Hämeenlinnan hallinto-oikeus (Finland) - 2548/2023
From GDPRhub
| Hämeenlinnan hallinto-oikeus - 2548/2023 | |
|---|---|
 | |
| Court: | Hämeenlinnan hallinto-oikeus (Finland) |
| Jurisdiction: | Finland |
| Relevant Law: | Article 5(1)(a) GDPR Article 32 GDPR Article 85(2) GDPR § 27(1) Data Protection Act |
| Decided: | 14.12.2023 |
| Published: | 19.12.2023 |
| Parties: | Sanoma Media Finland Oy |
| National Case Number/Name: | 2548/2023 |
| European Case Law Identifier: | |
| Appeal from: | Tietosuojavaltuutetun toimisto (Finland) 9970/163/2019 |
| Appeal to: | Pending appeal Korkein hallinto-oikeus (Finland) |
| Original Language(s): | Finnish |
| Original Source: | Hämeenlinnan hallinto-oikeus (in Finnish) |
| Initial Contributor: | fred |
The Administrative Court of Hämeenlinna upheld a DPA decision, which found that media outlets are not obliged to erase the personal tax information published in tax information portals due to journalistic exemption.
English Summary
Facts
The data subject had asked the Administrative Court of Hämeenlinna (the Court) to overturn the Finnish DPA's decision, according to which the media outlets owned by Sanoma Media Finland Oy (the controller) were not obliged to erase personal tax information because it was processed for journalistic purposes.
The data subject filed the appeal claiming that the controller had processed their personal data unlawfully, and claimed that, unlike individual news that utilises public tax information, the tax information portals published by the controller do not contribute to the emergence of an important social debate.
The data subject considered that the tax information portals contained information covered by the protection of people's privacy, which enabled the precise identification of individuals, and which had caused harm to the data subject and their family. The data subject also stated that if the Court considered that the tax information had been processed solely for journalistic purposes, the processing of personal data in the tax information portals had in any case violated Article 5(1)(a) GDPR and Article 32 GDPR, because the large-scale and permanent publication of personal data of a large number of people did not meet the requirements set for the security of processing.
The controller emphasised that the tax information portals enable public debate on socially significant topics related to taxation, such as income disparity. The publication of tax information promotes opportunities to make observations related to society, especially when the information is available to everyone free of charge.
The DPA pointed out that the question is not whether tax information can be published, but whether Section 27(1) of the Finnish Data Protection Act applies, according to which certain provisions of the GDPR do not apply to the processing of personal data solely for journalistic purposes.
Holding
The Court noted that the purpose of publishing tax information could reasonably be considered to be disclosure of information to the public. In the tax information portals published by the controller, public tax information concerning the data subject has been processed solely for journalistic purposes in accordance with Section 27(1) of the Finnish Data Protection Act.
In this respect, the Court considered that information published on the tax information portals consisted of accurate public tax information and did not reveal sensitive details of the data subject's private life. Therefore, the exemptions provided for in Section 27(1) of the Finnish Data Protection Act could be deemed necessary to reconcile the right to the protection of personal data with the freedom of expression and information in accordance with Article 85(2) GDPR.
The Court held that the provisions on the security of processing in Article 32 GDPR are not intended to limit the publication of information resulting from the purpose of the processing of personal data, and they may not be interpreted together with Article 5(1)(a) GDPR as restrictions on such processing.
In light of this, the Court agreed with the DPA that the controller had not violated the GDPR or the Finnish Data Protection Act.
