the tax machine operates as a search engine. Finding out a person's information using a tax machine is thus significantly faster, cheaper and easier than it was in a tax exchange case. Making information available to everyone in this way easily and free of charge is significantly more detrimental to data subjects than publishing it in a paper, paid journal. In addition, the applicant has stated that it is common knowledge that information once published on the Internet will also remain public and cannot be effectively deleted everywhere.
The applicant has stated that the Supreme Administrative Court did not rule on the amount of information that would be acceptable to publish in the Tax Exchange case. Thus, the mere fact that Sanoma publishes less information is not sufficient for Sanoma not to be regarded as having published the background register (in whole or in part).
In its defense, the applicant has further stated that, secondly, Sanoma in any case publishes the income data of more than 100,000 Finns and at the same time restricts the privacy of all of them without any case-by-case consideration and assessment. This is a significant number of registrants. According to the applicant, such a processing volume can in no way be considered insignificant.
The applicant has continued that the processing of personal data by tax machines is therefore a very extensive processing of personal data, both in terms of the number of data subjects and in terms of individual personal data. The applicant has questioned whether such extensive processing is necessary (or even the correct and in fact effective way) to achieve the objectives on which Sanoma justifies the publication of the information. The applicant has emphasized that this is a matter of reconciling two fundamental rights, in which case the exceptions and limitations to the protection of privacy must be carried out within the limits of what is strictly necessary.
Finally, the applicant states that the issue is the same as in the Tax Exchange case. It is necessary to decide whether Sanoma has processed the data in the background register to such an extent that the processing must be considered in breach of data protection legislation in this respect.

Applicable law

The General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation) has been applicable since 25 May 2018. The provision is a directly applicable law in the Member States. The General Data Protection Regulation contains national room for maneuver, which allows national law to supplement and clarify matters specifically defined in the Regulation. The Data Protection Act (1050/2018) clarifies and supplements the general data protection regulation and its national application.

Legal questions

The Data Protection Ombudsman will assess and resolve the applicant's case on the basis of the above-mentioned General Data Protection Regulation and the Data Protection Act. The following legal issues are involved:
Does the processing of personal data performed in connection with Helsingin Sanomat's and Ilta-Sanomat's tax machines fall within the scope of the exception provided for in section 27 (1) of the Data Protection Act; and
Irrespective of whether or not the processing of personal data in connection with Helsingin Sanomat's and Ilta-Sanomat's tax machines falls within the exception provided for in section 27 (1) of the Data Protection Act, the Data Protection Ombudsman has to decide whether Article 5 (1) (a) of the General Data Protection Regulation applies. processing of personal data contrary to the first subparagraph or Article 32.
For the sake of clarity, the Data Protection Ombudsman is not competent to assess the extent to which tax information and tax documents are public under the Act on the Disclosure and Confidentiality of Tax Information (1346/1999). As far as the relationship between the above-mentioned law and the general data protection regulation is concerned, such an assessment will be made in the context of drafting the law. The Data Protection Ombudsman has thus not been able to assess the right of the controller to publish tax information per se, and there is no question of possible prior interference with the content of the publications. The issue is only whether the exception provided for in section 27 of the Data Protection Act applies to the processing of personal data referred to in the case.
In this context, the Data Protection Ombudsman also draws attention to the fact that the Data Protection Ombudsman is not in a position to reconcile freedom of expression and the protection of personal data. This coordination has been carried out by the national legislator with the exceptions provided for in section 27 of the Data Protection Act. In the present case, the Data Protection Commissioner must decide whether the exception provided for in section 27 of the Data Protection Act for the processing of personal data in connection with the tax machines of Helsingin Sanomat and Ilta-Sanomat applies only to the processing of personal data for journalistic purposes. In assessing the conditions for the application of the exception, the Data Protection Ombudsman has to take into account in particular the fact that it is a matter of reconciling two different fundamental rights - freedom of expression and protection of personal data.

Decision of the Data Protection Ombudsman

The processing of personal data performed in connection with Helsingin Sanomat's and Ilta-Sanomat's tax machines falls within the scope of the exception provided for in section 27 (1) of the Data Protection Act.
The present case does not concern the processing of personal data in breach of Article 5 (1) (a) or Article 32 of the General Data Protection Regulation.

