CJEU - C-101/01 - Lindqvist

CJEU - Case C-101/01 Lindqvist
Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 1 (1) Directive 95/46 Article 10 European Convention for the protection of Human Rights (ECHR) Article 13 Directive 95/46 Article 25 Directive 95/46 Article 3 Directive 95/46 Article 8 Directive 95/46 Article 8 European Convention for the protection of Human Rights (ECHR) Article 9 Directive 95/46 Paragraph 13 Swedish Law on Personal Data, ‘the PUL (1998:204) Paragraph 33 Swedish Law on Personal Data, ‘the PUL (1998:204) Paragraph 36 Swedish Law on Personal Data, ‘the PUL (1998:204)
Decided:	06.11.2003
Parties:	Bodil Lindqvist Göta hovrätt (Sweden)
Case Number/Name:	Case C-101/01 Lindqvist
European Case Law Identifier:	ECLI:EU:C:2003:596
Reference from:	Göta hovrätt (Sweden)
Language:	24 EU Languages
Original Source:	Judgement
Initial Contributor:	Elaine Thuo

On 6th November 2003, the CJEU made a judgment on Bodil Lindqvist case. The case concerns the scope of processing of personal data by electronic means laid down under Article 3(1) of Directive 95/46.

English Summary

Facts

The case is about Mrs. Lindqvist who worked as a catechist in the Alseda Parish (Sweden). At the end of 1998, she set up internet pages on her personal computer in order to allow parishioners preparing for their confirmation to obtain any information they needed. She requested the administrator of the Swedish Church’s website to set up a link between those pages and the website. The pages she had set up contained information about Mrs. Lindqvist and 18 of her colleagues in the parish. The pages contained information including their full names, first names, jobs held, hobbies, telephone numbers and medical information on one of her colleagues. She had not informed her colleagues of those pages, obtain their consent or sought approval from the supervisory authority to process the personal data and sensitive personal data. The public prosecutor brought a proceeding against her, that she was in breach of the PUL on grounds that she processed personal data automatically without giving prior written notice to the Supervisory Authority (Datainspektionen). In addition, she processed sensitive personal data and transferred personal data to a third country without authorization or consent from the data subjects. The Royal Court (Göta hovrätt) stayed the national proceedings and referred some question of law to the CJEU.

Dispute

The questions brought before the CJEU were:

1. Whether a self-made list, with personal data of others, published on the internet constitute processing of personal data wholly or partly by automatic means as defined under Article 3(1) Directive 95/46.
2. Whether the act of setting up internet home pages for 15 people with links between the pages which make it possible to search the pages using the first name be considered processing of personal data which forms part of a filing system within the meaning under Article 3(1) Directive 95/46?
3. Whether the processing of personal data is covered under the exception to processing under a household activity under Article 3(1) Directive 95/46?
4. Whether the reference made to the health condition of Mrs. Lindqvist colleague amounts to processing of health/medical data under Article 8(1) Directive 95/46?
5. Whether publication of information on the internet, which can be viewed by anyone in the world, amount to transfer of personal data according to Article 25 Directive 95/46.
6. Whether the provisions of Directive 95/46 are in conflict with the general principles of freedom of expression under Article 10 ECHR.
7. Lastly, whether a member state can provide more extensive protection for personal data than that provided under Article 13 Directive 95/46.

Holding

On the first and second question, the CJEU held that the term personal data defined under Article 2(b) of Directive 95/46 includes any information relating to an identified or identifiable natural person. Hence, the term covers the name of a person, his telephone number or information relating to his working conditions or hobbies. Regarding the question whether Mrs. Lindqvist was processing personal data using internet pages, the court referred to Article 3(1) Directive 95/46 and observed that, according to the definition, the term processing of personal data covers any operation performed on personal data whether or not by automatic means. Thus, the court held that the operation of loading personal data on an internet page must be considered to be processing of personal data. The court also considered the third question, whether the processing falls under the exception stipulated under Article 3(2) Directive 95/46 as argued by Mrs. Lindqvist. On this, the court critically examined the exceptions stipulated which include processing by a natural person in the course of a purely household or personal activity. The court interpreted the exception to mean that the exception covers only activities which are carried out in the course of purely private or family life of individuals which clearly is not the case here since the activities carried out by Mrs. Lindqvist were or charitable or religious nature.

On the fourth question, the court interpreted widely Article 3(1) to include information concerning all aspects of physical and mental health state of an individual. Hence, Mrs. Lindqvist's reference to her colleagues health condition constitutes processing of personal data concerning health in line with Article 8(1) Directive 95/46.

On the fifth question, the court noted that the term transfer was not defined by Directive 95/46. Hence, in order to determine whether loading personal data on an internet page constitutes transfer within the meaning of transfer envisioned under Article 25 Directive 95/46, the court took into account the technical nature of the internet pages operations. The court noted that, in order for internet users to have access to the internet pages containing the personal data, they had to first connect to the internet and then proceed to carry out a search. Thus, the technical operations in question did not contain the technical means to send that information automatically to people who did not seek to access those pages. The court held that Mrs. Lindqvist did not transfer personal data as enumerated under Article 25 Directive 95/46.

On the sixth question, the court noted that Member states have an obligation to ensure that national laws are harmonized to ensure free flow of information between member states and also safeguard individuals’ rights and freedoms. Thus, there must be balancing of rights of individuals and economic and social integration. Mrs. Lindqvist's freedom of expression in her work to contribute to religious life had to be weighed against the protection of individual rights. To balance these two, the court emphasized on the importance of respecting the principle of proportionality that means taking into account all the circumstances of the case before it before making a decision. The court held that the provisions of Directive 95/46 do not necessarily bring a restriction which conflicts with the general principles of freedom of expression, but it is up to the national courts to ensure a fair balance between the rights and interests in question.

On the seventh question, the court addressed the question with reference to the provisions of Recital 8 and 10 Directive 95/46. In the harmonization of laws by member states, the court reiterated the importance of having a complete harmonization of laws. The court noted that Directive 95/46 allows room for manoeuvres in certain cases, but such manoeuvres should ensure that there is a balance between the free movement of personal data and protection of private life. In conclusion, the court held that measures taken by member states to ensure the protection of personal data must be consistent with the provisions of Directive 95/46. However, nothing prevents a member state from extending the scope of national legislation to areas not included in the scope of Directive 95/46.dfgd

Further Resources

Share blogs or news articles here!