Comment
The Administrative Court of Helsinki has issued a similar decision in case 7353/2023.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
ADMINISTRATIVE COURT OF HÄMENLINNA DECISION 2548/2023 14/12/2023 ID number 22121/03.04.04.04.01/2021 Case A case concerning the processing of tax data Appellant Decision to be appealed Decision of the Data Protection Commissioner 27 October 2021 ID number 9970/163/2019 The processing of the case at the data protection commissioner's office has required Sanoma Media Finland Oy to remove his information in its entirety from the tax machines published on the websites of Helsingin Sanomat and Ilta-Sanom, and after the company refused to do so, the matter was referred to the data protection commissioner. has considered that the processing of personal data in tax machines is contrary to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons in the processing of personal data and on the free movement of this data and repealing Directive 95/46/EC (General Data Protection Regulation) and the Data Protection Act, and the data is not processed only for journalistic purposes as referred to in Section 27 of the Data Protection Act. In its decision under appeal, the Data Protection Commissioner has considered the data controller's processing actions to be in accordance with the law. Among other things, the following has been stated in the reasons for the decision: In the current case, the issue has been the publication of tax information of natural persons whose annual income has exceeded the limit of 100,000 or 150,000 euros. Such persons can be considered to have high incomes in Finland. Only less than two percent of Finnish income earners reach the mentioned incomes. Tax information is presented in tax machines in an objective way. It is already a question of public information to which anyone has access. In the evaluation, it is also important that the tax information processed in the tax machine has been expressly stipulated to be public, although the application of Section 27 of the Data Protection Act cannot be justified solely on the basis of this fact. The information has been obtained legally from official sources. Information on high-income individuals has been published in the tax machines. The tax information of individual persons can be considered to promote a socially interesting discussion about both taxes and income distribution. Questions about income differences and, among other things, the individual reasons for income differences are almost always the subject of social debate and also the subject of research. Positions and opinions on income inequality are presented in public, for example from the perspective of justice and economic equality. Reporting on income differences serves the public debate, and it's not just about satisfying the curiosity of certain people. On the basis of the above and other grounds in its decision, the Data Protection Commissioner has considered that the processing of personal data carried out in connection with Helsingin Sanomat's and Ilta-Sanomit's tax machines falls within the scope of the journalistic exception provided for in Section 27(1) of the Data Protection Act and that Article 17 and Article 21 of the General Data Protection Regulation therefore do not apply in the case to be applied. The Data Protection Commissioner has further considered that the case does not involve processing of personal data contrary to Article 5, Paragraph 1, Subsection a or Article 32 of the General Data Protection Regulation. Claims in the administrative court has demanded that the administrative court overturn the data protection commissioner's decision and confirm that Sanoma Media Finland Oy processed personal data concerning him unlawfully or secondarily return the case to the data protection commissioner for re-processing. The Data Protection Commissioner must be obliged to compensate the parties involved and court costs with legal default interest. The decision differs in its outcome and reasoning from the data protection commissioner's previous interpretation practice and from the decision given by the Supreme Administrative Court in the so-called Veropörssi case, KHO 2009:82. Deviation from the established interpretation practice is not justified in any way. The decision has only referred to the amount of information, which cannot be considered as a sufficient basis for the opposite interpretation. The Data Protection Commissioner has also completely ignored the fact that the information of the so-called editorial background register has been published almost as is in Sanoma Media Finland Oy's tax machines. In accordance with the interpretation line made by the Supreme Administrative Court in the Veropörssi case, this cannot be considered to meet the requirements of the journalistic exception. When assessing the extent of the publication of information, the Supreme Administrative Court primarily referred to how much of the information received from the Tax Administration had been published, and not just to the number of published information. Despite the income limit, in this case too, the issue is a very significant amount of personal data. Verokone responds to an individual's request for another person's personal data, and in this respect it is not a matter of disclosing the information to the public. Unlike individual news stories that use public tax data, tax machines do not contribute to the emergence of an important social debate. The information that emerges from them is insufficient to draw