Reasoning

At first

Despite the fact that the taxpayer had agreed to the applicant's request in the autumn of 2019 not to disclose the applicant's tax information as part of the taxpayer's mass transfer, the applicant's information was published on the internet tax machines of Sanoma Media Finland Oy (“Sanoma”), Helsingin Sanomat and Ilta-Sanomat. The applicant has notified Sanoma of its objection to the processing of his personal data and requested that they be deleted from the tax machines in question. The message has not agreed to the applicant's request.
It should be noted that this is material published in the media and stored in digital form. As provided in section 2 of the Act on the Exercise of Freedom of Expression in the Mass Communication (460/2003), the public means a freely selectable group of recipients of a message. A publication, on the other hand, refers to a printed product, a data disc or any other text, sound or image recording made available to the public. Publishing, on the other hand, refers to making publications and non-program online messages available to the public. The said Act applies to publishing and programming activities in Finland, and this Act lays down more detailed provisions on the exercise of freedom of expression guaranteed in the Constitution in the mass media.
When assessing whether the exception provided for in section 27 of the Data Protection Act applies, the law also applies to whether the law on the exercise of freedom of expression in the mass media applies to the activity. The application of the said Act to the processing of personal data for journalistic purposes only provided for in section 27 of the Data Protection Act is relevant because the person then has the retrospective legal remedies for liability related to freedom of expression provided for in this Act. Section 13 of the Act on the Exercise of Freedom of Expression in the Mass Media provides for a violation of the editor-in-chief. In assessing whether the conditions for the application of section 27 of the Data Protection Act are met, it is also relevant whether the responsibility for processing the data covered by the exception can be clearly assigned to a specific party, such as the editor-in-chief. The data subject will therefore not be deprived of legal protection, even if the exceptions provided for in section 27 of the Data Protection Act become applicable to the processing of personal data in question.
The preliminary work of the Data Protection Act has also considered that a comprehensive and functioning system of self-regulation of the mass media, in which journalistic activities are bound by the code of professional ethics, the Journalist's guidelines, contributes to enabling extensive exceptions to the protection of personal data. Compliance with the journalist's instructions is monitored by the Public Speech Council.
In addition, the provision of Chapter 24, Section 8 of the Penal Code (39/1889) on the dissemination of invasive information, which applies to an act in which information, hint or image of another person's private life is presented in such a way that the act is likely to cause harm or suffering to or to the injured person, is relevant. contempt for.