conclusions about, for example, the income level of certain occupations. The European Court of Human Rights has also drawn attention to this in its judgment in the case of Satakunn Markkinapörssi Oy and Satamedia Oy v. Finland, stating that the companies that published tax information had not explained how the readers of their publications could draw conclusions, for example, about the development of income and wealth differences based on the raw data published in bulk. The publication of income tax information does not create an automatic right to the processing of the information or its publication. Even in the publication of public information, questions related to data protection and privacy should always be evaluated on a case-by-case basis. Information covered by the protection of people's privacy is available from the tax machines, which together enable the exact identification and identification of a person. The tax machines also indirectly provide information about the wealth of those persons whose taxable income has not exceeded the income limits defined for publication in the tax machines, because the absence of a person's information from the tax machine reveals that his income fell below the income limit. The right to privacy, which is protected as a fundamental right of people who have exceeded a certain income limit, cannot be restricted categorically without a case-by-case consideration. is not a public figure, nor in a socially significant position. He is not involved in politics, and his work does not involve any public or general interests. Also, the fact that he owns shares in a private limited company does not make him a socially significant person. Through Verokone, information has been permanently and easily made available to the general public. This has caused harm and suffering to his family as well. asked in the fall of 2019 that the taxman would not hand over income tax information. The taxman complied with the request, but despite this, the newspapers published by Sanoma Media Finland Oy have acquired the information as part of their tax machines published on the internet. The income limits of Helsingin Sanomat's and Ilta-Sanomit's tax machines are not based on a separate consideration, but on pre-compiled information received from the tax accountant. The data protection commissioner's decision does not show how persons exceeding a certain income limit can be considered socially significant power users, without a case-by-case assessment. In the decision, the importance of a case-by-case assessment in determining a socially significant position or a public position has been emphasized contradictory on several occasions, but on the other hand, the decision also outlines that, regardless of the specific circumstances of the case, the social position of all those who earned more than 100,000 euros is such that their privacy can be restricted. Contrary to what was stated in the data protection commissioner's decision, the possible existence of other means of legal protection is not relevant in the assessment of whether the processing took place solely for journalistic purposes. Privacy protection can be limited only to the extent that it is absolutely necessary. Tax machines are not absolutely necessary to process income tax information in the media. has also announced that it will renew its earlier submission to the Data Protection Commissioner. At that time, he had, among other things, considered that if the data is considered to have been processed only for journalistic purposes, the processing of his personal data in the tax machines has in any case been against Article 5(1)(a) and Article 32 of the General Data Protection Regulation. If Section 27 of the Data Protection Act is considered to be applicable to the processing of personal data in tax machines, the persons listed in the tax machine do not have any legal recourse in matters related to the processing of their personal data. In this situation, the data controller has, based on Article 5(1)(a) and Article 32 of the General Data Protection Regulation, an emphasized obligation to ensure that its actions are proportionate to the goal they aim for and that the processing does not pose a risk to the data subjects. The large-scale and permanent publication of the personal data of a very large group of people does not meet the requirements laid down in Article 32 of the General Data Protection Regulation for the security of data processing and the consideration of the rights and freedoms of registered users. Statements and explanations In his statement, the Data Protection Commissioner has revised his earlier statement on the matter and stated, among other things, that the complaint should be rejected as unfounded. The statement states, among other things, that the tax machines are available to anyone free of charge and that they do not contain tax information to the same extent as the text message service in the so-called Veropörssi case. As presented in the complaint, the Data Protection Commissioner has not based his decision only on the amount of published information. In addition to the limitedness of published tax data, importance has been given to social interest, i.e. the ratio of published income to the median income of Finns. The decision to publish public and confidential information is an editorial decision of the media, the evaluation of which is guided by, among other things, journalistic guidelines. The case is not about whether public information can be published, but whether Section 27 of the Data Protection Act will be applied to the processing referred to in the case. in his explanation, he referred to his earlier statement on the matter and stated, among other things, that the data protection legislation has not changed with regard to the journalistic exception. Sanoma Media Finland Oy has not presented any concrete reasons for how the listing of tax machines in the form of a list contributes to the general public's ability to follow the social development of income and wealth differences. Since it is a matter of reconciling two fundamental rights, the journalistic processing exception must be interpreted narrowly. In this case, it is not justified to publish the entire income information listing in the name of a journalistic exception, when the desired social discussion can be secured with less invasive actions. As far as the search function is concerned, the tax machines are parallel to the text message service of the Tax Exchange case. The tax machines are free of charge and available to anyone, which leads to an even harsher result in terms of the privacy of the person listed in the tax machine and must be taken into account when reconciling conflicting basic rights. Sanoma Media Finland Oy has given an explanation. Sanoma Media Finland Oy's explanation has been given for information. Administrative law decision and reasons The administrative court rejects the appeal with legal costs. Reasoning Applicable Rules and Regulations According to Article 7 of the Charter of Fundamental Rights of the European Union, everyone has the right to have their private life respected. According to Article 8, paragraph 1 of the Charter of Fundamental Rights, everyone has the right to the protection of their personal data. According to paragraph 2 of the same article, the processing of such data must be appropriate and must take place for a specific purpose and with the consent of the person concerned or on the basis of another legal justification provided by law. According to Article 11, paragraph 1 of the Charter of Fundamental Rights of the European Union, everyone has the right to freedom of expression. This right includes freedom of opinion and the freedom to receive and disseminate information or ideas without interference by the authorities and regardless of territorial boundaries. According to paragraph 2 of the article, the freedom and pluralism of the media is respected. Article 6 of Chapter II of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons in the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (General Data Protection Regulation) provides for the conditions under which the processing of personal data is lawful . Article 17 of Chapter III of the Regulation provides for the data subject's right to delete data and Article 21 of the same chapter provides for the data subject's right to object to the processing of personal data concerning him. According to Article 85(1) of the General Data Protection Regulation, Member States must by legislation reconcile the right to the protection of personal data in accordance with this Regulation and the right to freedom of expression and freedom of communication, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. According to paragraph 2 of the same article, for processing for journalistic purposes or for the purposes of academic, artistic or literary expression, Member States must provide for exemptions or exceptions to the provisions of Chapter II (principles) and Chapter III (data subject's rights), if they are necessary to reconcile the right to the protection of personal data with freedom of expression and with freedom of communication. According to section 27 subsection 1 of the Data Protection Act, in order to protect freedom of expression and freedom of communication, the processing of personal data solely for journalistic purposes or for the purposes of academic, artistic or literary expression does not apply to, for example, Article 5, Paragraph 1, Subsections c–e, Article 6 and 12–22 of the Data Protection Regulation article. According to subsection 3 of the same section, in order to protect freedom of expression and freedom of information transmission, the processing of personal data only for journalistic purposes or for the purposes of academic, artistic or literary expression, Article 5, paragraph 1, subparagraphs a and b of the data protection regulation shall apply only in the applicable parts. The jurisprudence of the European Court of Human Rights According to the jurisprudence of the European Court of Human Rights, the level of protection of personal data depends, among other things, on the nature and importance of the right guaranteed in the human rights treaty relevant to the case and on the nature and purpose of interference with it. The Court of Human Rights has held that purely financial information, which does not involve intimate details or information closely related to the identity of an individual, does not deserve enhanced protection (G.S.B. v. Switzerland, 22/12/2015, paragraph 93). In another case, the Human Rights Court did not consider the publication of tax debt information on the authority's website to be problematic in itself, but considered it to be in violation of Article 8 of the Human Rights Convention in the circumstances of the case, among other things, due to the fact that when enacting the law, it was not considered whether the publication of all information to be published, especially the taxpayer's home address, was necessary to achieve the intended