Journalistic purpose

Section 27 of the Data Protection Act provides for the processing of personal data for the purposes of journalistic expression. In order to safeguard freedom of expression and information, Articles 5 (1) (c) to (e), 6 and 7, 9 and 10, 11 (2), 12 to 22, 30, 34 of the General Data Protection Regulation do not apply to the processing of personal data for journalistic purposes only. Paragraphs 1 to 3, Articles 35 and 36, Article 56, Article 58 (2) (f), Articles 60 to 63 and Articles 65 to 67. On the other hand, in order to safeguard freedom of expression and information, Articles 5 (1) (a) and (b) and (2), Articles 24 to 26, 31, 39 and 40, 42, 57 and 58 of the General Data Protection Regulation apply to the processing of personal data for journalistic purposes only, Articles 64 and 70 only where applicable.
The concept of journalistic purpose is not defined in the Data Protection Act, nor in the Government's draft law. Furthermore, the concept is not defined in the General Data Protection Regulation or in the previous Personal Data Directive (95/46 / EC). However, recital 153 of the General Data Protection Regulation states that the exceptions for the exercise of freedom of expression should apply in particular to the processing of personal data in the audiovisual field and in news and newspaper archives. In this context, it should also be noted that the European Court of Human Rights has ruled in Times Newspapers Ltd. v. United Kingdom (Nos. 1 and 2) that internet archives play an important role in the storage and availability of news and information. These archives are an important source for educational activities and historical research, especially because they are easily accessible to the public and generally free.
The judgment of the Court of Justice of the European Union in Case C-73/07 states, inter alia: That judgment further states: 'Activities such as those at issue in the main proceedings, which concern information derived from public documents under national law, may be regarded as journalistic activities if their purpose is to communicate information, opinions or ideas to the public by any means of communication'. Furthermore, that judgment states: disclosure to the public, which is a matter for the national court to assess. ' On the other hand, it is clear from the Court's ruling that, in order to strike a harmonious balance, the protection of the fundamental right to privacy requires that the exceptions and limitations referred to here be carried out within the limits of what is strictly necessary.
The Supreme Administrative Court, for its part, in its judgment KHO 2009: 82 based on the preliminary ruling of the Court of Justice in Case C-73/07, stated that the starting point for the assessment is whether the activity in question is intended to express information, opinions and ideas to the public. It is therefore necessary to assess whether the sole purpose of the processing of personal tax data in the present case was to disclose information, opinions or ideas to the public.
According to the Supreme Administrative Court, the assessment must take into account the extent to which the activity can be considered to promote a socially interesting debate rather than to seek to satisfy the curiosity of individuals in isolation from the social debate. The above-mentioned solution (KHO 2009: 82) stipulates a necessary, open and socially interesting discussion in a democratic society or the control of the exercise of social power and freedom of criticism as a precondition for publication.
The assessment must also take into account that the rights to respect for private and family life enshrined in Article 7 of the Charter of Fundamental Rights of the European Union correspond to Article 8 (1) ECHR and that Article 52 (3) of the ECHR and the rights guaranteed by the European Convention for the Protection of Fundamental Freedoms, have the same meaning and scope as the Convention. Consequently, the case law of the European Court of Human Rights (EIT) is also relevant.
In assessing the applicability of section 27 of the Data Protection Act to the processing of personal data, it is therefore necessary to assess whether the processing of personal data in connection with Helsingin Sanomat's and Ilta-Sanomat's tax machines complies with the case law described above by the European Court of Justice, the European Court of Human Rights. The assessment is case-by-case.