goal (L.B. v Hungary, 9 March 2023, paragraphs 130 and 136). The Human Rights Court has considered that restricting the processing of tax information by the media constitutes interference with freedom of speech and is therefore only permitted under the conditions set out in Article 10, Paragraph 2 of the European Convention on Human Rights (Satakunnan Markkinapörssi ja Satamedia Oy v. Finland, 27 June 2017, paragraphs 139–141). In its jurisprudence, the Human Rights Court has emphasized that the public's right to receive information is an essential right in a democratic society, and there are few opportunities to restrict freedom of speech when it comes to political speech or a discussion on a topic of public interest (paragraphs 167 and 169 of the above-mentioned judgment with references to jurisprudence). Such a discussion cannot be considered to be promoted by newspaper articles whose sole purpose is to satisfy the curiosity of a certain readership about a person's private life (paragraph 169 of the same judgment). The Court of Human Rights has also emphasized that it is not for it or the national courts to define which method of reporting journalists should use and which details should be published to ensure the credibility of the article, and that journalists are free to choose what issues they report on and how, as long as this is done in accordance with the ethical rules of their profession framework (paragraph 186 of the judgment with case law references). In its jurisprudence, the European Court of Human Rights has emphasized the importance of internet archives maintained by the media in terms of the preservation and availability of news and information, and pointed out that such digital archives are important sources for education and historical research, especially because they are easily accessible to the public and usually free of charge (M.L. and W.W. v. Germany, 28.6. 2018, para 90 and Times Newspapers Ltd v United Kingdom (Nos 1 and 2), 10 March 2009, para 45). When assessing whether interference with freedom of speech has been necessary in a democratic society as referred to in Article 10, paragraph 2 of the European Convention on Human Rights, the human rights court has examined whether the national authorities have found a fair balance between freedom of speech and the right to respect for private life (Delfi AS v. Estonia, 16.6.2015, paragraphs 110 and 138 and Satakunta Markkinapörssi and Satamedia Oy v. Finland, 27 June 2017, paragraphs 123 and 160). In this assessment, the human rights court has paid attention to, among other things, the significance of the published information in terms of a discussion of public interest, the method of obtaining the information, the reliability and content of the information, the effects of the publication and how well-known the person who is the subject of the news is (Axel Springer AG v. Germany, 7 February 2012, paragraphs 90–95 and Satakunta Markkinapörssi and Satamedia Oy v. Finland, 27 June 2017, paragraph 165). In the case Satakunta Markkinapörssi ja Satamedia Oy v. Suomi, the human rights court paid attention to the latter criterion, among other things, to the fact that the published tax information concerned persons, of whom very few had high incomes (paragraph 180 of the judgment). In the same case, the Human Rights Court gave significance to the fact that the companies that had published tax information had withdrawn their request for information on tax information after the tax board had asked them for additional clarification due to the position of the data protection officer and had hired people to collect the information from local tax offices, thereby circumventing the restrictions set by law on the release of personal information (paragraphs 12, 184 and 185 of the judgment). . When evaluating the necessity of interfering with the publication of a person's income information, the Human Rights Court has also given importance to the fact that it was possible for the public to get the same information to see the authority (Fressox and Roire v. France, 21.1.1999, paragraph 53). The Human Rights Court has applied the same evaluation criteria in cases where the expression of information, opinions or ideas has allegedly violated the right to enjoy respect for private and family life (for example, Fürst-Pfeifer v. Itävältä, 17.5.2016, paragraphs 36–42 and Karakó v. Hungary, 28.4. .2009, paragraphs 20, 25 and 26). Explanation presented The newspapers Helsingin Sanomat and Ilta-Sanomat, published by Sanoma Media Finland Oy, publish public tax information in the tax machines on their websites. Helsingin Sanomat publishes information on the earnings and capital income of an individual natural person and the taxes paid to him, if he has earned at least 150,000 euros during the tax year. Helsingin Sanomat also publishes the information of a person who has earned at least 100,000 euros, if he has earned at least 150,000 euros in one or more years in the last five years, or has earned more than one million euros in any one year. Ilta-Sanomat publishes the tax information of those persons who have earned at least 100,000 euros during the previous year. The income mentioned above is annually about two percent of the income earners. In addition to tax information, published information includes, among other things, the person's first and last name, year of birth and the province where he lives. has demanded Sanoma Media Finland Oy to remove all information about him from the tax calculators published on the websites of Helsingin Sanomat and Ilta-Sanom and, after the company's refusal, brought the matter to the data protection commissioner for resolution. In its decision under appeal, the Data Protection Commissioner has not ordered the data controller to delete the data in question. The editors of Helsingin Sanomat and Ilta-Sanomit, in their response to the data protection commissioner's request for clarification, have justified the publication of public taxation data of other high-income earners, among other things, on the grounds that the tax data is related to the social debate on income distribution, the financing of the welfare state, and the encouragement of work and entrepreneurship, and their publication provides an opportunity to evaluate the structure and fairness of taxation, income the fairness of the distribution and how fairly all Finns participate in financing the welfare society. In the response, it has been pointed out that in addition to media editorials, readers of their publications can also make such observations related to society from the tax information of individual persons, which the editorials could not produce for the public without the interaction between them and the readers. In their response, the editors have stated that they publish only a small part of the material they receive from the Tax Administration and that they select the material to be published based on journalistic judgment. In addition, the response justifies the publication of tax information on the grounds that he earns 27 times as much as the average wage earner and his significant capital income indicates that he likely has power in the companies from which he receives capital income. Legal assessment The issue is whether there is a right to object to the processing of public tax information about him in the so-called tax machines on the websites of Helsingin Sanomat and Ilta-Sanomit and the right to have the information removed from these services. According to § 27 subsection 1 of the Data Protection Act, the provisions of the general data regulation concerning the rights of the data subject are not applied to the processing of personal data for journalistic purposes only. Therefore, the first step to be taken in the case is whether the mentioned legal section can be applied to the processing of personal data referred to above. The enactment of Section 27 of the Data Protection Act is based on Article 85 of the General Data Protection Regulation, according to which member states must provide for exemptions or exceptions to the provisions of that regulation for processing for journalistic purposes, if they are necessary to reconcile the right to the protection of personal data with freedom of expression and freedom of communication. According to paragraph 153 of the preamble of the General Data Protection Regulation, this should apply especially to the processing of personal data in the audiovisual sector and in news and magazine archives. According to the same paragraph, concepts related to freedom of expression, such as journalism, must be interpreted broadly in order to take into account the importance of the right to this freedom in all democratic societies. The right to protect personal data is closely related to the fundamental right to respect for private and family life. In the interpretation of the provisions of Articles 7 and 11 of the Charter of Fundamental Rights of the European Union concerning this fundamental right and freedom of expression and freedom of communication, due to the provisions of Article 52, paragraph 3 of the Charter of Fundamental Rights, Articles 8 and 10 of the Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights) and the jurisprudence on their interpretation must also be taken into account (judgment in the case C-345/17, Buivids, EU:C:2018:780, paragraphs 65 and 66). According to its Article 53, the provisions of the Charter of Fundamental Rights may not otherwise be interpreted in such a way that they would limit or violate the human rights and fundamental freedoms recognized in the European Convention on Human Rights. As is clear from the general reasoning of the government's presentation on the Data Protection Act, the processing of data for journalistic purposes means the same in the Data Protection Act as in the General Data Protection Regulation, and its interpretation must therefore take into account the jurisprudence of the Court of Justice of the European Union. According to the jurisprudence of the Court of Justice of the European Union, concepts related to freedom of expression, including the concept of journalism, must be interpreted broadly in order to take into account the importance that freedom of expression has in all democratic societies. In order to find a harmonious balance between the two fundamental rights, the protection of the fundamental right to privacy has, on the other hand, been considered to require that the exceptions and limitations stipulated in the protection of data must be implemented within the limits of absolute necessity. The Court of Justice of the European Union has considered that the processing of personal data takes place only for journalistic purposes, if the sole purpose of the processing is to express information, opinions and thoughts to the public using any means of data transmission. The fact that the publication of information is related to the pursuit of profit does not in principle prevent it from being considered only for journalistic purposes. (Judgment in case C‑73/07, Satakunta Markkinapörssi ja