Interest weighting

The EDPS first notes that this is a situation to which the law on the exercise of freedom of expression in the mass media, incl. the liability of the editor-in-chief provided for in section 13 of the Act. The Data Protection Commissioner states that the threshold for considering that section 27 of the Data Protection Act would not apply to the processing of personal data carried out in connection with such activities is in principle not exceeded.
In its judgment of 24 June 2004, the European Court of Human Rights, von Hannover, stated, inter alia, that the press has an essential role to play in a democratic society. Although it may not exceed certain limits, in particular as regards the protection of the reputation and rights of others, its task was nevertheless to share information and ideas on all matters of common interest in an appropriate manner for its duties and responsibilities. The case law of the European Court of Human Rights has also taken a position on reconciling freedom of expression and privacy (ie issues to be taken into account in the balancing of interests).
Axel Springer v Germany mentions, as a first such criterion, the importance of publication in relation to the public interest debate. The EIT has explicitly stated that what is considered to be in the public interest is determined on a case-by-case basis. In particular, it has been stated that not only the publication's involvement in politics or crime, but also publications relating to sports and performing artists can be considered to be in the public interest. In the present case, some of the tax information published in the tax machines relates to persons belonging to such categories of persons specifically mentioned by the court, and some of the information does not relate to persons belonging to such categories of persons. On the other hand, reference should also be made to the ruling of the European Court of Human Rights in Satakunnan Markkinapörssi Oy and Satamedia Oy, where the EIT has stated that the content, nature and relevance of published information must be taken into account when assessing whether it is of public interest. The EDPS notes that there is undoubtedly a general interest in information on taxes and taxation in general. In the case law of the EIT, where there is no public interest, the exercise of other rights may be given greater weight. However, the EIT considered that the collection and publication of personal tax information, to the extent that it was done in the case of Satakunnan Markkinapörssi Oy and Satamedia Oy, was not in the public interest within the meaning of the European Convention on Human Rights.
It should also be noted that in Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland (2017), the EIT also stated for the first time that Article 8 of the European Convention on Human Rights provides for a right to an informed right to self-determination, and disseminated in one form or manner in such a way that rights under Article 8 of the European Convention on Human Rights may be affected. The EIT considered that the publication of tax information was clearly covered by the protection of privacy, despite the fact that such information was itself public under national law.
Notwithstanding the above, it must be stated that the present case as such cannot be equated with the case of Satakunnan Markkinapörssi Oy and Satamedia Oy. Satakunnan Markkinapörssi Oy had published tax information for approximately 1.2 million people in the annual Veropörssi magazines. The lower limit for the information to be published was defined for each municipality. The income thresholds above which the income of individuals was published in the Tax Exchange were significantly lower than in the present case. In other words, the sampling basis of Satakunnan Markkinapörssi Oy had been so broad that income data of non-high-income persons had also been published. It was also possible to purchase tax information via the SMS service. It should be further noted that the Supreme Administrative Court's decision in Supreme Administrative Court 2009: 82 also explicitly held that the publication of tax information in a certain way and to a certain extent had not promoted a socially interesting debate rather than sought to satisfy the curiosity of individuals.
The decision of the Supreme Administrative Court (KHO 2009: 82) means that tax information may not be published as such and to the extent that it was published in the Tax Exchange in 2001. Furthermore, the ban imposed on Satakunnan Markkinapörssi Oy by Decision 3 / 26.11.2009 of the Data Protection Board has been defined as prohibiting the company from processing taxable personal income and capital data and assets in breach of the Personal Data Act to the extent and in the same way as for the 2001 tax data. The ban did not specify in detail what tax information would be allowed to be published. Thus, the journalistic discretion of the information to be published was still left to the publisher or publisher.
The present case concerns the publication of tax information on natural persons whose annual income has exceeded EUR 100 000 or EUR 150 000. Such persons can be considered high-income people in Finland. Only less than two percent of Finnish income recipients reach this income.
It should be noted that the tax lists describing the outcome of taxation or the corresponding current public information on taxation have been publicly available in Finland for decades. It can be further noted that the draft laws on the disclosure and confidentiality of tax information have stated that many newspapers have published public information on taxation and that it has enabled a relevant societal debate. The above-mentioned preliminary works of the law have continued that it is possible to make observations about the level of taxation and its allocation, as well as the functioning of the administration, from public information on taxation. In particular, the general public has been particularly interested in the income and wealth data of individuals. In addition, it has been explicitly stated that public information on taxation may continue to be relevant from the point of view of civil oversight and not only to satisfy human curiosity. It has been stated in the draft laws that the debate on the disclosure of tax information has shown that there is a strong public opinion behind maintaining the disclosure of tax information. Even in the legal literature, the publication of list-based information itself includes an assessment of the relevance of the information. Once published, the information can be used for a variety of purposes, including both societal debate and satisfying the curiosity of individuals. The list nature of the data does not in itself rule out the possibility of social debate.