Satamedia, EU:C:2008:727, paragraphs 55–62 and judgment in case C-345/17, Buivids, EU:C:2018:780, 50–53, 63 and paragraph 64.) In the general reasoning of the government's proposal regarding the law on the disclosure and confidentiality of tax information (HE 149/1999 vp), it has been stated that it is considered that public information on taxation can also be important from the point of view of citizen control and not only from the point of view of satisfying human curiosity. The public tax information published on the tax machines in question includes, among other things, the taxpayer's name and year of birth and the province in which the taxpayer's domicile is located, as well as information about his earned and capital income and the total amount of taxes paid. In Helsingin Sanomat's tax machine, information about the amount of taxes is expressed as a tax percentage. The editorial offices of Helsingin Sanomat and Ilta-Sanomat have emphasized in their response to the Data Protection Commissioner's request for clarification that they select the material published in tax machines based on journalistic consideration. There is no reason to doubt the accuracy of this announcement based on the facts presented in the complaint. The editorial offices of Helsingin Sanomat and Ilta-Sanomat have stated in their response to the Data Protection Commissioner's request for clarification that they publish only part of the public tax information they receive. The information handed over to the media by the Tax Administration consists of data materials produced on request pursuant to Section 21 of the Act on the Publicity of Public Activities of Public Authorities and information separately requested by the media. Pursuant to the aforementioned legal section, the Tax Administration produces for the media, among other things, materials that contain public tax information from the entire country on those persons who received a total of at least 100,000 euros in earned income and capital income taxable in state taxation during the tax year. Helsingin Sanomat does not publish tax information to this extent in its tax engine, and the lower availability of tax information for persons with lower incomes than mentioned above is not in itself sufficient evidence that the selection of relevant tax information to be published in Ilta-Sanomat's tax engine was not based on journalistic judgment. In their response, the editors have justified the publication and the limitations of the published material with aspects related to the importance of the information in the social debate and the public's right to receive information relevant to the social debate. Based on the information obtained from the tax machines, it is possible to discuss socially relevant issues related to taxation, such as income differences and the fairness of the distribution of the tax burden. The publication of tax information can rightly be assumed to promote the public's opportunities to make observations related to society and thereby be able to promote the opportunities of information media to receive useful tips from the public in editorial work. These conclusions are not invalidated by the fact that making observations relevant to the social debate about published tax information also requires the utilization of information obtained from other sources and is therefore presumably only possible for some of the users of tax machines. The aforementioned goals of publication are promoted by the fact that the published tax information is available to everyone free of charge in the public information network. It is not possible to reliably state in advance what all the tax information can have in terms of promoting the social debate in these circumstances. For the reasons mentioned in the Data Protection Commissioner's decision, the public tax information of high-income taxpayers is significantly more likely to have such significance than public tax information on average. has referred in his appeal to the fact that the publication of data in the tax machines of Helsingin Sanomat and Ilta-Sanomat can be compared to the case presented in the Supreme Administrative Court's yearbook decision KHO 2009:82, where the processing of the data was not deemed to have taken place for editorial purposes. In the case in question, however, the issue was a much wider publication of tax information than in the case being decided now. The tax information of approximately 1.2 million people per municipality had been published in the Veropörssi magazine and the related SMS service. Only a few of these people had high incomes, a fact that the European Court of Human Rights specifically drew attention to in its judgment on the same case. Helsingin Sanomat's tax machine has published information on people who have earned more than 150,000 euros per year. In Ilta-Sanomie's tax machine, the corresponding limit is 100,000 euros. At least two percent of income earners have incomes this high. The editors of Helsingin Sanomat and Ilta-Sanomit have presented previously explained reasons related to the public interest for the limitations of the material to be published and the publication of information about him, due to which the purpose of publishing information about him can be rightly considered to be the disclosure of information to the public. The comments made in the complaint about the presentation of published taxation information in tax machines do not change the fact that the information in question is available to an unlimited number of people on the public road network. The information in question must therefore be deemed to have been expressed to the public. In the evaluation of the case, it cannot be given essential importance to whether the search for information in the service takes place by browsing a static list or by using the search function intended to facilitate the search for information. The Administrative Court considers, on the grounds presented above, that the processing of relevant public tax information on the websites of Helsingin Sanomat and Ilta-Sanomat has taken place in the manner referred to in Section 27 of the Data Protection Act only for journalistic purposes. In the matter, it is still necessary to assess whether the application of the exceptions provided for in paragraph 1 of the above-mentioned section can be considered necessary in Article 85, paragraph 2 of the General Data Protection Regulation in order to reconcile the right to the protection of personal data with freedom of expression and freedom of communication. This assessment must take into account the jurisprudence of the European Court of Human Rights explained above in this decision. Prohibiting the processing of relevant tax information in Helsingin Sanomat's and Ilta-Sanomat's tax machines on the basis of the case law in question would mean limiting freedom of speech. According to paragraph 2 of Article 10 of the European Convention on Human Rights, such restrictions are only permitted if they are provided for by law and are necessary in a democratic society to protect the rights of other persons or for another reason mentioned in the same paragraph. When evaluating the necessity of restrictions on freedom of speech and freedom of communication, it must be taken into account, among other things, that the information published in the tax machines of Helsingin Sanomat and Ilta-Sanomit consists of accurate public tax information and does not reveal sensitive details of private or family life. The need to protect the taxpayer's private and family life has been taken into account in the provisions regarding the disclosure of tax information, for example, in such a way that the disclosure of information does not apply to information about the address and municipality of residence of the taxpayer. Nor has such information been published in the tax machines of Helsingin Sanomat and Ilta-Sanomit. In contrast to the case concerning Veropörssi magazine, in the case at hand, in the acquisition of personal data, the restrictions on the release of personal data stipulated in Section 16, subsection 3 of the Act on the Publicity of the Activities of Circumventive Authorities have not even been claimed. Taking into account, in addition to these points, the reasons presented for the publication of information and the aspects of their evaluation presented above, it is not necessary to limit freedom of speech and freedom of communication in the way presented in order to protect his rights. For this reason, Article 85(2) of the Data Protection Regulation cannot be considered to require that the exceptions provided for in Section 27(1) of the Data Protection Act should be applied in this case more limitedly than what was done in the decision of the Data Protection Commissioner under appeal. to the processing of public tax data in Helsingin Sanomat's and Ilta-Sanom's tax machines, the exceptions provided for in section 27 subsection 1 of the Data Protection Act must therefore be applied, and he therefore does not have the right to demand the deletion of the data in question and to object to their processing pursuant to Articles 17 and 21 of the General Data Protection Regulation. has considered that Article 5, Paragraph 1, Subsection a and Article 32 of the General Data Protection Regulation have also been violated in the processing of personal data concerning him. According to Section 27, subsection 3 of the Data Protection Act, the first mentioned subsection applies to the processing of personal data only for journalistic purposes only to the extent applicable. As can be seen from the detailed justifications of the government's motion (HE 9/2018 vp) regarding the above-mentioned paragraph, application in the applicable parts means in this context that the application of Article 5, paragraph 1, subparagraph a of the General Data Protection Regulation is linked to whether a closely related article is applied to the processing operations. Article 32 of the General Data Protection Regulation applies to the processing of personal data for journalistic purposes only. however, the arguments presented in support of their demands are not related to the questions regulated in the article in question, i.e. whether the data controller has ensured the protection of the personal data it processes against unauthorized or illegal processing or against accidental loss or damage. The provisions of Article 32 of the General Data Protection Regulation concerning the security of processing are not intended to limit the publication of information resulting from the purpose of processing personal data, and when interpreted together with Article 5, paragraph 1, subparagraph a of the regulation, restrictions on such processing operations cannot be derived from them. The Data Protection Commissioner has thus been able to consider that Sanoma Media Finland Oy has not acted in violation of the General Data Protection Regulation and the Data Protection Act. The Data Protection Commissioner may have decided not to use his remedial powers. The appeal must therefore be rejected.