Reference should also be made to the provision of Chapter 24, Section 8 of the Penal Code on the dissemination of invasive information and its preliminary work. The preamble to the provision explicitly states that the protection of privacy must not restrict citizens' right to information on matters of social importance. The more and deeper the social impact of a factor, the more legitimate the requirement to publish and receive information about it. Of particular importance to society is the exercise of political and economic power. Such areas are subject to decision-making, affect the daily lives of many people or may otherwise be of fundamental importance. This justifies the fact that the privacy of, for example, politicians and business people is not protected to the same extent as that of other people.
There must be strong grounds for intervening in a debate of general interest. Not only are political expressions in the narrow sense considered such a debate, but the debate on economic conditions in society, for example, also enjoys strong protection. If, on the other hand, the expression deals with purely private matters, that is to say, matters of no general or social significance, the protection afforded by freedom of expression is narrower.
In this context, attention must also be paid to the wording used in the Supreme Administrative Court's judgment in Supreme Administrative Court 2009: 82: The term used rather refers to a particular type of probabilistic weighing, i.e., in this context, to assess whether tax machines are more likely to contribute to the social debate or to the satisfaction of the curiosity of individuals detached from the social debate. In particular, it must be borne in mind that the assessment must distinguish between satisfying the curiosity of individuals alone and satisfying the curiosity of individuals detached from the social debate. However, the EDPS emphasizes that satisfying the curiosity of individuals does not preclude the processing of personal data for journalistic purposes only.
High-income individuals can be considered to be of great public interest. Descriptive in this respect has been stated in the above-mentioned Government proposal (HE 149/1999 vp). When discussing the retention or deletion of public information on taxation, the government's proposal also mentions the possibility that only the information of persons above a certain income level or the information of persons of other significant social status would be public. Although such a solution is not considered appropriate due to the difficulties of delimitation, the discussion on the matter and the fact that a reference to this has been included in the Government's proposal in general show that high-income people have been seen as a special group in this respect. Special attention must also be paid to the fact that the above-mentioned division mentions both 1) persons exceeding a certain income level and 2) persons in an otherwise significant social position. High-income earners can therefore be considered to be in a significant social position simply because of their income - regardless of their other social status.
Reference may also be made in this connection to the Opinion of Advocate General Kokott in Case C-73/07. In this Opinion, Advocate General Kokott states, inter alia, that the State authorities' [...] cannot assess too strictly whether journalistic purposes are involved. It is usually not possible to determine in advance which information relates to matters of public interest and, after all, it is at least in part that the media is influenced by the creation of the public interest or interest through the transmission of information. [- -] Nor is it, in principle, for the public authorities to foresee in advance the issues in which such a general interest will not arise in the future. Such a prediction would be the first step on the road to censorship. The fact that the dissemination of information and ideas does not concern matters of public interest can therefore be established only when it is obvious'.
It should also be noted that the European Court of Human Rights has ruled in its case law that journalistic freedom includes the freedom to choose how matters are dealt with and approached. Courts, including the European Court of Human Rights, cannot express their views on deliveries in this regard. Journalists are free to choose what details are necessary to publish in order to ensure the credibility of the article. However, the Court has drawn attention to the fact that these decisions must be made in accordance with the ethical guidelines and code of conduct for journalists. Nor does the EDPS have the power to assess the content of a journalistic publication decision or the way in which data is processed. When assessing whether Section 27 of the Data Protection Act becomes applicable, the Data Protection Commissioner cannot assess whether the processing of personal data is detrimental to the data subject. It is up to the media players alone to assess the harm, inconvenience or other effects of the information being published on its target in the globalized operating environment.
Furthermore, in Axel Springer v Germany, one of the criteria for assessment is the degree to which the person concerned is known and the subject of the publication. The assessment must therefore take into account the role of the person concerned and the nature of the matter which is the subject of the publication. In this context, a distinction must be made between a so-called private individual and a person acting in a public capacity (such as political or public figures). The Court has further held that a person unknown to the public may claim special protection of privacy, unlike persons in public office.
It is not possible to describe comprehensively what a public task a natural person must have in order for the general public to have a legitimate right to obtain information about that person, for example through tax machines. It is equally difficult to define a subset of “public figures”. Generally, a person in the public eye is considered to be a person who, because of his or her duties or commitments, is subject to a certain degree of media publicity. Decision No 1165 of the Parliamentary Assembly of the Council of Europe on the protection of privacy in 1998 contains one possible definition of "public figure". According to it, "public figures hold public office and / or use public funds and, more broadly, anyone in a public position, for example in politics, the economy, the arts, volunteering, sport or any other field."
The European Data Protection Board has also defined the concept of public status in its interpretative guidance. According to this interpretative guideline, a public position or a public person means that a person is, at least to some extent, subject to so-called media exposure through his or her actions or commitments. In the light of the above, it should be noted that those involved in business can, in principle, be considered to be in a public position. It should be noted, however, that the term business is not an unambiguous term. In their decision-making practice, the Data Protection Supervisor and the Assistant Data Protection Supervisor have considered that, for example, a trade register entry or a dominant position in a company may mean that a person can be considered to be involved in business. However, this is only one of the factors to be taken into account in the assessment. A person can also be considered to be involved in business on some other or some other basis. It is a question of an overall assessment on a case-by-case basis. All relevant factors must be taken into account when assessing the matter.
It should also be noted that the self-regulatory body for media players, the Public Speech Council, has considered in its tax information decisions (2973C / SL / 00 and 7260 / SL / 19) that significant income or wealth undermines the protection of the privacy of the average citizen. The EDPS also considers that significant revenues reduce the right of a natural person to the protection of personal data for tax purposes in this case.
The European Court of Human Rights has also ruled that the assessment must take into account the past performance of the person concerned and whether the information in question has already been published. The method of obtaining the data and the accuracy of the data are also mentioned as evaluation criteria. In connection with this evaluation criterion, information may be divided into both factual information (facts) and opinions or views that individuals have about an issue or person. In assessing the inaccuracy or completeness of personal data, account must be taken of whether the matter in question is a fact whose accuracy cannot be disputed or whether it is a subjective opinion or opinion. It should be noted that the information currently available is, in principle, accurate. Thus, the information is not normally subject to an objectively observable error of fact which, for example, gives an incorrect, incomplete or misleading picture of a natural person.
The content, format and consequences of the publication have also become a criterion for the European Court of Human Rights. In the context of this evaluation criterion, the EIT has explicitly stated that the extent to which a publication is widely available may also be relevant.
An analogy can also be drawn from the judgments of the Court of Justice of the European Union in Cases C-131/12 and C-136/17, which state that the processing of personal data by internet search engines in the name of the data subject fundamental rights. It has also been stated in the above-mentioned judgments that the data subject's rights in principle supersede not only the financial interest of the search engine operator but also the interest of the general public in obtaining access to the data in question through the data subject's name. However, the European Court of Justice has identified a number of factors that need to be taken into account in the assessment. These include the nature or sensitivity of the information in question, and in particular the interests of Internet users in obtaining information, which in turn must take into account the data subject's potential public or similar status.
In assessing how the processing of personal data by tax machines should be assessed in the light of the above cases, it should be noted that the EDPS Interpretative Guide explicitly states that the internet search engine operator must take into account the impact of deleting data on internet users' access rights. As the Court of Justice of the European Union has stated, the restriction of a data subject's fundamental rights must be based on the overriding interest of the general public in obtaining the information in question. In summary, the European Data Protection Board's interpretative guidelines state that, on a case-by-case basis, internet search engine operators may refuse to delete data if they can show that access to the data is absolutely necessary to safeguard Internet users' access rights.
It should be noted that the information is presented in an objective manner in the tax machines. It is in itself a matter of public information to which anyone has access. It is also relevant in the assessment that the tax information processed in the tax machine is expressly provided for to the public, although the application of section 27 of the Data Protection Act cannot be justified solely on the basis of this fact. The information has been obtained legally from official sources. Only high-income individuals have been published on tax machines. Individual tax information can be seen as contributing to a socially interesting debate on both taxes and income distribution. Issues of income inequality, including individual causes of income inequality, are almost always the subject of societal debate and research. Positions and opinions on income inequality are presented to the public from the perspective of, among other things, fairness and economic equality. Indeed, reporting on income disparities is a matter of public debate, and it is not just a matter of satisfying curiosity about certain individuals. The EDPS considers that the current situation is a matter of fostering a public debate on issues considered to be of general interest and importance, rather than satisfying the curiosity of a specific readership. The EDPS notes that there are no facts in the case that would lead to the conclusion that the processing of personal data referred to in section 27 of the Data Protection Act is not for journalistic purposes only.
For the reasons set out above, the Data Protection Commissioner considers that the processing of personal data in connection with Helsingin Sanomat's and Ilta-Sanomat's tax machines falls within the scope of the exception provided for in section 27 (1) of the Data Protection Act.
As the processing of personal data in connection with Helsingin Sanomat's and Ilta-Sanomat's tax machines falls within the scope of the exception provided for in section 27 (1) of the Data Protection Act, Articles 17 and 21 of the General Data Protection Regulation will not apply.

The concept of the editorial register

Section 2 (a) of the Personal Data Act, which preceded the repealed Personal Data Act (523/1999), defined an editorial register. It is clear from the preamble to the Personal Data Act that the Personal Data Act was intended in this respect to maintain the current state of regulation of the media's editorial registers within the framework permitted by the Personal Data Directive.
It should be noted, however, that neither the Data Protection Act nor the relevant Government proposal mentions an editorial register. On the other hand, it is clear from the preamble to the Data Protection Act that the implementation of the General Data Protection Regulation should maintain a status quo in which the processing of personal data for journalistic purposes is subject to provisions mainly concerning the obligation to protect personal data and the Authority's powers. It should also be noted that the nature of the processing of personal data has changed significantly since the enactment of the Personal Data Act. This also applies to the processing of personal data for journalistic purposes. The means of expressing freedom of expression have also changed significantly with digitalisation, technological advances, online publications and social media.
With regard to the editorial register, it should be noted that the Personal Registers Act was partially revised in 1994 (387/1994). The editorial offices of the media were then largely excluded from the scope of the Personal Data Act, as the possibility for data protection authorities to control and intervene in the personal registers of the media was considered to be incompatible with freedom of expression and freedom of the press. According to the definition in section 2 (2a) of the Act, editorial registers were personal registers which were intended for use exclusively in the editorial work of the media and which were not available to others. According to the draft law, the information contained in the editorial registers could not be used, for example, in administrative or marketing tasks in the media.
In this context, the EDPS also draws attention to new methods of journalism, such as aggregation and data journalism. Mass aggregation means that the readership is involved in investigative journalism projects. This enables, among other things, large data sets to be traversed. Internationally, the use of the grouping method has led to the disclosure of socially significant information and increased public debate and activity. Datajournalism, on the other hand, refers to the method of journalism, in which new information or news is produced, for example, by combining and analyzing extensive data. Readers can also use these methods to make observations about our society or its members that might not be made without this interaction. Mass aggregation and data journalism can be seen as facilitating the structuring and accessibility of large masses of data that are common in modern society. Although there is no explicit mention or provision in the current legislation for editorial registers, it should be noted that for such registers, the EDPS only monitors compliance with the obligation to protect the registers.
It has already been stated in the Government 's proposal 1993 vp - HE 311 that some of the information collected by the media to be published is not so much problematic from the point of view of data protection. The aim has been to ensure that media registers are protected from both technical and other inappropriate external interference. It is further noted that in the case of published material, the related needs for the protection of privacy and the legal protection of the individual may be safeguarded by other provisions, such as the provisions of Chapter 27, Section 3a of the Penal Code [dissemination of information that infringes privacy].
When section 27 of the Data Protection Act applies, Article 32 on the security of the processing of the General Data Protection Decree shall apply. Taking into account the latest technology and implementation costs, the nature, extent, context and purposes of the processing and the risks to the rights and freedoms of natural persons varying in probability and severity, the controller and processor shall take appropriate technical and organizational measures to ensure a level of security and the continued confidentiality, integrity, availability and fault tolerance of the Services; (c) the ability to quickly recover data availability and access in the event of a physical or technical failure; and (d) a procedure for regularly testing, examining and evaluating the effectiveness of technical and organizational measures to ensure the security of data processing. Adequate protection of personal data is at the heart of security of processing. In the context of tax information, weak protection could be demonstrated, for example, by the fact that the information would leak into the network other than as a result of a considered decision. For information published on a tax machine, this obligation to protect means, for example, that outsiders should not be able to edit or delete the information. For example, availability (such as data destruction) or data corruption could also be a problem. For the sake of clarity, the applicability of Article 5 (1) (a) of the General Data Protection Regulation to the processing of personal data for journalistic purposes does not per se mean that the maintenance of a tax machine is contrary to Article 32 of the General Data Protection Regulation. The EDPS considers that the present case does not concern the processing of personal data in breach of Article 5 (1) (a) or Article 32 of the General Data Protection Regulation.

Applicable law

Mentioned in the explanatory memorandum.

Appeal

According to section 25 of the Data Protection Act (1050/2018), an appeal against this decision may be lodged with an administrative court in accordance with the provisions of the Act on Administrative Proceedings (808/2019).